Security audit

Darkhunt Observability

Security checks for vulnerabilities and agentic risk

Overview

This observability plugin is purpose-aligned, but its default telemetry can expose tool inputs, tool results, user identity, and credentials more broadly than its metadata-only description suggests.

Review this before installing in any workspace with private code, logs, memory, or user data. Use only a trusted telemetry endpoint, avoid default assumptions that metadata mode is content-free, restrict who can read OpenClaw config/backups, and consider disabling or patching tool-result export and direct PII export before production use.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: src/payload.ts:66
Finding: Default Metadata Mode Exports Sensitive Tool Inputs and Results
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: src/payload.ts:481
Finding: User Personally Identifiable Information Is Exported Independently of Payload Mode
Content: View full analysis
; if (u.id && !identity.slackUserId) identity.slackUserId = String(u.id); if (u.name && !identity.slackUsername) identity.slackUsername = String(u.name); if (u.real_name && !identity.fullName) identity.fullName = String(u.real_name); if (u.email && !identity.email) identity.email = String(u.email); if (u.profile && typeof u.profile === 'object') { const p = u.profile as Record; if (p.display_name && !identity.displayName) identity.displayName = String(p.display_name); if (p.real_name && !identity.fullName) identity.fullName = String(p.real_name); if (p.email && !identity.email) identity.email = String(p.email); } } ``` ```ts export function resolveUserDisplayId(identity?: UserIdentity): string | undefined { ...[truncated 2513 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: src/cli.ts:50
Finding: CLI Prints and Stores Telemetry Authorization Credentials in Plaintext
Content: View full analysis
{ const pluginConfig = getPluginConfig(ctx.config); if (!pluginConfig || Object.keys(pluginConfig).length === 0) { console.log('No configuration found. Run "openclaw tracehub setup" to configure.'); return; } console.log(JSON.stringify(pluginConfig, null, 2)); }); ``` ```ts const parsed = parseValue(value); setNestedKey(pluginConfig, key, parsed); try { savePluginConfig(pluginConfig); const dim = (s: string) => `\x1b[2m${s}\x1b[0m`; const green = (s: string) => `\x1b[32m${s}\x1b[0m`; console.log(''); console.log(green(` ${key} = ${JSON.stringify(parsed)}`)); printRestartBanner(); } catch (err: any) { console.error(` Could not save: ${err.message}`); } ``` ```ts function savePluginConfig(pluginConfig: Record): void { const configPath = getConfigPath(); const raw = fs.readFileSync(configPath, 'utf-8'); const config = JSON.parse(raw); // Ensure path exists: plugins.entries..config if (!config.plugins) config.plugins = {}; if (!config.plugins.entries) config.plugins.entries = {}; if (!config.plugins.entries[PLUGIN_ID]) config.plugins.entries[PLUGIN_ID] = { enabled: true }; config.plugins.entries[PLUGIN_ID].config = pluginConfig; // Create backup before writing const backupPath = configPath + '.bak'; fs.copyFileSync(configPath, backupPath); fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + '\n', 'utf-8'); } ``` ### Technical Analysis The `config` command serializes and prints the entire plugin configuration. Because authentication is stored under configuration headers, this output ...[truncated 1774 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: test/fixtures/real-spans/all-spans.json:283
Finding: Committed Real-Span Fixtures Retain Personal and Operational Information
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (113)

Known Vulnerable Dependency: protobufjs==7.5.4 — 12 advisory(ies): CVE-2026-44294 (protobuf.js: Denial of service from crafted field names in generated code); CVE-2026-44293 (protobuf.js: Code injection through bytes field defaults in generated toObject c); CVE-2026-44289 (protobuf.js: Denial of service through unbounded protobuf recursion) +9 more

Critical

Category: Supply Chain
Confidence: 90% confidence
Finding: protobufjs is a runtime dependency via OpenTelemetry OTLP protobuf exporters, so its parser/codegen flaws are directly relevant. Multiple advisories including denial of service and code-injection style issues in generated/object-conversion paths make this especially concerning in a telemetry package that serializes/deserializes protobuf data.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: vitest==3.2.4 — 2 advisory(ies): CVE-2026-47429 (When Vitest UI server is listening, arbitrary file can be read and executed); CVE-2026-84373 (Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock)

