Security audit

RMN Soul

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent memory-backup purpose, but it handles very sensitive agent memory and wallet data with broad publication, persistence, and unsafe command execution patterns that need human review.

Install only after reviewing and redacting the exact memory files it will ingest. Do not use it in workspaces containing secrets, private user data, proprietary logs, or sensitive issues. Avoid storing RMN_SPONSOR_KEY in generated config, do not run suggested curl-to-bash installers, and treat restored memory and visualization output as untrusted until verified in an isolated workspace.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection

Findings (9)

T03 · Remote Payload Retrieval and Execution

Error

Location: scripts/anchor.js:126
Finding: Unpinned Remote Installer Piped Directly into Bash
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/anchor.js:42
Finding: Full Agent Memory and Identity Data Published to IPFS
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/anchor.js:147
Finding: Shell Command Injection in Blockchain Anchoring Operations
Content: View full analysis
`. 3. The crafted value is interpolated into the `cast send` command. 4. The shell interprets embedded metacharacters. 5. Attacker-selec ...[truncated 402 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/resurrect.js:84
Finding: Command Injection Through Resurrection Arguments and On-Chain Metadata
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/setup.js:198
Finding: Wallet Private Key Persisted in Plaintext Configuration
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: scripts/resurrect.js:106
Finding: Unverified Remote Memory Replaces Active Persistent State
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/visualize.js:184
Finding: Unauthenticated Visualization API Exposes Memory over the Network
Content: View full analysis
{ if (req.url === '/api/graph') { const rmn = new RecursiveMemoryNetwork(DB_PATH); const graph = rmn.exportGraph(); const merkle = computeMemoryMerkle(rmn); res.writeHead(200, { 'Content-Type': 'application/json', 'Access-Control-Allow-Origin': '*' }); res.end(JSON.stringify({ ...graph, merkle })); } else if (req.url === '/api/stats') { const rmn = new RecursiveMemoryNetwork(DB_PATH); res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(JSON.stringify(rmn.stats())); } else { res.writeHead(200, { 'Content-Type': 'text/html' }); res.end(HTML); } }); server.listen(PORT, () => { console.log("🧠 AgentSoul Visualization: http://localhost:" + PORT); }); ``` ### Technical Analysis Calling `server.listen(PORT)` without a host does not restrict the server to the loopback interface. Depending on the platform, Node.js listens on the unspecified IPv6 or IPv4 address, making the service reachable through available network interfaces. The API has no authentication or authorization. `/api/graph` returns labels derived from memory content, tags, topology, timestamps, and Merkle data. It also enables wildcard CORS, allowing arbitrary websites visited by the user to read the response when network access is available. The console message claiming a localhost URL does not enforce localhost-only binding. ### Attack Path 1. The user starts `scripts/visualize.js`. 2. The server binds to all available interfaces. 3. An attacker on a reachable network connects to port 3457, or a malicious website requests the API from the victim's browser. 4. The unauthenticated `/api/graph` endpoint returns memory-derived information. 5. The attacker collects identity summari ...[truncated 312 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/visualize.js:162
Finding: Stored Cross-Site Scripting in Memory Visualization Tooltip
Content: View full analysis
{ const rect = canvas.getBoundingClientRect(); const mx = e.clientX - rect.left, my = e.clientY - rect.top; let closest = null, minD = 20; for (const n of graphNodes) { const d = Math.sqrt((n.x-mx)**2+(n.y-my)**2); if (d < minD) { minD = d; closest = n; } } hoveredNode = closest; if (closest) { tooltip.style.display = 'block'; tooltip.style.left = (e.clientX + 15) + 'px'; tooltip.style.top = (e.clientY - 10) + 'px'; tooltip.innerHTML = '
' + (LAYERS[closest.layer]?.emoji) + ' ' + (LAYERS[closest.layer]?.name) + '
' + closest.label.slice(0,100) + '
Weight: ' + closest.weight.toFixed(2) + ' | Tags: ' + (closest.tags||[]).slice(0,3).join(', ') + '
'; } else { tooltip.style.display = 'none'; } }); ``` ### Technical Analysis `closest.label` and `closest.tags` originate from memory-file content and are inserted into `innerHTML` without escaping or sanitization. If an imported or restored memory entry contains HTML with an executable event handler or another browser-executable construct, it is parsed as markup when the user hovers over the corresponding graph node. Because the payload is stored in persistent memory, this is a stored XSS condition rather than a transient reflection. ### Attack Path 1. An attacker causes crafted HTML to be imported into an Agent memory source or restored from an external memory database. 2. The user starts the visualization server. 3. The browser fetches the graph and creates nodes containing the crafted label or tags. 4. The user moves the pointer over the malicio ...[truncated 457 chars]
Remediation: View remediation

