Skills/PyPI/pseudolife-mcp

pseudolife-mcp@0.24.0

VERIFIED· not started

Publisher claims: "Pseudolife persistent long-term memory for MCP-compatible coding agents" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher pseudogiant-xr · publishing for 122 daysInstalls 3,103Last detonated 26 min ago
$claude mcp add pseudolife-mcp -- uvx pseudolife-mcp
WatchReport an issue

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
PSEUDOLIFE_CODEX_SERVER_TOKENConfiguration, not credentials: CLAUDE_CODE_SESSION_ID, PSEUDOLIFE_AGENT_COORDINATION, PSEUDOLIFE_AGENT_LABEL, PSEUDOLIFE_AGENT_PROJECT, PSEUDOLIFE_AGENT_STATE, PSEUDOLIFE_AGENT_STATE_DIR, PSEUDOLIFE_AGENT_TASK, PSEUDOLIFE_AGENT_WAKE, PSEUDOLIFE_CODEX_BIN, PSEUDOLIFE_CODEX_SERVER_URL, PSEUDOLIFE_HOOK_PROBE_MS, PSEUDOLIFE_MCP_NO_SPAWN, PSEUDOLIFE_MCP_PROXY_TIMEOUT_SECONDS, PSEUDOLIFE_MCP_SHARED_HOST, PSEUDOLIFE_WRITER_ID
Where it talks to
no vendor host named in the code
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard. It asks for PSEUDOLIFE_CODEX_SERVER_TOKEN and talks to its vendor. Give the credential to the guard, not the server: the value never enters the server's environment and only travels to the host you bind. What the tools do with a real credential was not observed.

$vet-skills run --net declared -- uvx pseudolife-mcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-15 and scored it 86/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.3sprocessdependency install exit 1 ·
0.3sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.3sprocessscript backend runs setup only
0.3sprocessno install scripts to re-run

Static findings

MEDIUM
Python subprocess execution detectedtests/test_connect.py:957 · Python subprocess execution detectedproc = subprocess.run([sys.executable, "-m", "pseudolife_memory.cli", "connect", "--help"],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_codex_hooks.py:1068 · Python subprocess execution detectedcompleted = subprocess.run([pwsh, "-NoProfile", "-File", str(driver)],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedpseudolife_memory/shim.py:883 · Python subprocess execution detectedreturn subprocess.Popen(argv, **kwargs).pidFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
URL with embedded credentialstests/test_codex_hooks.py:383 · URL with embedded credentials — may be phishing or credential leaking"http://user:[email protected]:8765",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
Python subprocess execution detectedtests/test_codex_hooks.py:93 · Python subprocess execution detectedreturn subprocess.run([bash_exe(), str(script)], input=input, env=env,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_codex_hooks.py:908 · Python subprocess execution detectedresult = subprocess.run([bash, script.as_posix()], env=env, capture_output=True,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_connect.py:626 · Python subprocess execution detectedsubprocess.run(["icacls", str(path), "/grant", "*S-1-1-0:R"], check=True, capture_output=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_codex_hooks.py:448 · Python subprocess execution detectedwidened = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_cli_imports.py:46 · Python subprocess execution detectedreturn subprocess.run([sys.executable, "-X", "utf8=0", *arguments],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedpseudolife_memory/shim.py:615 · Python subprocess execution detectedreturn subprocess.Popen(child_python.cli_argv("serve"), **kwargs)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_codex_hooks.py:72 · Python subprocess execution detectedreturn subprocess.run([pwsh, "-NoProfile", *map(str, args)], input=input,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_connect.py:884 · Python subprocess execution detectedresult = subprocess.run([bash_exe(), str(ROOT / "plugin/hooks/session-start.sh")],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_backup_cli.py:371 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandpyproject.toml:109 · Process kill command — agent can terminate processes# after a reboot its stop can kill an unrelated process (pg0 #37).Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Privileged sudo commandtests/test_expose_cli.py:506 · Privileged sudo command — agent may execute with elevated privilegesassert "sudo tailscale set --operator=$USER" in errFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
URL with embedded credentialstests/test_connect.py:1034 · URL with embedded credentials — may be phishing or credential leakingcode, _report, out = run_json(capsys, f"http://user:{SECRET}@example.com")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
Python subprocess execution detectedtests/test_credentials.py:528 · Python subprocess execution detectedsubprocess.run(["icacls", str(folder), "/reset", "/T"], capture_output=True, timeout=60)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