Critical

Category: Supply Chain
Confidence: 90% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: vitest==3.2.4 — 2 advisory(ies): CVE-2026-47429 (When Vitest UI server is listening, arbitrary file can be read and executed); CVE-2026-84373 (Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock)

Critical

Category: Supply Chain
Confidence: 95% confidence
Finding: The package includes Vitest 3.0.0 with a static analysis match indicating resolution to a vulnerable 3.2.4 release affected by arbitrary file read and possible execution issues in the UI/mocking components. Although Vitest is a devDependency, these flaws can still be dangerous in developer workstations or CI runners if the vulnerable features are exposed, making the skill context moderately less dangerous than a production dependency but still a real supply-chain and environment risk.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: brace-expansion==5.0.5 — 4 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-45149 (brace-expansion: Large numeric range defeats documented `max` DoS protection); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +1 more

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: brace-expansion==2.0.3 — 3 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro); CVE-2026-69152 (brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-1)

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: nanoid==3.3.11 — 3 advisory(ies): CVE-2026-67214 (nanoid: non-secure generators can loop indefinitely with negative size); CVE-2026-67213 (nanoid: custom generators can loop indefinitely when size is zero); CVE-2026-73086 (nanoid: Integer Overflow or Wraparound)

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: picomatch==4.0.3 — 2 advisory(ies): CVE-2026-33672 (Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Mat); CVE-2026-33671 (Picomatch has a ReDoS vulnerability via extglob quantifiers)

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: postcss==8.5.8 — 4 advisory(ies): CVE-2026-45623 (PostCSS: Arbitrary file read and information disclosure via attacker-controlled ); CVE-2026-69153 (PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappi); CVE-2026-41305 (PostCSS has XSS via Unescaped </style> in its CSS Stringify Output) +1 more

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: vite==7.3.1 — 5 advisory(ies): CVE-2026-39365 (Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling); CVE-2026-53571 (vite: `server.fs.deny` bypass on Windows alternate paths); CVE-2026-39363 (Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket) +2 more

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 75% confidence
Finding: Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
Content: Scanner excerpt · src/index.ts (reported line 98)May include surrounding context.
ts
); if (debug && api.logger) { api.logger.info('[tracehub-telemetry] Debug mode enabled (TRACEHUB_DEBUG=1)'); api.logger.info(`[tracehub-telemetry] Exporting to: ${config.traces_endpoint}`); }

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: When debug mode is enabled, the plugin logs transcript update keys and a serialized slice of the transcript payload. Transcript updates can contain prompts, model outputs, user content, secrets, or regulated data, so writing them to logs creates a secondary sensitive-data exposure channel outside the intended telemetry pipeline.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The event discovery logic logs serialized evt and ctx payloads for wildcard and suspect events, which may include secrets, tokens, prompts, tool inputs/outputs, session identifiers, or internal state. Because it attempts to capture unknown events broadly, it is especially likely to collect sensitive data the developer did not anticipate.
Content: No source excerpt is available for this finding.

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · test/fixtures/real-spans/all-spans.json (reported line 240)May include surrounding context.
json
52409", "userId": "sergey", "userEmail": "sergey", "serviceVersion": "0.3.4", "organizationId": "efipttt6p3r8", "workspaceId": "a0000000-0000-0000-0000-000000000001", "applicationId": "33f69603-b74b-4b88-8ba8-4957b5f3f155", "spanId": "0732a1c3c0687061", "parentSpanId": "836c32e40878fd90", "name": "memory_search", "type": "tool", "level": "DEFAULT", "model": { "name": "claude-sonnet-4-6" }, "content": { "inputMessages": [ { "role": "user", "content": "attack techniques LLM guardrails testing" } ], "outputMessages": [ { "role": "tool", "content": "{\n \"results\": [\n {\n \"path\": \"knowledge/public/docs/ui-guide.md\",\n \"startLine\": 31,\n \"endLine\": 48,\n \"score\": 0.459544625878334,\n \"snippet\": \"This section tracks defender targets, attacker taxonomy (Baseline, Agent, etc.), specific attack techniques, LLM

