CUGA is an open-source generalist agent harness for the enterprise, supporting complex task execution on web and APIs, OpenAPI/MCP integrations, composable architecture, reasoning modes, and policy-aware features.
- capability exposure inferred + 35
- recent drift inferred + 20
- inherited (deps) attested + 15
- tool safety inferred + 25
- trust mitigators mixed − 8
attested inferred mixed
The A–E grade is our heuristic synthesis — a "review this" prompt, not a verdict. Each factor is tagged by what backs it: attested (a verifiable record), reported (a third party's claim), or inferred (our own heuristic, e.g. permissions). See methodology.
grade last moved 3d ago · see ecosystem CVEs →
- D · 69 → E · 87
- D · 62 → D · 69
- C · 52 → D · 62
- C · 44 → C · 52
- A · 0 → C · 44
No known CVEs for this server.
inherited (deps) · grade factor +15
- high dangerous code
committed secret: Slack token · dynamic exec: __import__ sink, eval()/exec()
- medium tool shadowing send_email
tool "send_email" shadows a verified server's tool
- medium toxic flow (lethal trifecta)
lethal trifecta reachable across this server's tool + source surface: private-data access + untrusted-content ingestion + network exfil (a leg is proven only in the analyzed source)
- low dangerous code
env-secret-flows-to-network-js: A process environment value (often a secret/token) flows into a network call — possible credential exfiltration. (cuga-project-cuga-agent-259a90b/sr
- low dangerous code
env-secret-flows-to-network-js: A process environment value (often a secret/token) flows into a network call — possible credential exfiltration. (cuga-project-cuga-agent-259a90b/sr
analyzed commit ff48a6b · analyzer v33 · 15h ago
skills & prompt files 9
- skill cuga-project-cuga-agent-ff48a6b/.bob/skills/cuga-contributor-workflows/SKILL.md
- skill cuga-project-cuga-agent-ff48a6b/.bob/skills/cuga-github-issues/SKILL.md
- skill cuga-project-cuga-agent-ff48a6b/.claude/skills/cuga-contributor-workflows/SKILL.md
- skill cuga-project-cuga-agent-ff48a6b/.claude/skills/cuga-github-issues/SKILL.md
- skill cuga-project-cuga-agent-ff48a6b/.cursor/skills/cuga-contributor-workflows/SKILL.md
- skill cuga-project-cuga-agent-ff48a6b/.cursor/skills/cuga-github-issues/SKILL.md
- agent-rules cuga-project-cuga-agent-ff48a6b/AGENTS.md
- agent-rules cuga-project-cuga-agent-ff48a6b/CLAUDE.md
- agent-rules cuga-project-cuga-agent-ff48a6b/src/cuga/backend/cuga_graph/nodes/AGENTS.md
danger signals21
- dynamic code execution __import__ sink cuga-project-cuga-agent-ff48a6b/src/cuga/backend/browser_env/tools/playwright_commands.py :314
await page.goto(getattr(__import__("os"), "environ")[app_name.upper()], timeout=30000) - dynamic code execution eval()/exec() cuga-project-cuga-agent-ff48a6b/src/cuga/backend/cuga_graph/nodes/cuga_lite/executors/local/local_executor.py :95
exec(wrapped_code, restricted_globals, exec_locals) - dynamic code execution eval()/exec() cuga-project-cuga-agent-ff48a6b/src/cuga/backend/cuga_graph/nodes/cuga_lite/executors/tests/test_code_wrapper_freeze.py :44
exec(wrapped, g) - dynamic code execution eval()/exec() cuga-project-cuga-agent-ff48a6b/src/cuga/backend/cuga_graph/nodes/cuga_supervisor/tests/test_delegation_recording.py :171
exec(source, namespace, namespace) - dynamic code execution eval()/exec() cuga-project-cuga-agent-ff48a6b/src/cuga/backend/tools_env/code_sandbox/sandbox.py :254
exec(compiled_code, namespace, namespace) - dynamic code execution eval()/exec() cuga-project-cuga-agent-ff48a6b/src/cuga/sdk_core/tests/test_supervisor_advanced.py :159
exec( - dynamic code execution eval()/exec() cuga-project-cuga-agent-ff48a6b/src/system_tests/e2e/calculator_tool.py :69
result = eval(expression, {"__builtins__": {}}, allowed_names) - dynamic code execution eval()/exec() cuga-project-cuga-agent-ff48a6b/tests/events/test_arming_hitl.py :302
exec(compile(ast.Module(body=wanted, type_ignores=[]), "<door>", "exec"), ns) - dynamic code execution eval()/exec() cuga-project-cuga-agent-ff48a6b/tests/unit/test_knowledge_tool_stub.py :56
exec(compile(stub_src, "<stub>", "exec"), ns) - suspicious endpoint t.me cuga-project-cuga-agent-ff48a6b/src/cuga/backend/events/app.py :2870
how = f"open https://t.me/{bot}?start={token}" - suspicious endpoint api.telegram.org cuga-project-cuga-agent-ff48a6b/src/cuga/backend/events/telegram_direct.py :28
API = "https://api.telegram.org" - suspicious endpoint api.telegram.org cuga-project-cuga-agent-ff48a6b/tests/events/live_e2e.py :546
api = f"https://api.telegram.org/bot{tok}" - suspicious endpoint api.telegram.org cuga-project-cuga-agent-ff48a6b/tests/events/live_telegram_check.py :59
api = f"https://api.telegram.org/bot{tok}" - suspicious endpoint api.telegram.org cuga-project-cuga-agent-ff48a6b/tests/events/preflight.py :131
code, body = _http(f"https://api.telegram.org/bot{tok}/getMe", timeout=15) - over-broad OAuth scope admin:repo_hook cuga-project-cuga-agent-ff48a6b/src/cuga/backend/events/catalog.py :839
"(scopes repo + admin:repo_hook) — a pasted PAT is not accepted by AP's github piece", - over-broad OAuth scope gmail.modify cuga-project-cuga-agent-ff48a6b/src/cuga/backend/events/oauth.py :53
"scopes": ["https://www.googleapis.com/auth/gmail.modify"], - over-broad OAuth scope admin:repo_hook cuga-project-cuga-agent-ff48a6b/src/cuga/backend/events/oauth.py :88
"scopes": ["repo", "admin:repo_hook"], - over-broad OAuth scope admin:repo_hook cuga-project-cuga-agent-ff48a6b/src/cuga/backend/events/setup_guides.py :75
"approve. Requested scopes: repo + admin:repo_hook.", - over-broad OAuth scope admin:repo_hook cuga-project-cuga-agent-ff48a6b/tests/events/test_events_dimensions.py :491
assert set(oauth.provider("github")["scopes"]) == {"repo", "admin:repo_hook"} - committed secret Slack token cuga-project-cuga-agent-ff48a6b/docs/examples/travel_agent/.env.example :9
xoxb-y…(30 chars, redacted) - committed secret Slack token cuga-project-cuga-agent-ff48a6b/docs/examples/travel_agent/tools/slack.py :71
xoxb-y…(30 chars, redacted)
- recent drift +20 capability drift →
[](https://mcpobservatory.com/servers/github:cuga-project/cuga-agent/security) Heuristic, inferred signals — false positives (legitimately powerful tools, forks, language ports) are expected. Treat each as "review this", not a verdict. See the ecosystem-wide picture on the security hub, or the fleet security of cuga-project.