github Python re-analysis due deep scan unknown

cuga-project/cuga-agent

v0.3.2

CUGA is an open-source generalist agent harness for the enterprise, supporting complex task execution on web and APIs, OpenAPI/MCP integrations, composable architecture, reasoning modes, and policy-aware features.

maintainer: cuga-project
licence: NOASSERTION
first seen: 2026-06-01
last seen: 2026-09-10
releases · 30d: 2
short id

Drift inferred · capture-to-capture

HIGH 2026-09-09 code analysis flagged dynamic code execution in cuga-project/cuga-agent
HIGH 2026-09-08 code analysis flagged dynamic code execution in cuga-project/cuga-agent
HIGH 2026-09-08 code analysis flagged dynamic code execution in cuga-project/cuga-agent
HIGH 2026-09-06 code analysis flagged dynamic code execution in cuga-project/cuga-agent
HIGH 2026-09-02 code analysis flagged dynamic code execution in cuga-project/cuga-agent
HIGH 2026-09-02 code analysis flagged dynamic code execution in cuga-project/cuga-agent
HIGH 2026-09-01 code analysis flagged dynamic code execution in cuga-project/cuga-agent
HIGH 2026-09-01 code analysis flagged dynamic code execution in cuga-project/cuga-agent
HIGH 2026-08-31 code analysis flagged dynamic code execution in cuga-project/cuga-agent
HIGH 2026-08-26 code analysis flagged dynamic code execution in cuga-project/cuga-agent
HIGH 2026-08-26 code analysis flagged dynamic code execution in cuga-project/cuga-agent
HIGH 2026-08-25 code analysis flagged dynamic code execution in cuga-project/cuga-agent
HIGH 2026-08-25 code analysis flagged dynamic code execution in cuga-project/cuga-agent
HIGH 2026-08-20 code analysis flagged dynamic code execution in cuga-project/cuga-agent
HIGH 2026-08-20 code analysis flagged dynamic code execution in cuga-project/cuga-agent
HIGH 2026-08-20 code analysis flagged dynamic code execution in cuga-project/cuga-agent
HIGH 2026-08-20 code analysis flagged dynamic code execution in cuga-project/cuga-agent
HIGH 2026-08-20 code analysis flagged dynamic code execution in cuga-project/cuga-agent
HIGH 2026-08-19 code analysis flagged dynamic code execution in cuga-project/cuga-agent
HIGH 2026-08-19 code analysis flagged dynamic code execution in cuga-project/cuga-agent

capabilities 14 tools

transport stdio · streamable-http · http · sse counts 14 tools · 0 res · 0 prompts permission surface via code analysis

tools

delete_knowledge_document
fetch_doc_page
filter_grep
get_ingestion_status
get_knowledge_status
ingest_knowledge
ingest_knowledge_url
list_emails
list_knowledge_documents
perform_ui_task
read_email
search_doc
search_knowledge
send_email

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit ff48a6b · analyzer v33 · 15h ago

