Self-hosted AI agent for terminal and Telegram, with Claude/Codex workers, live activity and a deterministic permission kernel.
- capability exposure inferred + 35
- recent drift inferred + 20
- tool safety inferred + 25
- trust mitigators mixed − 3
inferred mixed
The A–E grade is our heuristic synthesis — a "review this" prompt, not a verdict. Each factor is tagged by what backs it: attested (a verifiable record), reported (a third party's claim), or inferred (our own heuristic, e.g. permissions). See methodology.
grade last moved 3d ago · see ecosystem CVEs →
- D · 69 → D · 77
- C · 57 → D · 69
- B · 21 → C · 57
No known CVEs for this server.
- high dangerous code
committed secret: Anthropic key · dynamic exec: __import__(), eval()/exec()
- high tool shadowing remote_exec
tool "remote_exec" shadows a verified server's tool
- medium purpose mismatch git
benign-looking name carries shell, secrets
- low exfiltration combo git
single tool reads + sends: shell, net, secrets
analyzed commit 1c2b543 · analyzer v33 · 50m ago
skills & prompt files 1
- agent-rules talos-kernel-Talos-1c2b543/CLAUDE.md
danger signals13
- dynamic code execution __import__() talos-kernel-Talos-1c2b543/talos/conductor.py :211
background: object = field(default_factory=lambda: __import__( - dynamic code execution eval()/exec() talos-kernel-Talos-1c2b543/tests/test_custom_provider_routing.py :77
exec(compile(ast.Module(body=[node], type_ignores=[]), '<service-factory>', 'exec'), scope) - suspicious endpoint api.telegram.org talos-kernel-Talos-1c2b543/talos/doctor.py :317
antwort = get(f"https://api.telegram.org/bot{token}/getMe", timeout=20) - suspicious endpoint api.telegram.org talos-kernel-Talos-1c2b543/talos/setup_wizard.py :46
API_URL = "https://api.telegram.org/bot{token}/{method}" - suspicious endpoint api.telegram.org talos-kernel-Talos-1c2b543/talos/telegram.py :30
_BASE = "https://api.telegram.org/bot{token}/{method}" - suspicious endpoint 169.254.169.254 (cloud metadata) talos-kernel-Talos-1c2b543/tests/test_apiclient.py :174
_FakeResponse(302, headers={"Location": "http://169.254.169.254/latest"}), - suspicious endpoint api.telegram.org talos-kernel-Talos-1c2b543/tests/test_composition_wiring.py :101
f"https://api.telegram.org/bot{echt}/getUpdates" - suspicious endpoint 169.254.169.254 (cloud metadata) talos-kernel-Talos-1c2b543/tests/test_web.py :127
web.guard_url("https://169.254.169.254/latest/meta-data/", resolve=resolver()) - committed secret Anthropic key talos-kernel-Talos-1c2b543/redteam.py :1166
sk-ant…(44 chars, redacted) - committed secret Anthropic key talos-kernel-Talos-1c2b543/tests/test_api_reasoner.py :23
sk-ant…(35 chars, redacted) - committed secret Anthropic key talos-kernel-Talos-1c2b543/tests/test_crashreport.py :57
sk-ant…(35 chars, redacted) - committed secret Anthropic key talos-kernel-Talos-1c2b543/tests/test_credentials.py :29
sk-ant…(35 chars, redacted) - committed secret Anthropic key talos-kernel-Talos-1c2b543/tests/test_recall.py :299
sk-ant…(49 chars, redacted)
- recent drift +20 capability drift →
[](https://mcpobservatory.com/servers/github:talos-kernel/talos/security) Heuristic, inferred signals — false positives (legitimately powerful tools, forks, language ports) are expected. Treat each as "review this", not a verdict. See the ecosystem-wide picture on the security hub, or the fleet security of talos-kernel.