Buzz Integration using ACP

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:29 AM UTC
• Version: 0.2.1

Overview

The skill appears purpose-aligned, but it needs Review because it runs always-on credentialed agents and persists prompt/message previews in system logs.

Install only if you are comfortable operating an always-on self-hosted agent service. Use dedicated Unix users per relay/agent, keep env files outside repos with mode 0600, restrict OPENCLAW_URL to a trusted endpoint, remove prompt/message body logging, and inspect any remote installer or sudo systemd command before running it.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:136

Finding

Mutable Remote Installer Is Executed Directly Through a Shell

Content

View full analysis

Vulnerability Details

File Location: README.md:136
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: Critical

Vulnerable Code:

bash

curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable

Technical Analysis

The installation instructions pipe content retrieved from an external URL directly into a shell. Although the command requires HTTPS and TLS 1.2 or later, it does not pin an installer version or verify a cryptographic signature or expected digest before execution.

Consequently, the effective code executed by this project can change after the repository has been reviewed. TLS protects data in transit but does not protect against compromise of the upstream hosting service, unexpected upstream changes, DNS or certificate-authority compromise, or unauthorized modification of the installer at its source.

The command executes with the privileges of the user following the installation instructions. It is not necessary to use a pipe-to-shell construction to install Rust, and this behavior exceeds the minimum risk required for the declared functionality.

Attack Path

1. An attacker compromises the installer origin, its deployment process, or another component capable of influencing the response from https://sh.rustup.rs.
2. The attacker modifies the returned shell script to contain arbitrary commands.
3. A user follows the project installation instructions.
4. curl streams the attacker-controlled response directly to sh.
5. The malicious commands execute without an opportunity for local inspection or integrity verification.
6. The payload can modify user startup files, steal accessible credentials, replace binaries under the user account, or establish additional persistence.

Impact Assessment

Successful exploitation provides arbitrary command execution with the privileges of the installing user. The a ...[truncated 492 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the pipe-to-shell command from the installation instructions.
• Direct users to install Rust through a trusted operating-system package manager where practical.
• If rustup is required, download the installer as a separate file before execution.
• Pin the expected installer release or immutable artifact.
• Publish an expected cryptographic digest or signature and verify it locally before execution.
• Fail installation when verification does not succeed.
• Provide an inspection step before invoking the downloaded file.
• Document the upstream trust boundary and avoid running the installer with elevated privileges.

A safer workflow should follow this model:

bash

curl --proto '=https' --tlsv1.2 -fSLo rustup-init.sh https://sh.rustup.rs
# Verify a publisher-provided signature or pinned digest here.
less rustup-init.sh
sh rustup-init.sh -y --default-toolchain stable

Merely separating download and execution is not sufficient by itself; cryptographic verification against a trusted, pinned value is the essential control.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: systemd/buzz-relay.service:7

Finding

Shared Service Account and Broad Workspace Access Weaken Credential Isolation

Content

View full analysis

Vulnerability Details

File Locations:

• systemd/buzz-relay.service:7-26
• systemd/buzz-marvin.service:7-27
• systemd/buzz-shadowverse.service:7-28

Vulnerability Type: Excessive filesystem access and insufficient isolation between credential-bearing services
Risk Level: Medium

Vulnerable Configuration:

ini

# systemd/buzz-relay.service
[Service]
Type=simple
User=marvin
WorkingDirectory=/home/marvin/.openclaw/workspace/repos/buzz
EnvironmentFile=/home/marvin/.openclaw/workspace/repos/buzz/.env
ExecStart=/home/marvin/.local/bin/buzz-relay
Restart=always
RestartSec=5
StandardOutput=journal
StandardError=journal
SyslogIdentifier=buzz-relay

# Hardening — the relay writes a git pack cache to its working directory
# and may need Docker socket access for media storage. ReadWritePaths
# grants write access to only those paths under ProtectSystem=strict.
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=read-only
PrivateTmp=true
ReadWritePaths=/home/marvin/.openclaw/workspace/repos/buzz

ini

# systemd/buzz-marvin.service
[Service]
Type=simple
User=marvin
WorkingDirectory=/home/marvin/.openclaw/workspace
EnvironmentFile=/home/marvin/.openclaw/secrets/buzz-marvin.env
ExecStart=/home/marvin/.local/bin/buzz-acp \
  --agent-command python3 \
  --agent-args /home/marvin/.openclaw/workspace/bin/buzz-acp.py \
  --subscribe mentions
Restart=always
RestartSec=10
StandardOutput=journal
StandardError=journal
SyslogIdentifier=buzz-marvin