skills & prompt files 9

danger signals21

dynamic code execution __import__ sink cuga-project-cuga-agent-ff48a6b/src/cuga/backend/browser_env/tools/playwright_commands.py :314 await page.goto(getattr(__import__("os"), "environ")[app_name.upper()], timeout=30000)
dynamic code execution eval()/exec() cuga-project-cuga-agent-ff48a6b/src/cuga/backend/cuga_graph/nodes/cuga_lite/executors/local/local_executor.py :95 exec(wrapped_code, restricted_globals, exec_locals)
dynamic code execution eval()/exec() cuga-project-cuga-agent-ff48a6b/src/cuga/backend/cuga_graph/nodes/cuga_lite/executors/tests/test_code_wrapper_freeze.py :44 exec(wrapped, g)
dynamic code execution eval()/exec() cuga-project-cuga-agent-ff48a6b/src/cuga/backend/cuga_graph/nodes/cuga_supervisor/tests/test_delegation_recording.py :171 exec(source, namespace, namespace)
dynamic code execution eval()/exec() cuga-project-cuga-agent-ff48a6b/src/cuga/backend/tools_env/code_sandbox/sandbox.py :254 exec(compiled_code, namespace, namespace)
dynamic code execution eval()/exec() cuga-project-cuga-agent-ff48a6b/src/cuga/sdk_core/tests/test_supervisor_advanced.py :159 exec(
dynamic code execution eval()/exec() cuga-project-cuga-agent-ff48a6b/src/system_tests/e2e/calculator_tool.py :69 result = eval(expression, {"__builtins__": {}}, allowed_names)
dynamic code execution eval()/exec() cuga-project-cuga-agent-ff48a6b/tests/events/test_arming_hitl.py :302 exec(compile(ast.Module(body=wanted, type_ignores=[]), "<door>", "exec"), ns)
dynamic code execution eval()/exec() cuga-project-cuga-agent-ff48a6b/tests/unit/test_knowledge_tool_stub.py :56 exec(compile(stub_src, "<stub>", "exec"), ns)
suspicious endpoint t.me cuga-project-cuga-agent-ff48a6b/src/cuga/backend/events/app.py :2870 how = f"open https://t.me/{bot}?start={token}"
suspicious endpoint api.telegram.org cuga-project-cuga-agent-ff48a6b/src/cuga/backend/events/telegram_direct.py :28 API = "https://api.telegram.org"
suspicious endpoint api.telegram.org cuga-project-cuga-agent-ff48a6b/tests/events/live_e2e.py :546 api = f"https://api.telegram.org/bot{tok}"
suspicious endpoint api.telegram.org cuga-project-cuga-agent-ff48a6b/tests/events/live_telegram_check.py :59 api = f"https://api.telegram.org/bot{tok}"
suspicious endpoint api.telegram.org cuga-project-cuga-agent-ff48a6b/tests/events/preflight.py :131 code, body = _http(f"https://api.telegram.org/bot{tok}/getMe", timeout=15)
over-broad OAuth scope admin:repo_hook cuga-project-cuga-agent-ff48a6b/src/cuga/backend/events/catalog.py :839 "(scopes repo + admin:repo_hook) — a pasted PAT is not accepted by AP's github piece",
over-broad OAuth scope gmail.modify cuga-project-cuga-agent-ff48a6b/src/cuga/backend/events/oauth.py :53 "scopes": ["https://www.googleapis.com/auth/gmail.modify"],
over-broad OAuth scope admin:repo_hook cuga-project-cuga-agent-ff48a6b/src/cuga/backend/events/oauth.py :88 "scopes": ["repo", "admin:repo_hook"],
over-broad OAuth scope admin:repo_hook cuga-project-cuga-agent-ff48a6b/src/cuga/backend/events/setup_guides.py :75 "approve. Requested scopes: repo + admin:repo_hook.",
over-broad OAuth scope admin:repo_hook cuga-project-cuga-agent-ff48a6b/tests/events/test_events_dimensions.py :491 assert set(oauth.provider("github")["scopes"]) == {"repo", "admin:repo_hook"}
committed secret Slack token cuga-project-cuga-agent-ff48a6b/docs/examples/travel_agent/.env.example :9 xoxb-y…(30 chars, redacted)
committed secret Slack token cuga-project-cuga-agent-ff48a6b/docs/examples/travel_agent/tools/slack.py :71 xoxb-y…(30 chars, redacted)

code evidence vv0.3.2 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 1151

filesystem 201

fs cuga-project-cuga-agent-ff48a6b/conftest.py :5 import shutil
fs (weak) cuga-project-cuga-agent-ff48a6b/docs/examples/a2a_two_cuga/_preflight.py :26 from pathlib import Path
fs (weak) cuga-project-cuga-agent-ff48a6b/docs/examples/demo_apps/setup/cli.py :13 from pathlib import Path
fs (weak) cuga-project-cuga-agent-ff48a6b/docs/examples/knowledge_demo/main.py :27 from pathlib import Path
fs (weak) cuga-project-cuga-agent-ff48a6b/docs/examples/travel_agent/agents/compliance_agent.py :22 from pathlib import Path
fs (weak) cuga-project-cuga-agent-ff48a6b/docs/examples/travel_agent/main.py :25 from pathlib import Path
fs (weak) cuga-project-cuga-agent-ff48a6b/scripts/checks/no_exc_in_responses.py :51 from pathlib import Path
fs (weak) cuga-project-cuga-agent-ff48a6b/scripts/codeql/check_sarif.py :35 from pathlib import Path
fs cuga-project-cuga-agent-ff48a6b/src/cuga/backend/activity_tracker/tracker.py :4 import shutil
fs cuga-project-cuga-agent-ff48a6b/src/cuga/backend/browser_env/browser/chat_async.py :10 from pathlib import Path
fs cuga-project-cuga-agent-ff48a6b/src/cuga/backend/browser_env/browser/gym_env_async.py :9 from pathlib import Path
fs cuga-project-cuga-agent-ff48a6b/src/cuga/backend/browser_env/browser/gym_obs/obs_async.py :266 img = PIL.Image.open(f)

