ClawHub
Back to skill

Security audit

SafetyCard

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent static security-audit workflow that reads source code, uses local search, and runs its own validator without evidence of hidden execution, persistence, or data exfiltration.

Install this only if you want a rigorous static security scoring workflow for agent or MCP repositories. Expect it to read the target source tree, run local git/rg searches, run the bundled score.py validator, and create audit output files; do not use it on code you are not authorized to inspect.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (65)

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding

The skill claims to perform a static source review and produce scores, but the instructions delegate much of the substantive assessment to a pre-authored scorecard workflow and include running helper scripts and replaying embedded search commands. That mismatch is dangerous because users may trust the skill as a pure non-executing auditor when it actually depends on additional execution and on operator-supplied artifacts that can bias or smuggle behavior beyond the declared review boundary.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md
Read `references/criteria.md` (the anchors for every level) and score C1–C10 with the method below. Record everything in `scorecard.json` following `references/

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

md
Read `references/criteria.md` (the anchors for every level) and score C1–C10 with the method below. Record everything in `scorecard.json` following `references/

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.

md
Read `references/criteria.md` (the anchors for every level) and score C1–C10 with the method below. Record everything in `scorecard.json` following `references/

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.

md
Read `references/criteria.md` (the anchors for every level) and score C1–C10 with the method below. Record everything in `scorecard.json` following `references/

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 197)May include surrounding context.

md
Read `references/criteria.md` (the anchors for every level) and score C1–C10 with the method below. Record everything in `scorecard.json` following `references/

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · references/criteria.md (reported line 59)May include surrounding context.

md
**D · Default & tamper-resistance**
- L0: Default install runs with admin/owner privilege; least privilege requires manual hardening.
- L1: Narrower default exists but is trivially widened by an env var or a value the workspace controls.
- L2: Reasonable default role; widening is an operator config change without warning.
- L3: Default is read-only or near-minimal; write requires explicit operator elevation.
- L4: L3, and no tool or input can alter the agent's own role/permissions; elevation is time-bounded and automatically reverts.

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · references/criteria.md (reported line 195)May include surrounding context.

md
**D · Default & tamper-resistance**
- L0: Default install runs with admin/owner privilege; least privilege requires manual hardening.
- L1: Narrower default exists but is trivially widened by an env var or a value the workspace controls.
- L2: Reasonable default role; widening is an operator config change without warning.
- L3: Default is read-only or near-minimal; write requires explicit operator elevation.
- L4: L3, and no tool or input can alter the agent's own role/permissions; elevation is time-bounded and automatically reverts.

Cloud Metadata Access

High
Category
Server-Side Request Forgery
Confidence
90% confidence
Finding

Code accesses a cloud instance metadata endpoint (e.g. 169.254.169.254). A single request can return temporary IAM credentials, making this a high-value SSRF target for credential theft.

Content

Scanner excerpt · references/criteria.md (reported line 141)May include surrounding context.

md
- L0: Raw passthrough: arbitrary shell string, arbitrary URL, arbitrary SQL, unbounded quantities.
- L1: Denylist/regex filtering (blocked words, dangerous-command lists).
- L2: Typed schemas and some validation, but escapable (path `startswith` without `realpath`, symlinks, URL checked before redirects, SQL "read-only" by checking it starts with `SELECT`).
- L3: Allowlist validation in code: resolved-path containment, URL/host allowlists that recheck redirects and block internal addresses (localhost, `169.254.169.254`), parameterized queries, numeric bounds.
- L4: L3, and general tools are replaced by narrow ones (`create_issue` instead of `http_request`; `read_file(path)` instead of shell `cat`), with validation robust to races (open-then-check, `O_NOFOLLOW`).

**C · Coverage**

Privileged Container / Container Escape

High
Category
Privilege Escalation
Confidence
80% confidence
Finding

Potential security issue detected. Manual review is recommended.

