📦
Audit History
cloudbase-agent - 2 audits
Version comparison
Capability and finding changes across audited versions, newest first.
Audit version 2 Latest
Jul 9, 2026, 03:45 PM
Most static hits are documentation examples or markdown syntax, including placeholder secrets, local URLs, dotenv usage, and inline code. Confirmed risks remain in authentication examples, unverified JWT decoding, public interface binds, shell-based deployment steps, and wildcard CORS guidance.
22
Files scanned
5,743
Lines analyzed
33
Review items
0
False positives ignored
Confirmed security concerns (10)
High
System reconnaissance
logger.warning("Missing or invalid Authorization header")
The middleware logs a missing or invalid Authorization header and then continues as an anonymous user. That behavior can bypass authentication for protected agent actions.
High
System reconnaissance
# Handle invalid token (log but don't block in this example)
The basic JWT example explicitly handles an invalid token by logging rather than blocking. The request then continues to the agent, which is an authentication bypass if reused.
High
System reconnaissance
print(f"Invalid JWT token: {e}")
The invalid token branch only prints the error in the basic middleware example. Because execution continues afterward, this is a real unsafe pattern.
High
System reconnaissance
# raise InvalidRequestError(message="Invalid authentication token")
The blocking exception is commented out in the basic authentication example. That makes the shown code continue after invalid authentication.
High
Base64 decode
const payload = JSON.parse(atob(token.split(".")[1]));
The code decodes a JWT payload with atob and uses the sub claim for tenant isolation without signature verification. This can let a caller spoof user identity.
High
Base64 decode
const payload = JSON.parse(atob(token.split(".")[1]));
The code decodes a JWT payload with atob and uses the sub claim for tenant isolation without signature verification. This can let a caller spoof user identity.
High
Authentication Fallback Allows Anonymous Requests
The Coze middleware uses a dev-secret fallback and continues requests as user anonymous when the Authorization header is missing or invalid. This can turn a protected agent endpoint into an unauthenticated endpoint if copied into production.
The cited example directly sets a predictable JWT secret fallback and yields after assigning an anonymous user on missing authentication.
High
Invalid JWT Example Continues Execution
The basic authentication middleware logs InvalidTokenError and then yields to the agent instead of blocking the request. Later secure guidance exists, but this initial example is unsafe if reused.
The code catches InvalidTokenError, prints the error, leaves the blocking exception commented out, and reaches the yield statement.
High
Unverified JWT Payload Used for Tenant Isolation
TypeScript adapter examples parse the JWT body with atob and use payload.sub for CloudBaseSaver userId. The signature is not verified before using that value for tenant isolation.
Both examples decode the JWT payload client-side and trust sub for storage isolation without a verification step.
Medium
py/skill.md:106-111py/adapter-coze.md:272-282py/agent-deployment.md:340-356ts/server-quickstart.md:78-83
Wildcard CORS in Agent Server Examples
TypeScript and Python examples enable broad CORS on agent endpoints, including FastAPI credentialed CORS. Public agent APIs should use explicit origin allowlists in production.
The cited snippets enable wildcard or broadly enabled CORS for agent servers, and one FastAPI example also enables credentials.
Capability review items (18)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Python getenv function
JWT_SECRET = os.getenv("JWT_SECRET_KEY", "dev-secret")
The example falls back to JWT_SECRET_KEY="dev-secret", which can create forgeable JWTs if copied into production. This is a real authentication weakness, not just configuration access.
High
getenv function call
JWT_SECRET = os.getenv("JWT_SECRET_KEY", "dev-secret")
The getenv call supplies a hardcoded dev-secret fallback for JWT signing. A missing environment variable would silently weaken authentication.
High
Generic API/secret keys
JWT_SECRET = os.getenv("JWT_SECRET_KEY", "dev-secret")
JWT_SECRET falls back to a predictable value named dev-secret. This creates a credible credential weakness when reused beyond local development.
Medium
Hardcoded IP address
host="0.0.0.0"
The example binds an agent service to 0.0.0.0, which exposes it on all interfaces when run directly. This is common for deployment but needs authentication and network controls.
Medium
Shell command substitution
PROJECT_DIR="$(pwd)"
The deployment guide contains shell script templates that a coding agent may execute during packaging or startup setup. The commands are legitimate but still create real local execution risk.
Medium
Shell command substitution
echo "✅ Using: $PYTHON_BIN ($($PYTHON_BIN --version 2>&1))"
The deployment guide contains shell script templates that a coding agent may execute during packaging or startup setup. The commands are legitimate but still create real local execution risk.
