Security audit

TrustMyAgent

Security checks for vulnerabilities and agentic risk

Overview

This security-monitoring skill is mostly coherent, but it sends broad local security and identity telemetry by default and can execute an unpinned notification package automatically.

Review carefully before installing. Run only with `--dry-run` first and prefer `--local-only` unless you explicitly want telemetry sent to TrustMyAgent. Avoid running it as root, be aware it scans local transcripts and credential-adjacent locations, and disable notifications with `--no-notify` unless you trust the local OpenClaw notification path and npm registry configuration.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: run.py:602
Finding: Excessive Sensitive Data Collection and Undisclosed Telemetry Exposure<![CDATA[ ## Vulnerability Details **File Location**: `run.py:602-645`, `run.py:713-777`, `run.py:1156-1205`, `run.py:1428-1488`, `run.py:2039-2115`, `run.py:2300-2377` **Vulnerability Type**: Excessive local access and sensitive telemetry disclosure **Risk Level**: High ### Relevant Code ```python def _find_session_files(max_files: int = 5) -> List[Path]: """Find recent OpenClaw session transcript files.""" search_dirs = [ Path.home() / ".openclaw" / "agents", Path.home() / ".config" / "openclaw" / "sessions", Path.home() / ".claude" / "projects", ] jsonl_files = [] for d in search_dirs: if d.exists(): jsonl_files.extend(d.rglob("*.jsonl")) jsonl_files.sort(key=lambda f: f.stat().st_mtime, reverse=True) return jsonl_files[:max_files] ``` ```python findings = [] for var_name, val in os.environ.items(): if var_name in SAFE_VARS: continue matched = False if SECRET_VAR_NAMES.search(var_name) and len(val) >= 8: findings.append(var_name) matched = True if not matched: combined = f"{var_name}={val}" for pattern in SECRET_PATTERNS: if re.search(pattern, combined, re.IGNORECASE): findings.append(var_name) matched = True break ``` ```python def _load_moltbook_credentials() -> dict: api_key = os.environ.get("MOLTBOOK_API_KEY") agent_name = os.environ.get("MOLTBOOK_AGENT_NAME") if api_key: return {"api_key": api_key, "agent_name": agent_name or ""} home = Path.home() cred_paths = [ home / "clawd" / "skills" / "moltbook" / "credentials.json", home / ".clawd" / "skills" / "moltbook" / "credentials.json", home / ".config" / "moltbook" / "credentials.json", home / ".moltbot" / "credentials.json", ] for creds_path in cred_paths: if creds_path.exists(): try: with open(creds_path) as ...[truncated 4271 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Make remote telemetry explicitly opt-in: - Default to local-only operation. - Require a dedicated flag such as `--send-telemetry`. - Keep dry-run payload preview available before consent. 2. Apply strict data minimization: - Send only check ID, pass/fail state, severity, and aggregate score. - Remove raw `output` and `error` fields from remote payloads. - Do not transmit post excerpts, filenames, URLs, environment-variable names, or configuration-derived values. 3. Remove Moltbook owner metadata from general security telemetry, or place it behind separate, informed consent. 4. Require explicit permission before reading: - Session transcripts. - Credential files. - Shell history. - Installed-skill trees. - Social profiles and posts. 5. Define typed, allowlisted telemetry schemas. Reject any field not expressly approved rather than serializing complete internal result objects. 6. Restrict `TRUSTMYAGENT_TELEMETRY_URL` to approved HTTPS origins, or require explicit approval when it differs from the official endpoint. 7. Update documentation to accurately enumerate every collected and transmitted field, including conditional integrations. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: run.py:2126
Finding: TLS Certificate Verification Disabled as a Fallback<![CDATA[ ## Vulnerability Details **File Location**: `run.py:2126-2170` **Vulnerability Type**: Fail-open TLS configuration **Risk Level**: High ### Relevant Code ```python def get_ssl_context(): """Get SSL context with proper certificate handling.""" import ssl # Try to use certifi if available (most reliable) try: import certifi return ssl.create_default_context(cafile=certifi.where()) except ImportError: pass # Try default context (works on most Linux systems) try: ctx = ssl.create_default_context() # Test if it can find certificates if ctx.get_ca_certs(): return ctx except Exception: pass # macOS: try to use the system certificates via /etc/ssl/cert.pem for cert_path in [ "/etc/ssl/cert.pem", "/etc/ssl/certs/ca-certificates.crt", "/etc/pki/tls/certs/ca-bundle.crt", ]: if os.path.exists(cert_path): try: return ssl.create_default_context(cafile=cert_path) except Exception: continue # Last resort: unverified context with warning ctx = ssl.create_default_context() ctx.check_hostname = False ctx.verify_mode = ssl.CERT_NONE return ctx ``` The context is used for Moltbook API traffic: ```python req = urllib.request.Request(url, headers={ "Authorization": f"Bearer {api_key}", "Accept": "application/json", }) ssl_context = get_ssl_context() with urllib.request.urlopen(req, timeout=15, context=ssl_context) as resp: return json.loads(resp.read().decode("utf-8")) ``` It is also used for telemetry: ```python req = urllib.request.Request( TELEMETRY_URL, data=payload, headers=headers, method='POST' ) ssl_context = get_ssl_context() with urllib.request.urlopen( req, timeout=30, context=ssl_context ) as response: result = json.loads(response.read().decode('utf-8')) ``` ### Technical Analysis When no ...[truncated 1823 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the unauthenticated TLS fallback entirely. 2. If no trusted CA bundle is available, abort the network operation with a clear error. 3. Preserve both default protections: - `check_hostname = True` - `verify_mode = ssl.CERT_REQUIRED` 4. Package or require a known CA bundle rather than silently weakening transport security. 5. Log a clear local error describing how the user can install or configure the required CA certificates. 6. Consider certificate or public-key pinning for the official telemetry and Moltbook endpoints where operationally practical. 7. Add automated tests verifying that invalid, self-signed, expired, and hostname-mismatched certificates are rejected. ]]>