Content

Scanner excerpt · references/criteria.md (reported line 205)May include surrounding context.

md
Exception for hardened capability runtimes: if the runtime is memory-safe **and** no `unsafe`/native code is reachable from scripts (check the engine's source at the pinned version, e.g. typed-array or buffer implementations), **and** the host recovers from engine panics and caps stack depth and memory, then a realistic failure is misuse of the injected functions or a crash, not arbitrary code in the host. Rate B by what the injected functions reach, counting independent layers that still hold, at most L3 (a crash still costs availability). Removing script-reachable features that use `unsafe` (e.g. deleting `ArrayBuffer` and typed-array globals) counts.

- L0: Host-equivalent: Docker socket mounted, `--privileged`, host network plus root, home directory or `~/.ssh`/`~/.aws` mounted, or credentials in the sandbox environment.
- L1: Broad host filesystem mount or full network egress with credentials available.
- L2: Workspace mounted read-write plus unrestricted network.
- L3: Workspace-only mount, no secrets in the environment, network egress off or allowlisted, CPU/memory/PID limits.

Privileged Container / Container Escape

High
Category
Privilege Escalation
Confidence
80% confidence
Finding

Potential security issue detected. Manual review is recommended.

Content

Scanner excerpt · references/criteria.md (reported line 211)May include surrounding context.

md
- L3: Workspace-only mount, no secrets in the environment, network egress off or allowlisted, CPU/memory/PID limits.
- L4: Ephemeral (destroyed per run or per call), no network or proxy-allowlisted egress, no secrets, resource limits, and nothing persists to the host except reviewed outputs.

**Caps:** C4-HOSTROOT — Docker socket mounted, `--privileged`, or root plus host network in the default sandbox → ≤ 0.25.
**Where to look:** subprocess/exec call sites, Dockerfiles and run arguments (`-v`, `--network`, `--cap-*`, `--privileged`, `user:`), sandbox backends and their defaults, fallback logic when Docker is missing, how tool processes get their env.
**Traps:** an in-process "safe" Python executor documented by its own authors as not a security boundary (check their docs and issues for the caveat, then rate L1); a sandbox for the `python` tool while `bash` runs on host; the container receiving `env=os.environ`; "sandbox" mode that only restricts writes while allowing full network (exfiltration path); a fallback that runs on host when the container fails to start.

Privileged Container / Container Escape

High
Category
Privilege Escalation
Confidence
80% confidence
Finding

Potential security issue detected. Manual review is recommended.

Content

Scanner excerpt · references/criteria.md (reported line 212)May include surrounding context.

md
- L3: Workspace-only mount, no secrets in the environment, network egress off or allowlisted, CPU/memory/PID limits.
- L4: Ephemeral (destroyed per run or per call), no network or proxy-allowlisted egress, no secrets, resource limits, and nothing persists to the host except reviewed outputs.

**Caps:** C4-HOSTROOT — Docker socket mounted, `--privileged`, or root plus host network in the default sandbox → ≤ 0.25.
**Where to look:** subprocess/exec call sites, Dockerfiles and run arguments (`-v`, `--network`, `--cap-*`, `--privileged`, `user:`), sandbox backends and their defaults, fallback logic when Docker is missing, how tool processes get their env.
**Traps:** an in-process "safe" Python executor documented by its own authors as not a security boundary (check their docs and issues for the caveat, then rate L1); a sandbox for the `python` tool while `bash` runs on host; the container receiving `env=os.environ`; "sandbox" mode that only restricts writes while allowing full network (exfiltration path); a fallback that runs on host when the container fails to start.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/example-report.md (reported line 52)May include surrounding context.

