T05 · Unauthorized Access and Privilege Escalation
Error
- Location
start-simple.py:76- Finding
Unauthenticated network access to memory, persona, and administrative APIs
- Content
View full analysis
- Remediation
View remediation
Security audit
Memory Processor
Security checks for vulnerabilities and agentic risk
Overview
This is a real memory/persona server, but it exposes persistent memory and persona controls without authentication by default.
Review before installing or running. Only run this bound to localhost or behind strong authentication, avoid storing secrets or sensitive personal data, add real deletion/redaction and retention controls, and pin dependencies/model revisions before using it with real agent memory.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (5)
T02 · Agent Memory Poisoning
Error
- Location
app/services/memory_service.py:65- Finding
Unauthenticated persistent poisoning of Agent long-term memory
- Content
View full analysis
= settings.IMPORTANCE_IMMEDIATE: item.level = MemoryLevel.L3_COLD await self.l3.append_to_memory(item, section="decisions" if any( e.type.value == "decision" for e in events ) else "general") await self.l2.set(item) if embedding: await self.l4.add(item, embedding) persisted_level = MemoryLevel.L3_COLD ``` ```python # app/core/l3_storage.py:68-89 async def append_to_memory(self, item: MemoryItem, section: str = "general"): await self.init() async with await self._get_lock(self.memory_file): content = await self._read_file(self.memory_file) entry = self._format_memory_entry(item, section) if section == "decisions": content = self._append_to_section(content, "## 重要决策", entry) elif section == "lessons": content = self._append_to_section(content, "## 学到的内容", entry) elif section == "projects": content = self._append_to_secti ...[truncated 2451 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
app/services/event_detector.py:48- Finding
Sensitive-data detection does not prevent plaintext storage and retrieval
- Content
View full analysis
GetMemoryResponse: item = await self.l1.get(key) if item: item.access_count += 1 item.last_accessed = datetime.utcnow() await self.l1.set(key, item) return GetMemoryResponse(found=True, item=item, from_level=MemoryLevel.L1_HOT) item = await self.l2.get(key) if item: await self.l1.set(key, item) return GetMemoryResponse(found=True, item=item, from_level=MemoryLevel.L2_WARM) return GetMemoryResponse(found=False) ``` ### Technical Analysis The application detects several common secret formats, but detection only decreases the generated importance score. It does not reject, redact, hash, encrypt, or quarantine sensitive content. Every submitted record is written to L1. A caller can additionally over ...[truncated 1328 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
app/models.py:117- Finding
Unbounded API input permits memory, CPU, and disk denial of service
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
pyproject.toml:26- Finding
Unpinned dependencies and mutable runtime model retrieval create supply-chain risk
- Content
View full analysis
=0.109.0", "uvicorn[standard]>=0.27.0", "pydantic>=2.5.0", "pydantic-settings>=2.1.0", "sqlalchemy>=2.0.25", "aiosqlite>=0.19.0", "redis>=5.0.0", "faiss-cpu>=1.7.4", "sentence-transformers>=2.2.2", "numpy>=1.26.0", "apscheduler>=3.10.0", "celery>=5.3.0", "python-multipart>=0.0.6", "python-jose[cryptography]>=3.3.0", "passlib[bcrypt]>=1.7.4", "pyyaml>=6.0.1", "aiofiles>=23.2.0", "httpx>=0.26.0", "structlog>=24.1.0", "prometheus-client>=0.19.0", ] ``` ```python # app/services/embedding.py:18-24 def init(self): if self.model is None: print(f"[Embedding] Loading model: {self.model_name}") self.model = SentenceTransformer(self.model_name) print(f"[Embedding] Model loaded, dimension: {self.dimension}") ``` ### Technical Analysis The installation instructions resolve dependencies using open-ended minimum-version constraints. No lockfile, exact version set, or package hashes are present in the reviewed project. A later installation may therefore execute dependency versions different from those reviewed. The normal embedding implementation also loads a model by a mutable name: ```text paraphrase-multilingual-MiniLM-L12-v2 ``` If it is not already cached, Sentence Transformers can retrieve model artifacts from its configured model source. The code does not pin an immutable model revision or verify expected artifact hashes. This is a supply-chain hardening issue rather than evidence that any currently named package or model is malicious ...[truncated 1108 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- Rogue AgentSelf-Modification, Session Persistence
Findings (89)
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md Traditional AI assistants rely on static "character settings" — they play roles but lack true selves. DreamMoon-MemProcessor enables AI to: - 🌱 **Grow Naturally** - Learn from experiences like a living organism - 🔄 **Self-Evolve** - Continuously cognize and improve through reflection - ⚖️ **Maintain Consistency** - Stay stable while keeping core values This is not role-playing. This is **true digital personality**.