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · test/fixtures/real-spans/trace-4e547885e3b6.json (reported line 16)May include surrounding context.
json
52409", "userId": "sergey", "userEmail": "sergey", "serviceVersion": "0.3.4", "organizationId": "efipttt6p3r8", "workspaceId": "a0000000-0000-0000-0000-000000000001", "applicationId": "33f69603-b74b-4b88-8ba8-4957b5f3f155", "spanId": "0732a1c3c0687061", "parentSpanId": "836c32e40878fd90", "name": "memory_search", "type": "tool", "level": "DEFAULT", "model": { "name": "claude-sonnet-4-6" }, "content": { "inputMessages": [ { "role": "user", "content": "attack techniques LLM guardrails testing" } ], "outputMessages": [ { "role": "tool", "content": "{\n \"results\": [\n {\n \"path\": \"knowledge/public/docs/ui-guide.md\",\n \"startLine\": 31,\n \"endLine\": 48,\n \"score\": 0.459544625878334,\n \"snippet\": \"This section tracks defender targets, attacker taxonomy (Baseline, Agent, etc.), specific attack techniques, LLM

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 90% confidence
Finding: Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
Content: Scanner excerpt · test/fixtures/real-spans/all-spans.json (reported line 253)May include surrounding context.
json
"outputMessages": [ { "role": "tool", "content": "{\n \"results\": [\n {\n \"path\": \"knowledge/public/docs/ui-guide.md\",\n \"startLine\": 31,\n \"endLine\": 48,\n \"score\": 0.459544625878334,\n \"snippet\": \"This section tracks defender targets, attacker taxonomy (Baseline, Agent, etc.), specific attack techniques, LLM models used, and success outcomes. Users can view run details or delete historical records.\\n\\n## Attack Builder & Viewer\\n\\nThe attack builder presents a graph showing attack nodes, branches, and pruned paths. The Launch Attack drawer requires Target Service, Algorithm, and Model selection. Additional controls manage Reasoning, Depth, Width, and Branching parameters.\\n\\n### Attack Details Side Panel\\n\\nDisplays target configuration, algorithm selection, model choice, reasoning settings, attack parameters (depth, width, branching), total attempts versus generations explored, and a chronol\",\n \"source\": \"memory\"\n },\n {\n \"path\": \"knowledge/public/marketing/homepage.md\",\n \"startLine\": 24,\n \"endLine\": 61,\n \"score\": 0.43784851431846616,\n \"snippet\": \"Adversarial testing discovers how AI can be manipulated or exploited. Organizations can execute structured campaigns testing jailbreak and injection vulnerabilities against language models.\\n\\n- Push-button AI pentest with tunable parameters\\n- Attack methods: TAP, Decoding/Encoding, Agentic attacks, and DarkHunt's special attacker powered by a knowledge graph of AI attacks\\n- Findings align to frameworks: OWASP Top 10 for LLMs, MITRE ATLAS\\n- Compliance mapping: EU AI Act readiness, ISO/IEC 42001, NIST AI RMF\\n- Executive risk summaries and developer-level remediation guidance\\n\\n### 2. AI Observability (Upcoming)\\n\\nComplete traceability from outputs to source data with policy enforcement per intera\",\n \"source\": \"memory\"\n },\n {\n \"path\": \"knowl ...[truncated 26 chars]

