critical Security checks cicd CI/CD security conf 0.96 3 occurrences Compose service contains a literal secret environment value

Literal secrets in Compose files are committed to source and exposed through container inspection.

lines 61, 97, 111

docker-compose.yml:61, 97, 111 (3 hits)

CI/CD securitycontainers

high Security checks quality Quality conf 1.00 ✓ Repobility Missing import: `http` used but not imported

The file uses `http.something(...)` but never imports `http`. This raises NameError at runtime the first time the line executes.

octomate/tentacles/channel/slack/ink.py:88

high Security checks quality Quality conf 1.00 ✓ Repobility Missing import: `signal` used but not imported

The file uses `signal.something(...)` but never imports `signal`. This raises NameError at runtime the first time the line executes.

octomate/base.py:79

high Security checks security auth conf 0.70 [AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: GET /{chat_id}.

A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: GET /{chat_id}.

octomate/tentacles/channel/web/vercel/routes.py:94

high Security checks quality Quality conf 1.00 ✓ Repobility 25 occurrences `self.position` used but never assigned in __init__

Method `__lt__` of class `DeferredQuestion` reads `self.position`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.

5 files, 25 locations

octomate/tentacles/channel/base.py:189, 212, 217, 225, 236, 240, 242, 251, +2 more (10 hits)

octomate/tentacles/agent/claude/base.py:132, 139, 141, 158, 162, 185, 186, 340, +1 more (9 hits)

octomate/schemas/messages.py:106, 112, 138 (3 hits)

octomate/schemas/deferred.py:140, 143 (2 hits)

tests/support/channels.py:296

high Security checks software dependencies conf 0.88 cryptography: GHSA-537c-gmf6-5ccf

Vulnerable OpenSSL included in cryptography wheels

uv.lock

high Security checks cicd CI/CD security conf 0.90 Database service has no persistent data volume

Database containers store data in the writable container layer unless a volume or bind mount is attached to the image's data directory. Recreating the container can lose state.

docker-compose.yml:97 CI/CD securitycontainers

low Security checks cicd CI/CD security conf 0.84 Database service publishes a host port

Publishing database ports to the host increases exposure. Internal Compose networking usually only needs expose, not ports.

docker-compose.yml:97 CI/CD securitycontainers

high Security checks software dependencies conf 0.90 ✓ Repobility Dockerfile FROM `ghcr.io/astral-sh/uv:python3.13-bookworm-slim` not pinned by digest

`FROM ghcr.io/astral-sh/uv:python3.13-bookworm-slim` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potentially different. Production images should pin to `image@sha256:...` for reproducibility + supply-chain integrity.

Dockerfile:1

high Security checks quality Quality conf 0.80 ✓ Repobility FastAPI POST /api/chat has no auth

Handler `chat` is registered with router/app.post(...) but no Depends/Security parameter is declared and no auth marker appears in the function body.

octomate/tentacles/channel/web/vercel/routes.py:53

high Security checks software dependencies conf 0.88 idna: PYSEC-2026-215

Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as `"\u0660" * N` or `"\u30fb" * N + "\u6f22"` utilize the `valid_contexto`…

uv.lock

high Security checks software dependencies conf 0.88 langsmith: GHSA-f4xh-w4cj-qxq8

LangSmith SDK TracingMiddleware: Arbitrary server-side file read

uv.lock

high Security checks software dependencies conf 0.88 pyjwt: PYSEC-2026-175

PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument directly to urllib.request.urlopen() which uses Python stdlib's default OpenerDirector registering HTTPHandler, HTTPSHandler, FTPHandler, FileHandler, and DataHandler. There is currently no docu…

uv.lock

high Security checks software dependencies conf 0.88 pyjwt: PYSEC-2026-177

PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient.get_signing_key() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Since kid comes from the unverified token header, an attacker can trigger unlimited out…

uv.lock

high Security checks software dependencies conf 0.88 pyjwt: PYSEC-2026-178

PyJWT is a JSON Web Token implementation in Python. From 2.8.0 to 2.12.1, when verifying detached JWS tokens using the unencoded-payload option ("b64": false, RFC 7797), PyJWT performs Base64URL decoding of the compact-serialization payload segment before enforcing the detached-payload rules. For b…