# Hardening — relax (e.g. add ReadWritePaths=) if this breaks the agent's
# access to its WorkingDirectory.
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=read-only
PrivateTmp=true

ini

# systemd/buzz-shadowverse.service
[Service]
Type=simple
User=marvin
WorkingDirectory=/home/marvin/.openclaw/workspace
EnvironmentFile=/home/marvin/.openclaw/secrets/buzz-shadowverse.env
ExecStar
...[truncated 3509 chars]

Remediation

View remediation

Remediation Suggestions

• Create a dedicated Unix account for each security boundary, such as buzz-relay, buzz-marvin, and buzz-shadowverse.
• Assign each environment file to its corresponding service account with mode 0600.
• Store credential files outside source repositories and general-purpose workspaces, for example under /etc/buzz/credentials/.
• Use systemd credential facilities such as LoadCredential= or an external secrets manager where supported.
• Replace ProtectHome=read-only with ProtectHome=true and explicitly expose only required paths.
• Grant ReadOnlyPaths= only for the executable, configuration, and prompt files each service needs.
• Replace whole-workspace ReadWritePaths= entries with dedicated runtime or state directories.
• Consider DynamicUser=true for services that do not require a stable account.
• Add relevant hardening directives where compatible:
  • PrivateDevices=true
  • ProtectKernelTunables=true
  • ProtectKernelModules=true
  • ProtectControlGroups=true
  • RestrictSUIDSGID=true
  • RestrictNamespaces=true
  • LockPersonality=true
  • MemoryDenyWriteExecute=true
  • SystemCallArchitectures=native
• Restrict outbound network access per service with systemd networking controls or host firewall policy.
• Ensure the relay does not receive Docker socket access unless demonstrated to be necessary. Access to the Docker daemon is generally equivalent to root-level control and should not be granted based only on a speculative requirement.

T09 · Insecure Skill Coding Practices

Warning

• Location: buzz-acp.py:316

Finding

Conversation and System-Prompt Content Is Persisted in System Logs

Content

View full analysis

Vulnerability Details

File Locations:

• buzz-acp.py:316
• buzz-acp.py:374
• buzz-acp.py:407
• Related logging destination: systemd/buzz-marvin.service:18-19 and systemd/buzz-shadowverse.service:18-19

Vulnerability Type: Sensitive information exposure through application logging
Risk Level: Medium

Vulnerable Code:

python

if system_prompt:
    log.info("session/new systemPrompt preview: %s", system_prompt[:200])

python

log.info("user message: %s", user_message[:200])

python

log.info("openclaw reply (%d chars): %s", len(reply), reply[:200])

The service units persist stderr through journald:

ini

StandardOutput=journal
StandardError=journal

Technical Analysis

The bridge logs the first 200 characters of the system prompt, every extracted user message, and every generated model reply at the INFO level. Logging is configured to use stderr, while the systemd units route stderr to the system journal.

Message previews can contain private Buzz messages, source code, credentials pasted by users, internal URLs, personal information, or confidential system instructions. System-prompt previews may reveal internal operating rules and deployment context. The fixed 200-character truncation reduces volume but does not provide meaningful secrecy because tokens and passwords commonly fit entirely within that length.

Journald can retain records across restarts, expose them to privileged log readers, include them in support bundles, or forward them into centralized logging infrastructure. Content logging is not necessary for the bridge's normal operation.

Attack Path

1. A user sends a Buzz message containing confidential content or a credential.
2. The ACP harness delivers the message to buzz-acp.py.
3. The bridge writes the first 200 characters to stderr at INFO level.
4. systemd stores the output in journald.
5. A system administrator, ...[truncated 1186 chars]

Remediation

View remediation

Remediation Suggestions

• Remove prompt and response bodies from normal INFO logging.
• Log only non-sensitive metadata, such as session identifiers, channel identifiers, message lengths, status codes, and timing.
• Place any content preview behind an explicit, disabled-by-default diagnostic option.
• Apply structured redaction for bearer tokens, API keys, private keys, passwords, database URLs, cookies, and authorization headers before diagnostic logging.
• Avoid logging system prompts because they can contain internal policy and deployment information.
• Define restrictive journald retention and access policies.
• Confirm whether logs are forwarded externally and document that data boundary.
• Add automated tests asserting that representative credentials and message bodies do not appear in emitted logs.