md
## Critical gaps
- Model-generated code executes in-process by default; the maintainers state the local executor is not a security boundary. (ASI05; C4). Evidence: [src/smolagents/agents.py:1535](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/agents.py#L1535); [SECURITY.md:80](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/SECURITY.md#L80)
- If a web page the agent reads hijacks it, it can leak data through arbitrary URL fetches and run any registered tool, with no human involved. (ASI01; C5). Evidence: [README.md:61-64](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/README.md#L61-L64); [src/smolagents/default_tools.py:528](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/default_tools.py#L528)
- .env in the working directory is loaded at import time, letting a cloned repo set endpoints or sandbox credentials (impact inferred). (ASI06; C6). Evidence: [src/smolagents/remote_executors.py:46-48](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/remote_executors.py#L46-L48); [src/smolagents/cli.py:230](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/cli.py#L230)
- Hub, Space, and MCP tools run in-process with full authority once trust_remote_code=True, which official examples routinely set. (ASI04; C7). Evidence: [src/smolagents/tools.py:1052-1055](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/tools.py#L1052-L1055); [src/smolagents/tools.py:1005](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/tools.py#L1005)

## Criterion details

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/example-report.md (reported line 59)May include surrounding context.

md
## Critical gaps
- Model-generated code executes in-process by default; the maintainers state the local executor is not a security boundary. (ASI05; C4). Evidence: [src/smolagents/agents.py:1535](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/agents.py#L1535); [SECURITY.md:80](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/SECURITY.md#L80)
- If a web page the agent reads hijacks it, it can leak data through arbitrary URL fetches and run any registered tool, with no human involved. (ASI01; C5). Evidence: [README.md:61-64](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/README.md#L61-L64); [src/smolagents/default_tools.py:528](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/default_tools.py#L528)
- .env in the working directory is loaded at import time, letting a cloned repo set endpoints or sandbox credentials (impact inferred). (ASI06; C6). Evidence: [src/smolagents/remote_executors.py:46-48](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/remote_executors.py#L46-L48); [src/smolagents/cli.py:230](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/cli.py#L230)
- Hub, Space, and MCP tools run in-process with full authority once trust_remote_code=True, which official examples routinely set. (ASI04; C7). Evidence: [src/smolagents/tools.py:1052-1055](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/tools.py#L1052-L1055); [src/smolagents/tools.py:1005](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/tools.py#L1005)

## Criterion details

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/example-report.md (reported line 138)May include surrounding context.

md
## Critical gaps
- Model-generated code executes in-process by default; the maintainers state the local executor is not a security boundary. (ASI05; C4). Evidence: [src/smolagents/agents.py:1535](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/agents.py#L1535); [SECURITY.md:80](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/SECURITY.md#L80)
- If a web page the agent reads hijacks it, it can leak data through arbitrary URL fetches and run any registered tool, with no human involved. (ASI01; C5). Evidence: [README.md:61-64](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/README.md#L61-L64); [src/smolagents/default_tools.py:528](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/default_tools.py#L528)
- .env in the working directory is loaded at import time, letting a cloned repo set endpoints or sandbox credentials (impact inferred). (ASI06; C6). Evidence: [src/smolagents/remote_executors.py:46-48](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/remote_executors.py#L46-L48); [src/smolagents/cli.py:230](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/cli.py#L230)
- Hub, Space, and MCP tools run in-process with full authority once trust_remote_code=True, which official examples routinely set. (ASI04; C7). Evidence: [src/smolagents/tools.py:1052-1055](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/tools.py#L1052-L1055); [src/smolagents/tools.py:1005](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/tools.py#L1005)

## Criterion details

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/example-report.md (reported line 140)May include surrounding context.

md
## Critical gaps
- Model-generated code executes in-process by default; the maintainers state the local executor is not a security boundary. (ASI05; C4). Evidence: [src/smolagents/agents.py:1535](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/agents.py#L1535); [SECURITY.md:80](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/SECURITY.md#L80)
- If a web page the agent reads hijacks it, it can leak data through arbitrary URL fetches and run any registered tool, with no human involved. (ASI01; C5). Evidence: [README.md:61-64](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/README.md#L61-L64); [src/smolagents/default_tools.py:528](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/default_tools.py#L528)
- .env in the working directory is loaded at import time, letting a cloned repo set endpoints or sandbox credentials (impact inferred). (ASI06; C6). Evidence: [src/smolagents/remote_executors.py:46-48](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/remote_executors.py#L46-L48); [src/smolagents/cli.py:230](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/cli.py#L230)
- Hub, Space, and MCP tools run in-process with full authority once trust_remote_code=True, which official examples routinely set. (ASI04; C7). Evidence: [src/smolagents/tools.py:1052-1055](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/tools.py#L1052-L1055); [src/smolagents/tools.py:1005](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/tools.py#L1005)