uv.lock

high Security checks software dependencies conf 0.88 pyjwt: PYSEC-2026-179

PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the secre…

uv.lock

high Security checks software dependencies conf 0.88 python-multipart: GHSA-5rvq-cxj2-64vf

python-multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service

uv.lock

high System graph quality Integrity conf 1.00 Blocking `httpx.get(...)` inside `async def download` — octomate/tentacles/channel/napcat/ink.py:72

Sync I/O inside an async function blocks the event loop. While `httpx.get(...)` is running, *all* other coroutines on this loop are paused — silent throughput collapse under concurrency. Use the async equivalent (`httpx.AsyncClient`, `asyncio.sleep`, `aiofiles`) or wrap with `await asyncio.to_threa…

octomate/tentacles/channel/napcat/ink.py:72 Sync io in asyncPerformance

high System graph quality Integrity conf 1.00 Blocking `httpx.post(...)` inside `async def get_image_url` — octomate/tentacles/channel/napcat/ink.py:67

Sync I/O inside an async function blocks the event loop. While `httpx.post(...)` is running, *all* other coroutines on this loop are paused — silent throughput collapse under concurrency. Use the async equivalent (`httpx.AsyncClient`, `asyncio.sleep`, `aiofiles`) or wrap with `await asyncio.to_thre…

octomate/tentacles/channel/napcat/ink.py:67 Sync io in asyncPerformance

high System graph quality Integrity conf 1.00 Blocking `httpx.post(...)` inside `async def get_user_profile` — octomate/tentacles/channel/napcat/ink.py:49

Sync I/O inside an async function blocks the event loop. While `httpx.post(...)` is running, *all* other coroutines on this loop are paused — silent throughput collapse under concurrency. Use the async equivalent (`httpx.AsyncClient`, `asyncio.sleep`, `aiofiles`) or wrap with `await asyncio.to_thre…

octomate/tentacles/channel/napcat/ink.py:49 Sync io in asyncPerformance

high System graph quality Integrity conf 1.00 Blocking `httpx.post(...)` inside `async def inspect` — octomate/tentacles/channel/napcat/ink.py:34

Sync I/O inside an async function blocks the event loop. While `httpx.post(...)` is running, *all* other coroutines on this loop are paused — silent throughput collapse under concurrency. Use the async equivalent (`httpx.AsyncClient`, `asyncio.sleep`, `aiofiles`) or wrap with `await asyncio.to_thre…

octomate/tentacles/channel/napcat/ink.py:34 Sync io in asyncPerformance

high System graph quality Integrity conf 1.00 Blocking `httpx.post(...)` inside `async def inspect` — octomate/tentacles/channel/napcat/ink.py:38

Sync I/O inside an async function blocks the event loop. While `httpx.post(...)` is running, *all* other coroutines on this loop are paused — silent throughput collapse under concurrency. Use the async equivalent (`httpx.AsyncClient`, `asyncio.sleep`, `aiofiles`) or wrap with `await asyncio.to_thre…

octomate/tentacles/channel/napcat/ink.py:38 Sync io in asyncPerformance

high System graph security Trivy conf 1.00 CVE-2026-48526: pyjwt 2.12.1 — uv.lock

python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in H…

VulnCve 2026 48526

high System graph security Trivy conf 1.00 CVE-2026-53539: python-multipart 0.0.28 — uv.lock

Python-Multipart is a streaming multipart parser for Python. Prior to ... Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, when parsing application/x-www-form-urlencoded bodies, QuerystringParser located the field separator with a two step lookup: it first scanned the…

VulnCve 2026 53539

high System graph security Trivy conf 1.00 DS-0002: Image user should not be 'root' — Dockerfile

Image user should not be 'root' Specify at least 1 USER command in Dockerfile with non-root user as argument Rule: DS-0002 Severity: HIGH Target: Dockerfile