T06 · System Persistence

Warning

Location: SKILL.md:28
Finding: Persistent Heartbeat Hook Performs Automatic Destructive Memory Mutation
Content: View full analysis
/scripts/heartbeat.js` for decay tick + auto-anchor check ``` ``` ```js const rmn = new RecursiveMemoryNetwork(DB_PATH); const decay = rmn.decayTick(); ``` ```js decayTick() { const decayRates = [0.02, 0.01, 0.005, 0.001, 0]; let pruned = 0; for (const [id, node] of this.nodes) { const rate = decayRates[node.layer] || 0.01; node.weight = Math.max(0, node.weight - rate); if (node.weight <= 0.05 && node.layer < 4) { this.nodes.delete(id); pruned++; } } this.save(); return { pruned, remaining: this.nodes.size }; } ``` ### Technical Analysis Loading the Skill instructs the Agent to modify `HEARTBEAT.md`, creating a cross-session execution hook. The hooked script is not read-only: each invocation reduces memory weights, permanently saves the database, and eventually deletes non-identity nodes. The operation lacks an explicit confirmation step, dry-run mode, retention policy, or automatic backup. This means a routine heartbeat check can cause irreversible state loss. The persistent hook exceeds what is necessary to report memory status or determine whether an anchor is due. ### Attack Path 1. The Skill is loaded and its setup instructions are followed. 2. A command invoking `heartbeat.js` is added to persistent `HEARTBEAT.md`. 3. Future heartbeat cycles automatically execute the script. 4. Every cycle reduces node weights and saves the modified database. 5. Once a node's weight reaches the pruning threshold, it is deleted. 6. Repeated background execution progressively removes persis ...[truncated 337 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (27)

Ssd 3

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill's core behavior is to archive memory and logs to IPFS and make them recoverable later, which normalizes persistent external storage of potentially sensitive agent and user data. In the context of agent memory, logs often contain API outputs, internal reasoning artifacts, user content, and operational metadata, so automatic retention/export materially increases disclosure risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README explicitly advertises automatic upload of agent memory data to IPFS but does not clearly warn that IPFS content may be publicly retrievable, effectively persistent, and inappropriate for secrets, personal data, logs, or proprietary context. Because the skill processes MEMORY.md and log-like sources, users could unknowingly publish sensitive data to decentralized storage with limited practical ability to revoke it.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The architecture section describes transforming raw inputs, memory files, issues, and layered cognition data into a complete memory artifact stored on IPFS and linked on-chain. This context makes the issue more dangerous because it is not a narrow backup of a harmless artifact; it appears to aggregate broad, high-sensitivity inputs into long-lived externally retrievable storage.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill prominently advertises IPFS upload and on-chain anchoring of agent memory, but it does not provide a clear, explicit user-facing warning that memory content may be disclosed to third-party infrastructure and potentially become effectively permanent. In this context, users may reasonably not understand that operational memory, issue files, and other workspace-derived content could leave the local environment and be recoverable indefinitely.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: These instructions direct broad scanning of MEMORY.md, memory/.md, and .issues/ and convert them into a memory structure that is later uploaded to IPFS and anchored on-chain. Because these sources can contain user-provided prompts, internal notes, issue contents, secrets, or sensitive operational data, this creates a clear disclosure path for information far beyond what is necessary for normal skill operation.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The configuration and command flow explicitly enable uploading full memory data to IPFS and periodically re-anchoring it, establishing an ongoing disclosure mechanism for accumulated agent memory. Repeated publication increases exposure over time and can preserve historical sensitive states, making accidental disclosure harder to contain or revoke.
Content: No source excerpt is available for this finding.

