AgenticX is a unified, production-ready multi-agent platform — Python SDK + CLI (agx) + Studio server + Machi desktop app. Features Meta-Agent orchestration, 15+ LLM providers, MCP Hub, hierarchical memory, avatar & group chat, skill ecosystem, safety sandbox, and IM gateway (Feishu/WeChat).
D high
- capability exposure inferred + 35
- recent drift inferred + 20
- tool safety inferred + 12
- trust mitigators mixed − 3
inferred mixed
The A–E grade is our heuristic synthesis — a "review this" prompt, not a verdict. Each factor is tagged by what backs it: attested (a verifiable record), reported (a third party's claim), or inferred (our own heuristic, e.g. permissions). See methodology.
graded 6m ago · see ecosystem CVEs →
- C · 56 → D · 64
- A · 0 → C · 56
Inferred surface — each links to servers holding it:
No known CVEs for this server.
- high dangerous code
committed secret: Anthropic key, OpenAI key · dynamic exec: eval()/exec(), __import__(), __import__ sink
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit de771f7 · analyzer v32 · 1h ago
skills & prompt files 23
- skill DemonDamon-AgenticX-de771f7/.cursor/skills/code-deep-research/SKILL.md
- skill DemonDamon-AgenticX-de771f7/.cursor/skills/code-module-summaries/SKILL.md
- agent-rules DemonDamon-AgenticX-de771f7/AGENTS.md
- skill DemonDamon-AgenticX-de771f7/agenticx/skills/agenticx-a2a-connector/SKILL.md
- skill DemonDamon-AgenticX-de771f7/agenticx/skills/agenticx-agent-builder/SKILL.md
- skill DemonDamon-AgenticX-de771f7/agenticx/skills/agenticx-automation-crontask/SKILL.md
- skill DemonDamon-AgenticX-de771f7/agenticx/skills/agenticx-deployer/SKILL.md
- skill DemonDamon-AgenticX-de771f7/agenticx/skills/agenticx-memory-architect/SKILL.md
- skill DemonDamon-AgenticX-de771f7/agenticx/skills/agenticx-query-data-source/SKILL.md
- skill DemonDamon-AgenticX-de771f7/agenticx/skills/agenticx-quickstart/SKILL.md
- skill DemonDamon-AgenticX-de771f7/agenticx/skills/agenticx-skill-manager/SKILL.md
- skill DemonDamon-AgenticX-de771f7/agenticx/skills/agenticx-tool-creator/SKILL.md
- skill DemonDamon-AgenticX-de771f7/agenticx/skills/agenticx-workflow-designer/SKILL.md
- skill DemonDamon-AgenticX-de771f7/agenticx/skills/bundled/code-dev-workflow/SKILL.md
- skill DemonDamon-AgenticX-de771f7/agenticx/skills/bundled/feature-loop/SKILL.md
- skill DemonDamon-AgenticX-de771f7/agenticx/skills/bundled/project-initializer/SKILL.md
- skill DemonDamon-AgenticX-de771f7/agenticx/skills/bundled/skill-creator/SKILL.md
- agent-rules DemonDamon-AgenticX-de771f7/docs/api/agents.md
- agent-rules DemonDamon-AgenticX-de771f7/docs/concepts/agent.md
- skill DemonDamon-AgenticX-de771f7/examples/agenticx-for-delivery/skills/b2b-desktop-design-system/SKILL.md
- skill DemonDamon-AgenticX-de771f7/examples/agenticx-for-delivery/skills/playwright-uitest/SKILL.md
- skill DemonDamon-AgenticX-de771f7/examples/agenticx-for-delivery/skills/requirement-decompose/SKILL.md
- skill DemonDamon-AgenticX-de771f7/examples/agenticx-for-delivery/skills/scaffold-vite-react/SKILL.md
danger signals21
- dynamic code execution eval()/exec() DemonDamon-AgenticX-de771f7/agenticx/core/code_action_executor.py :87
exec(code, g, l) - dynamic code execution eval()/exec() DemonDamon-AgenticX-de771f7/agenticx/core/executor.py :265