## Criterion details

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/example-report.md (reported line 141)May include surrounding context.

md
## Critical gaps
- Model-generated code executes in-process by default; the maintainers state the local executor is not a security boundary. (ASI05; C4). Evidence: [src/smolagents/agents.py:1535](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/agents.py#L1535); [SECURITY.md:80](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/SECURITY.md#L80)
- If a web page the agent reads hijacks it, it can leak data through arbitrary URL fetches and run any registered tool, with no human involved. (ASI01; C5). Evidence: [README.md:61-64](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/README.md#L61-L64); [src/smolagents/default_tools.py:528](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/default_tools.py#L528)
- .env in the working directory is loaded at import time, letting a cloned repo set endpoints or sandbox credentials (impact inferred). (ASI06; C6). Evidence: [src/smolagents/remote_executors.py:46-48](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/remote_executors.py#L46-L48); [src/smolagents/cli.py:230](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/cli.py#L230)
- Hub, Space, and MCP tools run in-process with full authority once trust_remote_code=True, which official examples routinely set. (ASI04; C7). Evidence: [src/smolagents/tools.py:1052-1055](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/tools.py#L1052-L1055); [src/smolagents/tools.py:1005](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/tools.py#L1005)

## Criterion details

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/example-report.md (reported line 143)May include surrounding context.

md
## Critical gaps
- Model-generated code executes in-process by default; the maintainers state the local executor is not a security boundary. (ASI05; C4). Evidence: [src/smolagents/agents.py:1535](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/agents.py#L1535); [SECURITY.md:80](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/SECURITY.md#L80)
- If a web page the agent reads hijacks it, it can leak data through arbitrary URL fetches and run any registered tool, with no human involved. (ASI01; C5). Evidence: [README.md:61-64](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/README.md#L61-L64); [src/smolagents/default_tools.py:528](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/default_tools.py#L528)
- .env in the working directory is loaded at import time, letting a cloned repo set endpoints or sandbox credentials (impact inferred). (ASI06; C6). Evidence: [src/smolagents/remote_executors.py:46-48](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/remote_executors.py#L46-L48); [src/smolagents/cli.py:230](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/cli.py#L230)
- Hub, Space, and MCP tools run in-process with full authority once trust_remote_code=True, which official examples routinely set. (ASI04; C7). Evidence: [src/smolagents/tools.py:1052-1055](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/tools.py#L1052-L1055); [src/smolagents/tools.py:1005](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/tools.py#L1005)

## Criterion details

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/example-report.md (reported line 146)May include surrounding context.

md
## Critical gaps
- Model-generated code executes in-process by default; the maintainers state the local executor is not a security boundary. (ASI05; C4). Evidence: [src/smolagents/agents.py:1535](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/agents.py#L1535); [SECURITY.md:80](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/SECURITY.md#L80)
- If a web page the agent reads hijacks it, it can leak data through arbitrary URL fetches and run any registered tool, with no human involved. (ASI01; C5). Evidence: [README.md:61-64](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/README.md#L61-L64); [src/smolagents/default_tools.py:528](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/default_tools.py#L528)
- .env in the working directory is loaded at import time, letting a cloned repo set endpoints or sandbox credentials (impact inferred). (ASI06; C6). Evidence: [src/smolagents/remote_executors.py:46-48](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/remote_executors.py#L46-L48); [src/smolagents/cli.py:230](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/cli.py#L230)
- Hub, Space, and MCP tools run in-process with full authority once trust_remote_code=True, which official examples routinely set. (ASI04; C7). Evidence: [src/smolagents/tools.py:1052-1055](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/tools.py#L1052-L1055); [src/smolagents/tools.py:1005](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/tools.py#L1005)

