Krilliac/Sonder-runtime
github Python analyzed ad7e59d
Sonder Runtime — private-first GPU-backed AI orchestration, grounded execution, web tools, memory, and adaptive learning.
risk
D high
- capability exposure inferred + 35
- recent drift inferred + 20
- tool safety inferred + 14
inferred
The A–E grade is our heuristic synthesis — a "review this" prompt, not a verdict. Each factor is tagged by what backs it: attested (a verifiable record), reported (a third party's claim), or inferred (our own heuristic, e.g. permissions). See methodology.
risk trajectory
- D · 66 → D · 69
- C · 58 → D · 66
- C · 46 → C · 58
- A · 0 → C · 46
capability exposure
Inferred surface — each links to servers holding it:
vulnerabilities
No known CVEs for this server.
tool safety
- high dangerous code
committed secret: OpenAI key, Anthropic key, GitHub token, private key · dynamic exec: eval()/exec(), __import__ sink, __import__(), pickle.loads()
- low exfiltration combo
sensitive read and network capabilities split across this server's tools
skills & danger signals
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit ad7e59d · analyzer v33 · 5d ago
skills & prompt files 38
- skill .claude/skills/sonder-agents-and-fleets/SKILL.md
- skill .claude/skills/sonder-architecture-contract/SKILL.md
- skill .claude/skills/sonder-build-and-env/SKILL.md
- skill .claude/skills/sonder-change-control/SKILL.md
- skill .claude/skills/sonder-config-and-flags/SKILL.md
- skill .claude/skills/sonder-debugging-playbook/SKILL.md
- skill .claude/skills/sonder-diagnostics-and-tooling/SKILL.md
- skill .claude/skills/sonder-docs-and-writing/SKILL.md
- skill .claude/skills/sonder-external-positioning/SKILL.md
- skill .claude/skills/sonder-failure-archaeology/SKILL.md
- skill .claude/skills/sonder-memory-and-training/SKILL.md
- skill .claude/skills/sonder-run-and-operate/SKILL.md
- skill .claude/skills/sonder-security-and-privacy/SKILL.md
- skill .claude/skills/sonder-selfmod-lifecycle/SKILL.md
- skill .claude/skills/sonder-server-decomposition-campaign/SKILL.md
- skill .claude/skills/sonder-validation-and-qa/SKILL.md
- prompt-file prompts/README.md
- prompt-file prompts/agent_hosted.md
- prompt-file prompts/agent_local.md
- prompt-file prompts/autopilot_planner.md
- prompt-file prompts/autopilot_reviewer.md
- prompt-file prompts/autopilot_system.md
- prompt-file prompts/autopilot_worker.md
- prompt-file prompts/child_lane.md
- prompt-file prompts/claim_reviewer.md
- prompt-file prompts/curriculum_task_generator.md
- prompt-file prompts/execution_router.md
- prompt-file prompts/execution_router_system.md
- prompt-file prompts/grounded_extraction_system.md
- prompt-file prompts/ollama_alias_system.md
- prompt-file prompts/reflection_distill.md
- prompt-file prompts/reflection_distill_system.md
- prompt-file prompts/reflection_pitfall.md
- prompt-file prompts/reflection_pitfall_system.md
- prompt-file prompts/runtime_identity.md
- prompt-file prompts/selfmod_editor.md
- prompt-file prompts/trace_instructions.md
- prompt-file prompts/web_research_agent.md
danger signals52
- dynamic code execution eval()/exec() reloadable_mcp.py :801
exec(code, namespace, namespace) - dynamic code execution eval()/exec() sonder_runtime/adapters/filesystem/sealed_python_main.py :46
exec(code, module.__dict__) - dynamic code execution __import__ sink sonder_runtime/adapters/mcp_subprocess.py :78
self._platform = platform_name or __import__("os").name - dynamic code execution eval()/exec() sonder_runtime/adapters/persistence/migrations.py :113
exec(code, module.__dict__) - dynamic code execution __import__() sonder_runtime/adapters/persistence/sqlite/loop_state.py :184
recorded_at = self._clock() if self._clock is not None else __import__( - dynamic code execution eval()/exec() tests/fixtures/prompt_golden_capture.py :99
text = eval(compile(ast.Expression(expr), path, "eval"), {"__builtins__": __builtins__}, dict(namespace)) - dynamic code execution pickle.loads() tests/production/test_release_hardening.py :131
roundtrip = pickle.loads(pickle.dumps(err)) - dynamic code execution __import__ sink tests/test_adaptive_training.py :2132
claim.write_text(str(__import__("os").getpid()), encoding="ascii") - dynamic code execution eval()/exec() tests/test_arena_shooter_scaffold.py :32
exec(source[start:end], namespace) - dynamic code execution __import__ sink tests/test_arena_shooter_scaffold.py :51
"subprocess": __import__("subprocess"), - dynamic code execution eval()/exec() tests/test_chat_file_admission.py :26
exec(compile(ast.Module(body=[node], type_ignores=[]), str(path), "exec"), namespace) - dynamic code execution eval()/exec() tests/test_eval_harness.py :58
exec(code + "\n" + check, namespace) # trusted literals from this file - dynamic code execution eval()/exec() tests/test_file_page_rendering.py :210
exec(compile(tree, "<file_read dispatch>", "exec"), namespace) - dynamic code execution eval()/exec() tests/test_fleet_briefing.py :47
exec(compile(ast.Module(body=[entry], type_ignores=[]), str(source), "exec"), scope) - dynamic code execution eval()/exec() tests/test_fleet_stall_diagnostics.py :56
exec(compile( - dynamic code execution eval()/exec() tests/test_fleet_store_compatibility.py :20