HTTP URL with a raw public IP addresstests/test_connect.py:975 · HTTP URL with a raw public IP address — a hard-coded destination that domain-based monitoring cannot nameassert env == {URL_KEY: "http://100.64.0.2:8765", "KEEP": "1", FILE_KEY: str(token), NO_SPAWN: "1"}Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL with embedded credentialstests/test_connect.py:1038 · URL with embedded credentials — may be phishing or credential leakingmachine.user_url = f"https://user:{SECRET}@example.com/path"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
Python subprocess execution detectedtests/test_credentials.py:295 · Python subprocess execution detectedsubprocess.run(["icacls", str(path), "/grant", "*S-1-1-0:R"], check=True,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Privileged sudo commandtests/test_expose_cli.py:350 · Privileged sudo command — agent may execute with elevated privileges"permission denied; use 'sudo tailscale serve' or 'tailscale set --operator=$USER'\n",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
URL with embedded credentialstests/test_connect.py:1032 · URL with embedded credentials — may be phishing or credential leakingcode, out = run(capsys, f"http://user:{SECRET}@example.com")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)tests/test_connect.py:444 · MCP server using network transport (SSE/HTTP) — data sent over network"mcpServers": {"pseudolife-memory": {"type": "http", "url": "http://127.0.0.1:8765/mcp"}},Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
File permission modification commandtests/test_credentials.py:330 · File permission modification command — agent changes file ownership/permissionsassert fix.endswith(f"chmod 600 {path}")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
URL using a raw public IP addresstests/test_connect.py:975 · URL using a raw public IP address — may bypass domain-based filteringassert env == {URL_KEY: "http://100.64.0.2:8765", "KEEP": "1", FILE_KEY: str(token), NO_SPAWN: "1"}Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL using a raw public IP addresstests/test_connect.py:972 · URL using a raw public IP address — may bypass domain-based filteringresult = codex_connection.replace_connection(fake, home, tmp_path, "http://100.64.0.2:8765",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedtests/test_doctor_cli.py:529 · Python subprocess execution detectedreturn subprocess.run([sys.executable, "-c", _SDK_CHECK], cwd=cwd, env=env,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
HTTP URL with a raw public IP addresstests/test_connect.py:588 · HTTP URL with a raw public IP address — a hard-coded destination that domain-based monitoring cannot nameout = _refused(machine, capsys, "http://100.64.0.2:8765", "--yes")Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL using a raw public IP addresstests/test_connect.py:553 · URL using a raw public IP address — may bypass domain-based filteringremote = "http://100.64.0.2:8765"Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
HTTP URL with a raw public IP addresstests/test_connect.py:977 · HTTP URL with a raw public IP address — a hard-coded destination that domain-based monitoring cannot name"http://100.64.0.2:8765", str(token))Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Access to sensitive file pathstests/test_console_cli.py:137 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"file:///etc/passwd", "http://127.0.0.1:8765/ui/#/settings",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Hidden zero-width characters detectedtests/test_connect.py:896 · Hidden zero-width characters detected — may conceal contentmonkeypatch.setattr("sys.stdin", io.TextIOWrapper(io.BytesIO(("" + GOOD + "\r\n").encode())))Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
MEDIUM
HTTP URL with a raw public IP addresstests/test_connect.py:553 · HTTP URL with a raw public IP address — a hard-coded destination that domain-based monitoring cannot nameremote = "http://100.64.0.2:8765"Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Process kill commandtests/test_graph.py:305 · Process kill command — agent can terminate processes# running after svc exists would kill the shared service's connection.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedtests/test_daemon_http.py:321 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
HTTP URL with a raw public IP addresstests/test_connect.py:972 · HTTP URL with a raw public IP address — a hard-coded destination that domain-based monitoring cannot nameresult = codex_connection.replace_connection(fake, home, tmp_path, "http://100.64.0.2:8765",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL with embedded credentialstests/test_connect.py:431 · URL with embedded credentials — may be phishing or credential leaking@pytest.mark.parametrize("url", ["ftp://example.com", "http://example.com/mcp", "http://u:[email protected]",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
