Skip to content

Comments

Claude/security functionality analysis al5 zg#7

Merged
caiqinghua merged 8 commits intoopenagen:mainfrom
TomTomCoder:claude/security-functionality-analysis-al5ZG
Feb 23, 2026
Merged

Claude/security functionality analysis al5 zg#7
caiqinghua merged 8 commits intoopenagen:mainfrom
TomTomCoder:claude/security-functionality-analysis-al5ZG

Conversation

@TomTomCoder
Copy link

@TomTomCoder TomTomCoder commented Feb 22, 2026

Summary

Describe this PR in 2-5 bullets:

  • Problem:
  • Why it matters:
  • What changed:
  • What did not change (scope boundary):

Label Snapshot (required)

  • Risk label (risk: low|medium|high):
  • Size label (size: XS|S|M|L|XL, auto-managed/read-only):
  • Scope labels (core|agent|channel|config|cron|daemon|doctor|gateway|health|heartbeat|integration|memory|observability|onboard|provider|runtime|security|service|skillforge|skills|tool|tunnel|docs|dependencies|ci|tests|scripts|dev, comma-separated):
  • Module labels (<module>: <component>, for example channel: telegram, provider: kimi, tool: shell):
  • Contributor tier label (trusted contributor|experienced contributor|principal contributor|distinguished contributor, auto-managed/read-only; author merged PRs >=5/10/20/50):
  • If any auto-label is incorrect, note requested correction:

Change Metadata

  • Change type (bug|feature|refactor|docs|security|chore):
  • Primary scope (runtime|provider|channel|memory|security|ci|docs|multi):

Linked Issue

  • Closes #
  • Related #
  • Depends on # (if stacked)
  • Supersedes # (if replacing older PR)

Supersede Attribution (required when Supersedes # is used)

  • Superseded PRs + authors (#<pr> by @<author>, one per line):
  • Integrated scope by source PR (what was materially carried forward):
  • Co-authored-by trailers added for materially incorporated contributors? (Yes/No)
  • If No, explain why (for example: inspiration-only, no direct code/design carry-over):
  • Trailer format check (separate lines, no escaped \n): (Pass/Fail)

Validation Evidence (required)

Commands and result summary:

cargo fmt --all -- --check
cargo clippy --all-targets -- -D warnings
cargo test
  • Evidence provided (test/log/trace/screenshot/perf):
  • If any command is intentionally skipped, explain why:

Security Impact (required)

  • New permissions/capabilities? (Yes/No)
  • New external network calls? (Yes/No)
  • Secrets/tokens handling changed? (Yes/No)
  • File system access scope changed? (Yes/No)
  • If any Yes, describe risk and mitigation:

Privacy and Data Hygiene (required)

  • Data-hygiene status (pass|needs-follow-up):
  • Redaction/anonymization notes:
  • Neutral wording confirmation (use ZeroClaw/project-native labels if identity-like wording is needed):

Compatibility / Migration

  • Backward compatible? (Yes/No)
  • Config/env changes? (Yes/No)
  • Migration needed? (Yes/No)
  • If yes, exact upgrade steps:

Human Verification (required)

What was personally validated beyond CI:

  • Verified scenarios:
  • Edge cases checked:
  • What was not verified:

Side Effects / Blast Radius (required)

  • Affected subsystems/workflows:
  • Potential unintended effects:
  • Guardrails/monitoring for early detection:

Agent Collaboration Notes (recommended)

  • Agent tools used (if any):
  • Workflow/plan summary (if any):
  • Verification focus:
  • Confirmation: naming + architecture boundaries followed (AGENTS.md + CONTRIBUTING.md):

Rollback Plan (required)

  • Fast rollback command/path:
  • Feature flags or config toggles (if any):
  • Observable failure symptoms:

Risks and Mitigations

List real risks in this PR (or write None).

  • Risk:
    • Mitigation:

@claude
chore: update Cargo.lock (rustix version reference normalization)
b75bbf8 
Minor Cargo.lock update from running cargo commands during security
analysis — normalizes `rustix 1.1.3` version reference to `rustix`.

https://claude.ai/code/session_01EFyqry32yYwkmYs2zFMiyb
@claude
fix(security): fix build errors, harden security defaults and documen…
f5b3d3a 
…tation

Fix 5 compilation errors blocking the build:
- reliable.rs: remove duplicate `chat` method implementation
- agent.rs, loop_.rs: replace `futures::` with `futures_util::` (correct crate name)
- Cargo.toml: add `alloc` feature to futures-util (required for join_all)
- memory/cli.rs: gate PostgresMemory behind #[cfg(feature = "memory-postgres")]
  with a clear compile-time error when the feature is absent