show 28 more

fs cuga-project-cuga-agent-ff48a6b/src/cuga/backend/browser_env/browser/gym_obs/websocket_server.py :243 from pathlib import Path
fs cuga-project-cuga-agent-ff48a6b/src/cuga/backend/browser_env/page_understanding/extractor_utils/extract_async.py :303 img = PIL.Image.open(f)
fs cuga-project-cuga-agent-ff48a6b/src/cuga/backend/browser_env/page_understanding/nocodeui_pu_utils/nocode_utils.py :79 rules = yaml.safe_load(open(os.path.join(current_dir, 'rules.yaml')))
fs cuga-project-cuga-agent-ff48a6b/src/cuga/backend/cuga_graph/nodes/cuga_agent_core/policy/execution_policy.py :58 "avoid `os.path`, `open()`, or other local-filesystem calls when targeting sandbox paths."
fs cuga-project-cuga-agent-ff48a6b/src/cuga/backend/cuga_graph/nodes/cuga_lite/cuga_lite_graph.py :7 from pathlib import Path
fs cuga-project-cuga-agent-ff48a6b/src/cuga/backend/cuga_graph/nodes/cuga_lite/cuga_lite_node.py :149 from pathlib import Path
fs cuga-project-cuga-agent-ff48a6b/src/cuga/backend/cuga_graph/nodes/cuga_lite/executors/filesystem/backends.py :21 from pathlib import Path
fs cuga-project-cuga-agent-ff48a6b/src/cuga/backend/cuga_graph/nodes/cuga_lite/executors/filesystem/paths.py :21 import shutil
fs (weak) cuga-project-cuga-agent-ff48a6b/src/cuga/backend/cuga_graph/nodes/cuga_lite/executors/filesystem/tests/test_workspace_fs.py :13 from pathlib import Path
fs cuga-project-cuga-agent-ff48a6b/src/cuga/backend/cuga_graph/nodes/cuga_lite/executors/filesystem/workspace_fs.py :23 from pathlib import PurePosixPath
fs cuga-project-cuga-agent-ff48a6b/src/cuga/backend/cuga_graph/nodes/cuga_lite/executors/local/local_sandbox_executor.py :25 import shutil
fs cuga-project-cuga-agent-ff48a6b/src/cuga/backend/cuga_graph/nodes/cuga_lite/executors/native/native_sandbox_executor.py :24 import shutil
fs cuga-project-cuga-agent-ff48a6b/src/cuga/backend/cuga_graph/nodes/cuga_lite/executors/opensandbox/opensandbox_executor.py :35 from pathlib import Path
fs (weak) cuga-project-cuga-agent-ff48a6b/src/cuga/backend/cuga_graph/nodes/cuga_lite/executors/tests/test_code_executor.py :431 code = "import pathlib\np = pathlib.Path('.')\nprint(p.name or '.')"
fs (weak) cuga-project-cuga-agent-ff48a6b/src/cuga/backend/cuga_graph/nodes/cuga_lite/executors/tests/test_code_wrapper_freeze.py :17 import pathlib
fs (weak) cuga-project-cuga-agent-ff48a6b/src/cuga/backend/cuga_graph/nodes/cuga_lite/executors/tests/test_local_sandbox_skills.py :18 from pathlib import Path
fs (weak) cuga-project-cuga-agent-ff48a6b/src/cuga/backend/cuga_graph/nodes/cuga_lite/executors/tests/test_security_validator.py :38 ("open('/tmp/x')", "file access|open"),
fs (weak) cuga-project-cuga-agent-ff48a6b/src/cuga/backend/cuga_graph/nodes/cuga_lite/executors/tests/test_tool_call_budget_levels.py :13 from pathlib import Path
fs cuga-project-cuga-agent-ff48a6b/src/cuga/backend/cuga_graph/nodes/cuga_lite/helpers/find_tools.py :6 from pathlib import Path
fs (weak) cuga-project-cuga-agent-ff48a6b/src/cuga/backend/cuga_graph/nodes/cuga_lite/tests/test_schema_trim_appworld_corpus.py :6 from pathlib import Path
fs (weak) cuga-project-cuga-agent-ff48a6b/src/cuga/backend/cuga_graph/nodes/cuga_lite/tests/test_schema_trim_public_corpus.py :6 from pathlib import Path
fs cuga-project-cuga-agent-ff48a6b/src/cuga/backend/cuga_graph/nodes/cuga_supervisor/nodes/prepare_agents_and_prompt.py :6 from pathlib import Path
fs (weak) cuga-project-cuga-agent-ff48a6b/src/cuga/backend/cuga_graph/nodes/cuga_supervisor/tests/test_supervisor_tool_call_cap.py :11 from pathlib import Path
fs cuga-project-cuga-agent-ff48a6b/src/cuga/backend/cuga_graph/policy/filesystem_sync.py :200 with open(file_path, 'w', encoding='utf-8') as f:
fs cuga-project-cuga-agent-ff48a6b/src/cuga/backend/cuga_graph/policy/folder_loader.py :9 from pathlib import Path
fs (weak) cuga-project-cuga-agent-ff48a6b/src/cuga/backend/cuga_graph/policy/tests/test_filesystem_sync.py :14 import shutil
fs (weak) cuga-project-cuga-agent-ff48a6b/src/cuga/backend/cuga_graph/policy/tests/test_similarity_integration.py :6 from pathlib import Path
fs cuga-project-cuga-agent-ff48a6b/src/cuga/backend/cuga_graph/policy/tool_guard/manager.py :11 import shutil

161 more not shown — this panel samples each group; the count above is the real total.

