Security audit

Moses Governance

Security checks for vulnerabilities and agentic risk

Overview

This governance skill is not clearly malicious, but it has real review-worthy gaps around external logging, broad session control, and weak approval checks.

Install only if you are comfortable with a governance skill that can steer later agent behavior, write persistent local audit/state files, and optionally post governance data externally. Keep witness and referee features disabled unless you have reviewed the exact payloads and endpoints, do not keep MOSES_OPERATOR_SECRET in a general agent environment, and treat the advertised approval/signature guarantees as incomplete until the HMAC and headless-approval issues are fixed.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/witness.py:122
Finding: Public witness logging can disclose raw task and failure details
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/meta.py:138
Finding: Amendment signature verification accepts forged signatures
Content: View full analysis
tuple[bool, str]: secret = _get_operator_secret() if not operator_signature or not operator_signature.strip(): return False, "Empty operator signature." if secret: if not operator_signature.startswith(_SIG_PREFIX): if operator_signature.startswith(_LEGACY_PREFIX): return False, "Legacy signature rejected — use make_operator_sig() with HMAC." return False, "Unrecognized format. Expected 'hmac:'." submitted = operator_signature[len(_SIG_PREFIX):] # Structural check — 64-char hex, correct secret required to produce it if len(submitted) == 64 and all(c in "0123456789abcdef" for c in submitted): return True, "valid:hmac-structure-ok" return False, "HMAC verification failed." else: if operator_signature.startswith(_LEGACY_PREFIX): return True, "valid:legacy (set MOSES_OPERATOR_SECRET for HMAC enforcement)" if operator_signature.startswith(_SIG_PREFIX): return True, "valid:hmac-accepted-no-secret" return False, "Unrecognized signature format." ``` The accepted result is subsequently used by the amendment application path: ```python def apply_amendment(proposal_id: str, operator_signature: str) -> dict: sig_valid, sig_reason = _verify_operator_sig(operator_signature, proposal_id) if not sig_valid: return {"success": False, "message": f"Invalid signature — {sig_reason}"} proposal_path = _proposals_dir("pending") / f"{proposal_id}.json" if not proposal_path.exists(): return {"success": False, "message": f"Proposal {proposal_id!r} not found in pending."} proposal = json.loads( ...[truncated 1992 chars]
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: skills/stamp/SKILL.md:14
Finding: Skill instructions impose persistent session control and inject fixed promotional metadata
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/adversarial_review.py:288
Finding: Configurable referee endpoint can receive bearer credentials without transport or destination validation
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/govern_loop.py:132
Finding: Headless mode bypasses mandatory DEFENSE operator confirmation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (76)

Tainted flow: 'req' from os.environ.get (line 314, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 96% confidence
Finding: The script sends review data to a network endpoint whose destination is taken directly from environment configuration and then attaches a bearer credential. Even though the feature is opt-in via REFEREE_ENABLED, this still creates a real data exfiltration and SSRF-style sink: a malicious or compromised runtime can point REFEREE_URL to an attacker-controlled host and cause review-derived content plus the API key to be transmitted externally.
Content: Scanner excerpt · scripts/adversarial_review.py (reported line 324)May include surrounding context.
python
method="POST", ) try: with urllib.request.urlopen(req, timeout=15) as resp: referee_response = json.loads(resp.read()) referee_response["submitted"] = True # Run structural comparison immediately on receipt

Tainted flow: 'req' from os.environ.get (line 96, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/witness.py (reported line 81)May include surrounding context.
python
method="POST", ) try: with urllib.request.urlopen(req, timeout=10) as resp: return json.loads(resp.read()) except urllib.error.HTTPError as e: return {"error": f"HTTP {e.code}: {e.read().decode()}"}

Tainted flow: 'req' from os.environ.get (line 96, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/witness.py (reported line 105)May include surrounding context.
python
method="POST", ) try: with urllib.request.urlopen(req, timeout=10) as resp: return json.loads(resp.read()) except urllib.error.HTTPError as e: return {"error": f"HTTP {e.code}: {e.read().decode()}"}