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 90% confidence
Finding: Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
Content: Scanner excerpt · test/fixtures/real-spans/all-spans.json (reported line 1623)May include surrounding context.
json
"outputMessages": [ { "role": "tool", "content": "{\n \"results\": [\n {\n \"path\": \"knowledge/public/docs/ui-guide.md\",\n \"startLine\": 31,\n \"endLine\": 48,\n \"score\": 0.459544625878334,\n \"snippet\": \"This section tracks defender targets, attacker taxonomy (Baseline, Agent, etc.), specific attack techniques, LLM models used, and success outcomes. Users can view run details or delete historical records.\\n\\n## Attack Builder & Viewer\\n\\nThe attack builder presents a graph showing attack nodes, branches, and pruned paths. The Launch Attack drawer requires Target Service, Algorithm, and Model selection. Additional controls manage Reasoning, Depth, Width, and Branching parameters.\\n\\n### Attack Details Side Panel\\n\\nDisplays target configuration, algorithm selection, model choice, reasoning settings, attack parameters (depth, width, branching), total attempts versus generations explored, and a chronol\",\n \"source\": \"memory\"\n },\n {\n \"path\": \"knowledge/public/marketing/homepage.md\",\n \"startLine\": 24,\n \"endLine\": 61,\n \"score\": 0.43784851431846616,\n \"snippet\": \"Adversarial testing discovers how AI can be manipulated or exploited. Organizations can execute structured campaigns testing jailbreak and injection vulnerabilities against language models.\\n\\n- Push-button AI pentest with tunable parameters\\n- Attack methods: TAP, Decoding/Encoding, Agentic attacks, and DarkHunt's special attacker powered by a knowledge graph of AI attacks\\n- Findings align to frameworks: OWASP Top 10 for LLMs, MITRE ATLAS\\n- Compliance mapping: EU AI Act readiness, ISO/IEC 42001, NIST AI RMF\\n- Executive risk summaries and developer-level remediation guidance\\n\\n### 2. AI Observability (Upcoming)\\n\\nComplete traceability from outputs to source data with policy enforcement per intera\",\n \"source\": \"memory\"\n },\n {\n \"path\": \"knowl ...[truncated 26 chars]

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 90% confidence
Finding: Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
Content: Scanner excerpt · test/fixtures/real-spans/all-spans.json (reported line 2863)May include surrounding context.
json
"outputMessages": [ { "role": "tool", "content": "{\n \"results\": [\n {\n \"path\": \"knowledge/public/docs/ui-guide.md\",\n \"startLine\": 31,\n \"endLine\": 48,\n \"score\": 0.459544625878334,\n \"snippet\": \"This section tracks defender targets, attacker taxonomy (Baseline, Agent, etc.), specific attack techniques, LLM models used, and success outcomes. Users can view run details or delete historical records.\\n\\n## Attack Builder & Viewer\\n\\nThe attack builder presents a graph showing attack nodes, branches, and pruned paths. The Launch Attack drawer requires Target Service, Algorithm, and Model selection. Additional controls manage Reasoning, Depth, Width, and Branching parameters.\\n\\n### Attack Details Side Panel\\n\\nDisplays target configuration, algorithm selection, model choice, reasoning settings, attack parameters (depth, width, branching), total attempts versus generations explored, and a chronol\",\n \"source\": \"memory\"\n },\n {\n \"path\": \"knowledge/public/marketing/homepage.md\",\n \"startLine\": 24,\n \"endLine\": 61,\n \"score\": 0.43784851431846616,\n \"snippet\": \"Adversarial testing discovers how AI can be manipulated or exploited. Organizations can execute structured campaigns testing jailbreak and injection vulnerabilities against language models.\\n\\n- Push-button AI pentest with tunable parameters\\n- Attack methods: TAP, Decoding/Encoding, Agentic attacks, and DarkHunt's special attacker powered by a knowledge graph of AI attacks\\n- Findings align to frameworks: OWASP Top 10 for LLMs, MITRE ATLAS\\n- Compliance mapping: EU AI Act readiness, ISO/IEC 42001, NIST AI RMF\\n- Executive risk summaries and developer-level remediation guidance\\n\\n### 2. AI Observability (Upcoming)\\n\\nComplete traceability from outputs to source data with policy enforcement per intera\",\n \"source\": \"memory\"\n },\n {\n \"path\": \"knowl ...[truncated 26 chars]