Medium
Unix shell invocation · 3 occurrences
#!/bin/bash
The deployment guide contains shell script templates that a coding agent may execute during packaging or startup setup. The commands are legitimate but still create real local execution risk.
Medium
Hardcoded IP address
AgentServiceApp().run(create_agent, port=port, host="0.0.0.0")
The example binds an agent service to 0.0.0.0, which exposes it on all interfaces when run directly. This is common for deployment but needs authentication and network controls.
Medium
Hardcoded IP address
server.run(host="0.0.0.0", port=9000)
The example binds an agent service to 0.0.0.0, which exposes it on all interfaces when run directly. This is common for deployment but needs authentication and network controls.
Medium
Hardcoded IP address
uvicorn.run(fastapi_app, host="0.0.0.0", port=9000)
The example binds an agent service to 0.0.0.0, which exposes it on all interfaces when run directly. This is common for deployment but needs authentication and network controls.
Medium
Hardcoded IP address
uvicorn.run(app, host="0.0.0.0", port=9000)
The example binds an agent service to 0.0.0.0, which exposes it on all interfaces when run directly. This is common for deployment but needs authentication and network controls.
Medium
Hardcoded IP address
--bind 0.0.0.0:9000
The example binds an agent service to 0.0.0.0, which exposes it on all interfaces when run directly. This is common for deployment but needs authentication and network controls.
Medium
Hardcoded IP address
app.run(create_agent, port=port, host="0.0.0.0")
The example binds an agent service to 0.0.0.0, which exposes it on all interfaces when run directly. This is common for deployment but needs authentication and network controls.
Medium
Unix shell invocation
#!/bin/sh
The deployment guide contains shell script templates that a coding agent may execute during packaging or startup setup. The commands are legitimate but still create real local execution risk.
Medium
Unix shell invocation
> **NOTE**: Use `#!/bin/sh` (not `#!/bin/bash`) for maximum compatibility. The entry point should ma
The deployment guide contains shell script templates that a coding agent may execute during packaging or startup setup. The commands are legitimate but still create real local execution risk.
Medium
Unix shell invocation
| **Startup script** | `scf_bootstrap` — `#!/bin/sh` + `node src/index.js` |
The deployment guide contains shell script templates that a coding agent may execute during packaging or startup setup. The commands are legitimate but still create real local execution risk.
Risk Factors
🌐 Network access (37)
py/adapter-coze.md:58 py/adapter-coze.md:125 py/adapter-coze.md:136 py/adapter-coze.md:282 py/adapter-langgraph.md:235 py/adapter-langgraph.md:295 py/agent-deployment.md:314 py/authentication.md:431 py/authentication.md:456 py/authentication.md:468 py/references/observability.md:312 py/references/observability.md:360 py/references/observability.md:364 py/references/observability.md:134 py/references/observability.md:233 py/references/observability.md:301 py/references/observability.md:328 py/references/recipes.md:300 py/references/recipes.md:32 py/references/server.md:36 py/references/tools.md:55 py/references/tools.md:87 py/server-quickstart.md:291 py/server-quickstart.md:304 py/server-quickstart.md:321 py/server-quickstart.md:338 py/server-quickstart.md:397 py/server-quickstart.md:430 py/server-quickstart.md:277 py/server-quickstart.md:447 py/skill.md:111 SKILL.md:14 SKILL.md:15 ts/server-quickstart.md:82 ts/server-quickstart.md:128 ts/server-quickstart.md:138 ts/ui-clients.md:16
🔑 Env variables (50)