shell / exec 29

shell (weak) cuga-project-cuga-agent-ff48a6b/docs/examples/demo_apps/setup/cli.py :9 import subprocess
shell (weak) cuga-project-cuga-agent-ff48a6b/src/cuga/backend/cuga_graph/nodes/cuga_lite/executors/tests/test_security_validator.py :47 ("os.system('ls')", "os"),
shell (weak) cuga-project-cuga-agent-ff48a6b/src/cuga/backend/cuga_graph/policy/tests/test_policy_observability.py :3 import subprocess
shell cuga-project-cuga-agent-ff48a6b/src/cuga/backend/server/main.py :9 import subprocess
shell (weak) cuga-project-cuga-agent-ff48a6b/src/cuga/backend/tools_env/registry/tests/test_auth/test_auth_e2e.py :12 import subprocess
shell (weak) cuga-project-cuga-agent-ff48a6b/src/cuga/backend/tools_env/registry/tests/test_e2e_api_registry.py :13 import subprocess
shell (weak) cuga-project-cuga-agent-ff48a6b/src/cuga/backend/tools_env/registry/tests/test_output_schema.py :13 import subprocess
shell cuga-project-cuga-agent-ff48a6b/src/cuga/cli/main.py :6 import subprocess
shell (weak) cuga-project-cuga-agent-ff48a6b/src/cuga/demo_tools/crm/run_tests.py :7 import subprocess
shell (weak) cuga-project-cuga-agent-ff48a6b/src/cuga/sdk_core/tests/test_invoke_result_policy_decisions.py :3 import subprocess
shell (weak) cuga-project-cuga-agent-ff48a6b/src/scripts/build_embedded.py :7 import subprocess
shell (weak) cuga-project-cuga-agent-ff48a6b/src/scripts/build_standalone.py :6 import subprocess

show 17 more

shell (weak) cuga-project-cuga-agent-ff48a6b/src/scripts/commands.py :2 import subprocess
shell (weak) cuga-project-cuga-agent-ff48a6b/src/system_tests/e2e/port_manager.py :9 import subprocess
shell (weak) cuga-project-cuga-agent-ff48a6b/src/system_tests/e2e/server_stack.py :8 import subprocess
shell (weak) cuga-project-cuga-agent-ff48a6b/src/system_tests/profiling/memory/import_memory_breakdown.py :23 import subprocess
shell (weak) cuga-project-cuga-agent-ff48a6b/src/system_tests/profiling/memory/measure_sdk_memory.py :17 import subprocess
shell (weak) cuga-project-cuga-agent-ff48a6b/src/system_tests/profiling/memory/measure_server_memory.py :43 import subprocess
shell (weak) cuga-project-cuga-agent-ff48a6b/src/system_tests/profiling/memory/measure_tree_memory.py :25 import subprocess
shell (weak) cuga-project-cuga-agent-ff48a6b/src/system_tests/profiling/memory/tracemalloc_report.py :22 import subprocess
shell (weak) cuga-project-cuga-agent-ff48a6b/src/system_tests/profiling/startup/import_breakdown.py :15 import subprocess
shell (weak) cuga-project-cuga-agent-ff48a6b/src/system_tests/profiling/startup/measure_sdk_startup.py :14 import subprocess
shell (weak) cuga-project-cuga-agent-ff48a6b/src/system_tests/profiling/startup/measure_server_startup.py :22 import subprocess
shell (weak) cuga-project-cuga-agent-ff48a6b/tests/e2e/skills/test_skills_presentation_e2e.py :30 import subprocess
shell (weak) cuga-project-cuga-agent-ff48a6b/tests/events/live_exhaustive.py :30 import subprocess
shell (weak) cuga-project-cuga-agent-ff48a6b/tests/events/preflight.py :107 import subprocess
shell (weak) cuga-project-cuga-agent-ff48a6b/tests/system/test_manager_api_integration.py :18 import subprocess
shell (weak) cuga-project-cuga-agent-ff48a6b/tests/unit/test_e2e_server_stack.py :5 import subprocess
shell (weak) cuga-project-cuga-agent-ff48a6b/tests/unit/test_final_answer_function.py :329 import subprocess