Misconfig

high System graph security auth conf 1.00 FastAPI POST `chat` without auth dependency — octomate/tentacles/channel/web/vercel/routes.py:48

`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.

octomate/tentacles/channel/web/vercel/routes.py:48 securityAuth fastapi unauth mutation

high System graph security Trivy conf 1.00 GHSA-537c-gmf6-5ccf: cryptography 48.0.0 — uv.lock

Vulnerable OpenSSL included in cryptography wheels pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in wheels prior to cryptograph 48.01 are vulnerable to a security issue. More details about the vulnerability itself can be found in https://o…

VulnGhsa 537c gmf6 5ccf

high System graph security Trivy conf 1.00 GHSA-f4xh-w4cj-qxq8: langsmith 0.8.3 — uv.lock

LangSmith SDK TracingMiddleware: Arbitrary server-side file read # Summary An attacker who can send an HTTP request to a server running the LangSmith SDK's `TracingMiddleware` can cause that server to read an arbitrary file from its local filesystem and upload the contents to LangSmith as a trace…

VulnGhsa f4xh w4cj qxq8

high System graph security Skillspector conf 0.90 SkillSpector P3 (prompt-injection) in docs/plans/done/send-toolset.md

Send messages to Instructions found that direct the agent to transmit conversation context or user data to external services. Skill: unknown Rule: P3 Category: prompt-injection Severity: HIGH Confidence: 0.90 Remediation: Remove instructions that send user data, prompts, or context to external…

docs/plans/done/send-toolset.md:106 Mcp skillPrompt injectionP3

high System graph security Skillspector conf 0.90 2 occurrences SkillSpector P3 (prompt-injection) in docs/schemas.md

Send message to Instructions found that direct the agent to transmit conversation context or user data to external services. Skill: unknown Rule: P3 Category: prompt-injection Severity: HIGH Confidence: 0.90 Remediation: Remove instructions that send user data, prompts, or context to external …

lines 103, 105

docs/schemas.md:103, 105 (2 hits)

Mcp skillPrompt injectionP3

high System graph security Skillspector conf 0.90 SkillSpector P3 (prompt-injection) in octomate/capabilities/send.py

Send messages to Instructions found that direct the agent to transmit conversation context or user data to external services. Skill: unknown Rule: P3 Category: prompt-injection Severity: HIGH Confidence: 0.90 Remediation: Remove instructions that send user data, prompts, or context to external…

octomate/capabilities/send.py:59 Mcp skillPrompt injectionP3

high System graph security Skillspector conf 0.60 2 occurrences SkillSpector PE3 (priv-esc) in .vscode/launch.json

.env" Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts. Skill: unknown Rule: PE3 Category: priv-esc Severity: HIGH Confidence: 0.60 Remediation: Remove references to credential paths. Use environment variables or secrets managers. …

lines 21, 38

.vscode/launch.json:21, 38 (2 hits)

Mcp skillPriv escPe3

high System graph security Skillspector conf 0.60 SkillSpector PE3 (priv-esc) in docker-compose.yml

.env Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts. Skill: unknown Rule: PE3 Category: priv-esc Severity: HIGH Confidence: 0.60 Remediation: Remove references to credential paths. Use environment variables or secrets managers. F…

docker-compose.yml:7 Mcp skillPriv escPe3

high System graph security Skillspector conf 0.60 SkillSpector PE3 (priv-esc) in octomate/config/__init__.py

.env" Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts. Skill: unknown Rule: PE3 Category: priv-esc Severity: HIGH Confidence: 0.60 Remediation: Remove references to credential paths. Use environment variables or secrets managers. …

octomate/config/__init__.py:58 Mcp skillPriv escPe3

high System graph security Skillspector conf 0.70 7 occurrences SkillSpector PE3 (priv-esc) in uv.lock

keyring Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts. Skill: unknown Rule: PE3 Category: priv-esc Severity: HIGH Confidence: 0.70 Remediation: Remove references to credential paths. Use environment variables or secrets managers…

lines 883, 899, 1660, 1672, 1674, 2868, 2869

uv.lock:883, 899, 1660, 1672, 1674, 2868, 2869 (7 hits)

Mcp skillPriv escPe3

high System graph security Skillspector conf 0.80 SkillSpector SC4 (supply-chain) in pyproject.toml

requires-python Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits. Skill: unknown Rule: SC4 Category: supply-chain Severity: HIGH Confidence: 0.80 Remediation: Update the dependency to a patched version that addr…

pyproject.toml:6 Mcp skillSupply chainSc4

medium Security checks security auth conf 0.92 [AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.