## Criterion details

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/example-report.md (reported line 147)May include surrounding context.

md
## Critical gaps
- Model-generated code executes in-process by default; the maintainers state the local executor is not a security boundary. (ASI05; C4). Evidence: [src/smolagents/agents.py:1535](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/agents.py#L1535); [SECURITY.md:80](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/SECURITY.md#L80)
- If a web page the agent reads hijacks it, it can leak data through arbitrary URL fetches and run any registered tool, with no human involved. (ASI01; C5). Evidence: [README.md:61-64](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/README.md#L61-L64); [src/smolagents/default_tools.py:528](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/default_tools.py#L528)
- .env in the working directory is loaded at import time, letting a cloned repo set endpoints or sandbox credentials (impact inferred). (ASI06; C6). Evidence: [src/smolagents/remote_executors.py:46-48](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/remote_executors.py#L46-L48); [src/smolagents/cli.py:230](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/cli.py#L230)
- Hub, Space, and MCP tools run in-process with full authority once trust_remote_code=True, which official examples routinely set. (ASI04; C7). Evidence: [src/smolagents/tools.py:1052-1055](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/tools.py#L1052-L1055); [src/smolagents/tools.py:1005](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/tools.py#L1005)

## Criterion details

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/example-report.md (reported line 216)May include surrounding context.

md
## Critical gaps
- Model-generated code executes in-process by default; the maintainers state the local executor is not a security boundary. (ASI05; C4). Evidence: [src/smolagents/agents.py:1535](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/agents.py#L1535); [SECURITY.md:80](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/SECURITY.md#L80)
- If a web page the agent reads hijacks it, it can leak data through arbitrary URL fetches and run any registered tool, with no human involved. (ASI01; C5). Evidence: [README.md:61-64](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/README.md#L61-L64); [src/smolagents/default_tools.py:528](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/default_tools.py#L528)
- .env in the working directory is loaded at import time, letting a cloned repo set endpoints or sandbox credentials (impact inferred). (ASI06; C6). Evidence: [src/smolagents/remote_executors.py:46-48](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/remote_executors.py#L46-L48); [src/smolagents/cli.py:230](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/cli.py#L230)
- Hub, Space, and MCP tools run in-process with full authority once trust_remote_code=True, which official examples routinely set. (ASI04; C7). Evidence: [src/smolagents/tools.py:1052-1055](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/tools.py#L1052-L1055); [src/smolagents/tools.py:1005](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/tools.py#L1005)

## Criterion details

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/example-scorecard.json (reported line 140)May include surrounding context.

json
## Critical gaps
- Model-generated code executes in-process by default; the maintainers state the local executor is not a security boundary. (ASI05; C4). Evidence: [src/smolagents/agents.py:1535](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/agents.py#L1535); [SECURITY.md:80](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/SECURITY.md#L80)
- If a web page the agent reads hijacks it, it can leak data through arbitrary URL fetches and run any registered tool, with no human involved. (ASI01; C5). Evidence: [README.md:61-64](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/README.md#L61-L64); [src/smolagents/default_tools.py:528](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/default_tools.py#L528)
- .env in the working directory is loaded at import time, letting a cloned repo set endpoints or sandbox credentials (impact inferred). (ASI06; C6). Evidence: [src/smolagents/remote_executors.py:46-48](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/remote_executors.py#L46-L48); [src/smolagents/cli.py:230](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/cli.py#L230)
- Hub, Space, and MCP tools run in-process with full authority once trust_remote_code=True, which official examples routinely set. (ASI04; C7). Evidence: [src/smolagents/tools.py:1052-1055](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/tools.py#L1052-L1055); [src/smolagents/tools.py:1005](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/tools.py#L1005)