exec(code, exec_globals, exec_locals) - dynamic code execution __import__() DemonDamon-AgenticX-de771f7/agenticx/integrations/mem0/vector_stores/configs.py :41
module = __import__( - dynamic code execution __import__ sink DemonDamon-AgenticX-de771f7/agenticx/longrun/studio_routes.py :80
linear_key = str(cfg.linear_api_key or "").strip() or __import__("os").environ.get( - dynamic code execution eval()/exec() DemonDamon-AgenticX-de771f7/agenticx/memory/intelligence/memory_intelligence.py :293
return eval(rule.condition, {"__builtins__": {}}, context) - dynamic code execution __import__ sink DemonDamon-AgenticX-de771f7/agenticx/studio/voice_endpoints.py :349
openai_ready = bool(ak) or bool(str(__import__("os").environ.get("OPENAI_API_KEY", "") or "").strip()) - dynamic code execution __import__() DemonDamon-AgenticX-de771f7/agenticx/tools/executor.py :136
return __import__(name, globals, locals, fromlist, level) - dynamic code execution eval()/exec() DemonDamon-AgenticX-de771f7/agenticx/tools/executor.py :159
exec(code, safe_globals, local_vars) - dynamic code execution __import__() DemonDamon-AgenticX-de771f7/agenticx/tools/skill_execution_backend.py :138
return builtins.__import__(name, *args, **kw) - dynamic code execution eval()/exec() DemonDamon-AgenticX-de771f7/agenticx/tools/skill_execution_backend.py :144
exec(code, exec_globals) # noqa: S102 - dynamic code execution eval()/exec() DemonDamon-AgenticX-de771f7/tests/test_e2e_agent_tools.py :84
result = eval(expression) - dynamic code execution eval()/exec() DemonDamon-AgenticX-de771f7/tests/test_mcp_server_demo.py :181
result = eval(expression) - dynamic code execution eval()/exec() DemonDamon-AgenticX-de771f7/tests/test_smoke_agno_performance.py :216
return str(eval(expression)) # 简化实现 - dynamic code execution __import__() DemonDamon-AgenticX-de771f7/tests/test_smoke_hermes_agent_guidance.py :26
block = __import__( - dynamic code execution __import__ sink DemonDamon-AgenticX-de771f7/tests/test_smoke_longrun_primitives.py :50
__import__("os").name == "nt", - suspicious endpoint us.i.posthog.com (telemetry) DemonDamon-AgenticX-de771f7/agenticx/integrations/mem0/memory/telemetry.py :13
HOST = "https://us.i.posthog.com" - committed secret Anthropic key DemonDamon-AgenticX-de771f7/.cursor/plans/2026-03-06-ironclaw-safety-layer.plan.md :95
sk-ant…(75 chars, redacted) - committed secret OpenAI key DemonDamon-AgenticX-de771f7/agenticx/configs/knowledge_graphers_config.yml :6
sk-99a…(35 chars, redacted) - committed secret OpenAI key DemonDamon-AgenticX-de771f7/examples/env_template.txt :6
sk-jQ0…(51 chars, redacted) - committed secret OpenAI key DemonDamon-AgenticX-de771f7/examples/m3_embeddings_demo.py :115
sk-jQ0…(51 chars, redacted) - committed secret Anthropic key DemonDamon-AgenticX-de771f7/tests/test_safety_leak_detector.py :63
sk-ant…(75 chars, redacted)
- recent drift +20 capability drift →
[](https://mcpobservatory.com/servers/github:DemonDamon/AgenticX/security) Heuristic, inferred signals — false positives (legitimately powerful tools, forks, language ports) are expected. Treat each as "review this", not a verdict. See the ecosystem-wide picture on the security hub, or the fleet security of DemonDamon.