Universal Agent Harness
- capability exposure inferred + 35
- tool safety inferred + 5
- trust mitigators mixed − 3
inferred mixed
The A–E grade is our heuristic synthesis — a "review this" prompt, not a verdict. Each factor is tagged by what backs it: attested (a verifiable record), reported (a third party's claim), or inferred (our own heuristic, e.g. permissions). See methodology.
grade last moved 1w ago · see ecosystem CVEs →
- C · 57 → C · 37
- C · 49 → C · 57
- B · 32 → C · 49
No known CVEs for this server.
- medium dangerous code
dynamic exec: __import__(), __import__ sink
analyzed commit b9f7218 · analyzer v33 · 2h ago
skills & prompt files 10
- skill human-plus-machine-monkeybot-b9f7218/cli/skills/monkeybot/SKILL.md
- agent-rules human-plus-machine-monkeybot-b9f7218/cli/src/monkeybot_cli/scaffold_defaults/AGENT.md
- skill human-plus-machine-monkeybot-b9f7218/cli/src/monkeybot_cli/scaffold_defaults/browser/SKILL.md
- skill human-plus-machine-monkeybot-b9f7218/cli/src/monkeybot_cli/scaffold_defaults/image-generator/SKILL.md
- skill human-plus-machine-monkeybot-b9f7218/cli/src/monkeybot_cli/scaffold_defaults/loop/SKILL.md
- agent-rules human-plus-machine-monkeybot-b9f7218/evals/smoke_agent/monkeybot_config/AGENT.md
- skill human-plus-machine-monkeybot-b9f7218/evals/smoke_agent/skills/browser/SKILL.md
- skill human-plus-machine-monkeybot-b9f7218/examples/skills/browser/SKILL.md
- skill human-plus-machine-monkeybot-b9f7218/examples/skills/diagnostics/SKILL.md
- skill human-plus-machine-monkeybot-b9f7218/examples/skills/image-generator/SKILL.md
danger signals5
- dynamic code execution __import__() human-plus-machine-monkeybot-b9f7218/cli/src/monkeybot_cli/runtime_python.py :541
mod = __import__(mod_name) - dynamic code execution __import__ sink human-plus-machine-monkeybot-b9f7218/cli/tests/test_cli.py :21
env={**__import__("os").environ, "PYTHONPATH": str(CLI_ROOT / "src")}, - dynamic code execution __import__ sink human-plus-machine-monkeybot-b9f7218/tests/core/test_fs_isolation.py :462
env={**__import__("os").environ, "HOME": str(home)}, - dynamic code execution __import__ sink human-plus-machine-monkeybot-b9f7218/tests/core/test_knowledge_config.py :93
assert "KNOWLEDGE_ENABLED" not in __import__("os").environ - dynamic code execution __import__ sink human-plus-machine-monkeybot-b9f7218/tests/core/test_knowledge_single_writer.py :73
sentinel.write_text(str(__import__("os").getpid() + 1), encoding="utf-8")
[](https://mcpobservatory.com/servers/github:human-plus-machine/monkeybot/security) Heuristic, inferred signals — false positives (legitimately powerful tools, forks, language ports) are expected. Treat each as "review this", not a verdict. See the ecosystem-wide picture on the security hub, or the fleet security of human-plus-machine.