Python subprocess execution detectedtests/test_credentials.py:341 · Python subprocess execution detectedout = subprocess.run([str(whoami), "/user", "/fo", "csv", "/nh"], check=True,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)tests/test_connect.py:990 · MCP server using network transport (SSE/HTTP) — data sent over network"mcpServers": {"pseudolife-memory": {"type": "http", "url": "http://127.0.0.1:8765/mcp"}}})Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
File permission modification commandtests/test_credentials.py:832 · File permission modification command — agent changes file ownership/permissionsassert "chmod 600 '/fixture/my dir/token'" in credential_recovery(Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Privileged sudo commandtests/test_expose_cli.py:358 · Privileged sudo command — agent may execute with elevated privilegesassert "sudo tailscale set --operator=$USER" in errFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
URL with embedded credentialstests/test_connect.py:1037 · URL with embedded credentials — may be phishing or credential leakingmonkeypatch.setenv(URL_KEY, f"http://user:{SECRET}@127.0.0.1:1")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
URL using a raw public IP addresstests/test_connect.py:977 · URL using a raw public IP address — may bypass domain-based filtering"http://100.64.0.2:8765", str(token))Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Process kill commandtests/test_heap_trim.py:201 · Process kill command — agent can terminate processes"""nan/inf would pass a "<= 0" check and kill the thread at its firstFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedtests/test_credentials.py:335 · Python subprocess execution detectedreturn subprocess.run([sys.executable, "-m", "pseudolife_memory.credentials", "repair",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commandtests/test_credentials.py:820 · File permission modification command — agent changes file ownership/permissionswindows=False).endswith("chmod 600 /fixture/dir/token")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtests/test_credentials.py:455 · Python subprocess execution detectedlisting = subprocess.run(["icacls", str(folder)], capture_output=True, text=True,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
URL using a raw public IP addresstests/test_connect.py:588 · URL using a raw public IP address — may bypass domain-based filteringout = _refused(machine, capsys, "http://100.64.0.2:8765", "--yes")Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Access to sensitive file pathstests/test_mcp_server.py:848 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesv1, v2, v3 = ("the api key lives in .env",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
HTTP URL with a raw public IP addresstests/test_invite_cli.py:229 · HTTP URL with a raw public IP address — a hard-coded destination that domain-based monitoring cannot name"900s", "--replace", "--url", "http://100.64.0.2:8765"]Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
HTTP URL with a raw public IP addresstests/test_invite_cli.py:33 · HTTP URL with a raw public IP address — a hard-coded destination that domain-based monitoring cannot namemonkeypatch.setattr(invite_cli, "exposed_url", lambda port: "http://100.64.0.2:8765")Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL using a raw public IP addresstests/test_invite_cli.py:33 · URL using a raw public IP address — may bypass domain-based filteringmonkeypatch.setattr(invite_cli, "exposed_url", lambda port: "http://100.64.0.2:8765")Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedtests/test_lease_cli.py:1507 · Python subprocess execution detectedreturn subprocess.Popen([sys.executable, "-c", "import sys; sys.stdin.readline()"],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_mcp_server.py:816 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif e["text"] == "the api key lives in .env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_heap_trim.py:245 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filestemplate = (REPO / "ops" / ".env.example").read_text(encoding="utf-8")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtests/test_lease_cli.py:1962 · Python subprocess execution detectedreturn subprocess.run([_pwsh_or_skip(), "-NoProfile", "-NonInteractive", "-Command", script],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
HTTP URL with a raw public IP addresstests/test_invite_cli.py:511 · HTTP URL with a raw public IP address — a hard-coded destination that domain-based monitoring cannot name"http://100.64.0.2:8765"]Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Hidden zero-width characters detectedtests/test_lease_cli.py:958 · Hidden zero-width characters detected — may conceal content_write_token_file(token_file, "tok-with-bom")Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)tests/test_mcp_server.py:1437 · MCP server using network transport (SSE/HTTP) — data sent over networkorig_app = mcp_server.mcp.streamable_http_appFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