## Criterion details

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/example-scorecard.json (reported line 555)May include surrounding context.

json
## Critical gaps
- Model-generated code executes in-process by default; the maintainers state the local executor is not a security boundary. (ASI05; C4). Evidence: [src/smolagents/agents.py:1535](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/agents.py#L1535); [SECURITY.md:80](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/SECURITY.md#L80)
- If a web page the agent reads hijacks it, it can leak data through arbitrary URL fetches and run any registered tool, with no human involved. (ASI01; C5). Evidence: [README.md:61-64](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/README.md#L61-L64); [src/smolagents/default_tools.py:528](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/default_tools.py#L528)
- .env in the working directory is loaded at import time, letting a cloned repo set endpoints or sandbox credentials (impact inferred). (ASI06; C6). Evidence: [src/smolagents/remote_executors.py:46-48](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/remote_executors.py#L46-L48); [src/smolagents/cli.py:230](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/cli.py#L230)
- Hub, Space, and MCP tools run in-process with full authority once trust_remote_code=True, which official examples routinely set. (ASI04; C7). Evidence: [src/smolagents/tools.py:1052-1055](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/tools.py#L1052-L1055); [src/smolagents/tools.py:1005](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/tools.py#L1005)

## Criterion details

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/example-scorecard.json (reported line 560)May include surrounding context.

json
## Critical gaps
- Model-generated code executes in-process by default; the maintainers state the local executor is not a security boundary. (ASI05; C4). Evidence: [src/smolagents/agents.py:1535](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/agents.py#L1535); [SECURITY.md:80](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/SECURITY.md#L80)
- If a web page the agent reads hijacks it, it can leak data through arbitrary URL fetches and run any registered tool, with no human involved. (ASI01; C5). Evidence: [README.md:61-64](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/README.md#L61-L64); [src/smolagents/default_tools.py:528](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/default_tools.py#L528)
- .env in the working directory is loaded at import time, letting a cloned repo set endpoints or sandbox credentials (impact inferred). (ASI06; C6). Evidence: [src/smolagents/remote_executors.py:46-48](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/remote_executors.py#L46-L48); [src/smolagents/cli.py:230](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/cli.py#L230)
- Hub, Space, and MCP tools run in-process with full authority once trust_remote_code=True, which official examples routinely set. (ASI04; C7). Evidence: [src/smolagents/tools.py:1052-1055](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/tools.py#L1052-L1055); [src/smolagents/tools.py:1005](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/tools.py#L1005)

## Criterion details

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/example-scorecard.json (reported line 578)May include surrounding context.

json
## Critical gaps
- Model-generated code executes in-process by default; the maintainers state the local executor is not a security boundary. (ASI05; C4). Evidence: [src/smolagents/agents.py:1535](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/agents.py#L1535); [SECURITY.md:80](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/SECURITY.md#L80)
- If a web page the agent reads hijacks it, it can leak data through arbitrary URL fetches and run any registered tool, with no human involved. (ASI01; C5). Evidence: [README.md:61-64](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/README.md#L61-L64); [src/smolagents/default_tools.py:528](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/default_tools.py#L528)
- .env in the working directory is loaded at import time, letting a cloned repo set endpoints or sandbox credentials (impact inferred). (ASI06; C6). Evidence: [src/smolagents/remote_executors.py:46-48](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/remote_executors.py#L46-L48); [src/smolagents/cli.py:230](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/cli.py#L230)
- Hub, Space, and MCP tools run in-process with full authority once trust_remote_code=True, which official examples routinely set. (ASI04; C7). Evidence: [src/smolagents/tools.py:1052-1055](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/tools.py#L1052-L1055); [src/smolagents/tools.py:1005](https://github.com/huggingface/smolagents/blob/c30b115286e000e98711fae5e85993547b73d826/src/smolagents/tools.py#L1005)

## Criterion details

Static analysis

No suspicious patterns detected.