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 90% confidence
Finding: Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
Content: Scanner excerpt · test/fixtures/real-spans/trace-4e547885e3b6.json (reported line 29)May include surrounding context.
json
"outputMessages": [ { "role": "tool", "content": "{\n \"results\": [\n {\n \"path\": \"knowledge/public/docs/ui-guide.md\",\n \"startLine\": 31,\n \"endLine\": 48,\n \"score\": 0.459544625878334,\n \"snippet\": \"This section tracks defender targets, attacker taxonomy (Baseline, Agent, etc.), specific attack techniques, LLM models used, and success outcomes. Users can view run details or delete historical records.\\n\\n## Attack Builder & Viewer\\n\\nThe attack builder presents a graph showing attack nodes, branches, and pruned paths. The Launch Attack drawer requires Target Service, Algorithm, and Model selection. Additional controls manage Reasoning, Depth, Width, and Branching parameters.\\n\\n### Attack Details Side Panel\\n\\nDisplays target configuration, algorithm selection, model choice, reasoning settings, attack parameters (depth, width, branching), total attempts versus generations explored, and a chronol\",\n \"source\": \"memory\"\n },\n {\n \"path\": \"knowledge/public/marketing/homepage.md\",\n \"startLine\": 24,\n \"endLine\": 61,\n \"score\": 0.43784851431846616,\n \"snippet\": \"Adversarial testing discovers how AI can be manipulated or exploited. Organizations can execute structured campaigns testing jailbreak and injection vulnerabilities against language models.\\n\\n- Push-button AI pentest with tunable parameters\\n- Attack methods: TAP, Decoding/Encoding, Agentic attacks, and DarkHunt's special attacker powered by a knowledge graph of AI attacks\\n- Findings align to frameworks: OWASP Top 10 for LLMs, MITRE ATLAS\\n- Compliance mapping: EU AI Act readiness, ISO/IEC 42001, NIST AI RMF\\n- Executive risk summaries and developer-level remediation guidance\\n\\n### 2. AI Observability (Upcoming)\\n\\nComplete traceability from outputs to source data with policy enforcement per intera\",\n \"source\": \"memory\"\n },\n {\n \"path\": \"knowl ...[truncated 26 chars]

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 90% confidence
Finding: Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
Content: Scanner excerpt · test/fixtures/real-spans/trace-4e547885e3b6.json (reported line 575)May include surrounding context.
json
"outputMessages": [ { "role": "tool", "content": "{\n \"results\": [\n {\n \"path\": \"knowledge/public/docs/ui-guide.md\",\n \"startLine\": 31,\n \"endLine\": 48,\n \"score\": 0.459544625878334,\n \"snippet\": \"This section tracks defender targets, attacker taxonomy (Baseline, Agent, etc.), specific attack techniques, LLM models used, and success outcomes. Users can view run details or delete historical records.\\n\\n## Attack Builder & Viewer\\n\\nThe attack builder presents a graph showing attack nodes, branches, and pruned paths. The Launch Attack drawer requires Target Service, Algorithm, and Model selection. Additional controls manage Reasoning, Depth, Width, and Branching parameters.\\n\\n### Attack Details Side Panel\\n\\nDisplays target configuration, algorithm selection, model choice, reasoning settings, attack parameters (depth, width, branching), total attempts versus generations explored, and a chronol\",\n \"source\": \"memory\"\n },\n {\n \"path\": \"knowledge/public/marketing/homepage.md\",\n \"startLine\": 24,\n \"endLine\": 61,\n \"score\": 0.43784851431846616,\n \"snippet\": \"Adversarial testing discovers how AI can be manipulated or exploited. Organizations can execute structured campaigns testing jailbreak and injection vulnerabilities against language models.\\n\\n- Push-button AI pentest with tunable parameters\\n- Attack methods: TAP, Decoding/Encoding, Agentic attacks, and DarkHunt's special attacker powered by a knowledge graph of AI attacks\\n- Findings align to frameworks: OWASP Top 10 for LLMs, MITRE ATLAS\\n- Compliance mapping: EU AI Act readiness, ISO/IEC 42001, NIST AI RMF\\n- Executive risk summaries and developer-level remediation guidance\\n\\n### 2. AI Observability (Upcoming)\\n\\nComplete traceability from outputs to source data with policy enforcement per intera\",\n \"source\": \"memory\"\n },\n {\n \"path\": \"knowl ...[truncated 26 chars]