py/adapter-coze.md:134 py/adapter-coze.md:135 py/adapter-coze.md:136 py/adapter-coze.md:213 py/adapter-coze.md:267 py/adapter-coze.md:268 py/adapter-coze.md:269 py/adapter-coze.md:281 py/adapter-coze.md:134 py/adapter-coze.md:135 py/adapter-coze.md:136 py/adapter-coze.md:213 py/adapter-coze.md:267 py/adapter-coze.md:268 py/adapter-coze.md:269 py/adapter-coze.md:281 py/adapter-coze.md:30 py/adapter-coze.md:43 py/adapter-coze.md:57 py/adapter-coze.md:97 py/adapter-coze.md:124 py/adapter-coze.md:135 py/adapter-coze.md:149 py/adapter-coze.md:161 py/adapter-coze.md:213 py/adapter-coze.md:268 py/adapter-coze.md:292 py/adapter-coze.md:293 py/adapter-coze.md:319 py/adapter-coze.md:320 py/adapter-coze.md:337 py/adapter-coze.md:338 py/adapter-coze.md:356 py/adapter-development.md:117 py/adapter-development.md:118 py/adapter-langgraph.md:556 py/adapter-langgraph.md:557 py/adapter-langgraph.md:558 py/adapter-langgraph.md:556 py/adapter-langgraph.md:557 py/adapter-langgraph.md:558 py/adapter-langgraph.md:550 py/adapter-langgraph.md:551 py/adapter-langgraph.md:550 py/adapter-langgraph.md:551 py/adapter-langgraph.md:545 py/adapter-langgraph.md:557 py/agent-deployment.md:313 py/agent-deployment.md:387 py/authentication.md:319
⚙️ External commands (50)
py/agent-deployment.md:92 py/agent-deployment.md:104 py/agent-deployment.md:89 py/agent-deployment.md:322 py/agent-deployment.md:377 py/skill.md:26 py/skill.md:27 py/skill.md:28 py/skill.md:29 py/skill.md:46 py/skill.md:60 py/skill.md:61 py/skill.md:62 py/skill.md:63 py/skill.md:78-87 py/skill.md:87-91 py/skill.md:91-112 py/skill.md:112-122 py/skill.md:122-142 py/skill.md:142-146 py/skill.md:146 py/skill.md:148-161 py/skill.md:161-163 py/skill.md:163-164 py/skill.md:164-169 py/skill.md:169-179 py/skill.md:179-181 py/skill.md:181-182 py/skill.md:182-183 py/skill.md:183-184 py/skill.md:184-188 py/skill.md:188-213 py/skill.md:213-217 py/skill.md:217-227 py/skill.md:227-233 py/skill.md:233-234 py/skill.md:234 py/skill.md:235 py/skill.md:236 py/skill.md:237-242 py/skill.md:242-243 py/skill.md:243-244 py/skill.md:244 py/skill.md:245-246 SKILL.md:12 SKILL.md:14 SKILL.md:15 SKILL.md:17 ts/agent-deployment.md:74 ts/agent-deployment.md:84
📁 Filesystem access (4)
Detected Patterns
System reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissance
Audited by: codex
Jul 9, 2026, 03:45 PM
Most static hits are documentation examples or markdown syntax, including placeholder secrets, local URLs, dotenv usage, and inline code. Confirmed risks remain in authentication examples, unverified JWT decoding, public interface binds, shell-based deployment steps, and wildcard CORS guidance.
22
Files scanned
5,743
Lines analyzed
33
Review items
0
False positives ignored
Confirmed security concerns (10)
High
System reconnaissance
logger.warning("Missing or invalid Authorization header")
The middleware logs a missing or invalid Authorization header and then continues as an anonymous user. That behavior can bypass authentication for protected agent actions.
High
System reconnaissance
# Handle invalid token (log but don't block in this example)
The basic JWT example explicitly handles an invalid token by logging rather than blocking. The request then continues to the agent, which is an authentication bypass if reused.
High
System reconnaissance
print(f"Invalid JWT token: {e}")
The invalid token branch only prints the error in the basic middleware example. Because execution continues afterward, this is a real unsafe pattern.
High
System reconnaissance
# raise InvalidRequestError(message="Invalid authentication token")
The blocking exception is commented out in the basic authentication example. That makes the shown code continue after invalid authentication.
High
Base64 decode
const payload = JSON.parse(atob(token.split(".")[1]));
The code decodes a JWT payload with atob and uses the sub claim for tenant isolation without signature verification. This can let a caller spoof user identity.
High
Base64 decode
const payload = JSON.parse(atob(token.split(".")[1]));
The code decodes a JWT payload with atob and uses the sub claim for tenant isolation without signature verification. This can let a caller spoof user identity.
High
Authentication Fallback Allows Anonymous Requests
The Coze middleware uses a dev-secret fallback and continues requests as user anonymous when the Authorization header is missing or invalid. This can turn a protected agent endpoint into an unauthenticated endpoint if copied into production.
The cited example directly sets a predictable JWT secret fallback and yields after assigning an anonymous user on missing authentication.
High
Invalid JWT Example Continues Execution
The basic authentication middleware logs InvalidTokenError and then yields to the agent instead of blocking the request. Later secure guidance exists, but this initial example is unsafe if reused.