network 119

net (weak) cuga-project-cuga-agent-ff48a6b/docs/examples/cuga_with_runtime_tools/fast_mcp_example.py :8 import httpx
net cuga-project-cuga-agent-ff48a6b/src/cuga/backend/cuga_graph/nodes/chat/chat_agent/chat_agent.py :6 import aiohttp
net cuga-project-cuga-agent-ff48a6b/src/cuga/backend/cuga_graph/nodes/cuga_lite/executors/common/call_api_helper.py :30 from urllib.parse import quote
net (weak) cuga-project-cuga-agent-ff48a6b/src/cuga/backend/cuga_graph/nodes/cuga_lite/executors/tests/test_security_validator.py :20 'payload = {"hint": "import requests carefully"}',
net (weak) cuga-project-cuga-agent-ff48a6b/src/cuga/backend/cuga_graph/nodes/cuga_lite/executors/tests/test_tool_call_timeout.py :90 'cuga.backend.cuga_graph.nodes.cuga_lite.providers.registry.aiohttp.ClientSession'
net cuga-project-cuga-agent-ff48a6b/src/cuga/backend/cuga_graph/nodes/cuga_lite/helpers/app_auth.py :1 import httpx
net cuga-project-cuga-agent-ff48a6b/src/cuga/backend/cuga_graph/nodes/cuga_lite/providers/combined.py :11 import aiohttp
net cuga-project-cuga-agent-ff48a6b/src/cuga/backend/cuga_graph/nodes/cuga_lite/providers/registry.py :12 import aiohttp
net cuga-project-cuga-agent-ff48a6b/src/cuga/backend/cuga_graph/nodes/cuga_supervisor/a2a_protocol.py :21 import httpx
net (weak) cuga-project-cuga-agent-ff48a6b/src/cuga/backend/cuga_graph/policy/tests/conftest.py :10 # ChatWatsonx caches an httpx.AsyncClient bound to the pytest event loop.
net cuga-project-cuga-agent-ff48a6b/src/cuga/backend/events/ap_engine.py :19 import httpx
net cuga-project-cuga-agent-ff48a6b/src/cuga/backend/events/app.py :545 import httpx

show 28 more

net cuga-project-cuga-agent-ff48a6b/src/cuga/backend/events/box_direct.py :23 import httpx
net cuga-project-cuga-agent-ff48a6b/src/cuga/backend/events/capability.py :14 import urllib.error
net cuga-project-cuga-agent-ff48a6b/src/cuga/backend/events/cuga_door.py :56 import httpx
net cuga-project-cuga-agent-ff48a6b/src/cuga/backend/events/direct_events.py :97 import httpx
net cuga-project-cuga-agent-ff48a6b/src/cuga/backend/events/discord_direct.py :23 import httpx
net cuga-project-cuga-agent-ff48a6b/src/cuga/backend/events/llm.py :23 import httpx
net cuga-project-cuga-agent-ff48a6b/src/cuga/backend/events/native_scheduler.py :25 import httpx
net cuga-project-cuga-agent-ff48a6b/src/cuga/backend/events/oauth.py :280 from urllib.parse import urlencode
net cuga-project-cuga-agent-ff48a6b/src/cuga/backend/events/runtime.py :279 import httpx
net cuga-project-cuga-agent-ff48a6b/src/cuga/backend/events/slack_direct.py :26 import httpx
net cuga-project-cuga-agent-ff48a6b/src/cuga/backend/events/telegram_direct.py :24 import httpx
net cuga-project-cuga-agent-ff48a6b/src/cuga/backend/events/tools_bridge.py :16 import httpx
net cuga-project-cuga-agent-ff48a6b/src/cuga/backend/evolve/integration.py :13 import aiohttp
net cuga-project-cuga-agent-ff48a6b/src/cuga/backend/knowledge/engine.py :17 import socket
net cuga-project-cuga-agent-ff48a6b/src/cuga/backend/knowledge/mcp_server.py :15 import httpx
net cuga-project-cuga-agent-ff48a6b/src/cuga/backend/llm/models.py :8 from urllib.parse import urlsplit
net cuga-project-cuga-agent-ff48a6b/src/cuga/backend/server/auth/dependencies.py :3 import httpx
net cuga-project-cuga-agent-ff48a6b/src/cuga/backend/server/auth/issuer_allowlist.py :6 from urllib.parse import urlparse, urlunparse
net cuga-project-cuga-agent-ff48a6b/src/cuga/backend/server/auth/jwt_validator.py :3 from urllib.parse import urlparse, urlunparse
net cuga-project-cuga-agent-ff48a6b/src/cuga/backend/server/auth/oidc_client.py :7 from urllib.parse import quote, urlencode
net cuga-project-cuga-agent-ff48a6b/src/cuga/backend/server/events_bridge.py :131 import httpx
net cuga-project-cuga-agent-ff48a6b/src/cuga/backend/server/main.py :13 import httpx
net cuga-project-cuga-agent-ff48a6b/src/cuga/backend/server/manage_routes/apply.py :6 import httpx
net cuga-project-cuga-agent-ff48a6b/src/cuga/backend/server/manage_routes/draft_routes.py :5 import httpx
net cuga-project-cuga-agent-ff48a6b/src/cuga/backend/server/manage_routes/knowledge_routes.py :5 import httpx
net cuga-project-cuga-agent-ff48a6b/src/cuga/backend/server/manage_routes/llm_routes.py :5 import httpx
net cuga-project-cuga-agent-ff48a6b/src/cuga/backend/tools_env/code_sandbox/e2b_sandbox.py :625 from urllib.parse import quote
net cuga-project-cuga-agent-ff48a6b/src/cuga/backend/tools_env/code_sandbox/sandbox.py :5 from urllib.parse import quote

79 more not shown — this panel samples each group; the count above is the real total.