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 90% confidence
Finding: Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
Content: Scanner excerpt · test/fixtures/real-spans/trace-b6e7db0e361c.json (reported line 294)May include surrounding context.
json
"outputMessages": [ { "role": "tool", "content": "{\n \"results\": [\n {\n \"path\": \"knowledge/public/docs/ui-guide.md\",\n \"startLine\": 31,\n \"endLine\": 48,\n \"score\": 0.459544625878334,\n \"snippet\": \"This section tracks defender targets, attacker taxonomy (Baseline, Agent, etc.), specific attack techniques, LLM models used, and success outcomes. Users can view run details or delete historical records.\\n\\n## Attack Builder & Viewer\\n\\nThe attack builder presents a graph showing attack nodes, branches, and pruned paths. The Launch Attack drawer requires Target Service, Algorithm, and Model selection. Additional controls manage Reasoning, Depth, Width, and Branching parameters.\\n\\n### Attack Details Side Panel\\n\\nDisplays target configuration, algorithm selection, model choice, reasoning settings, attack parameters (depth, width, branching), total attempts versus generations explored, and a chronol\",\n \"source\": \"memory\"\n },\n {\n \"path\": \"knowledge/public/marketing/homepage.md\",\n \"startLine\": 24,\n \"endLine\": 61,\n \"score\": 0.43784851431846616,\n \"snippet\": \"Adversarial testing discovers how AI can be manipulated or exploited. Organizations can execute structured campaigns testing jailbreak and injection vulnerabilities against language models.\\n\\n- Push-button AI pentest with tunable parameters\\n- Attack methods: TAP, Decoding/Encoding, Agentic attacks, and DarkHunt's special attacker powered by a knowledge graph of AI attacks\\n- Findings align to frameworks: OWASP Top 10 for LLMs, MITRE ATLAS\\n- Compliance mapping: EU AI Act readiness, ISO/IEC 42001, NIST AI RMF\\n- Executive risk summaries and developer-level remediation guidance\\n\\n### 2. AI Observability (Upcoming)\\n\\nComplete traceability from outputs to source data with policy enforcement per intera\",\n \"source\": \"memory\"\n },\n {\n \"path\": \"knowl ...[truncated 26 chars]

Instruction Override

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
Content: Scanner excerpt · test/fixtures/real-spans/all-spans.json (reported line 253)May include surrounding context.
json
"outputMessages": [ { "role": "tool", "content": "{\n \"results\": [\n {\n \"path\": \"knowledge/public/docs/ui-guide.md\",\n \"startLine\": 31,\n \"endLine\": 48,\n \"score\": 0.459544625878334,\n \"snippet\": \"This section tracks defender targets, attacker taxonomy (Baseline, Agent, etc.), specific attack techniques, LLM models used, and success outcomes. Users can view run details or delete historical records.\\n\\n## Attack Builder & Viewer\\n\\nThe attack builder presents a graph showing attack nodes, branches, and pruned paths. The Launch Attack drawer requires Target Service, Algorithm, and Model selection. Additional controls manage Reasoning, Depth, Width, and Branching parameters.\\n\\n### Attack Details Side Panel\\n\\nDisplays target configuration, algorithm selection, model choice, reasoning settings, attack parameters (depth, width, branching), total attempts versus generations explored, and a chronol\",\n \"source\": \"memory\"\n },\n {\n \"path\": \"knowledge/public/marketing/homepage.md\",\n \"startLine\": 24,\n \"endLine\": 61,\n \"score\": 0.43784851431846616,\n \"snippet\": \"Adversarial testing discovers how AI can be manipulated or exploited. Organizations can execute structured campaigns testing jailbreak and injection vulnerabilities against language models.\\n\\n- Push-button AI pentest with tunable parameters\\n- Attack methods: TAP, Decoding/Encoding, Agentic attacks, and DarkHunt's special attacker powered by a knowledge graph of AI attacks\\n- Findings align to frameworks: OWASP Top 10 for LLMs, MITRE ATLAS\\n- Compliance mapping: EU AI Act readiness, ISO/IEC 42001, NIST AI RMF\\n- Executive risk summaries and developer-level remediation guidance\\n\\n### 2. AI Observability (Upcoming)\\n\\nComplete traceability from outputs to source data with policy enforcement per intera\",\n \"source\": \"memory\"\n },\n {\n \"path\": \"knowl ...[truncated 26 chars]