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md Unlike traditional static character settings, it enables AI to: - 🌱 Grow naturally from experiences - 🔄 Self-evolve through reflection - ⚖️ Maintain stability while evolving **中文**:
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
python """删除记忆""" try: # TODO: 实现删除逻辑 logger.info(f"Delete memory requested for key: {key}") return {"success": True, "key": key, "note": "Delete logic not fully implemented"} except Exception as e: logger.exception(f"Error in delete_memory: {e}")
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
python logger.exception(f"Error in delete_memory: {e}") raise HTTPException( status_code=status.HTTP_500_INTERNAL_SERVER_ERROR, detail="Failed to delete memory" )
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python ALLOWED_ORIGINS: List[str] = ["*"] class Config: env_file = ".env" env_file_encoding = "utf-8" case_sensitive = True
YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
python erences.get("traits", {}) # 3. 生成核心维度评分 dimensions = self._generate_dimension_scores(seed_traits, user_traits) # 4. 构建价值观系统 value_system = self._generate_value_system( request.user_preferences.get("values", []), request.constraints ) # 5. 生成自我描述 self_description = self._generate_self_description(dimensions, value_system) # 6. 构建人格档案 persona = PersonaProfile( name=request.user_preferences.get("name", "DreamMoon"), title=request.user_preferences.get("title", "AI Assistant"), dimensions=dimensions, value_system=value_system, self_description=self_description, origin_story=self._generate_origin_story(request.base_seed), consistency_rules=request.constraints ) # 7. 存储到 L3 (人格是重要长期�
Possible Typosquatting: 'uvicorn' resembles popular package 'gunicorn'
High
- Category
- Supply Chain
- Confidence
- 70% confidence
- Finding
Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.
- Content
Possible Typosquatting: 'uvicorn' resembles popular package 'gunicorn'
High
- Category
- Supply Chain
- Confidence
- 70% confidence
- Finding
Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The README encourages storing and evolving persona data using memories, recent experiences, and user feedback, but it provides no warning about handling potentially sensitive personal data. In a memory/persona system, these examples normalize collection and retention of behavioral and preference data without mentioning consent, minimization, retention limits, or access controls, which increases privacy and compliance risk.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # Generate Persona | 生成人格 curl -X POST http://localhost:9090/api/v1/persona/generate \ -H "Content-Type: application/json" \ -d '{ "base_seed": "curious, friendly, good at problem solving | 好奇、友善、善于解决问题",
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md }' # Evolve Persona | 演进人格 curl -X POST http://localhost:9090/api/v1/persona/evolve \ -d '{ "persona_id": "xxx", "recent_experiences": ["memory_1", "memory_2"],
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill advertises automatic persistence and semantic search across layered memory, but the description does not clearly warn users that their inputs or user-related data may be stored and later retrieved. In a memory/persona system, this omission can lead to unexpected retention of sensitive information and privacy harms, especially if users assume interactions are ephemeral.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python start-simple.py
Generate Persona | 生成独立人格
curl -X POST http://localhost:9090/api/v1/persona/generate
-d '{"base_seed":"curious and friendly | 好奇友善","user_preferences":{"name":"AI Assistant | AI助手"}}'text
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The DELETE endpoint reports success without actually deleting anything, creating a semantic integrity issue where clients believe sensitive memory has been removed when it has not. In a memory-storage API, this can lead to unintended retention of data, compliance failures, and continued availability of records that users or operators expected to be erased.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The /analyze endpoint accepts arbitrary content and context, then explicitly determines whether the material is sensitive via detector.analyze(...). Although the code has internal logging for errors, there is no user-facing disclosure in the function docstring or nearby comments warning that submitted content may be processed for sensitivity analysis.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The module docstrings and inline documentation are entirely in Chinese, which indicates a fixed language assumption for the skill's natural-language interface and maintenance guidance. Under the stated policy, language-specific behavior should offer opt-in or clearly justify the locale restriction, neither of which appears in this file.
- Content
Insecure deserialization: pickle.loads()
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
Untrusted data is passed to an insecure deserializer (pickle, marshal, dill, jsonpickle, joblib, yaml.load without a safe Loader, or torch.load without weights_only). These deserializers reconstruct arbitrary objects and invoke callables during loading, so deserializing attacker-controlled bytes is equivalent to arbitrary code execution.
- Content
python import pickle try: item_dict = pickle.loads(item["data"]) return MemoryItem(**item_dict) except Exception: return None
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This code embeds Chinese-only natural-language descriptions such as "L3 冷存储" and related comments/docstrings throughout the file, indicating a fixed locale expectation. Under the language/locale policy, forcing a specific language without opt-in or documented justification is a policy concern.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The module docstring at L001 and class docstring at L017 present this component as archive storage centered on a FAISS vector index and file compression. However, the implementation later performs destructive lifecycle actions by packaging L3 files into tar archives and then deleting the originals, which is a materially different operational effect than the storage-oriented documentation suggests.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The code removes source memory files after creating the tar.gz archive, which is a destructive operation. Although there is a later print statement announcing archive creation, there is no prior confirmation, warning comment, or user-facing disclosure around the deletion behavior in this file.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This code file contains natural-language descriptions entirely in Chinese, including the primary module documentation and inline model descriptions, with no indication that language is configurable or limited to a China-specific use case. Under the policy rule, forcing a specific language without user opt-in is a locale/language policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The module-level and class docstrings are written only in Chinese, and all user-facing scheduler labels and status messages in this file also use Chinese. This imposes a specific language/locale in natural-language outputs without any visible opt-in or documented locale constraint.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The file’s user-facing natural-language strings and documentation are entirely in Chinese, including the module and class descriptions, with no indication that users can opt into another language or locale. Under the stated policy, forcing a specific language without user choice is a locale-policy concern.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The service persists user-provided memory content across multiple storage tiers (L1-L4), including long-lived summary and vector storage, without any visible consent, disclosure, or data minimization control in this code path. If sensitive user content is stored or replicated unexpectedly, it increases privacy risk, retention scope, and blast radius in the event of compromise or misuse.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Search queries are embedded via the embedding service, which may transmit or process potentially sensitive user queries outside the immediate search logic without disclosure or user choice. Queries often contain personal or confidential information, so silent embedding can create privacy exposure, logging risk, or third-party data handling concerns.
- Content