Safer logging examples include:

python

log.info(
    "session/prompt session=%s message_len=%d",
    session_id,
    len(user_message),
)

python

log.info(
    "openclaw reply completed session=%s reply_len=%d",
    session_id,
    len(reply),
)

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (45)

Tainted flow: 'req' from os.environ.get (line 255, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 97% confidence

Finding

The outbound request target is derived from OPENCLAW_URL, allowing environment-controlled network egress to an arbitrary endpoint. This can exfiltrate all user prompts, system prompts, and conversation history to an attacker-controlled server, and in some environments may also enable SSRF against internal services.

Content

Scanner excerpt · buzz-acp.py (reported line 259)May include surrounding context.

python

chunks = []

    try:
        with urlopen(req, timeout=300) as resp:
            for raw in resp:
                if cancel.is_set():
                    break

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · .gitignore (reported line 2)May include surrounding context.

text

# Secrets — never commit these
*.env
!*.env.example
secrets/
*.key

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 153)May include surrounding context.

bash

cd buzz
cp .env.example .env
# Edit .env — set secure passwords for PGPASSWORD, MinIO, Keycloak admin

docker compose up -d postgres redis minio keycloak

Credential Access

High

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

Sourcing .env with 'set -a' exports all secrets into the current shell environment, making them available to child processes and potentially visible via process inspection, crash dumps, or accidental logging. In context, the README itself acknowledges this risk, so the issue is not malicious but it still increases secret exposure during manual operation.

Content

Scanner excerpt · README.md (reported line 183)May include surrounding context.

bash

cd /path/to/buzz-repo
set -a
source .env
set +a
~/.local/bin/buzz-relay

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

bash

sudo cp systemd/buzz-relay.service /etc/systemd/system/
sudo systemctl daemon-reload && sudo systemctl enable --now buzz-relay

Key .env settings:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

The instructions explicitly direct the user to copy a secret signing key into a .env file and export it before running an administrative command. That creates a credential exposure risk because .env files are often mishandled, accidentally committed, or broadly readable, and exported secrets become accessible to child processes and potentially debugging or monitoring tools.

Content

Scanner excerpt · docs/troubleshooting.md (reported line 29)May include surrounding context.

bash

# Generate a key if you haven't
buzz-admin generate-key
# Copy the secret key to your .env as BUZZ_RELAY_PRIVATE_KEY
# Then export it when running buzz-admin:
export BUZZ_RELAY_PRIVATE_KEY=<your relay signing key>
export DATABASE_URL=postgres://buzz:PASSWORD@localhost:5432/buzz

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The fix instructs users to source the entire .env into the current shell, which loads all secrets into the environment and makes them available to child processes. The document does note this exposure immediately afterward, which reduces severity, but the practice still expands secret exposure and can leak credentials during routine troubleshooting.

Content

Scanner excerpt · docs/troubleshooting.md (reported line 47)May include surrounding context.

Fix: Use systemd (which reads EnvironmentFile= properly), or source it into the current shell explicitly:

bash

set -a
source /path/to/buzz/.env
set +a
buzz-relay

Known Vulnerable Dependency: fast-uri==3.1.4 — 5 advisory(ies): CVE-2026-75931 (fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme); CVE-2026-18446 (fast-uri vulnerable to host confusion via backslash authority introducer); CVE-2026-75975 (fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizat) +2 more

High

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The lockfile pins fast-uri to 3.1.4, and the reported advisories describe URL/host parsing confusion and SSRF-relevant normalization flaws. In this skill’s context, MCP/agent tooling may consume untrusted URLs or endpoints, so a vulnerable URI parser can materially affect request validation and allow bypasses of host allowlists or internal-network protections.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · examples/ccagent/package.json (reported line 5)May include surrounding context.

json

{
  "name": "buzz-claude-agent",
  "version": "0.1.0",
  "private": true,
  "description": "Reference Claude Code agent for Buzz via ACP — calls buzz messages send to post replies",
  "type": "module",
  "main": "dist/index.js",
  "scripts": {
    "build": "tsc -p tsconfig.json",
    "start": "node dist/index.js",
    "dev": "tsx src/index.ts"
  },
  "dependencies": {
    "@anthropic-ai/claude-agent-sdk": "^0.3.218",
    "@anthropic-ai/sdk": "^0.113.0",
    "@modelcontextprotocol/sdk": "^1.29.0",
    "@zed-industries/agent-client-protocol": "^0.4.5",
    "zod": "^4.4.3"
  },
  "devDependencies": {
    "@types/node": "^26.0.0",
    "tsx": "^4.0.0",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 154)May include surrounding context.

md

Type=simple
User=marvin
WorkingDirectory=/home/marvin/.openclaw/workspace/repos/buzz
EnvironmentFile=/home/marvin/.openclaw/workspace/repos/buzz/.env
ExecStart=/home/marvin/.local/bin/buzz-relay
Restart=always
RestartSec=5