The code catches InvalidTokenError, prints the error, leaves the blocking exception commented out, and reaches the yield statement.
High
Unverified JWT Payload Used for Tenant Isolation
TypeScript adapter examples parse the JWT body with atob and use payload.sub for CloudBaseSaver userId. The signature is not verified before using that value for tenant isolation.
Both examples decode the JWT payload client-side and trust sub for storage isolation without a verification step.
Medium
py/skill.md:106-111py/adapter-coze.md:272-282py/agent-deployment.md:340-356ts/server-quickstart.md:78-83
Wildcard CORS in Agent Server Examples
TypeScript and Python examples enable broad CORS on agent endpoints, including FastAPI credentialed CORS. Public agent APIs should use explicit origin allowlists in production.
The cited snippets enable wildcard or broadly enabled CORS for agent servers, and one FastAPI example also enables credentials.
Capability review items (18)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Python getenv function
JWT_SECRET = os.getenv("JWT_SECRET_KEY", "dev-secret")
The example falls back to JWT_SECRET_KEY="dev-secret", which can create forgeable JWTs if copied into production. This is a real authentication weakness, not just configuration access.
High
getenv function call
JWT_SECRET = os.getenv("JWT_SECRET_KEY", "dev-secret")
The getenv call supplies a hardcoded dev-secret fallback for JWT signing. A missing environment variable would silently weaken authentication.
High
Generic API/secret keys
JWT_SECRET = os.getenv("JWT_SECRET_KEY", "dev-secret")
JWT_SECRET falls back to a predictable value named dev-secret. This creates a credible credential weakness when reused beyond local development.
Medium
Hardcoded IP address
host="0.0.0.0"
The example binds an agent service to 0.0.0.0, which exposes it on all interfaces when run directly. This is common for deployment but needs authentication and network controls.
Medium
Shell command substitution
PROJECT_DIR="$(pwd)"
The deployment guide contains shell script templates that a coding agent may execute during packaging or startup setup. The commands are legitimate but still create real local execution risk.
Medium
Shell command substitution
echo "✅ Using: $PYTHON_BIN ($($PYTHON_BIN --version 2>&1))"
The deployment guide contains shell script templates that a coding agent may execute during packaging or startup setup. The commands are legitimate but still create real local execution risk.
Medium
Unix shell invocation · 3 occurrences
#!/bin/bash
The deployment guide contains shell script templates that a coding agent may execute during packaging or startup setup. The commands are legitimate but still create real local execution risk.
Medium
Hardcoded IP address
AgentServiceApp().run(create_agent, port=port, host="0.0.0.0")
The example binds an agent service to 0.0.0.0, which exposes it on all interfaces when run directly. This is common for deployment but needs authentication and network controls.
Medium
Hardcoded IP address
server.run(host="0.0.0.0", port=9000)
The example binds an agent service to 0.0.0.0, which exposes it on all interfaces when run directly. This is common for deployment but needs authentication and network controls.
Medium
Hardcoded IP address
uvicorn.run(fastapi_app, host="0.0.0.0", port=9000)
The example binds an agent service to 0.0.0.0, which exposes it on all interfaces when run directly. This is common for deployment but needs authentication and network controls.
Medium
Hardcoded IP address
uvicorn.run(app, host="0.0.0.0", port=9000)
The example binds an agent service to 0.0.0.0, which exposes it on all interfaces when run directly. This is common for deployment but needs authentication and network controls.
Medium
Hardcoded IP address
--bind 0.0.0.0:9000
The example binds an agent service to 0.0.0.0, which exposes it on all interfaces when run directly. This is common for deployment but needs authentication and network controls.
Medium
Hardcoded IP address
app.run(create_agent, port=port, host="0.0.0.0")
The example binds an agent service to 0.0.0.0, which exposes it on all interfaces when run directly. This is common for deployment but needs authentication and network controls.
Medium
Unix shell invocation
#!/bin/sh
The deployment guide contains shell script templates that a coding agent may execute during packaging or startup setup. The commands are legitimate but still create real local execution risk.
Medium
Unix shell invocation
> **NOTE**: Use `#!/bin/sh` (not `#!/bin/bash`) for maximum compatibility. The entry point should ma
The deployment guide contains shell script templates that a coding agent may execute during packaging or startup setup. The commands are legitimate but still create real local execution risk.
Medium
Unix shell invocation
| **Startup script** | `scf_bootstrap` — `#!/bin/sh` + `node src/index.js` |
The deployment guide contains shell script templates that a coding agent may execute during packaging or startup setup. The commands are legitimate but still create real local execution risk.