Security hardening:
- Enable Landlock sandbox by default on Linux: remove `optional = true` from
  the Linux-specific landlock dependency; replace all `cfg(feature = "sandbox-landlock")`
  gates with `cfg(target_os = "linux")` in mod.rs, detect.rs, and landlock.rs.
  The `sandbox-landlock` feature flag is kept as a no-op for backward compatibility.
- Add explicit security warning to channels-reference.md for the whatsapp-web
  feature flag (unofficial API, account-suspension risk, unpredictable attack surface).
- Add SSRF threat model document for the http_request tool:
  docs/security/http-request-ssrf-threat-model.md covering existing defenses
  (allowlist, private-host blocking, redirect-none, scheme restriction),
  known residual risks (DNS rebinding, HTTP cleartext), and operator guidance.
- Register the SSRF doc in docs/security/README.md.

https://claude.ai/code/session_01EFyqry32yYwkmYs2zFMiyb
@claude
docs(security): add shell execution security note
2cc07f9 
Document the security model of the shell tool:
- Defenses in place: autonomy policy, command validation, rate limiting,
  env_clear + SAFE_ENV_VARS whitelist, 60s timeout, 1MB output truncation
- Residual risks: no FS isolation without Landlock, no network egress filter,
  parent fd inheritance, shell injection via interpolated command strings
- Full test coverage matrix
- Operator configuration guidance

https://claude.ai/code/session_01EFyqry32yYwkmYs2zFMiyb
@github-actions
Copy link

github-actions bot commented Feb 22, 2026

Thanks for contributing to ZeroClaw.

For faster review, please ensure:

  • PR template sections are fully completed
  • cargo fmt --all -- --check, cargo clippy --all-targets -- -D warnings, and cargo test are included
  • If automation/agents were used heavily, add brief workflow notes
  • Scope is focused (prefer one concern per PR)

See CONTRIBUTING.md and docs/pr-workflow.md for full collaboration rules.

@github-actions
Copy link

github-actions bot commented Feb 22, 2026 •
edited
Loading

PR intake checks found warnings (non-blocking)

Fast safe checks found advisory issues. CI lint/test/build gates still enforce merge quality.

  • Incomplete required PR template fields: security risk/mitigation

Action items:

  1. Complete required PR template sections/fields.
  2. Remove tabs, trailing whitespace, and merge conflict markers from added lines.
  3. Re-run local checks before pushing:
    • ./scripts/ci/rust_quality_gate.sh
    • ./scripts/ci/rust_strict_delta_gate.sh
    • ./scripts/ci/docs_quality_gate.sh

Run logs: https://github.com/openagen/zeroclaw/actions/runs/22276711163

Detected blocking line issues (sample):

  • none

Detected advisory line issues (sample):

  • none

@github-actions github-actions bot added agent Auto scope: src/agent/** changed. memory Auto scope: src/memory/** changed. provider Auto scope: src/providers/** changed. docs Auto scope: docs/markdown/template files changed. dependencies Auto scope: dependency manifest/lock/policy changed. security Auto scope: src/security/** changed. size: S Auto size: 81-250 non-doc changed lines. risk: high Auto risk: security/runtime/gateway/tools/workflows. memory: cli Auto module: memory/cli changed. and removed memory Auto scope: src/memory/** changed. labels Feb 22, 2026
@github-actions github-actions bot added memory Auto scope: src/memory/** changed. size: XS Auto size: <=80 non-doc changed lines. and removed agent Auto scope: src/agent/** changed. provider Auto scope: src/providers/** changed. memory Auto scope: src/memory/** changed. size: S Auto size: 81-250 non-doc changed lines. labels Feb 22, 2026
@claude
docs(security): add security analysis table with grades to README
ac8cfee 
Add a dated security audit table covering 8 tool surfaces identified
during the 2026-02-22 security analysis. Each entry includes the risk
area, current grade, finding, and a concrete recommended remediation.

Surfaces covered: http_request (MITM, DNS rebinding), file_write
(path traversal), shell (network egress), git_operations (unintended
push), browser/browser_open (SSRF-adjacent, phishing), delegate
(prompt injection), and compiler hygiene (allow suppression).

https://claude.ai/code/session_01EFyqry32yYwkmYs2zFMiyb
@claude
docs(security): expand security analysis table to cover all 31 tool s…
2f91cbf 
…urfaces

Full source-code re-audit of every tool in src/tools/. Previous table
covered 8 surfaces with preliminary grades. Updated table:

- Covers all 31 tool surfaces organized by tier (file, network,
  command execution, memory, delegation, scheduling, external APIs,
  utility, hardware, compiler hygiene)
- Corrects grades based on actual code inspection (e.g. file_read
  upgraded to A, git_operations to A-, http_request SSRF to B+)
- Adds new surfaces: file_read, glob_search, pdf_read, image_info,
  web_search_tool, browser_open, memory_*, cron_*, composio, pushover,
  proxy_config, screenshot, hardware_*, delegate
- Each entry includes a verified finding and a concrete recommended action
- Adds an overall posture summary table by tier

https://claude.ai/code/session_01EFyqry32yYwkmYs2zFMiyb
@claude
fix(tests): add missing SkillsPromptInjectionMode arg to test call
f2e7001 
The `build_system_prompt_with_mode` function signature was extended with
a new `skills_prompt_mode: SkillsPromptInjectionMode` parameter, but the
call in the `native_tools_system_prompt_contains_zero_xml` test was not
updated to match. This caused a compile-time error (E0061: wrong number
of arguments) that blocked all test compilation.

