跑在终端的 coding agent —— 多 provider 可插拔、harness 全可改、数据不出门、每轮留轨迹
D high
- capability exposure inferred + 35
- recent drift inferred + 20
- tool safety inferred + 12
- trust mitigators mixed − 3
inferred mixed
The A–E grade is our heuristic synthesis — a "review this" prompt, not a verdict. Each factor is tagged by what backs it: attested (a verifiable record), reported (a third party's claim), or inferred (our own heuristic, e.g. permissions). See methodology.
grade last moved 3d ago · see ecosystem CVEs →
- C · 56 → D · 64
- C · 59 → C · 56
- A · 0 → C · 59
Inferred surface — each links to servers holding it:
No known CVEs for this server.
- high dangerous code
committed secret: GitHub token, private key, Anthropic key, AWS access key id, OpenAI key · dynamic exec: vm exec · credential logged in 1 file(s) · obfuscated payload: dynamic re…
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit d1f3071 · analyzer v33 · 1d ago
skills & prompt files 16
- skill njfuzrs-sid-code-d1f3071/.claude/skills/eval-session/SKILL.md
- prompt-file njfuzrs-sid-code-d1f3071/.pr-batch/prompts/fix-catalog-concurrent-write-merge.md
- prompt-file njfuzrs-sid-code-d1f3071/.pr-batch/prompts/fix-openrouter-filter-non-chat.md
- agent-rules njfuzrs-sid-code-d1f3071/CLAUDE.md
- agent-rules njfuzrs-sid-code-d1f3071/evals/CLAUDE.md
- agent-rules njfuzrs-sid-code-d1f3071/packages/cli/src/ui/CLAUDE.md
- skill njfuzrs-sid-code-d1f3071/packages/core/src/skill/builtin/bug-fix/SKILL.md
- skill njfuzrs-sid-code-d1f3071/packages/core/src/skill/builtin/ci-self-heal/SKILL.md
- skill njfuzrs-sid-code-d1f3071/packages/core/src/skill/builtin/claude-code-migration/SKILL.md
- skill njfuzrs-sid-code-d1f3071/packages/core/src/skill/builtin/code-governance/SKILL.md
- skill njfuzrs-sid-code-d1f3071/packages/core/src/skill/builtin/code-review/SKILL.md
- skill njfuzrs-sid-code-d1f3071/packages/core/src/skill/builtin/incident-rca/SKILL.md
- skill njfuzrs-sid-code-d1f3071/packages/core/src/skill/builtin/security-audit/SKILL.md
- skill njfuzrs-sid-code-d1f3071/packages/core/src/skill/builtin/skill-creator/SKILL.md
- prompt-file njfuzrs-sid-code-d1f3071/scripts/changelog-curate.prompt.md
- prompt-file njfuzrs-sid-code-d1f3071/website/blog/system-prompt-composition.md
danger signals16
- dynamic code execution vm exec njfuzrs-sid-code-d1f3071/packages/core/src/workflow/sandbox.ts :229
return vm.runInNewContext(`(${metaSrc})`, Object.create(null), { - suspicious endpoint 121.196.144.227 njfuzrs-sid-code-d1f3071/packages/core/src/migrations/rewrite-legacy-release-host.ts :54
const LEGACY_ORIGINS = ["http://121.196.144.227:80", "http://121.196.144.227"] as const; - suspicious endpoint 169.254.169.254 (cloud metadata) njfuzrs-sid-code-d1f3071/packages/core/tests/mcp/oauth-core.test.ts :347
oauth: { authServerMetadataUrl: "http://169.254.169.254/meta" }, // 云元数据地址，经典 SSRF 目标 - suspicious endpoint 121.196.144.227 njfuzrs-sid-code-d1f3071/packages/core/tests/migrations/rewrite-legacy-release-host.test.ts :24
const LEGACY_IP = "http://121.196.144.227"; - suspicious endpoint 169.254.169.254 (cloud metadata) njfuzrs-sid-code-d1f3071/packages/core/tests/tool/web-fetch.test.ts :287
headers: { location: "http://169.254.169.254/latest/meta-data/" }, - committed secret GitHub token njfuzrs-sid-code-d1f3071/packages/core/src/skill/builtin/security-audit/evals/case_sec_010.yaml :25
ghp_1A…(40 chars, redacted) - committed secret Anthropic key njfuzrs-sid-code-d1f3071/packages/core/tests/llm/secret-redact.test.ts :48
sk-ant…(31 chars, redacted) - committed secret AWS access key id njfuzrs-sid-code-d1f3071/packages/core/tests/llm/secret-redact.test.ts :59
AKIAJK…(20 chars, redacted) - committed secret private key njfuzrs-sid-code-d1f3071/packages/core/tests/llm/secret-redact.test.ts :101
PEM private key block (redacted) - committed secret OpenAI key njfuzrs-sid-code-d1f3071/packages/core/tests/llm/secret-redact.test.ts :195
sk-pro…(35 chars, redacted) - committed secret AWS access key id njfuzrs-sid-code-d1f3071/packages/core/tests/memory/write-guard-p1.test.ts :29
AKIA2Z…(20 chars, redacted) - committed secret Anthropic key njfuzrs-sid-code-d1f3071/packages/core/tests/permission/sensitive.test.ts :30
sk-ant…(39 chars, redacted) - committed secret OpenAI key njfuzrs-sid-code-d1f3071/packages/core/tests/permission/sensitive.test.ts :35
sk-pro…(27 chars, redacted) - committed secret AWS access key id njfuzrs-sid-code-d1f3071/packages/core/tests/skill/security-audit-scripts.test.ts :202
AKIAIO…(20 chars, redacted) - committed secret Anthropic key njfuzrs-sid-code-d1f3071/packages/core/tests/telemetry/content-tracing.test.ts :507
sk-ant…(49 chars, redacted) - credential in logs credential in log njfuzrs-sid-code-d1f3071/packages/cli/src/command/auth.ts :84
console.log(` Key 来源: ${report.apiKeySource}`);
- recent drift +20 capability drift →
[](https://mcpobservatory.com/servers/github:njfuzrs/sid-code/security) Heuristic, inferred signals — false positives (legitimately powerful tools, forks, language ports) are expected. Treat each as "review this", not a verdict. See the ecosystem-wide picture on the security hub, or the fleet security of njfuzrs.