secrets 33

secrets (weak) cuga-project-cuga-agent-ff48a6b/docs/examples/travel_agent/tools/flights.py :45 api_key = os.getenv("SERPAPI_API_KEY")
secrets (weak) cuga-project-cuga-agent-ff48a6b/docs/examples/travel_agent/tools/hotels.py :40 api_key = os.getenv("SERPAPI_API_KEY")
secrets (weak) cuga-project-cuga-agent-ff48a6b/docs/examples/travel_agent/tools/slack.py :55 token = os.getenv("SLACK_BOT_TOKEN", "")
secrets (weak) cuga-project-cuga-agent-ff48a6b/src/cuga/backend/cuga_graph/nodes/cuga_lite/executors/tests/test_e2b_direct.py :13 not os.environ.get("E2B_API_KEY"),
secrets cuga-project-cuga-agent-ff48a6b/src/cuga/backend/cuga_graph/nodes/cuga_lite/shortlister/embedding.py :129 api_key = cfg.get("api_key") or os.environ.get("OPENAI_API_KEY")
secrets cuga-project-cuga-agent-ff48a6b/src/cuga/backend/events/ap_engine.py :55 self.gateway_token = os.environ.get("GATEWAY_TOKEN", "")
secrets cuga-project-cuga-agent-ff48a6b/src/cuga/backend/events/app.py :121 if not os.environ.get("EVENTS_WEBHOOK_KEY"):
secrets cuga-project-cuga-agent-ff48a6b/src/cuga/backend/events/cuga_door.py :43 (os.environ.get("CUGA_RUN_TOKEN") or os.environ.get("GATEWAY_TOKEN") or "").split(" #", 1)[0].strip()
secrets cuga-project-cuga-agent-ff48a6b/src/cuga/backend/events/llm.py :136 if os.getenv("RITS_API_KEY"):
secrets cuga-project-cuga-agent-ff48a6b/src/cuga/backend/events/runtime.py :254 or (os.environ.get("CUGA_RUN_TOKEN") or os.environ.get("GATEWAY_TOKEN") or "")
secrets cuga-project-cuga-agent-ff48a6b/src/cuga/backend/events/service.py :153 "http", agent_store=agents, cuga_url=cuga_url, cuga_token=os.environ.get("CUGA_RUN_TOKEN", "")
secrets cuga-project-cuga-agent-ff48a6b/src/cuga/backend/knowledge/engine.py :1647 api_key = (config.embedding_api_key or os.environ.get("OPENAI_API_KEY") or "").strip()

show 21 more

secrets cuga-project-cuga-agent-ff48a6b/src/cuga/backend/llm/models.py :1217 api_key = _normalize_secret(resolve_secret("GROQ_API_KEY")) or os.environ.get("GROQ_API_KEY")
secrets cuga-project-cuga-agent-ff48a6b/src/cuga/backend/server/auth/oidc_client.py :230 client_secret = os.getenv("OIDC_CLIENT_SECRET")
secrets cuga-project-cuga-agent-ff48a6b/src/cuga/backend/server/events_bridge.py :134 tok = (os.environ.get("GATEWAY_TOKEN", "") or "").split(" #", 1)[0].strip()
secrets cuga-project-cuga-agent-ff48a6b/src/cuga/backend/server/main.py :1065 embedding_api_key=os.getenv("STORAGE_EMBEDDING_API_KEY")
secrets cuga-project-cuga-agent-ff48a6b/src/cuga/backend/server/run_routes.py :207 return (os.environ.get("CUGA_RUN_TOKEN") or os.environ.get("GATEWAY_TOKEN") or "").strip()
secrets cuga-project-cuga-agent-ff48a6b/src/cuga/backend/storage/embedding/embedding_service.py :107 key = api_key or os.environ.get("OPENAI_API_KEY")
secrets cuga-project-cuga-agent-ff48a6b/src/cuga/backend/tools_env/registry/registry/api_registry.py :42 api_key = os.getenv("TAVILY_API_KEY")
secrets cuga-project-cuga-agent-ff48a6b/src/cuga/evaluation/langfuse/get_langfuse_data.py :42 langfuse_secret_key = os.getenv('LANGFUSE_SECRET_KEY', None)
secrets (weak) cuga-project-cuga-agent-ff48a6b/src/system_tests/load/load_test.py :51 if not os.getenv("E2B_API_KEY"):
secrets (weak) cuga-project-cuga-agent-ff48a6b/src/system_tests/load/load_test_with_mocked_llm.py :61 if not os.getenv("E2B_API_KEY"):
secrets (weak) cuga-project-cuga-agent-ff48a6b/src/system_tests/profiling/bin/profile_digital_sales_tasks.py :824 langfuse_secret_key = config.profiling.langfuse.get('secret_key') or os.getenv('LANGFUSE_SECRET_KEY')
secrets (weak) cuga-project-cuga-agent-ff48a6b/tests/events/live_credentials_check.py :34 TOKEN = os.environ.get("TELEGRAM_BOT_TOKEN", "")
secrets (weak) cuga-project-cuga-agent-ff48a6b/tests/events/live_identity_check.py :19 TOKEN = os.environ.get("GATEWAY_TOKEN", "")
secrets (weak) cuga-project-cuga-agent-ff48a6b/tests/events/live_phase2_watchers.py :88 headers={"X-Gateway-Token": os.environ.get("GATEWAY_TOKEN", "")},
secrets (weak) cuga-project-cuga-agent-ff48a6b/tests/events/live_slack_inbound_check.py :37 SECRET = os.environ.get("SLACK_SIGNING_SECRET", "")
secrets (weak) cuga-project-cuga-agent-ff48a6b/tests/events/live_stage2_channels.py :20 TOKEN = os.environ.get("GATEWAY_TOKEN", "")
secrets (weak) cuga-project-cuga-agent-ff48a6b/tests/events/preflight.py :73 "grant_type=urn:ibm:params:oauth:grant-type:apikey&apikey=" + os.environ["WATSONX_APIKEY"]
secrets (weak) cuga-project-cuga-agent-ff48a6b/tests/events/test_events_dimensions.py :38 os.environ["TELEGRAM_BOT_TOKEN"] = "x"
secrets (weak) cuga-project-cuga-agent-ff48a6b/tests/events/test_events_studio_api.py :295 os.environ["BOX_DEV_TOKEN"] = "t"
secrets (weak) cuga-project-cuga-agent-ff48a6b/tests/integration/test_context_summarization.py :36 pytest.mark.skipif(not os.getenv("OPENAI_API_KEY"), reason="OPENAI_API_KEY not set"),
secrets (weak) cuga-project-cuga-agent-ff48a6b/tests/integration/test_vault_llm_secret_hydration.py :60 monkeypatch.setenv("VAULT_TOKEN", os.environ.get("VAULT_TOKEN", "dev-root"))