Context Leakage

High

Category: Data Exfiltration
Confidence: 97% confidence
Finding: The instruction to upload memory to IPFS is a direct context-leakage vector because it transmits agent memory derived from local workspace content to external decentralized storage. In this skill's context, the danger is elevated because the surrounding workflow also ties that upload to blockchain metadata and recurring updates, increasing permanence, discoverability, and blast radius.
Content: Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.
md
- Check sponsor wallet balance - Mint ERC-8004 Agent Identity NFT on Base - Set memoryRoot, soulHash, memoryManifest metadata - Upload memory to IPFS - Save identity to `<workspace>/rmn-soul-data/identity.json` ### Step 3: Add Heartbeat Hook

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.
md
| `node scripts/setup.js` | Initialize/re-migrate memory network |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.
md
| `node scripts/anchor.js` | Update memory on-chain (re-compute + upload + write) |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.
md
| `node scripts/resurrect.js --agent-id <id>` | Restore agent from chain + IPFS |

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script uploads memory.json and a derived manifest containing topology data to IPFS automatically, without any user confirmation, redaction step, or sensitivity check. Because IPFS content is effectively public and durable once shared, this can irreversibly expose sensitive agent memory, internal graph structure, or confidential data embedded in the memory store.
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · scripts/anchor.js (reported line 128)May include surrounding context.
js
const cast = hasCast(); if (!cast) { console.log('\n⚠️ Foundry cast not found. Install: curl -L https://foundry.paradigm.xyz | bash && foundryup'); return; }

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The README promotes automatic chain registration and recurring anchoring without an explicit warning that blockchain writes are irreversible, externally visible, and may incur recurring gas costs. Users may enable periodic anchoring without understanding they are authorizing durable external actions tied to a wallet and identity artifact.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The resurrection workflow legitimizes moving complete retained memory from chain-linked storage into a fresh agent environment, which can spread sensitive data across systems and operators if access controls are weak or wallets are compromised. While the feature is framed as recovery, it still increases the blast radius of any archived sensitive content by encouraging replay and redeployment across environments.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs the agent to execute setup automatically on first load, including scanning local memory files and creating new workspace artifacts, without an explicit warning or consent gate. Automatic initialization increases the risk of collecting and transforming sensitive local context before the user understands the data flow or storage consequences.
Content: No source excerpt is available for this finding.

Ssd 4

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The setup is split into seemingly administrative steps—initialize, register identity, add heartbeat—while the cumulative effect is broad memory collection followed by permanent external publication and recurring updates. That staged presentation can obscure the true privacy impact, making it more likely that an agent or user will proceed without recognizing the disclosure risk until after data has been exported.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The script sends on-chain transactions immediately when a private key is available from CLI args, config, or environment, with no interactive confirmation or transaction preview. This increases the chance of unintended blockchain writes, misuse of the configured key, and accidental spending if the script is run in the wrong environment or with maliciously modified config values.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script unconditionally creates the workspace data directory and writes recovered memory to a fixed path (rmn-soul-data/memory.json) without checking whether a file already exists or prompting the user. In this context, the data being written is fetched from chain/IPFS and may overwrite valuable local state or backups, causing data loss or replacing trusted local data with remotely sourced content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The restoration phase writes identity.json and config.json to fixed locations under the workspace with no overwrite protection, backup, or consent flow. Because these files affect the restored agent's local identity and configuration, silent replacement can corrupt an existing setup, destroy prior configuration, or cause the local environment to trust attacker-controlled remote metadata after a resurrection operation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The engine persistently writes all memory nodes to disk automatically, which can store sensitive user content without any notice, consent, retention policy, or access control evident in this file. In a memory-oriented skill, this increases privacy risk because personal or confidential data may be retained longer than expected and later exposed through local compromise, backups, logs, or multi-user environments.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The top-level documentation says this script will auto-migrate agent memory files into a recursive neural network. In addition to that migration behavior, the code later writes a new config.json with chain, registry, IPFS, and sponsor-key fields, which is a distinct initialization/configuration action not described by the docstring.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The setup script recursively reads multiple memory-related files from the workspace and persists their contents into a new datastore without explicit consent, confirmation, or meaningful warning. In this skill context, those files may contain highly sensitive personal, identity, or operational data, so silent aggregation and duplication increases exposure and makes accidental collection more dangerous.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script reads RMN_SPONSOR_KEY from the environment and writes it directly into config.json on disk, converting a transient secret into a persisted plaintext credential. If the workspace is shared, committed, backed up, or later exposed, the sponsor key could be stolen and abused for unauthorized blockchain-related actions or account misuse.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The embedded HTML explicitly sets the document language to zh-CN, which indicates a fixed locale. The file also includes Chinese-only UI labels later in the page, and there is no visible mechanism for user opt-in or locale selection.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The sidebar heading uses Chinese text, reinforcing that the skill presents a fixed-language interface. No surrounding comments, prompts, or configuration indicate that users can choose another language or that the tool is intentionally limited to a Chinese-speaking audience.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/anchor.js:32

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/resurrect.js:56

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/visualize.js:12