registry / mnemakit / 0.4.0

mnemakit@0.4.0

Your project's coding standards in every AI tool. Mnema captures your stack, architecture, and conventions and renders them into CLAUDE.md, .cursorrules, and more.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

The explicit mnema pull command accepts filenames from the authenticated cloud response and writes them without constraining them to .mnema. This enables remote-controlled path traversal and arbitrary relative file overwrite.

Static reason

No blocking static signals were detected.

Trigger

User runs mnema pull after connecting a project.

Impact

A compromised or malicious cloud response can overwrite files outside .mnema.

Mechanism

Unsanitized remote filename passed to path.join and writeFileSync.

Rationale

No install-time or covert malicious behavior was found, but the confirmed server-controlled path traversal is a critical arbitrary-file-overwrite vulnerability.

Evidence

package.jsonsrc/index.jssrc/commands/pull.jssrc/commands/render.jssrc/commands/sync.js.mnema/<server-supplied filename>

Network endpoints1

mnema-api.onrender.com/api/brain

Decision evidence

public snapshot

AI called this Suspicious at 96.0% confidence as Critical Vulnerability with low false-positive risk.

mnemakit@0.4.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code