database 21

db (weak) cuga-project-cuga-agent-ff48a6b/docs/examples/a2a_two_cuga/_preflight.py :24 import sqlite3
db cuga-project-cuga-agent-ff48a6b/src/cuga/backend/events/db.py :48 import sqlite3
db cuga-project-cuga-agent-ff48a6b/src/cuga/backend/events/db_persist.py :43 import sqlite3
db cuga-project-cuga-agent-ff48a6b/src/cuga/backend/knowledge/metadata/sqlite_store.py :10 import sqlite3
db cuga-project-cuga-agent-ff48a6b/src/cuga/backend/knowledge/storage/adapter.py :8 import sqlite3
db cuga-project-cuga-agent-ff48a6b/src/cuga/backend/storage/embedding/local.py :2 import sqlite3
db cuga-project-cuga-agent-ff48a6b/src/cuga/backend/storage/embedding/prod.py :28 import asyncpg
db cuga-project-cuga-agent-ff48a6b/src/cuga/backend/storage/relational/local.py :2 import sqlite3
db cuga-project-cuga-agent-ff48a6b/src/cuga/backend/storage/relational/prod.py :5 import asyncpg
db cuga-project-cuga-agent-ff48a6b/src/cuga/demo_tools/crm/crm_api/accounts.py :1 import sqlite3
db cuga-project-cuga-agent-ff48a6b/src/cuga/demo_tools/crm/crm_api/contacts.py :1 import sqlite3
db cuga-project-cuga-agent-ff48a6b/src/cuga/demo_tools/crm/crm_api/crud.py :1 import sqlite3

show 9 more

db cuga-project-cuga-agent-ff48a6b/src/cuga/demo_tools/crm/crm_api/database.py :2 import sqlite3
db cuga-project-cuga-agent-ff48a6b/src/cuga/demo_tools/crm/crm_api/leads.py :1 import sqlite3
db cuga-project-cuga-agent-ff48a6b/src/cuga/demo_tools/crm/crm_api/opportunities.py :1 import sqlite3
db cuga-project-cuga-agent-ff48a6b/src/cuga/demo_tools/crm/crm_api/seed_data.py :1 import sqlite3
db (weak) cuga-project-cuga-agent-ff48a6b/src/cuga/demo_tools/crm/tests/conftest.py :1 import sqlite3
db (weak) cuga-project-cuga-agent-ff48a6b/src/cuga/demo_tools/crm/tests/test_workspace_workflow.py :10 import sqlite3
db (weak) cuga-project-cuga-agent-ff48a6b/tests/events/test_db_persist.py :8 import sqlite3
db (weak) cuga-project-cuga-agent-ff48a6b/tests/unit/test_config_db_reset_wal_sidecars.py :10 import sqlite3
db (weak) cuga-project-cuga-agent-ff48a6b/tests/unit/test_knowledge_local_add_many.py :6 import sqlite3