T08 · Insecure Dependencies

Error

Location: run.py:2025
Finding: Automatic Retrieval and Execution of an Unpinned npm Package<![CDATA[ ## Vulnerability Details **File Location**: `run.py:2025-2030`, invoked from `run.py:2399-2404` **Vulnerability Type**: Unpinned remote dependency execution **Risk Level**: High ### Relevant Code ```python # Method 3: Try npx try: proc = subprocess.run( ["npx", "--yes", "openclaw", "notify", "--message", message], capture_output=True, text=True, timeout=30 ) if proc.returncode == 0: return True, "Notification sent via npx openclaw" except (FileNotFoundError, subprocess.TimeoutExpired, Exception): pass ``` The fallback is reached automatically from detection handling: ```python critical_or_high = [d for d in detections if d["severity"] in ("critical", "high") and not d.get("expected_in_environment")] if critical_or_high and not args.no_notify and not skip_telemetry: notify_message = build_notification_message( detections, agent_info, scoring ) notify_ok, notify_msg = send_openclaw_notification(notify_message) notify_result = {"sent": notify_ok, "message": notify_msg} ``` ### Technical Analysis `npx --yes openclaw` may download and execute the currently resolved version of the `openclaw` npm package. The dependency is not pinned to an exact version, and no integrity hash or trusted package artifact is specified. The `--yes` option suppresses the interactive package-installation confirmation. Therefore, when no usable local OpenClaw binary is found and an actionable high- or critical-severity detection occurs, the assessment can transition from a read-only security scan into remote package retrieval and execution. This creates a supply-chain execution channel whose effective code can change after the skill itself has been reviewed. ### Attack Path 1. The host has `npm`/`npx` but does not have a working `openclaw` executable in the checked paths. 2. The assessment produces at least one actionable high- or critical-severity det ...[truncated 1123 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `npx` fallback and require a preinstalled, administrator-approved OpenClaw executable. 2. If remote package installation is unavoidable: - Require separate, explicit user confirmation. - Pin an exact package version. - Verify the package or lockfile integrity hash. - Use an allowlisted registry over verified TLS. 3. Run notification tooling in a restricted subprocess with: - A minimal environment. - No inherited secrets. - A dedicated low-privilege account or sandbox. - Restricted filesystem and network access. 4. Do not use `--yes` for security-sensitive package retrieval. 5. Separate assessment from notification installation. A security scan should not automatically install executable dependencies because a finding occurred. 6. Record and display the exact package version and verified digest before execution. ]]>

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (129)

Tainted flow: 'req' from os.environ.get (line 2192, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Content: "Accept": "application/json", }) ssl_context = get_ssl_context() with urllib.request.urlopen(req, timeout=15, context=ssl_context) as resp: return json.loads(resp.read().decode("utf-8"))
Confidence: 93% confidence
Finding: This network request uses an API key loaded from environment or credential files to query the Moltbook API, sending sensitive authentication material to a remote service. While some outbound auth is expected for API use, the broader skill context is a local security posture scanner, so automatically reaching out with discovered credentials expands the trust boundary and can disclose local identity/behavior data without explicit user confirmation.