The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.

medium Security checks security auth conf 0.72 [AUC012] FastAPI interactive docs may be exposed by framework defaults: FastAPI exposes /docs, /redoc, and /openapi.json by default. Public production APIs should explicitly disable those defaults, protect them behind admin authentication, or publish a reviewed OpenAPI spec with declared security requirements.

FastAPI exposes /docs, /redoc, and /openapi.json by default. Public production APIs should explicitly disable those defaults, protect them behind admin authentication, or publish a reviewed OpenAPI spec with declared security requirements.

high Security checks quality Quality conf 0.72 Agent control bridge may listen on a network interface without visible auth

Agent, MCP, sidecar, and command bridge servers often start as local helpers. Binding them to 0.0.0.0 or a default all-interface listener without an authorization guard can expose tool execution or session data to the LAN.

docker-compose.yml:18

medium Security checks software dependencies conf 0.88 aiohttp: GHSA-4fvr-rgm6-gqmc

aiohttp: HTTP/1 Pipelined Requests Queue Without Limit

uv.lock

medium Security checks software dependencies conf 0.88 aiohttp: GHSA-63hw-fmq6-xxg2

aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines

uv.lock

medium Security checks software dependencies conf 0.88 aiohttp: GHSA-g3cq-j2xw-wf74

aiohttp: Unread Compressed Request Bodies Bypass client_max_size During Cleanup

uv.lock

medium Security checks software dependencies conf 0.88 aiohttp: GHSA-hg6j-4rv6-33pg

AIOHTTP is vulnerable to cross-origin redirect with per-request cookies

uv.lock

medium Security checks software dependencies conf 0.88 aiohttp: GHSA-hpj7-wq8m-9hgp

aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges

uv.lock

medium Security checks software dependencies conf 0.88 aiohttp: GHSA-jg22-mg44-37j8

AIOHTTP is Vulnerable to Deserialization of Untrusted Data

uv.lock

medium Security checks software dependencies conf 0.88 aiohttp: GHSA-xcgm-r5h9-7989

aiohttp: Incomplete websocket frame payloads bypass memory limits

uv.lock

low Security checks quality Error handling conf 0.55 ✓ Repobility Broad exception handler needs review

This handler catches Exception/BaseException. It is actionable when it swallows errors without logging, re-raising, or returning a structured error. Handlers that intentionally convert exceptions into typed error results should not be treated as high risk.

octomate/capabilities/react.py:339 Error handlingquality

medium Security checks cicd CI/CD security conf 0.94 4 occurrences Compose service `napcat` image uses the latest tag

The latest tag is mutable and can change without a code review, producing different images from the same source.

lines 28, 61, 85, 111

docker-compose.yml:28, 61, 85, 111 (4 hits)

CI/CD securitycontainers

medium Security checks cicd CI/CD security conf 0.88 Database service has no healthcheck

Compose starts dependent containers in dependency order, but it does not wait for a database to be ready unless a healthcheck is defined and dependents use service_healthy.

docker-compose.yml:97 CI/CD securitycontainers

high Security checks cicd CI/CD security conf 0.82 Docker final stage has no non-root USER

Docker images run as root unless the image or Dockerfile switches to a non-root user.

Dockerfile:1 CI/CD securitycontainers

medium Security checks quality Quality conf 0.78 Public web service has no security.txt

security.txt gives researchers and customers a safe disclosure channel. Public web apps and APIs should publish it under /.well-known/security.txt.