URL using a raw public IP addresstests/test_invite_cli.py:229 · URL using a raw public IP address — may bypass domain-based filtering"900s", "--replace", "--url", "http://100.64.0.2:8765"]Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)tests/test_mcp_server.py:1461 · MCP server using network transport (SSE/HTTP) — data sent over networkmcp_server.build_streamable_http_app()Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
URL using a raw public IP addresstests/test_invite_cli.py:113 · URL using a raw public IP address — may bypass domain-based filteringassert f"pseudolife-mcp pair http://100.64.0.2:8765 {printed}" in outFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Process kill commandtests/test_lease_cli.py:729 · Process kill command — agent can terminate processes"""The children still running (to assert on), then kill them all so aFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
HTTP URL with a raw public IP addresstests/test_invite_cli.py:123 · HTTP URL with a raw public IP address — a hard-coded destination that domain-based monitoring cannot nameassert report["pair_command"] == f"pseudolife-mcp pair http://100.64.0.2:8765 {report['code']}"Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedtests/test_lease_cli.py:108 · Python subprocess execution detectedself.proc = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_lease_cli.py:1457 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_heap_trim.py:192 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Compose passes an unset ops/.env value as an empty string."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
HTTP URL with a raw public IP addresstests/test_invite_cli.py:113 · HTTP URL with a raw public IP address — a hard-coded destination that domain-based monitoring cannot nameassert f"pseudolife-mcp pair http://100.64.0.2:8765 {printed}" in outFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)tests/test_mcp_server.py:1445 · MCP server using network transport (SSE/HTTP) — data sent over networkmcp_server.mcp.streamable_http_app = _captureFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
URL using a raw public IP addresstests/test_invite_cli.py:511 · URL using a raw public IP address — may bypass domain-based filtering"http://100.64.0.2:8765"]Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)tests/test_mcp_server.py:1450 · MCP server using network transport (SSE/HTTP) — data sent over networkmcp_server.mcp.streamable_http_app = orig_appFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
MCP server using network transport (SSE/HTTP)tests/test_mcp_server.py:1446 · MCP server using network transport (SSE/HTTP) — data sent over networkmcp_server.build_streamable_http_app()Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Process kill commandtests/test_merge_queue.py:147 · Process kill command — agent can terminate processes# Every shipped rule must kill at least a handful of real rejects —Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Access to sensitive file pathstests/test_mcp_server.py:797 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files_invoke("memory_store", {"text": "the api key lives in .env", "source": "notes"})Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_mcp_server.py:804 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif e["text"] == "the api key lives in .env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commandtests/test_lease_cli.py:838 · Process kill command — agent can terminate processes# `kill -INT <lease pid>` reaches only this process: after the grace theFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandtests/test_lease_cli.py:874 · Process kill command — agent can terminate processes# `kill <lease pid>`, `timeout`, a service or CI stop: without a handlerFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
URL using a raw public IP addresstests/test_move_cli.py:47 · URL using a raw public IP address — may bypass domain-based filteringTARGET_URL = "http://100.64.0.9:8765"Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL using a raw public IP addresstests/test_invite_cli.py:123 · URL using a raw public IP address — may bypass domain-based filteringassert report["pair_command"] == f"pseudolife-mcp pair http://100.64.0.2:8765 {report['code']}"Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Access to sensitive file pathstests/test_mcp_server.py:798 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files_invoke("memory_supersede", {"old_text": "the api key lives in .env",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtests/test_lease_cli.py:1766 · Python subprocess execution detectedresult = subprocess.run([pwsh, "-NoProfile", "-NonInteractive", "-Command", probe],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_move_cli.py:656 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesworld.env_path_model = f"{world.requested_checkout}/ops/.env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