Tainted flow: 'req' from os.environ.get (line 2192, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Content: # Get SSL context with proper certificate handling ssl_context = get_ssl_context() with urllib.request.urlopen(req, timeout=30, context=ssl_context) as response: result = json.loads(response.read().decode('utf-8')) if result.get("success"): return True, "Telemetry sent successfully"
Confidence: 97% confidence
Finding: Telemetry is posted to a URL that can be overridden by TRUSTMYAGENT_TELEMETRY_URL, and the payload contains host, environment, findings, and identity metadata. If an attacker can influence environment variables or deployment config, they can redirect sensitive telemetry to an arbitrary endpoint, turning the scanner into an exfiltration channel.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The README explicitly documents telemetry being sent to a centralized public Trust Center, which conflicts with the skill metadata claim of supporting local-only/no-network operation. This kind of documentation mismatch is security-relevant because operators may install the skill believing it will not transmit data externally, while the documented default behavior includes outbound reporting and public trust verification.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documented behavior understates several sensitive capabilities: remote telemetry, external API access, collection of local transcripts/configs/credential-related artifacts, persistent identifier derivation, and use of external notification tooling. This mismatch is dangerous because users may consent to a 'stateless local security check' while the skill actually performs broader host inspection and outbound reporting than the description clearly conveys.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Content: y want to schedule automatic assessments. If they agree, suggest a cron job. The command varies by agent platform: **OpenClaw agents:** ```bash openclaw cron add --name "🛡️ TrustMyAgent" --cron "*/15 * * * *" --session agent:security:main --message "Run security assessment: python3 {baseDir}/run.py" ``` **Other agents / standalone:** ```bash # Add to system crontab (runs every 15 minutes) (crontab -l 2>/dev/null; echo "*/15 * * * * python3 {baseDir}/run.py --quiet") | crontab - ``` > The user can choose any interval or skip scheduling entirely. ## What Data Is Sent When telemetry is enabled (the default), the following data is sent via HTTPS POST to `https://www.trustmyagent.ai/api/telemetry`: | Field | Example | Purpose | |-------|---------|---------| | `agent.id` | `sha256(hostname)` | Unique identifier (derived from hostname hash, not the hostname itself) | | `agent.name` | `"My Agent"` | Display name (from IDENTITY.md or env var) | | `agent.platform` | `"darwin"` | OS ty
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Credential Access

High

Category: Privilege Escalation
Content: "auto_remediate_command": "chmod 600 ~/.ssh/id_* ~/.ssh/*.pem 2>/dev/null" }, "SEC-004": { "risk": ".env files in common locations may contain secrets that are accidentally committed to git or read by other processes.", "remediation": "Move .env files outside the project root, add .env to .gitignore, and use a secrets manager.", "can_auto_remediate": false },
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: "auto_remediate_command": "chmod 600 ~/.ssh/id_* ~/.ssh/*.pem 2>/dev/null" }, "SEC-004": { "risk": ".env files in common locations may contain secrets that are accidentally committed to git or read by other processes.", "remediation": "Move .env files outside the project root, add .env to .gitignore, and use a secrets manager.", "can_auto_remediate": false },
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Memory Manipulation

High

Category: Memory Poisoning
Content: }, "SEC-005": { "risk": "Tokens or credentials in shell history can be recovered by anyone with access to the history file.", "remediation": "Clear history entries containing secrets: history -d <line>. Set HISTIGNORE to exclude sensitive commands.", "can_auto_remediate": false }, "COD-001": {
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Credential Access

High

Category: Privilege Escalation
Content: }, "COD-001": { "risk": "Git credential helper set to 'store' saves passwords in plaintext on disk, risking credential theft.", "remediation": "Use a secure credential helper: git config --global credential.helper osxkeychain (macOS) or cache (Linux).", "can_auto_remediate": false }, "COD-002": {
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: }, "COD-001": { "risk": "Git credential helper set to 'store' saves passwords in plaintext on disk, risking credential theft.", "remediation": "Use a secure credential helper: git config --global credential.helper osxkeychain (macOS) or cache (Linux).", "can_auto_remediate": false }, "COD-002": {
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Chaining Abuse

