github JavaScript analyzed 32b1d09

kernora-ai/agent-sec

Kernora Agent Security — a zero-install security baseline for AI coding agents (MCP). Free & open.

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 2 tools

transport streamable-http · http counts 2 tools · 0 res · 0 prompts permission surface via code analysis

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 32b1d09 · analyzer v33 · 5d ago

code evidence vHEAD · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 5

shell kernora-ai-agent-sec-32b1d09/baseline.js :50 statement: "Do not eval(), exec(), or deserialize (pickle, yaml.load, unsafe JSON revivers) untrusted input. Use safe parsers (yaml.safe_load, JSON.parse) and parameterize instead of building code str

net kernora-ai-agent-sec-32b1d09/src/worker.js :400 async fetch(req) {
net (weak) kernora-ai-agent-sec-32b1d09/test.mjs :3 // and drives its fetch() directly.