HTTP URL with a raw public IP addresstests/test_move_cli.py:47 · HTTP URL with a raw public IP address — a hard-coded destination that domain-based monitoring cannot nameTARGET_URL = "http://100.64.0.9:8765"Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL using a raw public IP addresstests/test_release_ux.py:1004 · URL using a raw public IP address — may bypass domain-based filteringfor text in (b"http://100.64.0.2:8765", b"100.64.0.10",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Access to sensitive file pathstests/test_pg_defaults.py:57 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_file = tmp_path / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_pg_defaults.py:46 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_file = tmp_path / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtests/test_release_ux.py:943 · Python subprocess execution detectedproc = subprocess.run(["git", "tag", "-l"], cwd=repo, check=True,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_move_cli.py:609 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif cmd.startswith("rm -f ") and cmd.endswith("ops/.env"):Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commandtests/test_move_cli.py:2847 · Process kill command — agent can terminate processes# ── Windows: SIGBREAK, and a rollback a second Ctrl-C cannot kill ────────────Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Access to sensitive file pathstests/test_move_cli.py:689 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesreturn c.remote is not None and "&& mv -f" in c.remote and "ops/.env" in c.remoteFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Privileged sudo commandtests/test_move_cli.py:497 · Privileged sudo command — agent may execute with elevated privilegesreturn self.expose_exit, b"", b"expose: run sudo tailscale set --operator=$USER"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedtests/test_pg_defaults.py:271 · Python subprocess execution detectedmoved = subprocess.run([sys.executable, "-c", code], cwd=root, capture_output=True,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
URL using a raw public IP addresstests/test_pair_cli.py:439 · URL using a raw public IP address — may bypass domain-based filteringcode, report, text = run_json(capsys, "http://100.64.0.2:8765", CODE)Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedtests/test_pg_defaults.py:268 · Python subprocess execution detectedplain = subprocess.run([sys.executable, "-c", code], cwd=root, env=env,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_recall.py:82 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesassert not rc._mentions("see .env file", "env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
URL with embedded credentialstests/test_pair_cli.py:268 · URL with embedded credentials — may be phishing or credential leaking@pytest.mark.parametrize("url", ["ftp://example.com", "http://user:[email protected]:8765",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
HTTP URL with a raw public IP addresstests/test_pair_cli.py:442 · HTTP URL with a raw public IP address — a hard-coded destination that domain-based monitoring cannot namecode, _out, err = run(capsys, "http://100.64.0.2:8765", CODE)Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Access to sensitive file pathstests/test_move_cli.py:1239 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesoptions[options.index("--env-file") + 1] = str(s["repo"] / "ops/.env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtests/test_pg_defaults.py:1360 · Python subprocess execution detectedrun = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_pg_defaults.py:69 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesresolves the ops/.env or compose-default layers."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtests/test_release_ux.py:800 · Python subprocess execution detectedproc = subprocess.run(["git", "ls-files"], cwd=repo, check=True,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandtests/test_move_cli.py:1817 · File permission modification command — agent changes file ownership/permissionsassert made and all("-m 700" in cmd and "chmod 700" in cmd for cmd in made), madeFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Python subprocess execution detectedtests/test_pg_defaults.py:275 · Python subprocess execution detectedbad = subprocess.run([sys.executable, "-c", code], cwd=root, capture_output=True,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_pg_defaults.py:1230 · Python subprocess execution detectedrun = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_release_ux.py:898 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_pair_cli.py:417 · Python subprocess execution detectedproc = subprocess.run([sys.executable, "-m", "pseudolife_memory.cli", "pair", "--help"],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File type combined with upload actiontests/test_move_cli.py:2231 · File type combined with upload action — agent may exfiltrate local data filesholds move.json, which a daemon refuses to start on; the rollback putsFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Access to sensitive file pathstests/test_pg_defaults.py:32 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_file = tmp_path / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_pg_defaults.py:23 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_file = tmp_path / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