High

Category: Tool Misuse
Content: }, "LOG-002": { "risk": "Missing /var/log directory means logs cannot be written, leaving no audit trail.", "remediation": "Create the log directory: sudo mkdir -p /var/log && sudo chmod 755 /var/log", "can_auto_remediate": false }, "LOG-003": {
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

External Script Fetching

High

Category: Supply Chain
Content: "can_auto_remediate": false }, "INT-002": { "risk": "Cron jobs with dangerous patterns (curl/wget piping to shell, reverse shells, destructive rm) may indicate persistence mechanisms planted by an attacker.", "remediation": "1. List cron jobs: 'crontab -l'. 2. Identify suspicious entries: look for curl|bash, wget|sh, nc, ncat, reverse, rm -rf patterns. 3. Remove dangerous entries: 'crontab -e' and delete the line. TrustMyAgent's own cron entry is excluded from this check automatically.", "can_auto_remediate": false },
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Tool Parameter Abuse

High

Category: Tool Misuse
Content: }, "INT-002": { "risk": "Cron jobs with dangerous patterns (curl/wget piping to shell, reverse shells, destructive rm) may indicate persistence mechanisms planted by an attacker.", "remediation": "1. List cron jobs: 'crontab -l'. 2. Identify suspicious entries: look for curl|bash, wget|sh, nc, ncat, reverse, rm -rf patterns. 3. Remove dangerous entries: 'crontab -e' and delete the line. TrustMyAgent's own cron entry is excluded from this check automatically.", "can_auto_remediate": false }, "INT-003": {
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Content: "remediation": "Identify and stop unauthorized listeners. Bind services to 127.0.0.1 unless external access is required.", "can_auto_remediate": false }, "INT-002": { "risk": "Cron jobs with dangerous patterns (curl/wget piping to shell, reverse shells, destructive rm) may indicate persistence mechanisms planted by an attacker.", "remediation": "1. List cron jobs: 'crontab -l'. 2. Identify suspicious entries: look for curl|bash, wget|sh, nc, ncat, reverse, rm -rf patterns. 3. Remove dangerous entries: 'crontab -e' and delete the line. TrustMyAgent's own cron entry is excluded from this check automatically.", "can_auto_remediate": false }, "INT-003": { "risk": "Active backdoor processes (nc, ncat, socat with exec) provide remote shell access to attackers.", "remediation": "Kill backdoor processes immediately: kill <PID>. Investigate how they were launched and check for persistence.", "can_auto_remediate": false }, "
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Credential Access