.well-known/security.txt

medium Security checks software dependencies conf 0.88 pydantic-settings: GHSA-4xgf-cpjx-pc3j

pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size

uv.lock

medium Security checks software dependencies conf 0.88 pyjwt: GHSA-993g-76c3-p5m4

PyJWKClient: missing scheme allowlist enables CVE-2024-21643-class SSRF + token forgery via file://, ftp://, data: schemes

uv.lock

medium Security checks software dependencies conf 0.88 pyjwt: GHSA-jq35-7prp-9v3f

PyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keys

uv.lock

medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/settings.json

This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.

.claude/settings.json VerificationClaude instruction

medium System graph quality Agent instructions conf 1.00 Agent instructions exist but release-hardening basics are missing

AI-coder instruction files were found, but the repo is missing license, ci. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable.

Repo hardeningGenerated repo pattern

medium System graph security Trivy conf 1.00 CVE-2026-34993: aiohttp 3.13.5 — uv.lock

aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load() AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution. Most applications using th…

VulnCve 2026 34993

medium System graph security Trivy conf 1.00 CVE-2026-45409: idna 3.13 — uv.lock

Internationalized Domain Names in Applications (IDNA) for Python provi ... Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such…

VulnCve 2026 45409

medium System graph security Trivy conf 1.00 CVE-2026-47265: aiohttp 3.13.5 — uv.lock

python-aiohttp: AIOHTTP: Information disclosure via improper handling of cookies during cross-origin redirects AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the `cookies` parameter on requests are sent after following a cr…

VulnCve 2026 47265

medium System graph security Trivy conf 1.00 CVE-2026-48522: pyjwt 2.12.1 — uv.lock

python-pyjwt: PyJWT: Server-Side Request Forgery (SSRF) via uncontrolled URL fetching in PyJWKClient PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument directly to urllib.request.urlopen() which uses Python stdlib's default OpenerDirector regis…

VulnCve 2026 48522

medium System graph security Trivy conf 1.00 CVE-2026-48523: pyjwt 2.12.1 — uv.lock

python-pyjwt: PyJWT: Verifier-side algorithm bypass leads to unauthorized information access PyJWT is a JSON Web Token implementation in Python. From 2.9.0 to 2.12.1, there is a verifier-side algorithm allow-list bypass when jwt.decode() or jwt.decode_complete() are called with a PyJWK key. The to…

VulnCve 2026 48523

medium System graph security Trivy conf 1.00 CVE-2026-48525: pyjwt 2.12.1 — uv.lock

python-pyjwt: PyJWT: Denial of Service via processing of crafted detached JWS tokens PyJWT is a JSON Web Token implementation in Python. From 2.8.0 to 2.12.1, when verifying detached JWS tokens using the unencoded-payload option ("b64": false, RFC 7797), PyJWT performs Base64URL decoding of the co…

VulnCve 2026 48525

medium System graph security Trivy conf 1.00 CVE-2026-54273: aiohttp 3.13.5 — uv.lock

AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ... AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, no limit was present on the number of pipelined requests that could be queued. An attacker may be able to use pipelined reques…

VulnCve 2026 54273

medium System graph security Trivy conf 1.00 CVE-2026-54274: aiohttp 3.13.5 — uv.lock

AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ... AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if an attacker sends large incomplete websocket frame payloads, it may be possible to bypass the usual size limits on memory u…

VulnCve 2026 54274

medium System graph security Trivy conf 1.00 CVE-2026-54276: aiohttp 3.13.5 — uv.lock

aiohttp: aiohttp: Information disclosure via DigestAuthMiddleware after cross-origin redirect AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, DigestAuthMiddleware can send an authentication response after following a cross-origin redirect. This like…

VulnCve 2026 54276

medium System graph security Trivy conf 1.00 CVE-2026-54277: aiohttp 3.13.5 — uv.lock

AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ... AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, it is possible to bypass the max_line_size check in parts of an HTTP request in the C parser. If using the optimised C parser …

VulnCve 2026 54277

medium System graph security Trivy conf 1.00 CVE-2026-54278: aiohttp 3.13.5 — uv.lock

AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ... AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, during cleanup it is possible for a compressed request body to be decompressed into memory in one chunk. An attacker may be ab…

VulnCve 2026 54278

medium System graph hardware Security conf 1.00 Dockerfile runs as root: Dockerfile

No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.