HTTP URL with a raw public IP addresstests/test_pair_cli.py:439 · HTTP URL with a raw public IP address — a hard-coded destination that domain-based monitoring cannot namecode, report, text = run_json(capsys, "http://100.64.0.2:8765", CODE)Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Access to sensitive file pathstests/test_move_cli.py:842 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv = f"{CHECKOUT}/ops/.env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
URL using a raw public IP addresstests/test_pair_cli.py:442 · URL using a raw public IP address — may bypass domain-based filteringcode, _out, err = run(capsys, "http://100.64.0.2:8765", CODE)Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedtests/test_release_ux.py:645 · Python subprocess execution detectedproc = subprocess.run(["git", "check-attr", "--stdin", "-z", "text", "diff"],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_shim_prompt.py:5 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesthe shim — the default since the 2026-07-11 cutover, and what ``ops/.env``Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtests/test_suite_cost.py:22 · Python subprocess execution detectedchild = subprocess.Popen([PYTHON, "-c", HOLD])Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
HTTP URL with a raw public IP addresstests/test_release_ux.py:1004 · HTTP URL with a raw public IP address — a hard-coded destination that domain-based monitoring cannot namefor text in (b"http://100.64.0.2:8765", b"100.64.0.10",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedtests/test_update_cli.py:1009 · Python subprocess execution detectedreturn subprocess.run(["git", "-C", str(repo), "-c", "user.name=test", "-c", "[email protected]",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
URL using a raw public IP addresstests/test_shim.py:1479 · URL using a raw public IP address — may bypass domain-based filteringcached = shim._load_handshake_cache("http://100.64.0.2:8765")Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Access to sensitive file pathstests/test_release_ux.py:888 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""``ops/.env`` holds the database password and the principal tokens. AFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtests/test_update_cli.py:1531 · Python subprocess execution detectedproc = subprocess.run([sys.executable, "-m", "pseudolife_memory.cli", "update", "--help"],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
URL using a raw public IP addresstests/test_shim.py:1477 · URL using a raw public IP address — may bypass domain-based filteringshim._store_handshake_cache("http://100.64.0.2:8765", tools=[tool])Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL using a raw public IP addresstests/test_shim.py:1476 · URL using a raw public IP address — may bypass domain-based filteringshim._store_handshake_cache("http://100.64.0.2:8765", instructions="Use it.")Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL using a raw public IP addresstests/test_shim.py:1420 · URL using a raw public IP address — may bypass domain-based filteringassert shim.ensure_daemon("http://100.64.0.2:8765") is NoneFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedtests/test_shim.py:939 · Python subprocess execution detectedproc = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_suite_lock.py:1050 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files_EXAMPLE_COPY = "rejects the compose default password, as ops/.env is a copy of ops/.env.example"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commandtests/test_suite_lock.py:119 · Process kill command — agent can terminate processes"""Hard-kill the interpreter that holds the lock, by its own pid: underFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedtests/test_suite_lock.py:2076 · Python subprocess execution detecteddone = subprocess.run(["pwsh", "-NoProfile", "-File", str(driver)], env=env,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
HTTP URL with a raw public IP addresstests/test_shim.py:1479 · HTTP URL with a raw public IP address — a hard-coded destination that domain-based monitoring cannot namecached = shim._load_handshake_cache("http://100.64.0.2:8765")Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedtests/test_suite_lock.py:2053 · Python subprocess execution detectedother = subprocess.Popen([sys.executable, "-c", "import time; time.sleep(60)"])Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_suite_lock.py:65 · Python subprocess execution detectedself.proc = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