Instruction Override

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
Content: Scanner excerpt · test/fixtures/real-spans/all-spans.json (reported line 1623)May include surrounding context.
json
"outputMessages": [ { "role": "tool", "content": "{\n \"results\": [\n {\n \"path\": \"knowledge/public/docs/ui-guide.md\",\n \"startLine\": 31,\n \"endLine\": 48,\n \"score\": 0.459544625878334,\n \"snippet\": \"This section tracks defender targets, attacker taxonomy (Baseline, Agent, etc.), specific attack techniques, LLM models used, and success outcomes. Users can view run details or delete historical records.\\n\\n## Attack Builder & Viewer\\n\\nThe attack builder presents a graph showing attack nodes, branches, and pruned paths. The Launch Attack drawer requires Target Service, Algorithm, and Model selection. Additional controls manage Reasoning, Depth, Width, and Branching parameters.\\n\\n### Attack Details Side Panel\\n\\nDisplays target configuration, algorithm selection, model choice, reasoning settings, attack parameters (depth, width, branching), total attempts versus generations explored, and a chronol\",\n \"source\": \"memory\"\n },\n {\n \"path\": \"knowledge/public/marketing/homepage.md\",\n \"startLine\": 24,\n \"endLine\": 61,\n \"score\": 0.43784851431846616,\n \"snippet\": \"Adversarial testing discovers how AI can be manipulated or exploited. Organizations can execute structured campaigns testing jailbreak and injection vulnerabilities against language models.\\n\\n- Push-button AI pentest with tunable parameters\\n- Attack methods: TAP, Decoding/Encoding, Agentic attacks, and DarkHunt's special attacker powered by a knowledge graph of AI attacks\\n- Findings align to frameworks: OWASP Top 10 for LLMs, MITRE ATLAS\\n- Compliance mapping: EU AI Act readiness, ISO/IEC 42001, NIST AI RMF\\n- Executive risk summaries and developer-level remediation guidance\\n\\n### 2. AI Observability (Upcoming)\\n\\nComplete traceability from outputs to source data with policy enforcement per intera\",\n \"source\": \"memory\"\n },\n {\n \"path\": \"knowl ...[truncated 26 chars]

Instruction Override

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
Content: Scanner excerpt · test/fixtures/real-spans/all-spans.json (reported line 2863)May include surrounding context.
json
"outputMessages": [ { "role": "tool", "content": "{\n \"results\": [\n {\n \"path\": \"knowledge/public/docs/ui-guide.md\",\n \"startLine\": 31,\n \"endLine\": 48,\n \"score\": 0.459544625878334,\n \"snippet\": \"This section tracks defender targets, attacker taxonomy (Baseline, Agent, etc.), specific attack techniques, LLM models used, and success outcomes. Users can view run details or delete historical records.\\n\\n## Attack Builder & Viewer\\n\\nThe attack builder presents a graph showing attack nodes, branches, and pruned paths. The Launch Attack drawer requires Target Service, Algorithm, and Model selection. Additional controls manage Reasoning, Depth, Width, and Branching parameters.\\n\\n### Attack Details Side Panel\\n\\nDisplays target configuration, algorithm selection, model choice, reasoning settings, attack parameters (depth, width, branching), total attempts versus generations explored, and a chronol\",\n \"source\": \"memory\"\n },\n {\n \"path\": \"knowledge/public/marketing/homepage.md\",\n \"startLine\": 24,\n \"endLine\": 61,\n \"score\": 0.43784851431846616,\n \"snippet\": \"Adversarial testing discovers how AI can be manipulated or exploited. Organizations can execute structured campaigns testing jailbreak and injection vulnerabilities against language models.\\n\\n- Push-button AI pentest with tunable parameters\\n- Attack methods: TAP, Decoding/Encoding, Agentic attacks, and DarkHunt's special attacker powered by a knowledge graph of AI attacks\\n- Findings align to frameworks: OWASP Top 10 for LLMs, MITRE ATLAS\\n- Compliance mapping: EU AI Act readiness, ISO/IEC 42001, NIST AI RMF\\n- Executive risk summaries and developer-level remediation guidance\\n\\n### 2. AI Observability (Upcoming)\\n\\nComplete traceability from outputs to source data with policy enforcement per intera\",\n \"source\": \"memory\"\n },\n {\n \"path\": \"knowl ...[truncated 26 chars]

