SAM
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport http counts 0 tools · 0 res
· 0 prompts
permission surface via code analysis
No tools enumerated yet for this server.
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit da4651c · analyzer v33 · 1d ago
skills & prompt files 4
danger signals3
- committed secret private key google-sam-da4651c/site/content/docs/manifests/mock-oidc.yaml :26
PEM private key block (redacted) - committed secret private key google-sam-da4651c/tests/e2e/docker/mock_oidc.py :10
PEM private key block (redacted) - committed secret private key google-sam-da4651c/tests/e2e/policy.bats :37
PEM private key block (redacted)
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 315
shell / exec 2
- shell (weak) google-sam-da4651c/development/examples/code-reviewer-pool/reviewer/review_server.mjs :2
import { spawn } from "node:child_process"; - shell (weak) google-sam-da4651c/development/examples/gemini-buddy-mcp/buddy_server.mjs :2
import { spawn } from "node:child_process";
network 2
- net google-sam-da4651c/internal/console/public/app.js :121
const infoResp = await fetch('info'); - net (weak) google-sam-da4651c/tests/ui/console.spec.js :348
const response = await route.fetch();
secrets 3
- secrets (weak) google-sam-da4651c/development/examples/code-reviewer-pool/manager/server.mjs :11
const API_TOKEN = process.env.SAM_API_TOKEN ?? "devtoken"; - secrets (weak) google-sam-da4651c/development/examples/code-reviewer-pool/reviewer/review_server.mjs :17
const POOL_SECRET = process.env.SAM_POOL_SECRET ?? "sam-dev-pool-secret"; // shared dev secret; enforcement always on - secrets (weak) google-sam-da4651c/tests/ui/console.spec.js :17
const ADMIN_TOKEN = process.env.SAM_ADMIN_TOKEN || 'ui-test-admin-token';
declared dependencies 146
- github.com/modelcontextprotocol/go-sdk@v1.8.0
- autoprefixer@^10.5.2
- postcss@^8.5.15
- postcss-cli@^11.0.1
- github.com/a2aproject/a2a-go/v2@v2.5.0
- github.com/biscuit-auth/biscuit-go/v2@v2.2.0
- github.com/coreos/go-oidc/v3@v3.21.0
- github.com/golang-jwt/jwt/v5@v5.3.1
- github.com/hashicorp/golang-lru/v2@v2.0.7
- github.com/ipfs/go-cid@v0.6.2
- github.com/ipfs/go-log/v2@v2.9.2
- github.com/jackc/pgx/v5@v5.11.0
show 28 more
- github.com/libp2p/go-libp2p@v0.49.0
- github.com/libp2p/go-libp2p-gostream@v0.6.0
- github.com/libp2p/go-libp2p-http@v0.5.0
- github.com/libp2p/go-libp2p-kad-dht@v0.42.1
- github.com/libp2p/go-libp2p-pubsub@v0.17.0
- github.com/libp2p/go-msgio@v0.3.0
- github.com/mattn/go-isatty@v0.0.24
- github.com/multiformats/go-multiaddr@v0.16.1
- github.com/multiformats/go-multiaddr-dns@v0.6.0
- github.com/multiformats/go-multihash@v0.2.3
- github.com/openai/openai-go@v1.12.0
- github.com/prometheus/client_golang@v1.24.1
- github.com/prometheus/client_model@v0.6.3
- github.com/spf13/cobra@v1.10.2
- go.etcd.io/bbolt@v1.5.0
- go.uber.org/zap@v1.28.0
- golang.org/x/net@v0.59.0
- golang.org/x/oauth2@v0.37.0
- golang.org/x/time@v0.16.0
- google.golang.org/protobuf@v1.36.12
- gopkg.in/yaml.v2@v2.4.0
- modernc.org/sqlite@v1.58.0
- filippo.io/bigmod@v0.1.1-0.20260103110540-f8a47775ebe5
- filippo.io/keygen@v1.0.0
- github.com/alecthomas/participle/v2@v2.1.4
- github.com/benbjohnson/clock@v1.3.5
- github.com/beorn7/perks@v1.0.1
- github.com/cespare/xxhash/v2@v2.3.0
106 more not shown — this panel samples each group; the count above is the real total.
transport_posture 3
- binds all interfaces (0.0.0.0) google-sam-da4651c/development/examples/code-reviewer-pool/manager/server.mjs :138
app.listen(PORT, "0.0.0.0", async () => { - binds all interfaces (0.0.0.0) google-sam-da4651c/development/examples/code-reviewer-pool/reviewer/review_server.mjs :92
app.listen(PORT, "0.0.0.0", () => { - network-listening, binds all interfaces, no auth detected google-sam-da4651c/development/examples/gemini-buddy-mcp/buddy_server.mjs :103
app.listen(PORT, "0.0.0.0", () => {