Where data access meets operational intelligence
E critical
- vulnerabilities attested + 50
- capability exposure inferred + 10
- recent drift inferred + 20
- tool safety inferred + 12
- trust mitigators mixed − 8
attested inferred mixed
The A–E grade is our heuristic synthesis — a "review this" prompt, not a verdict. Each factor is tagged by what backs it: attested (a verifiable record), reported (a third party's claim), or inferred (our own heuristic, e.g. permissions). See methodology.
graded 1m ago · see ecosystem CVEs →
- B · 34 → E · 84
- B · 26 → B · 34
Inferred surface — each links to servers holding it:
CRITICAL
Path traversal opening Sqlite3 database
EPSS 3%
HIGH
Parameter injection in DB connection URIs leading to local file inclusion
EPSS 1%
HIGH
Unbounded Memory Consumption in Authentication Middleware Can Lead to Denial of Service
- high dangerous code
committed secret: private key
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit 42bcb57 · analyzer v28 · 2d ago
skills & prompt files 10
- skill clidey-whodb-42bcb57/.agents/skills/impeccable/SKILL.md
- agent-rules clidey-whodb-42bcb57/AGENTS.md
- agent-rules clidey-whodb-42bcb57/CLAUDE.md
- skill clidey-whodb-42bcb57/cli/external-plugin/openai-skills/whodb/SKILL.md
- skill clidey-whodb-42bcb57/cli/external-plugin/whodb/skills/query-builder/SKILL.md
- skill clidey-whodb-42bcb57/cli/external-plugin/whodb/skills/schema-designer/SKILL.md
- skill clidey-whodb-42bcb57/cli/external-plugin/whodb/skills/whodb/SKILL.md
- skill clidey-whodb-42bcb57/cli/skills/query-builder/SKILL.md
- skill clidey-whodb-42bcb57/cli/skills/schema-designer/SKILL.md
- skill clidey-whodb-42bcb57/cli/skills/whodb/SKILL.md
danger signals30
- committed secret private key clidey-whodb-42bcb57/core/src/common/ssl/tls_test.go :58
PEM private key block (redacted) - committed secret private key clidey-whodb-42bcb57/dev/certs/ca/clickhouse/ca-key.pem :1
PEM private key block (redacted) - committed secret private key clidey-whodb-42bcb57/dev/certs/ca/cockroachdb/ca-key.pem :1
PEM private key block (redacted) - committed secret private key clidey-whodb-42bcb57/dev/certs/ca/elasticsearch/ca-key.pem :1
PEM private key block (redacted) - committed secret private key clidey-whodb-42bcb57/dev/certs/ca/mariadb/ca-key.pem :1
PEM private key block (redacted) - committed secret private key clidey-whodb-42bcb57/dev/certs/ca/memcached/ca-key.pem :1
PEM private key block (redacted) - committed secret private key clidey-whodb-42bcb57/dev/certs/ca/mongodb/ca-key.pem :1
PEM private key block (redacted) - committed secret private key clidey-whodb-42bcb57/dev/certs/ca/mysql/ca-key.pem :1
PEM private key block (redacted) - committed secret private key clidey-whodb-42bcb57/dev/certs/ca/postgres/ca-key.pem :1
PEM private key block (redacted) - committed secret private key clidey-whodb-42bcb57/dev/certs/ca/redis/ca-key.pem :1
PEM private key block (redacted) - committed secret private key clidey-whodb-42bcb57/dev/certs/client/clickhouse/client-key.pem :1
PEM private key block (redacted) - committed secret private key clidey-whodb-42bcb57/dev/certs/client/cockroachdb/client-key.pem :1
PEM private key block (redacted) - committed secret private key clidey-whodb-42bcb57/dev/certs/client/elasticsearch/client-key.pem :1
PEM private key block (redacted) - committed secret private key clidey-whodb-42bcb57/dev/certs/client/mariadb/client-key.pem :1
PEM private key block (redacted) - committed secret private key clidey-whodb-42bcb57/dev/certs/client/memcached/client-key.pem :1
PEM private key block (redacted) - committed secret private key clidey-whodb-42bcb57/dev/certs/client/mongodb/client-key.pem :1
PEM private key block (redacted) - committed secret private key clidey-whodb-42bcb57/dev/certs/client/mysql/client-key.pem :1
PEM private key block (redacted) - committed secret private key clidey-whodb-42bcb57/dev/certs/client/postgres/client-key.pem :1
PEM private key block (redacted) - committed secret private key clidey-whodb-42bcb57/dev/certs/client/redis/client-key.pem :1
PEM private key block (redacted) - committed secret private key clidey-whodb-42bcb57/dev/certs/server/clickhouse/server-key.pem :1
PEM private key block (redacted) - committed secret private key clidey-whodb-42bcb57/dev/certs/server/cockroachdb/server-key.pem :1
PEM private key block (redacted) - committed secret private key clidey-whodb-42bcb57/dev/certs/server/elasticsearch/server-key.pem :1
PEM private key block (redacted) - committed secret private key clidey-whodb-42bcb57/dev/certs/server/mariadb/server-key.pem :1
PEM private key block (redacted) - committed secret private key clidey-whodb-42bcb57/dev/certs/server/memcached/server-key.pem :1
PEM private key block (redacted) - committed secret private key clidey-whodb-42bcb57/dev/certs/server/mongodb/mongodb.pem :25
PEM private key block (redacted) - committed secret private key clidey-whodb-42bcb57/dev/certs/server/mongodb/server-key.pem :1
PEM private key block (redacted) - committed secret private key clidey-whodb-42bcb57/dev/certs/server/mysql/server-key.pem :1
PEM private key block (redacted) - committed secret private key clidey-whodb-42bcb57/dev/certs/server/postgres/server-key.pem :1
PEM private key block (redacted) - committed secret private key clidey-whodb-42bcb57/dev/certs/server/redis/redis.pem :25
PEM private key block (redacted) - committed secret private key clidey-whodb-42bcb57/dev/certs/server/redis/server-key.pem :1
PEM private key block (redacted)
- recent drift +20 capability drift →
[](https://mcpobservatory.com/servers/github:clidey/whodb/security) Heuristic, inferred signals — false positives (legitimately powerful tools, forks, language ports) are expected. Treat each as "review this", not a verdict. See the ecosystem-wide picture on the security hub, or the fleet security of clidey.