Fix: pass `SkillsPromptInjectionMode::Full` as the 8th argument,
consistent with the default used throughout the codebase.

https://claude.ai/code/session_01EFyqry32yYwkmYs2zFMiyb
@claude
chore: resolve all clippy -D warnings and fmt violations
58a1967 
Fix 36 clippy errors and formatting violations to make the codebase
pass `cargo fmt --all -- --check` and `cargo clippy --all-targets -- -D warnings`
with zero diagnostics.

Key fixes by category:

Correctness:
- Replace invalid regex backreferences (\1) in XML tool-tag parser with a
  manual closing-tag search (iter_xml_tagged_sections); the `regex` crate
  does not support backreferences, so the original code would have panicked
  at runtime on first use of the XML dispatcher path.

MSRV:
- Bump rust-version 1.87 → 1.91 to align with str::floor_char_boundary
  (stable since 1.91) already used in shell/screenshot/memory tools.

Visibility / privacy:
- Narrow channels::handle_command to pub(crate) to match ChannelCommands
  visibility; eliminates private-interface-in-public-API lint.

Lint suppressions (intentional API surface):
- #[allow(unused_imports)] on pub use re-exports in cost/mod.rs,
  onboard/mod.rs, tools/mod.rs, peripherals/mod.rs that are used from the
  binary crate or are intentional public API.
- #[allow(clippy::unused_async)] on the hardware-feature stub for
  create_peripheral_tools (must stay async for call-site consistency).
- #[allow(clippy::assertions_on_constants)] on a platform-guard assertion
  in the landlock test.
- #[allow(clippy::type_complexity)] on the pairing guard's brute-force
  field.

Style / idiomatic fixes:
- Replace format!-collect with fold+writeln! in discord/telegram tests.
- Elide explicit lifetimes in providers/copilot.rs.
- Merge identical match arms (bedrock, compatible, telegram, wizard,
  main.rs unreachable arms).
- Use ? operator instead of let-else for question_mark lint.
- Use array-of-char pattern for manual_pattern_char_comparison.
- Remove needless return / continue statements.
- Derive Default for SkillsConfig (all fields use standard defaults).
- Replace criterion::black_box (deprecated) with std::hint::black_box.
- Box::pin large heartbeat future directly to move it off the stack.
- Use struct initializer syntax in config_persistence tests.
- Use array literals instead of vec! where Vec is not needed.
- Remove duplicate unreachable cfg block in memory/cli.rs.
- Fix unreadable long literal in nextcloud_talk test.
- Replace ALLOWED_IMAGE_MIME_TYPES.iter().any() with .contains().
- Suppress cast_possible_truncation for intentional u64→usize casts.

https://claude.ai/code/session_01EFyqry32yYwkmYs2zFMiyb
@TomTomCoder TomTomCoder reopened this Feb 22, 2026
@github-actions github-actions bot added agent Auto scope: src/agent/** changed. memory Auto scope: src/memory/** changed. labels Feb 22, 2026
@github-actions github-actions bot added size: M Auto size: 251-500 non-doc changed lines. config: core Auto module: config core files changed. agent: loop Auto module: agent/loop changed. cron: store Auto module: cron/store changed. daemon: core Auto module: daemon core files changed. onboard: wizard Auto module: onboard/wizard changed. service: core Auto module: service core files changed. skills: core Auto module: skills core files changed. agent Auto scope: src/agent/** changed. memory Auto scope: src/memory/** changed. config Auto scope: src/config/** changed. cron Auto scope: src/cron/** changed. daemon Auto scope: src/daemon/** changed. onboard Auto scope: src/onboard/** changed. service Auto scope: src/service/** changed. skills Auto scope: src/skills/** changed. and removed cron Auto scope: src/cron/** changed. daemon Auto scope: src/daemon/** changed. onboard Auto scope: src/onboard/** changed. service Auto scope: src/service/** changed. skills Auto scope: src/skills/** changed. agent Auto scope: src/agent/** changed. memory Auto scope: src/memory/** changed. config Auto scope: src/config/** changed. labels Feb 22, 2026
@caiqinghua caiqinghua merged commit fe0c958 into openagen:main Feb 23, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

agent: loop Auto module: agent/loop changed. channel Auto scope: src/channels/** changed. config: core Auto module: config core files changed. core Auto scope: root src/*.rs files changed. cron: store Auto module: cron/store changed. daemon: core Auto module: daemon core files changed. dependencies Auto scope: dependency manifest/lock/policy changed. docs Auto scope: docs/markdown/template files changed. memory: cli Auto module: memory/cli changed. onboard: wizard Auto module: onboard/wizard changed. provider Auto scope: src/providers/** changed. risk: high Auto risk: security/runtime/gateway/tools/workflows. security Auto scope: src/security/** changed. service: core Auto module: service core files changed. size: M Auto size: 251-500 non-doc changed lines. skills: core Auto module: skills core files changed. tests Auto scope: tests/** changed. tool Auto scope: src/tools/** changed.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@TomTomCoder @caiqinghua @claude