exec("from fleet_store import *", namespace) - dynamic code execution eval()/exec() tests/test_fleet_synthesis.py :39
exec(compile(ast.Module(body=nodes, type_ignores=[]), str(path), "exec"), scope) - dynamic code execution eval()/exec() tests/test_lint_ratchet_gate.py :161
exec("from sonder_runtime.application.agent_registry.unified import *", namespace) - dynamic code execution __import__() tests/test_native_mcp.py :144
name for name, target in __import__( - dynamic code execution eval()/exec() tests/test_nightly_selfmod_model_selection.py :468
selected = [k for k, expr in kinds.items() if eval(expr, {}, env)] - dynamic code execution eval()/exec() tests/test_observation_prompt_views.py :31
exec(compile(ast.Module(body=nodes, type_ignores=[]), "server.py", "exec"), namespace) - dynamic code execution __import__() tests/test_orchestration_durability.py :310
__import__( - dynamic code execution __import__ sink tests/test_platform_paths_home_override.py :46
assert __import__("os").environ["SONDER_HOME"] == sentinel - dynamic code execution eval()/exec() tests/test_playbook_prompt_parity.py :85
exec(compile(ast.Module(body=[function], type_ignores=[]), "<prompt composition>", "exec"), namespace) - dynamic code execution eval()/exec() tests/test_playbook_tools_integration.py :41
exec(compile(ast.Module(body=[function], type_ignores=[]), "<http dispatch>", "exec"), namespace) - dynamic code execution __import__ sink tests/test_postgres_private_binding.py :23
if __import__("os").name != "nt": - dynamic code execution eval()/exec() tests/test_powershell_generated_gate.py :33
exec(compile(source, "origin/main:permission_modes.py", "exec"), module.__dict__) - dynamic code execution pickle.loads() tests/test_preflight_service.py :54
restored = pickle.loads(pickle.dumps(report)) - dynamic code execution eval()/exec() tests/test_production_tier_evidence.py :216
exec(compile(ast.Module(body=functions, type_ignores=[]), "server.py", "exec"), namespace) - dynamic code execution __import__() tests/test_reflection_provenance.py :247
src = inspect.getsource(__import__(module)) - dynamic code execution eval()/exec() tests/test_ruff_latent_bugs_regressions.py :67
exec("from sonder_runtime.application.compaction import *", namespace) - dynamic code execution eval()/exec() tests/test_run_result_formatting.py :228
exec(compile(ast.Module(body=[node], type_ignores=[]), str(source), "exec"), scope) - dynamic code execution eval()/exec() tests/test_solver.py :15
exec(code + "\n" + check, ns) - dynamic code execution eval()/exec() tests/test_tier_generation_contract.py :342
exec(compile(module, "server.py", "exec"), namespace) - dynamic code execution __import__ sink tests/test_tool_audit_repository.py :119
@pytest.mark.skipif(not hasattr(__import__("os"), "geteuid"), reason="POSIX modes") - dynamic code execution __import__ sink tests/test_typed_runtime_export.py :19
assert __import__("os").environ["SONDER_HOST"] == "poisoned-host" - dynamic code execution __import__() tests/test_verifiers.py :674
mod = __import__(mod_name) - dynamic code execution __import__() tests/test_wp9_operations.py :29
tracer = BoundedTracer(exporter, cardinality=__import__( - dynamic code execution __import__() verifiers.py :915
mod = __import__(mod_name) - suspicious endpoint 169.254.169.254 (cloud metadata) tests/test_external_mcp.py :156
"http://169.254.169.254/mcp", - suspicious endpoint 8.8.8.8 tests/test_external_mcp.py :181
server = _server(endpoint="https://8.8.8.8/mcp", allow_remote=True) - suspicious endpoint 8.8.8.8 tests/test_local_service_probe.py :20
"http://8.8.8.8:80/", - suspicious endpoint 169.254.169.254 (cloud metadata) tests/test_local_service_probe.py :226
302, {"location": "http://169.254.169.254:80/latest/meta-data"}, - suspicious endpoint 169.254.169.254 (cloud metadata) tests/test_safety_eval.py :245
policy.check("https://169.254.169.254/metadata") - suspicious endpoint 8.8.8.8 tests/test_sonder_inference_private_workers.py :141
("https://8.8.8.8:443", "not a private-network address"), - suspicious endpoint 169.254.169.254 (cloud metadata) tests/test_update_manifest_trust.py :301
sonder_updates._assert_public_update_source("http://169.254.169.254/x") - suspicious endpoint 8.8.8.8 tests/test_update_manifest_trust.py :305
addresses = sonder_updates._assert_public_update_source("http://8.8.8.8/x") - committed secret OpenAI key tests/fixtures/session_export_parity.py :15
sk-par…(32 chars, redacted) - committed secret Anthropic key tests/test_playbook_safety_gates.py :18
sk-ant…(49 chars, redacted) - committed secret GitHub token tests/test_redaction_domain_seam.py :54
ghp_16…(40 chars, redacted) - committed secret private key tests/test_session_export_redaction.py :41
PEM private key block (redacted) - committed secret Anthropic key tests/test_session_export_redaction.py :49
sk-ant…(49 chars, redacted)
other grade factors
- recent drift +20 capability drift →
embed badge
[](https://mcpobservatory.com/servers/github:Krilliac/Sonder-runtime/security) Heuristic, inferred signals — false positives (legitimately powerful tools, forks, language ports) are expected. Treat each as "review this", not a verdict. See the ecosystem-wide picture on the security hub, or the fleet security of Krilliac.