Risk Factors
🌐 Network access (37)
py/adapter-coze.md:58 py/adapter-coze.md:125 py/adapter-coze.md:136 py/adapter-coze.md:282 py/adapter-langgraph.md:235 py/adapter-langgraph.md:295 py/agent-deployment.md:314 py/authentication.md:431 py/authentication.md:456 py/authentication.md:468 py/references/observability.md:312 py/references/observability.md:360 py/references/observability.md:364 py/references/observability.md:134 py/references/observability.md:233 py/references/observability.md:301 py/references/observability.md:328 py/references/recipes.md:300 py/references/recipes.md:32 py/references/server.md:36 py/references/tools.md:55 py/references/tools.md:87 py/server-quickstart.md:291 py/server-quickstart.md:304 py/server-quickstart.md:321 py/server-quickstart.md:338 py/server-quickstart.md:397 py/server-quickstart.md:430 py/server-quickstart.md:277 py/server-quickstart.md:447 py/skill.md:111 SKILL.md:14 SKILL.md:15 ts/server-quickstart.md:82 ts/server-quickstart.md:128 ts/server-quickstart.md:138 ts/ui-clients.md:16
🔑 Env variables (50)
py/adapter-coze.md:134 py/adapter-coze.md:135 py/adapter-coze.md:136 py/adapter-coze.md:213 py/adapter-coze.md:267 py/adapter-coze.md:268 py/adapter-coze.md:269 py/adapter-coze.md:281 py/adapter-coze.md:134 py/adapter-coze.md:135 py/adapter-coze.md:136 py/adapter-coze.md:213 py/adapter-coze.md:267 py/adapter-coze.md:268 py/adapter-coze.md:269 py/adapter-coze.md:281 py/adapter-coze.md:30 py/adapter-coze.md:43 py/adapter-coze.md:57 py/adapter-coze.md:97 py/adapter-coze.md:124 py/adapter-coze.md:135 py/adapter-coze.md:149 py/adapter-coze.md:161 py/adapter-coze.md:213 py/adapter-coze.md:268 py/adapter-coze.md:292 py/adapter-coze.md:293 py/adapter-coze.md:319 py/adapter-coze.md:320 py/adapter-coze.md:337 py/adapter-coze.md:338 py/adapter-coze.md:356 py/adapter-development.md:117 py/adapter-development.md:118 py/adapter-langgraph.md:556 py/adapter-langgraph.md:557 py/adapter-langgraph.md:558 py/adapter-langgraph.md:556 py/adapter-langgraph.md:557 py/adapter-langgraph.md:558 py/adapter-langgraph.md:550 py/adapter-langgraph.md:551 py/adapter-langgraph.md:550 py/adapter-langgraph.md:551 py/adapter-langgraph.md:545 py/adapter-langgraph.md:557 py/agent-deployment.md:313 py/agent-deployment.md:387 py/authentication.md:319
⚙️ External commands (50)
py/agent-deployment.md:92 py/agent-deployment.md:104 py/agent-deployment.md:89 py/agent-deployment.md:322 py/agent-deployment.md:377 py/skill.md:26 py/skill.md:27 py/skill.md:28 py/skill.md:29 py/skill.md:46 py/skill.md:60 py/skill.md:61 py/skill.md:62 py/skill.md:63 py/skill.md:78-87 py/skill.md:87-91 py/skill.md:91-112 py/skill.md:112-122 py/skill.md:122-142 py/skill.md:142-146 py/skill.md:146 py/skill.md:148-161 py/skill.md:161-163 py/skill.md:163-164 py/skill.md:164-169 py/skill.md:169-179 py/skill.md:179-181 py/skill.md:181-182 py/skill.md:182-183 py/skill.md:183-184 py/skill.md:184-188 py/skill.md:188-213 py/skill.md:213-217 py/skill.md:217-227 py/skill.md:227-233 py/skill.md:233-234 py/skill.md:234 py/skill.md:235 py/skill.md:236 py/skill.md:237-242 py/skill.md:242-243 py/skill.md:243-244 py/skill.md:244 py/skill.md:245-246 SKILL.md:12 SKILL.md:14 SKILL.md:15 SKILL.md:17 ts/agent-deployment.md:74 ts/agent-deployment.md:84
📁 Filesystem access (4)
Detected Patterns
System reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissance
Audited by: codex