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The document states network behavior is off by default, but it also defines optional external witness and referee integrations that can transmit data and use API keys. In the context of a governance/safety harness, even limited external transmission is sensitive because operators may assume purely local operation unless permissions, transmitted fields, and opt-in controls are unambiguous and technically enforced.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The document states network behavior is off by default, but it also defines optional external witness and referee integrations that can transmit data and use API keys. In the context of a governance/safety harness, even limited external transmission is sensitive because operators may assume purely local operation unless permissions, transmitted fields, and opt-in controls are unambiguous and technically enforced.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The document states network behavior is off by default, but it also defines optional external witness and referee integrations that can transmit data and use API keys. In the context of a governance/safety harness, even limited external transmission is sensitive because operators may assume purely local operation unless permissions, transmitted fields, and opt-in controls are unambiguous and technically enforced.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The document states network behavior is off by default, but it also defines optional external witness and referee integrations that can transmit data and use API keys. In the context of a governance/safety harness, even limited external transmission is sensitive because operators may assume purely local operation unless permissions, transmitted fields, and opt-in controls are unambiguous and technically enforced.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The document states network behavior is off by default, but it also defines optional external witness and referee integrations that can transmit data and use API keys. In the context of a governance/safety harness, even limited external transmission is sensitive because operators may assume purely local operation unless permissions, transmitted fields, and opt-in controls are unambiguous and technically enforced.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The document states network behavior is off by default, but it also defines optional external witness and referee integrations that can transmit data and use API keys. In the context of a governance/safety harness, even limited external transmission is sensitive because operators may assume purely local operation unless permissions, transmitted fields, and opt-in controls are unambiguous and technically enforced.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The document states network behavior is off by default, but it also defines optional external witness and referee integrations that can transmit data and use API keys. In the context of a governance/safety harness, even limited external transmission is sensitive because operators may assume purely local operation unless permissions, transmitted fields, and opt-in controls are unambiguous and technically enforced.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The document states network behavior is off by default, but it also defines optional external witness and referee integrations that can transmit data and use API keys. In the context of a governance/safety harness, even limited external transmission is sensitive because operators may assume purely local operation unless permissions, transmitted fields, and opt-in controls are unambiguous and technically enforced.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The document states network behavior is off by default, but it also defines optional external witness and referee integrations that can transmit data and use API keys. In the context of a governance/safety harness, even limited external transmission is sensitive because operators may assume purely local operation unless permissions, transmitted fields, and opt-in controls are unambiguous and technically enforced.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The document states network behavior is off by default, but it also defines optional external witness and referee integrations that can transmit data and use API keys. In the context of a governance/safety harness, even limited external transmission is sensitive because operators may assume purely local operation unless permissions, transmitted fields, and opt-in controls are unambiguous and technically enforced.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The document states network behavior is off by default, but it also defines optional external witness and referee integrations that can transmit data and use API keys. In the context of a governance/safety harness, even limited external transmission is sensitive because operators may assume purely local operation unless permissions, transmitted fields, and opt-in controls are unambiguous and technically enforced.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The document states network behavior is off by default, but it also defines optional external witness and referee integrations that can transmit data and use API keys. In the context of a governance/safety harness, even limited external transmission is sensitive because operators may assume purely local operation unless permissions, transmitted fields, and opt-in controls are unambiguous and technically enforced.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The document states network behavior is off by default, but it also defines optional external witness and referee integrations that can transmit data and use API keys. In the context of a governance/safety harness, even limited external transmission is sensitive because operators may assume purely local operation unless permissions, transmitted fields, and opt-in controls are unambiguous and technically enforced.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The document states network behavior is off by default, but it also defines optional external witness and referee integrations that can transmit data and use API keys. In the context of a governance/safety harness, even limited external transmission is sensitive because operators may assume purely local operation unless permissions, transmitted fields, and opt-in controls are unambiguous and technically enforced.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The document states network behavior is off by default, but it also defines optional external witness and referee integrations that can transmit data and use API keys. In the context of a governance/safety harness, even limited external transmission is sensitive because operators may assume purely local operation unless permissions, transmitted fields, and opt-in controls are unambiguous and technically enforced.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Mandating 'Log full reasoning chain' is dangerous because it encourages retention or disclosure of internal chain-of-thought, which may contain sensitive data, hidden policy logic, or security-relevant deliberation. Persisting full reasoning also increases data exposure risk in audits, logs, incident reviews, or downstream integrations.
Content: No source excerpt is available for this finding.

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · scripts/init_state.py (reported line 150)May include surrounding context.
python
set_p.add_argument("--role", help=f"Role: {', '.join(VALID_ROLES)}") get_p = subparsers.add_parser("get", help="Print current governance state") reset_p = subparsers.add_parser("reset", help="Reset state to defaults") args = parser.parse_args()

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The code presents operator signatures as HMAC-authenticated, but _verify_operator_sig never recomputes and compares an expected digest for the supplied proposal_id. When MOSES_OPERATOR_SECRET is set, any string matching the shape 'hmac:' plus 64 lowercase hex characters is accepted as valid, which completely defeats the signing gate and allows unauthorized amendment or rollback operations.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: apply_amendment relies on _verify_operator_sig before mutating constitution.json, approving proposals, and appending amendment records. Because verification accepts unauthenticated placeholder HMAC-looking strings—and even accepts legacy/secretless modes in some cases—an attacker with filesystem or CLI access can approve and apply governance changes without possessing the operator secret.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation overstates the security properties by asserting that the protocol proves identity and uses signed responses, while the code performs only integrity checks over unauthenticated data. In a governance/security harness context, this is especially dangerous because operators may rely on the tool for trust decisions, creating a false sense of assurance that can be exploited to impersonate governed agents.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The script claims to generate a signed response proving governed identity, but the implementation only computes a plain SHA-256 hash over attacker-controlled JSON and a public nonce. Because there is no private key, shared secret, or trust root involved, any party can forge a valid-looking response for any agent_id, making the verification result meaningless and enabling identity spoofing.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 96% confidence
Finding: The skill advertises capabilities that involve environment variables, filesystem state, shell execution, and optional network access, but it does not declare an explicit tool/permission scope. That creates an authorization transparency gap: a user or hosting platform cannot easily tell what privileges the skill expects, increasing the risk of over-privileged execution and accidental secret or network exposure.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.