Docker-based, multi-tenant platform for autonomous AI agent ecosystems — runs on local or cloud models, with built-in cross-instance federation. Source-available under the PolyForm Small Business License.
C elevated
- capability exposure inferred + 8
- recent drift inferred + 20
- tool safety inferred + 12
inferred
The A–E grade is our heuristic synthesis — a "review this" prompt, not a verdict. Each factor is tagged by what backs it: attested (a verifiable record), reported (a third party's claim), or inferred (our own heuristic, e.g. permissions). See methodology.
graded 53s ago · see ecosystem CVEs →
- B · 25 → C · 40
Inferred surface — each links to servers holding it:
No known CVEs for this server.
- high dangerous code
committed secret: OpenAI key, Anthropic key, GitHub token, private key · dynamic exec: __import__(), eval()/exec(), __import__ sink
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit c75f40c · analyzer v28 · 2d ago
skills & prompt files 23
- agent-rules EricLortie-laborforge-release-c75f40c/.cursor/rules/agents-api.mdc
- agent-rules EricLortie-laborforge-release-c75f40c/.cursor/rules/backend-architecture.mdc
- agent-rules EricLortie-laborforge-release-c75f40c/.cursor/rules/container-naming.mdc
- agent-rules EricLortie-laborforge-release-c75f40c/.cursor/rules/database-schema.mdc
- agent-rules EricLortie-laborforge-release-c75f40c/.cursor/rules/development-workflow.mdc
- agent-rules EricLortie-laborforge-release-c75f40c/.cursor/rules/docker-commands.mdc
- agent-rules EricLortie-laborforge-release-c75f40c/.cursor/rules/frontend-architecture.mdc
- agent-rules EricLortie-laborforge-release-c75f40c/.cursor/rules/resource-references.mdc
- agent-rules EricLortie-laborforge-release-c75f40c/.cursor/rules/security-authentication.mdc
- agent-rules EricLortie-laborforge-release-c75f40c/AGENTS.md
- agent-rules EricLortie-laborforge-release-c75f40c/CLAUDE.md
- agent-rules EricLortie-laborforge-release-c75f40c/cli/CLAUDE.md
- agent-rules EricLortie-laborforge-release-c75f40c/docker/CLAUDE.md
- agent-rules EricLortie-laborforge-release-c75f40c/docs/architecture/modules/api/agents.md
- agent-rules EricLortie-laborforge-release-c75f40c/docs/architecture/modules/providers/gemini.md
- agent-rules EricLortie-laborforge-release-c75f40c/frontend/CLAUDE.md
- agent-rules EricLortie-laborforge-release-c75f40c/imports/CLAUDE.md
- skill EricLortie-laborforge-release-c75f40c/imports/openclaw/skills/laborforge/SKILL.md
- agent-rules EricLortie-laborforge-release-c75f40c/imports/packages/_templates/ecosystem/schemas/AGENTS.md
- skill EricLortie-laborforge-release-c75f40c/imports/packages/integrations/openclaw/skills/laborforge/SKILL.md
- agent-rules EricLortie-laborforge-release-c75f40c/installer/CLAUDE.md
- agent-rules EricLortie-laborforge-release-c75f40c/mcp_runtime/CLAUDE.md
- agent-rules EricLortie-laborforge-release-c75f40c/modules/CLAUDE.md
danger signals52
- dynamic code execution __import__() EricLortie-laborforge-release-c75f40c/modules/api/public/status.py :907
module = __import__(module_path, fromlist=[attr_name]) - dynamic code execution __import__() EricLortie-laborforge-release-c75f40c/modules/api/scheduler.py :1498
module = __import__(module_path, fromlist=[func_name]) - dynamic code execution __import__() EricLortie-laborforge-release-c75f40c/modules/email_providers/factory.py :37
__import__(package) - dynamic code execution eval()/exec() EricLortie-laborforge-release-c75f40c/modules/mcp_servers/_framework/mcp_entrypoint.py :516
exec(func_code, wrapper_locals) - dynamic code execution __import__() EricLortie-laborforge-release-c75f40c/modules/observability/sentry_init.py :82
mod = __import__(path, fromlist=[name]) - dynamic code execution __import__() EricLortie-laborforge-release-c75f40c/modules/storage/factory.py :36