Instruction Override

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
Content: Scanner excerpt · test/fixtures/real-spans/trace-4e547885e3b6.json (reported line 29)May include surrounding context.
json
"outputMessages": [ { "role": "tool", "content": "{\n \"results\": [\n {\n \"path\": \"knowledge/public/docs/ui-guide.md\",\n \"startLine\": 31,\n \"endLine\": 48,\n \"score\": 0.459544625878334,\n \"snippet\": \"This section tracks defender targets, attacker taxonomy (Baseline, Agent, etc.), specific attack techniques, LLM models used, and success outcomes. Users can view run details or delete historical records.\\n\\n## Attack Builder & Viewer\\n\\nThe attack builder presents a graph showing attack nodes, branches, and pruned paths. The Launch Attack drawer requires Target Service, Algorithm, and Model selection. Additional controls manage Reasoning, Depth, Width, and Branching parameters.\\n\\n### Attack Details Side Panel\\n\\nDisplays target configuration, algorithm selection, model choice, reasoning settings, attack parameters (depth, width, branching), total attempts versus generations explored, and a chronol\",\n \"source\": \"memory\"\n },\n {\n \"path\": \"knowledge/public/marketing/homepage.md\",\n \"startLine\": 24,\n \"endLine\": 61,\n \"score\": 0.43784851431846616,\n \"snippet\": \"Adversarial testing discovers how AI can be manipulated or exploited. Organizations can execute structured campaigns testing jailbreak and injection vulnerabilities against language models.\\n\\n- Push-button AI pentest with tunable parameters\\n- Attack methods: TAP, Decoding/Encoding, Agentic attacks, and DarkHunt's special attacker powered by a knowledge graph of AI attacks\\n- Findings align to frameworks: OWASP Top 10 for LLMs, MITRE ATLAS\\n- Compliance mapping: EU AI Act readiness, ISO/IEC 42001, NIST AI RMF\\n- Executive risk summaries and developer-level remediation guidance\\n\\n### 2. AI Observability (Upcoming)\\n\\nComplete traceability from outputs to source data with policy enforcement per intera\",\n \"source\": \"memory\"\n },\n {\n \"path\": \"knowl ...[truncated 26 chars]

Instruction Override

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
Content: Scanner excerpt · test/fixtures/real-spans/trace-4e547885e3b6.json (reported line 575)May include surrounding context.
json
"outputMessages": [ { "role": "tool", "content": "{\n \"results\": [\n {\n \"path\": \"knowledge/public/docs/ui-guide.md\",\n \"startLine\": 31,\n \"endLine\": 48,\n \"score\": 0.459544625878334,\n \"snippet\": \"This section tracks defender targets, attacker taxonomy (Baseline, Agent, etc.), specific attack techniques, LLM models used, and success outcomes. Users can view run details or delete historical records.\\n\\n## Attack Builder & Viewer\\n\\nThe attack builder presents a graph showing attack nodes, branches, and pruned paths. The Launch Attack drawer requires Target Service, Algorithm, and Model selection. Additional controls manage Reasoning, Depth, Width, and Branching parameters.\\n\\n### Attack Details Side Panel\\n\\nDisplays target configuration, algorithm selection, model choice, reasoning settings, attack parameters (depth, width, branching), total attempts versus generations explored, and a chronol\",\n \"source\": \"memory\"\n },\n {\n \"path\": \"knowledge/public/marketing/homepage.md\",\n \"startLine\": 24,\n \"endLine\": 61,\n \"score\": 0.43784851431846616,\n \"snippet\": \"Adversarial testing discovers how AI can be manipulated or exploited. Organizations can execute structured campaigns testing jailbreak and injection vulnerabilities against language models.\\n\\n- Push-button AI pentest with tunable parameters\\n- Attack methods: TAP, Decoding/Encoding, Agentic attacks, and DarkHunt's special attacker powered by a knowledge graph of AI attacks\\n- Findings align to frameworks: OWASP Top 10 for LLMs, MITRE ATLAS\\n- Compliance mapping: EU AI Act readiness, ISO/IEC 42001, NIST AI RMF\\n- Executive risk summaries and developer-level remediation guidance\\n\\n### 2. AI Observability (Upcoming)\\n\\nComplete traceability from outputs to source data with policy enforcement per intera\",\n \"source\": \"memory\"\n },\n {\n \"path\": \"knowl ...[truncated 26 chars]

Static analysis

No suspicious patterns detected.