tool registrations 14

search_knowledge cuga-project-cuga-agent-ff48a6b/src/cuga/backend/knowledge/mcp_server.py :199
ingest_knowledge cuga-project-cuga-agent-ff48a6b/src/cuga/backend/knowledge/mcp_server.py :254
ingest_knowledge_url cuga-project-cuga-agent-ff48a6b/src/cuga/backend/knowledge/mcp_server.py :287
list_knowledge_documents cuga-project-cuga-agent-ff48a6b/src/cuga/backend/knowledge/mcp_server.py :308
delete_knowledge_document cuga-project-cuga-agent-ff48a6b/src/cuga/backend/knowledge/mcp_server.py :328
get_ingestion_status cuga-project-cuga-agent-ff48a6b/src/cuga/backend/knowledge/mcp_server.py :348
get_knowledge_status cuga-project-cuga-agent-ff48a6b/src/cuga/backend/knowledge/mcp_server.py :365
perform_ui_task cuga-project-cuga-agent-ff48a6b/src/cuga/backend/server/mcp_servers/cuga.py :26
search_doc cuga-project-cuga-agent-ff48a6b/src/cuga/demo_tools/docs_mcp/docs_mcp_server.py :89
fetch_doc_page cuga-project-cuga-agent-ff48a6b/src/cuga/demo_tools/docs_mcp/docs_mcp_server.py :111
filter_grep cuga-project-cuga-agent-ff48a6b/src/cuga/demo_tools/docs_mcp/docs_mcp_server.py :251
send_email cuga-project-cuga-agent-ff48a6b/src/cuga/demo_tools/email_mcp/mcp_server/server.py :99

show 2 more

list_emails cuga-project-cuga-agent-ff48a6b/src/cuga/demo_tools/email_mcp/mcp_server/server.py :125
read_email cuga-project-cuga-agent-ff48a6b/src/cuga/demo_tools/email_mcp/mcp_server/server.py :165

declared dependencies 23

Error@generating summary: ...
middleware_invocation_failed@: ...
langchain@>=1.3.9,<1.3.15
langchain-ibm@>=0.3.9
ibm-watsonx-ai@>=1.5.13; python_version>=
easyocr@*
torch@>=2.13.0
torchvision@*
langchain-ollama@>=0.2.0
langchain-text-splitters@>=1.0,<2.0
beautifulsoup4@>=4.12
psycopg@>=3.2

show 11 more

toolguard@>=0.2.17
cuga-oak-health@; python_version>=
rapidfuzz@*
e2b-code-interpreter@>=2.4.1
opensandbox@*
opensandbox-code-interpreter@*
altk-evolve@>=1.1.0; python_version>=
ibm-watsonx-orchestrate-sdk@>=2.15.0; python_version>=
openlit@>=1.40.3
memray@>=1.11; sys_platform !=
and@python_version <

cursor-plugin 1

opaque (low) cuga-project-cuga-agent-ff48a6b/.cursor/skills/cuga-contributor-workflows/SKILL.md bundled .cursor/ plugin descriptor (cuga-project-cuga-agent-ff48a6b/.cursor/skills/cuga-contributor-workflows/SKILL.md) — presence-detected; review the descriptor

perm:untrusted 4

untrusted (weak) cuga-project-cuga-agent-ff48a6b/docs/examples/cuga_with_runtime_tools/fast_mcp_example.py :49 spec = httpx.get(OPENAPI_SPEC_URL).json()
untrusted cuga-project-cuga-agent-ff48a6b/src/cuga/demo_tools/crm/crm_api/run_all.py :30 spec = httpx.get(f"{api_base_url}/openapi.json", timeout=5.0).json()
untrusted cuga-project-cuga-agent-ff48a6b/src/cuga/demo_tools/crm/crm_api/wrap_as_mcp.py :51 spec = httpx.get(OPENAPI_SPEC_URL).json()
untrusted cuga-project-cuga-agent-ff48a6b/src/cuga/demo_tools/crm/wrap_as_mcp.py :49 spec = httpx.get(OPENAPI_SPEC_URL).json()

transport_posture 4

network-listening, binds all interfaces, no auth detected cuga-project-cuga-agent-ff48a6b/docs/examples/digital_sales_openapi/main.py :400 uvicorn.run(app, host="0.0.0.0", port=8888)
network-listening, binds all interfaces, no auth detected cuga-project-cuga-agent-ff48a6b/src/cuga/backend/server/debug_server.py :12 uvicorn.run(app, host="0.0.0.0", port=port, reload=False, log_level="info")
binds all interfaces (0.0.0.0) cuga-project-cuga-agent-ff48a6b/src/cuga/backend/tools_env/registry/tests/test_auth/auth_server.py :146 uvicorn.run(app, host="0.0.0.0", port=8002, log_level="info")
network-listening, binds all interfaces, no auth detected cuga-project-cuga-agent-ff48a6b/tests/events/live_phase2_watchers.py :74 uvicorn.Server(uvicorn.Config(fa, host="0.0.0.0", port=PORT, log_level="error")).run()