__import__(package) - dynamic code execution __import__() EricLortie-laborforge-release-c75f40c/modules/workflows/nodes/ai_services.py :432
safe_globals[module_name] = __import__(module_name) - dynamic code execution eval()/exec() EricLortie-laborforge-release-c75f40c/modules/workflows/nodes/ai_services.py :453
exec(compiled_code, safe_globals) - dynamic code execution __import__ sink EricLortie-laborforge-release-c75f40c/tests/unit/providers/test_llm_guardrails_wiring.py :86
).read() if __import__("os").path.exists( - suspicious endpoint api.telegram.org EricLortie-laborforge-release-c75f40c/modules/api/contacts.py :45
resp = httpx.get(f"https://api.telegram.org/bot{token}/getMe", timeout=10) - suspicious endpoint t.me EricLortie-laborforge-release-c75f40c/modules/api/contacts.py :105
"deep_link": f"https://t.me/{username}?start={nonce}", - suspicious endpoint api.telegram.org EricLortie-laborforge-release-c75f40c/modules/api/messaging_providers.py :455
await client.post(f"https://api.telegram.org/bot{token}/deleteWebhook") - suspicious endpoint api.telegram.org EricLortie-laborforge-release-c75f40c/modules/messaging_providers/telegram.py :39
_TG_BASE_URL = "https://api.telegram.org" - suspicious endpoint www.google-analytics.com (telemetry) EricLortie-laborforge-release-c75f40c/modules/security/content_security_policy.py :21
"https://www.google-analytics.com", - suspicious endpoint api.telegram.org EricLortie-laborforge-release-c75f40c/modules/tasks/messaging_inbound_tasks.py :39
_TELEGRAM_API = "https://api.telegram.org" - suspicious endpoint analytics.google.com (telemetry) EricLortie-laborforge-release-c75f40c/scripts/cloud/gcp_analytics_setup.py :481
print(" 1. Go to https://analytics.google.com/") - suspicious endpoint 169.254.169.254 (cloud metadata) EricLortie-laborforge-release-c75f40c/tests/unit/mcp_servers/test_url_fetch.py :17
"http://169.254.169.254/latest/meta-data/", # cloud metadata endpoint - suspicious endpoint 8.8.8.8 EricLortie-laborforge-release-c75f40c/tests/unit/mcp_servers/test_url_fetch.py :33
ok, reason = validate_public_url("http://8.8.8.8/") - suspicious endpoint api.telegram.org EricLortie-laborforge-release-c75f40c/tests/unit/messaging/test_telegram.py :30
request=httpx.Request("POST", "https://api.telegram.org/x"), - suspicious endpoint 169.254.169.254 (cloud metadata) EricLortie-laborforge-release-c75f40c/tests/unit/services/test_external_asset_ssrf.py :29
"http://169.254.169.254/", - suspicious endpoint 8.8.8.8 EricLortie-laborforge-release-c75f40c/tests/unit/services/test_external_asset_ssrf.py :55
"http://8.8.8.8/image.png", - suspicious endpoint 169.254.169.254 (cloud metadata) EricLortie-laborforge-release-c75f40c/tests/unit/services/test_url_metadata_ssrf.py :22
"http://169.254.169.254/", - suspicious endpoint 8.8.8.8 EricLortie-laborforge-release-c75f40c/tests/unit/services/test_url_metadata_ssrf.py :48
"http://8.8.8.8/", - over-broad OAuth scope gmail.modify EricLortie-laborforge-release-c75f40c/modules/email_providers/auth_modes.py :63
"https://www.googleapis.com/auth/gmail.modify", - over-broad OAuth scope https://www.googleapis.com/auth/cloud-platform EricLortie-laborforge-release-c75f40c/modules/email_providers/auth_modes.py :190
scopes=["https://www.googleapis.com/auth/cloud-platform"] - over-broad OAuth scope admin:org EricLortie-laborforge-release-c75f40c/modules/security/oauth_scope_policy.py :68
"admin:org", - over-broad OAuth scope admin:repo_hook EricLortie-laborforge-release-c75f40c/modules/security/oauth_scope_policy.py :69
"admin:repo_hook", - over-broad OAuth scope admin:enterprise EricLortie-laborforge-release-c75f40c/modules/security/oauth_scope_policy.py :71
"admin:enterprise", - over-broad OAuth scope admin:gpg_key EricLortie-laborforge-release-c75f40c/modules/security/oauth_scope_policy.py :72
"admin:gpg_key", - over-broad OAuth scope admin:public_key EricLortie-laborforge-release-c75f40c/modules/security/oauth_scope_policy.py :73
