Security audit
Security checks for vulnerabilities and agentic risk
A workflow-reading flaw can expose private files outside the selected project to your assistant.
Use trusted projects or the core tool profile until workflow reads reject links and enforce project containment. Prefer reviewed local files or a pinned installation, preview installation destinations, and enable checks or adapters only for trusted code. Configuration diagnostics can inventory other local applications. Treat empty secret-scan results cautiously because Git-history failures are not reported.
scripts/dev_engine.py:1036Workflow reads follow repository-controlled symlinks outside the selected project
Sensitive text outside the project, such as a private key or credential file at a known reachable path, can be copied into the agent's MCP context. This establishes unintended disclosure into the tool response, not automatic network exfiltration to the repository author.
The command npx -y permits fetching and installing an unavailable package without confirmation before executing it. This directly conflicts with the declared operating constraints, rather than merely being an unspecified implementation detail. The supplied chunk does not expose the package's implementation, so the claimed development tools and their safety properties cannot be verified.
The supplied code is an npm package launcher, not the described Python implementation. Although launching the named MCP server is consistent with the overall purpose, its automatic package-fetching behavior materially contradicts the stated installation and network restrictions. The package implementation is not supplied, so the advertised tools and their safety properties cannot be verified from this chunk.
The supplied module's primary function is a broad local MCP-client and skill-installation audit, rather than any of the described repository-development tools. Its built-in registries probe many applications' user-level configuration files and skill directories, and mcp_doctor returns their paths, server names, skill metadata, and coverage reports. This is a distinct undeclared capability and resource scope, not merely an implementation detail of the listed repository tools. Its offline, read-only behavior is consistent with the description, and there is no evidence here of exfiltration or execution of discovered server commands. The mismatch concerns the omitted inventory capability, not the absence of other declared tools from this single code chunk.
The supplied chunk implements an installer, not the declared MCP development tools. Its normal invocation installs into detected project skill directories without requiring a write-enabling flag; --dry-run is opt-in. installTo creates directories and copies package files, while cleanResidue removes allowlisted artifacts from existing installations. These installation and cleanup capabilities are not disclosed in the description and materially exceed its default-read-only scope. Although installation can support a larger package, these side effects are substantive rather than incidental implementation details. The code includes symlink safeguards and does not itself access the network or launch external tools. This finding is limited to the supplied installer and does not establish whether other package files implement the declared MCP tools.
Although package launchers can be supporting implementation details, this command materially contradicts the explicit installation and network restrictions. Pinning the version does not prevent downloading or automatic installation. The supplied chunk does not include the package implementation, so it cannot establish whether the advertised MCP tools or their other safety properties are implemented.
mcp_doctor appears in both TOOL_HANDLERS and the default full tool listing, but is absent from the declared purpose's tool enumeration. Its advertised scope includes Codex, Cursor, WorkBuddy, OpenCode, Claude Code, and other host configurations, extending beyond the declared repository-development resources. This is an additional callable capability, not merely an implementation detail. The supplied file delegates tool execution to dev_engine, whose implementation is unavailable, so actual filesystem access, redaction, offline behavior, and execution/write safeguards cannot be independently verified from this chunk.
The description omits mcp_doctor, but the code imports its implementation, exposes it as a dispatchable tool, and provides a dedicated mcp-doctor command with --skills-dir, --config, and --include-defaults options. This is a separate diagnostic capability involving host configuration resources, not merely an implementation detail of a declared tool. Its delegated implementation is not supplied, so its exact access behavior cannot be verified. The remaining visible behavior substantially matches the description; no direct network access or automatic installation is shown.
Although repository cloning and installation can be legitimate setup steps, the supplied chunk explicitly performs network retrieval and invokes an installer, conflicting with the description’s no-network and no-automatic-installation assurances. The clone also writes repository files locally. No further claims about the installer’s effects can be established without its contents.
The mismatch is the explicit bootstrap mechanism: these commands can fetch and execute an npm package rather than operate solely through an offline Python-standard-library implementation. The snippet contains only README commands, not the package implementation, so it does not establish whether the advertised MCP tools exist or whether the CLI modifies agent configuration or the specified directory.
The commands appear intended to launch or configure the declared tool, rather than serve an unrelated purpose. However, npx -y permits network-backed package installation without confirmation when the requested package is not cached or locally available. This conflicts with the explicit no-network and no-automatic-installation claims if those claims cover the supplied commands. The excerpt is only a README launcher snippet; it does not establish whether the server itself implements the advertised tools or remains offline after startup.
Referenced artifact was not completely inspected
详细契约见 `references/tools.md`；架构契约、评审语义与影响锥字段见 `references/architecture-contract.md`。
Referenced artifact was not completely inspected
- v0.2.3（2026-10-01）：安装器卫生批次——`bin/install.js` / `install.sh` 统一，未知参数 exit 2、`--help` / `--version`、残留清理白名单与嵌套载荷保留。
Referenced artifact was not completely inspected
- v0.2.3（2026-10-01）：安装器卫生批次——`bin/install.js` / `install.sh` 统一，未知参数 exit 2、`--help` / `--version`、残留清理白名单与嵌套载荷保留。
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
def _child_env():
env = os.environ.copy()
env["PYTHONIOENCODING"] = "utf-8"
env["NO_COLOR"] = "1"
env["FORCE_COLOR"] = "0"
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
"applied": bool(apply),
"preview": preview,
}
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
"codex", "Codex",
[
"{codex_home}/config.toml",
"{home}/.codex/config.toml",
"{codex_home}/config.json",
"{codex_home}/mcp.json",
"{home}/.codex/config.json",
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
"{home}/.codex/config.toml",
"{codex_home}/config.json",
"{codex_home}/mcp.json",
"{home}/.codex/config.json",
"{home}/.codex/mcp.json",
],
formats=("toml", "json"),
Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.
"{codex_home}/config.json",
"{codex_home}/mcp.json",
"{home}/.codex/config.json",
"{home}/.codex/mcp.json",
],
formats=("toml", "json"),
server_keys=("mcp_servers",) + DEFAULT_JSON_KEYS,
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
"claude-code", "Claude Code",
[
"{claude_config_dir}/settings.json",
"{home}/.claude/settings.json",
"{home}/.claude.json",
"{cwd}/.mcp.json",
],
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
),
_host(
"continue", "Continue",
["{home}/.continue/config.json", "{home}/.continue/config.yaml"],
formats=("json", "yaml"),
),
_host(
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
),
_host(
"continue", "Continue",
["{home}/.continue/config.json", "{home}/.continue/config.yaml"],
formats=("json", "yaml"),
),
_host(
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
),
_host(
"gemini", "Gemini CLI",
["{home}/.gemini/settings.json", "{home}/.gemini/mcp.json"],
),
_host(
"qwen", "Qwen Code",
Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.
),
_host(
"gemini", "Gemini CLI",
["{home}/.gemini/settings.json", "{home}/.gemini/mcp.json"],
),
_host(
"qwen", "Qwen Code",
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
record("missing-contract", "no architecture contract", "UNKNOWN",
observed, observed == "UNKNOWN", detail)
write("secret.env", "TOKEN=abcdefghijklmnopqrstuvwxyz123456\n")
try:
from dev_engine import scan_secrets
observed = len(scan_secrets(str(root))["findings"])
Without declared permissions the skill's intent is opaque and cannot be validated.