HTTP URL with a raw public IP addresstests/test_shim.py:1476 · HTTP URL with a raw public IP address — a hard-coded destination that domain-based monitoring cannot nameshim._store_handshake_cache("http://100.64.0.2:8765", instructions="Use it.")Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedtests/test_shim_python.py:364 · Python subprocess execution detectedreturn subprocess.run([PWSH, "-NoProfile", "-NonInteractive", "-File", str(path)],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_suite_lock.py:1058 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesthe checkout's ops/.env, this machine's test login file hidden."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
URL using a raw public IP addresstests/test_shim.py:1397 · URL using a raw public IP address — may bypass domain-based filteringfor url in ("http://100.64.0.2:8765", "https://daemon.example.invalid"):Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Access to sensitive file pathstests/test_release_ux.py:890 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesignored — ``.env`` and ``*.bak`` match neither ``.env.bak-<ts>`` shape —Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
HTTP URL with a raw public IP addresstests/test_shim.py:1477 · HTTP URL with a raw public IP address — a hard-coded destination that domain-based monitoring cannot nameshim._store_handshake_cache("http://100.64.0.2:8765", tools=[tool])Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Process kill commandtests/test_suite_lock.py:108 · Process kill command — agent can terminate processes# own; kill only what does not.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Access to sensitive file pathstests/test_release_ux.py:893 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesEvery ``ops/.env*`` variant is ignored except the tracked template."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_suite_lock.py:1039 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# worktree, whose ops/.env was missing or a copy of ops/.env.example, resolvedFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtests/test_update_cli.py:1534 · Python subprocess execution detectedproc = subprocess.run([sys.executable, str(ROOT / "ops" / "update.py"), "--help"],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_release_ux.py:907 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfor rel in ("ops/.env", "ops/.env.bak-x", "ops/.env.bak-20990101-000000",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtests/test_shim.py:136 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_update_cli.py:1026 · Python subprocess execution detectedsubprocess.run(["git", "init", "-q", str(root)], check=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandtests/test_shim.py:2043 · File permission modification command — agent changes file ownership/permissionsfix = "pseudolife_memory.credentials repair" if os.name == "nt" else "chmod 600"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
HTTP URL with a raw public IP addresstests/test_shim.py:1420 · HTTP URL with a raw public IP address — a hard-coded destination that domain-based monitoring cannot nameassert shim.ensure_daemon("http://100.64.0.2:8765") is NoneFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedtests/test_shim_python.py:39 · Python subprocess execution detectedsubprocess.run([sys.executable, "-m", "venv", "--without-pip", str(root)],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
HTTP URL with a raw public IP addresstests/test_shim.py:1397 · HTTP URL with a raw public IP address — a hard-coded destination that domain-based monitoring cannot namefor url in ("http://100.64.0.2:8765", "https://daemon.example.invalid"):Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedtests/test_suite_lock.py:1964 · Python subprocess execution detectedother = subprocess.Popen([sys.executable, "-c", "import time; time.sleep(60)"])Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_update_cli.py:236 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesoriginal_env = (root / "ops/.env").read_bytes()Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
Instructs the agent to modify its persistent memory or instruction filesPKG-INFO:466 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file# (PowerShell: Add-Content "$env:USERPROFILE\.claude\CLAUDE.md" (Get-Content examples\CLAUDE.memory.md -Raw))Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
URL to a private-network addresstests/test_update_cli.py:1830 · URL to a private-network address — a LAN or development targetassert _run(["--daemon-only", "--daemon-url", "http://10.0.0.7:8765"]) == 2Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
LOW
Instructs the agent to modify its persistent memory or instruction filesREADME.md:1177 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction fileAdd-Content "$env:USERPROFILE\.claude\CLAUDE.md" (Get-Content examples\CLAUDE.memory.md -Raw)Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Python subprocess execution detectedtests/test_update_cli.py:1686 · Python subprocess execution detectedprobe = subprocess.run(["git", "-C", str(root), "rev-parse", "HEAD"], capture_output=True, text=True,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
LOW