"admin:public_key", - over-broad OAuth scope delete_repo EricLortie-laborforge-release-c75f40c/modules/security/oauth_scope_policy.py :76
"delete_repo", - over-broad OAuth scope https://www.googleapis.com/auth/drive EricLortie-laborforge-release-c75f40c/modules/security/oauth_scope_policy.py :86
"https://www.googleapis.com/auth/drive", - over-broad OAuth scope gmail.modify EricLortie-laborforge-release-c75f40c/modules/security/oauth_scope_policy.py :89
"https://www.googleapis.com/auth/gmail.modify", - over-broad OAuth scope https://www.googleapis.com/auth/cloud-platform EricLortie-laborforge-release-c75f40c/modules/security/oauth_scope_policy.py :92
"https://www.googleapis.com/auth/cloud-platform", - over-broad OAuth scope gmail.modify EricLortie-laborforge-release-c75f40c/modules/services/integration_oauth_service.py :295
"https://www.googleapis.com/auth/gmail.modify", - over-broad OAuth scope gmail.modify EricLortie-laborforge-release-c75f40c/tests/unit/services/test_integration_oauth_service.py :140
"scope": "openid email https://www.googleapis.com/auth/gmail.modify", - committed secret OpenAI key EricLortie-laborforge-release-c75f40c/cli/internal/ui/components/components_test.go :492
sk-aaa…(39 chars, redacted) - committed secret Anthropic key EricLortie-laborforge-release-c75f40c/tests/integration/security/safety_corpus/positives.yaml :146
sk-ant…(39 chars, redacted) - committed secret OpenAI key EricLortie-laborforge-release-c75f40c/tests/security/test_secret_leak_pipeline_e2e.py :244
sk-pro…(32 chars, redacted) - committed secret Anthropic key EricLortie-laborforge-release-c75f40c/tests/unit/security/test_visibility_classifier.py :289
sk-ant…(34 chars, redacted) - committed secret GitHub token EricLortie-laborforge-release-c75f40c/tests/unit/security/test_visibility_classifier.py :414
ghp_aa…(40 chars, redacted) - committed secret OpenAI key EricLortie-laborforge-release-c75f40c/tests/unit/services/test_secret_detector.py :84
sk-pro…(40 chars, redacted) - committed secret Anthropic key EricLortie-laborforge-release-c75f40c/tests/unit/services/test_secret_detector.py :95
sk-ant…(37 chars, redacted) - committed secret OpenAI key EricLortie-laborforge-release-c75f40c/tests/unit/services/test_secret_detector_edge_cases.py :44
sk-pro…(32 chars, redacted) - committed secret Anthropic key EricLortie-laborforge-release-c75f40c/tests/unit/services/test_secret_detector_edge_cases.py :133
sk-ant…(33 chars, redacted) - committed secret OpenAI key EricLortie-laborforge-release-c75f40c/tests/unit/services/test_secret_detector_realistic_corpus.py :75
sk-pro…(32 chars, redacted) - committed secret Anthropic key EricLortie-laborforge-release-c75f40c/tests/unit/services/test_secret_detector_realistic_corpus.py :126
sk-ant…(39 chars, redacted) - committed secret private key EricLortie-laborforge-release-c75f40c/tests/unit/services/test_secret_detector_realistic_corpus.py :167
PEM private key block (redacted) - committed secret OpenAI key EricLortie-laborforge-release-c75f40c/tests/unit/services/test_secret_scrubber_edge_cases.py :174
sk-pro…(32 chars, redacted) - committed secret OpenAI key EricLortie-laborforge-release-c75f40c/tests/unit/services/test_secret_scrubber_service.py :247
sk-pro…(28 chars, redacted) - committed secret OpenAI key EricLortie-laborforge-release-c75f40c/tests/unit/tasks/test_secret_leak_scan.py :233
sk-pro…(28 chars, redacted) - committed secret Anthropic key EricLortie-laborforge-release-c75f40c/tests/unit/voice/test_resilience.py :161
sk-ant…(61 chars, redacted)
- recent drift +20 capability drift →
[](https://mcpobservatory.com/servers/github:EricLortie/laborforge-release/security) Heuristic, inferred signals — false positives (legitimately powerful tools, forks, language ports) are expected. Treat each as "review this", not a verdict. See the ecosystem-wide picture on the security hub, or the fleet security of EricLortie.