Container

medium System graph security Trivy conf 1.00 GHSA-4xgf-cpjx-pc3j: pydantic-settings 2.14.1 — uv.lock

pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size ### Summary `NestedSecretsSettingsSource` reads secret values from files in a configured `secrets_dir`. When `secrets_nested_subdir=True`, a directory e…

VulnGhsa 4xgf cpjx pc3j

medium System graph security Coverage conf 1.00 No auth library detected

The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing.

auth

medium System graph network Security conf 1.00 Privileged port 11 in use

Port 11 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.

docker-compose.yml Ports

medium System graph network Security conf 1.00 Privileged port 2 in use

Port 2 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.

docker-compose.yml Ports

medium System graph network Security conf 1.00 Privileged port 42 in use

Port 42 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.

docker-compose.yml Ports

medium System graph security Skillspector conf 0.50 2 occurrences SkillSpector E1 (data-exfil) in docs/plans/done/github-linear-mcp.md

https://api.githubcopilot.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: unknown Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trusted and nec…

lines 24, 67

docs/plans/done/github-linear-mcp.md:24, 67 (2 hits)

Mcp skillData exfilE1

medium System graph security Skillspector conf 0.50 SkillSpector E1 (data-exfil) in octomate.default.yaml

https://api.openai.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: unknown Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trusted and necessary.…

octomate.default.yaml:74 Mcp skillData exfilE1

medium System graph security Skillspector conf 0.60 SkillSpector E1 (data-exfil) in octomate/config/mcp.py

https://api.githubcopilot.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: unknown Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.60 Remediation: Verify the destination URL is trusted and nec…

octomate/config/mcp.py:9 Mcp skillData exfilE1

medium System graph security Skillspector conf 0.85 SkillSpector EA1 (excessive-agency) in octomate/tentacles/channel/lark/feelers/approvals.py

Tool:* Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution. Skill: unknown Rule: EA1 Category: excessive-agency Severity: MEDIUM Confidence: 0.…

octomate/tentacles/channel/lark/feelers/approvals.py:74 Mcp skillExcessive agencyEa1

medium System graph security Skillspector conf 0.85 SkillSpector EA2 (excessive-agency) in octomate/managers/conversations.py

auto-approve Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation. Skill: unknown Rule: EA2 Category: excessive-agency Severity: MEDIUM C…

octomate/managers/conversations.py:155 Mcp skillExcessive agencyEa2

medium System graph security Skillspector conf 0.85 SkillSpector EA2 (excessive-agency) in octomate/schemas/conversation.py

auto-approve Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation. Skill: unknown Rule: EA2 Category: excessive-agency Severity: MEDIUM C…

octomate/schemas/conversation.py:86 Mcp skillExcessive agencyEa2

medium System graph security Skillspector conf 0.85 SkillSpector EA2 (excessive-agency) in octomate/tentacles/agent/claude/base.py

auto-approve Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation. Skill: unknown Rule: EA2 Category: excessive-agency Severity: MEDIUM C…

octomate/tentacles/agent/claude/base.py:191 Mcp skillExcessive agencyEa2

medium System graph security Skillspector conf 0.75 SkillSpector EA4 (excessive-agency) in docs/plans/claude-agent-integration.md

timeout=None Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns. Skill: unknown Rule: EA4 Category: excessive-agency Severity: MEDIUM Confidence: 0.75 Remediat…

docs/plans/claude-agent-integration.md:117 Mcp skillExcessive agencyEa4

medium System graph security Skillspector conf 0.60 SkillSpector RA2 (rogue-agent) in docs/plans/claude-agent-integration.md

write messages + session id + transcript in one transaction, then `refresh` (cache stays coherent). - Tentacle: read `agent_session_id` on `ensure` → `resume=`; write back `ResultMessage.session_id` a Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or sta…

docs/plans/claude-agent-integration.md:105 Mcp skillRogue agentRa2

low Security checks cicd CI/CD security conf 0.72 .dockerignore misses sensitive defaults

.dockerignore exists but does not cover common secret or VCS patterns.