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 170)May include surrounding context.

md

Type=simple
User=marvin
WorkingDirectory=/home/marvin/.openclaw/workspace/repos/buzz
EnvironmentFile=/home/marvin/.openclaw/workspace/repos/buzz/.env
ExecStart=/home/marvin/.local/bin/buzz-relay
Restart=always
RestartSec=5

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

md

Type=simple
User=marvin
WorkingDirectory=/home/marvin/.openclaw/workspace/repos/buzz
EnvironmentFile=/home/marvin/.openclaw/workspace/repos/buzz/.env
ExecStart=/home/marvin/.local/bin/buzz-relay
Restart=always
RestartSec=5

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

md

Type=simple
User=marvin
WorkingDirectory=/home/marvin/.openclaw/workspace/repos/buzz
EnvironmentFile=/home/marvin/.openclaw/workspace/repos/buzz/.env
ExecStart=/home/marvin/.local/bin/buzz-relay
Restart=always
RestartSec=5

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/troubleshooting.md (reported line 42)May include surrounding context.

md

Type=simple
User=marvin
WorkingDirectory=/home/marvin/.openclaw/workspace/repos/buzz
EnvironmentFile=/home/marvin/.openclaw/workspace/repos/buzz/.env
ExecStart=/home/marvin/.local/bin/buzz-relay
Restart=always
RestartSec=5

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · systemd/buzz-relay.service (reported line 11)May include surrounding context.

text

Type=simple
User=marvin
WorkingDirectory=/home/marvin/.openclaw/workspace/repos/buzz
EnvironmentFile=/home/marvin/.openclaw/workspace/repos/buzz/.env
ExecStart=/home/marvin/.local/bin/buzz-relay
Restart=always
RestartSec=5

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 144)May include surrounding context.

cargo build --release -p buzz-relay -p buzz-acp -p buzz-admin

~3-15 min depending on hardware

mkdir -p ~/.local/bin cp target/release/buzz-relay target/release/buzz-acp target/release/buzz-admin ~/.local/bin/ cp target/release/buzz ~/.local/bin/buzz-cli # buzz CLI — agents call this to send messages

text

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill explicitly documents capabilities including shell execution, environment-secret access, network connectivity, and persistent systemd services, but it does not declare an enforceable tool scope in the skill metadata. That mismatch is dangerous because a host may grant broader powers than reviewers or users expect, increasing the blast radius if the agent or its prompts are compromised.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

4. Start relay

bash

sudo cp systemd/buzz-relay.service /etc/systemd/system/
sudo systemctl daemon-reload && sudo systemctl enable --now buzz-relay

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

4. Start relay

bash

sudo cp systemd/buzz-relay.service /etc/systemd/system/
sudo systemctl daemon-reload && sudo systemctl enable --now buzz-relay

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.

4. Start relay

bash

sudo cp systemd/buzz-relay.service /etc/systemd/system/
sudo systemctl daemon-reload && sudo systemctl enable --now buzz-relay

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.

4. Start relay

bash

sudo cp systemd/buzz-relay.service /etc/systemd/system/
sudo systemctl daemon-reload && sudo systemctl enable --now buzz-relay

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · docs/troubleshooting.md (reported line 125)May include surrounding context.

4. Start relay

bash

sudo cp systemd/buzz-relay.service /etc/systemd/system/
sudo systemctl daemon-reload && sudo systemctl enable --now buzz-relay

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

bash

sudo cp systemd/buzz-relay.service /etc/systemd/system/
sudo systemctl daemon-reload && sudo systemctl enable --now buzz-relay

Key .env settings:

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

md

# The provided unit files already include:
#   Environment=PATH=/home/<user>/.local/bin:/usr/local/bin:/usr/bin:/bin

sudo cp systemd/buzz-marvin.service /etc/systemd/system/
# For additional agents, copy and edit buzz-agent.service.example for each one
sudo systemctl daemon-reload
sudo systemctl enable --now buzz-marvin

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.

sudo cp systemd/buzz-marvin.service /etc/systemd/system/

For additional agents, copy and edit buzz-agent.service.example for each one

sudo systemctl daemon-reload sudo systemctl enable --now buzz-marvin

text

### 7. Windows/macOS/Linux desktop client

Static analysis

Detected: suspicious.dangerous_exec, suspicious.prompt_injection_instructions

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: examples/ccagent/dist/agent.js:15

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: examples/ccagent/src/agent.ts:33

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: README.md:289