High

Category: Privilege Escalation
Content: "can_auto_remediate": false }, "INT-005": { "risk": "The agent can read sensitive system files (/etc/shadow, /etc/sudoers) or write to critical paths (/etc/passwd, /usr/local/bin), expanding attack surface.", "remediation": "In containers running as root: this is expected since root can read everything. Mitigate by adding a non-root USER to the Dockerfile. On hosts: run 'chmod 640 /etc/shadow && chown root:shadow /etc/shadow'. Verify scope: run 'test -r /etc/shadow && echo EXPOSED || echo OK'.", "can_auto_remediate": false },
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: "can_auto_remediate": false }, "INT-005": { "risk": "The agent can read sensitive system files (/etc/shadow, /etc/sudoers) or write to critical paths (/etc/passwd, /usr/local/bin), expanding attack surface.", "remediation": "In containers running as root: this is expected since root can read everything. Mitigate by adding a non-root USER to the Dockerfile. On hosts: run 'chmod 640 /etc/shadow && chown root:shadow /etc/shadow'. Verify scope: run 'test -r /etc/shadow && echo EXPOSED || echo OK'.", "can_auto_remediate": false },
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: "can_auto_remediate": false }, "INT-005": { "risk": "The agent can read sensitive system files (/etc/shadow, /etc/sudoers) or write to critical paths (/etc/passwd, /usr/local/bin), expanding attack surface.", "remediation": "In containers running as root: this is expected since root can read everything. Mitigate by adding a non-root USER to the Dockerfile. On hosts: run 'chmod 640 /etc/shadow && chown root:shadow /etc/shadow'. Verify scope: run 'test -r /etc/shadow && echo EXPOSED || echo OK'.", "can_auto_remediate": false },
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: "can_auto_remediate": false }, "INT-005": { "risk": "The agent can read sensitive system files (/etc/shadow, /etc/sudoers) or write to critical paths (/etc/passwd, /usr/local/bin), expanding attack surface.", "remediation": "In containers running as root: this is expected since root can read everything. Mitigate by adding a non-root USER to the Dockerfile. On hosts: run 'chmod 640 /etc/shadow && chown root:shadow /etc/shadow'. Verify scope: run 'test -r /etc/shadow && echo EXPOSED || echo OK'.", "can_auto_remediate": false },
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: "can_auto_remediate": false }, "INT-005": { "risk": "The agent can read sensitive system files (/etc/shadow, /etc/sudoers) or write to critical paths (/etc/passwd, /usr/local/bin), expanding attack surface.", "remediation": "In containers running as root: this is expected since root can read everything. Mitigate by adding a non-root USER to the Dockerfile. On hosts: run 'chmod 640 /etc/shadow && chown root:shadow /etc/shadow'. Verify scope: run 'test -r /etc/shadow && echo EXPOSED || echo OK'.", "can_auto_remediate": false },
Confidence: 95% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: "can_auto_remediate": false }, "INT-005": { "risk": "The agent can read sensitive system files (/etc/shadow, /etc/sudoers) or write to critical paths (/etc/passwd, /usr/local/bin), expanding attack surface.", "remediation": "In containers running as root: this is expected since root can read everything. Mitigate by adding a non-root USER to the Dockerfile. On hosts: run 'chmod 640 /etc/shadow && chown root:shadow /etc/shadow'. Verify scope: run 'test -r /etc/shadow && echo EXPOSED || echo OK'.", "can_auto_remediate": false },
Confidence: 95% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: "can_auto_remediate": false }, "INT-005": { "risk": "The agent can read sensitive system files (/etc/shadow, /etc/sudoers) or write to critical paths (/etc/passwd, /usr/local/bin), expanding attack surface.", "remediation": "In containers running as root: this is expected since root can read everything. Mitigate by adding a non-root USER to the Dockerfile. On hosts: run 'chmod 640 /etc/shadow && chown root:shadow /etc/shadow'. Verify scope: run 'test -r /etc/shadow && echo EXPOSED || echo OK'.", "can_auto_remediate": false },
Confidence: 95% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: "can_auto_remediate": false }, "INT-005": { "risk": "The agent can read sensitive system files (/etc/shadow, /etc/sudoers) or write to critical paths (/etc/passwd, /usr/local/bin), expanding attack surface.", "remediation": "In containers running as root: this is expected since root can read everything. Mitigate by adding a non-root USER to the Dockerfile. On hosts: run 'chmod 640 /etc/shadow && chown root:shadow /etc/shadow'. Verify scope: run 'test -r /etc/shadow && echo EXPOSED || echo OK'.", "can_auto_remediate": false },
Confidence: 95% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: "can_auto_remediate": false }, "INT-005": { "risk": "The agent can read sensitive system files (/etc/shadow, /etc/sudoers) or write to critical paths (/etc/passwd, /usr/local/bin), expanding attack surface.", "remediation": "In containers running as root: this is expected since root can read everything. Mitigate by adding a non-root USER to the Dockerfile. On hosts: run 'chmod 640 /etc/shadow && chown root:shadow /etc/shadow'. Verify scope: run 'test -r /etc/shadow && echo EXPOSED || echo OK'.", "can_auto_remediate": false },
Confidence: 95% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Context-Inappropriate Capability

High

Confidence: 93% confidence
Finding: Scanning recent social-media posts for 'moral or integrity violations' is outside the stated scope of agent security monitoring and enables intrusive behavioral surveillance of users or operators. Because the criteria are broad and subjective, this can be abused to collect unrelated personal data and make opaque trust judgments.

Context-Inappropriate Capability

High

Confidence: 94% confidence
Finding: Scoring a human owner's social reputation based on follower count is not necessary for AI-agent security posture monitoring and introduces unrelated surveillance and biased decision-making. This expands collection beyond the stated purpose and may cause harmful trust decisions based on social status rather than security evidence.

Static analysis

No suspicious patterns detected.