.dockerignore CI/CD securitycontainers

low Security checks software dependencies conf 0.88 aiohttp: GHSA-2fqr-mr3j-6wp8

aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence

uv.lock

low Security checks software dependencies conf 0.88 aiohttp: GHSA-4m7w-qmgq-4wj5

aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections

uv.lock

low Security checks software dependencies conf 0.88 aiohttp: GHSA-9x8q-7h8h-wcw9

aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect

uv.lock

low Security checks software dependencies conf 0.88 aiohttp: GHSA-m6qw-4cw2-hm4m

aiohttp: CRLF injection in multipart headers

uv.lock

low Security checks cicd CI/CD security conf 0.68 App service does not wait for database health

depends_on controls startup order, but without condition: service_healthy an app can start while the database is still initializing and fail intermittently.

docker-compose.yml:111 CI/CD securitycontainers

high Security checks cicd CI/CD security conf 0.56 5 occurrences Compose service does not declare a runtime user

If the image does not define USER internally, this service may run as root.

lines 1, 28, 71, 85, 111

docker-compose.yml:1, 28, 71, 85, 111 (5 hits)

CI/CD securitycontainers

high Security checks cicd CI/CD security conf 0.62 5 occurrences Compose service lacks no-new-privileges hardening

no-new-privileges prevents processes from gaining additional privileges through setuid binaries or file capabilities.

lines 1, 28, 71, 85, 111

docker-compose.yml:1, 28, 71, 85, 111 (5 hits)

CI/CD securitycontainers

low Security checks quality Quality conf 0.60 3 occurrences Duplicated implementation block across source files

Duplicate implementation blocks are maintenance debt. Keep them visible, but they are not a high-severity defect unless the duplicated logic is security-sensitive or drifting.

3 files, 3 locations

octomate/models/todos.py:37

octomate/tentacles/agent/inkling/base.py:99

octomate/tentacles/channel/lark/feelers/output.py:91

duplicationquality

low Security checks quality Documentation No LICENSE file

Add a LICENSE file to your repository. Use choosealicense.com to pick the right license (MIT for permissive, Apache 2.0 for patent protection, GPL for copyleft).

low Security checks software dependencies conf 0.88 python-multipart: GHSA-6jv3-5f52-599m

python-multipart: Semicolon treated as querystring field separator enables parameter smuggling

uv.lock

low Security checks software dependencies conf 0.88 python-multipart: GHSA-v9pg-7xvm-68hf

python-multipart: Negative Content-Length in parse_form buffers the entire body in memory

uv.lock

low Security checks software dependencies conf 0.88 python-multipart: GHSA-vffw-93wf-4j4q

python-multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters

uv.lock

low System graph quality Maintenance conf 1.00 98 TODO/FIXME markers

High count of TODO/FIXME/HACK markers — track them as issues so they're not forgotten.

low System graph quality Production readiness conf 1.00 Composite production-readiness gap

Multiple low-cost hardening controls are missing together: license, ci. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation.

Repo hardeningGenerated repo pattern

low System graph security Trivy conf 1.00 CVE-2026-48524: pyjwt 2.12.1 — uv.lock

python-pyjwt: PyJWT: Denial of Service via unverified JSON Web Token key IDs PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient.get_signing_key() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Since kid…

VulnCve 2026 48524

low System graph security Trivy conf 1.00 CVE-2026-50269: aiohttp 3.13.5 — uv.lock

AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ... AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers…

VulnCve 2026 50269

low System graph security Trivy conf 1.00 CVE-2026-53537: python-multipart 0.0.28 — uv.lock

Python-Multipart is a streaming multipart parser for Python. Prior to ... Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, parse_options_header parsed Content-Disposition (and Content-Type) headers with email.message.Message, which transparently applies RFC 2231/5987 …