Instructs the agent to modify its persistent memory or instruction filesPKG-INFO:1215 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction filehooks, append it to Claude's global `~/.claude/CLAUDE.md`, Codex'sFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
URL to a private-network addresstests/test_update_cli.py:1739 · URL to a private-network address — a LAN or development targetassert _run(argv + ["--daemon-url", "http://10.0.0.7:8765"]) == 0, argvFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
LOW
Instructs the agent to modify its persistent memory or instruction filesREADME.md:374 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction filedefault (append to `~/.gemini/GEMINI.md` or `~/AGENTS.md`); useFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Access to sensitive file pathstests/test_update_cli.py:365 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files(project / ".env").write_text("PSEUDOLIFE_IMAGE_TAG=0.15.0\n", encoding="utf-8")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_web.py:543 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesst, _ = call(_app(svc), "GET", "/ui/../../../etc/passwd")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
URL to a private-network addresstests/test_update_cli.py:1770 · URL to a private-network address — a LAN or development targetassert _run(argv + ["--daemon-url", "http://10.0.0.7:8765"]) == 0, argvFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
LOW
Instructs the agent to modify its persistent memory or instruction filesREADME.md:283 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction fileappend` always writes the block from `examples/CLAUDE.memory.md` intoFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Instructs the agent to modify its persistent memory or instruction filesPKG-INFO:332 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction fileappend` always writes the block from `examples/CLAUDE.memory.md` intoFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Access to sensitive file pathstests/test_web.py:751 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfor rel in ("../../etc/passwd", "a/./../../x", "/", "/etc/passwd", "//host/share/x",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_update_cli.py:337 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesassert f"--env-file {project / '.env'}" in calls[compose]Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
Instructs the agent to modify its persistent memory or instruction filesREADME.md:417 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file# (PowerShell: Add-Content "$env:USERPROFILE\.claude\CLAUDE.md" (Get-Content examples\CLAUDE.memory.md -Raw))Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Instructs the agent to modify its persistent memory or instruction filesPKG-INFO:1226 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction fileAdd-Content "$env:USERPROFILE\.claude\CLAUDE.md" (Get-Content examples\CLAUDE.memory.md -Raw)Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Instructs the agent to modify its persistent memory or instruction filesREADME.md:1166 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction filehooks, append it to Claude's global `~/.claude/CLAUDE.md`, Codex'sFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
URL to a private-network addresstests/test_update_cli.py:1819 · URL to a private-network address — a LAN or development targetassert _run(["--clients-only", "--daemon-url", "http://10.0.0.7:8765"]) == 2, reportedFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
LOW
Instructs the agent to modify its persistent memory or instruction filesPKG-INFO:423 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction filedefault (append to `~/.gemini/GEMINI.md` or `~/AGENTS.md`); useFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Access to sensitive file pathstests/test_web.py:633 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files_ESCAPING_UI_PATHS = ["/ui/../../../etc/passwd", "/ui///etc/passwd", "/ui/a/../../x",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
URL to a private-network addresstests/test_update_cli.py:1823 · URL to a private-network address — a LAN or development targetassert _run(["--clients-only", "--daemon-url", "http://10.0.0.7:8765", "--tag", "0.15.1"]) == 0Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Access to sensitive file pathstests/test_update_cli.py:252 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesassert (root / "ops/.env").read_bytes() == original_envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_web.py:722 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesescaping = ["../x", "a/../../x", "/etc/passwd", "//host/share/x",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_update_cli.py:209 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_file = ops / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05

Cost to the agent

Instructions loaded
≈56 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Not checked against OSV yet; the weekly check has not reached this version.