VulnCve 2026 53537

low System graph security Trivy conf 1.00 CVE-2026-53538: python-multipart 0.0.28 — uv.lock

Python-Multipart is a streaming multipart parser for Python. Prior to ... Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, QuerystringParser treated ; as a field separator in application/x-www-form-urlencoded bodies, in addition to &. The WHATWG URL standard, modern b…

VulnCve 2026 53538

low System graph security Trivy conf 1.00 CVE-2026-53540: python-multipart 0.0.28 — uv.lock

Python-Multipart is a streaming multipart parser for Python. Prior to ... Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.31, parse_form() did not validate the Content-Length header before using it to bound its chunked read of the request body. A negative Content-Length …

VulnCve 2026 53540

low System graph security Trivy conf 1.00 CVE-2026-54275: aiohttp 3.13.5 — uv.lock

AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ... AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, the server_hostname TLS SNI check can be bypassed when an existing connection is reused. If an application makes multiple requ…

VulnCve 2026 54275

low System graph security Trivy conf 1.00 CVE-2026-54279: aiohttp 3.13.5 — uv.lock

AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ... AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, host-only cookies that are saved with CookieJar.save() and then restored later with CookieJar.load() lose their host-only stat…

VulnCve 2026 54279

low System graph security Trivy conf 1.00 CVE-2026-54280: aiohttp 3.13.5 — uv.lock

AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ... AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, payload resources are not closed correctly when a client disconnects in the middle of a write. If a payload is using an open f…

VulnCve 2026 54280

low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: ghcr.io/astral-sh/uv:python3.13-bookworm-slim

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

Dockerfile:1 containersPinned dependencies

low System graph security Trivy conf 1.00 DS-0026: No HEALTHCHECK defined — Dockerfile

No HEALTHCHECK defined Add HEALTHCHECK instruction in your Dockerfile Rule: DS-0026 Severity: LOW Target: Dockerfile

Misconfig

low System graph quality Agent instructions conf 1.00 Multiple root agent instruction files without precedence

The repo has multiple top-level AI-coder instruction files. Without precedence rules, different agents may follow different policies.

Governance

low System graph quality Integrity conf 1.00 Near-duplicate function bodies in 18 places

Functions with the same first-5-line body hash: octomate/tentacles/agent/base.py:run, octomate/tentacles/agent/base.py:run, octomate/tentacles/agent/base.py:run, octomate/tentacles/agent/base.py:run_stream_events This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see ht…

duplicatesduplication

low System graph quality Integrity conf 1.00 13 occurrences Near-duplicate function bodies in 2 places

Functions with the same first-5-line body hash: octomate/triage/graph.py:receptions, octomate/triage/graph.py:reception This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate.

13 occurrences

repo-level (13 hits)

duplicatesduplication

low System graph quality Integrity conf 1.00 2 occurrences Near-duplicate function bodies in 3 places

Functions with the same first-5-line body hash: octomate/triage/graph.py:channel, octomate/triage/graph.py:channel, octomate/triage/graph.py:channel This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene). Consolidate or document why they'r…

2 occurrences

repo-level (2 hits)

duplicatesduplication

low System graph quality Integrity conf 1.00 3 occurrences Near-duplicate function bodies in 4 places

Functions with the same first-5-line body hash: octomate/capabilities/react.py:run, octomate/capabilities/react.py:run, octomate/capabilities/react.py:run, octomate/capabilities/react.py:run This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hy…

3 occurrences

repo-level (3 hits)

duplicatesduplication

low System graph quality Integrity conf 1.00 Near-duplicate function bodies in 6 places

Functions with the same first-5-line body hash: octomate/triage/graph.py:run, octomate/triage/graph.py:run, octomate/triage/graph.py:run, octomate/triage/graph.py:run This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene). Consolidate or d…

duplicatesduplication

low System graph quality License conf 1.00 No license file detected

No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake.

Repo hardeningGenerated repo pattern

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `card_v2` in octomate/tentacles/channel/lark/feelers/cards.py:83