CoWork OS MCP Server

Findings (181)

• highHigh. Something risky that needs a close look before you install.
  code-execution issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  code-execution issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  code-execution issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dropper issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  code-execution issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dropper issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  credential-access issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  credential-access issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  credential-access issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  credential-access issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  exfiltration issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  exfiltration issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  credential-access issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  credential-access issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dropper issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  credential-access issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  credential-access issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  code-execution issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  credential-access issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  credential-access issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  credential-access issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  credential-access issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  credential-access issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  credential-access issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  credential-access issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  credential-access issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  backdoor issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  credential-access issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  secrets issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  secrets issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  secrets issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  secrets issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  secrets issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.

  src/electron/agent/tools/shell-tools.ts:644
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.

  src/electron/agent/tools/shell-tools.ts:685
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.

  src/electron/agent/tools/shell-tools.ts:691
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.

  src/electron/agent/tools/shell-tools.ts:735
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.

  src/electron/gateway/tunnel.ts:274
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.

  src/electron/gateway/tunnel.ts:359
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.

  src/electron/gateway/tunnel.ts:390
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.

  src/electron/gateway/tunnel.ts:602
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.

  src/electron/updater/update-manager.ts:750
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.

  src/electron/updater/update-manager.ts:775
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.

  src/electron/updater/update-manager.ts:798
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  httpcore2@2.9.1: 1 known vulnerability

  PYSEC-2026-3844

  benchmarks/harbor/requirements.txt
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  httpx2@2.9.1: 5 known vulnerabilities

  PYSEC-2026-3845, PYSEC-2026-3846, PYSEC-2026-3847, PYSEC-2026-3848, PYSEC-2026-3849

  benchmarks/harbor/requirements.txt
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  body-parser@2.3.0: 1 known vulnerability

  GHSA-27r3-jxmh-p828

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  follow-redirects@1.16.0: 3 known vulnerabilities

  GHSA-8r9p-f939-6h3c, GHSA-mrwp-f3q8-3g9p, GHSA-q3jh-wrc6-jgq8

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  zod@3.25.76: 1 known vulnerability

  GHSA-mrhx-c7xc-m3w5

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Install or build failed in a clean environment

  ode] [electron] 4: 0x1477ee5 [node] [electron] 5: 0x1477f13 [node] [electron] 6: 0x1490fea [node] [electron] 7: 0x14941b8 [node] [electron] 8: 0x1cfcc61 [node] [cli] npm run build:cli exited with code 0 [electron] Aborted (core dumped) [electron] npm run build:electron exited with code 134
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/electron/acp/__tests__/remote-invoker.test.ts:201
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/electron/acp/__tests__/remote-invoker.test.ts:237
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).

  src/electron/agent/__tests__/daemon-auto-prune.test.ts:23
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/electron/agent/sandbox/__tests__/macos-sandbox-credential-stores.test.ts:49
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/electron/agent/sandbox/__tests__/macos-sandbox-toolchains.test.ts:46
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/electron/agent/sandbox/__tests__/macos-sandbox-toolchains.test.ts:51
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/electron/agent/sandbox/__tests__/macos-sandbox-toolchains.test.ts:131
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/electron/agent/sandbox/__tests__/macos-sandbox-toolchains.test.ts:132
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/electron/agent/sandbox/__tests__/macos-sandbox-toolchains.test.ts:133
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/electron/agent/sandbox/__tests__/macos-sandbox-toolchains.test.ts:137
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/electron/agent/sandbox/__tests__/macos-sandbox-toolchains.test.ts:140
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/electron/agent/sandbox/__tests__/macos-sandbox-toolchains.test.ts:146
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/electron/agent/sandbox/__tests__/macos-toolchain-access.test.ts:27
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/electron/agent/sandbox/__tests__/macos-toolchain-access.test.ts:109
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/electron/agent/sandbox/__tests__/macos-toolchain-access.test.ts:111
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/electron/agent/sandbox/__tests__/macos-toolchain-access.test.ts:114
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/electron/agent/sandbox/__tests__/macos-toolchain-access.test.ts:115
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/electron/agent/sandbox/__tests__/space-files.test.ts:52
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/electron/agent/search/__tests__/searxng-provider.test.ts:41
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/electron/agent/security/__tests__/output-filter.test.ts:106
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/electron/agent/security/__tests__/output-filter.test.ts:122
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/electron/agent/security/__tests__/output-filter.test.ts:145
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/electron/agent/security/__tests__/output-filter.test.ts:163
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/electron/agent/security/__tests__/output-filter.test.ts:167
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/electron/agent/tools/__tests__/browser-tools.test.ts:1173
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).

  src/electron/agent/tools/__tests__/file-tools-protected-paths.test.ts:78
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).

  src/electron/applications/__tests__/photoshop-document-edit.test.ts:252
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).

  src/electron/applications/__tests__/photoshop-document-edit.test.ts:308
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).

  src/electron/applications/__tests__/photoshop-document-edit.test.ts:424
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).

  src/electron/browser/__tests__/fake-page.ts:586
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/electron/browser/credentials/__tests__/external-browsers.test.ts:67
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/electron/computer-use/cua-space/__tests__/settings.test.ts:29
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/electron/computer-use/cua-space/__tests__/settings.test.ts:41
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).

  src/electron/control-plane/__tests__/ssh-tunnel-arg-safety.test.ts:13
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/electron/control-plane/__tests__/ssh-tunnel.test.ts:221
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/electron/control-plane/__tests__/ssh-tunnel.test.ts:234
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/electron/control-plane/__tests__/ssh-tunnel.test.ts:250
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/electron/control-plane/__tests__/ssh-tunnel.test.ts:255
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/electron/control-plane/__tests__/ssh-tunnel.test.ts:262
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Sends data to a paste site, webhook catcher or chat webhook — common exfiltration channels.

  src/electron/gateway/__tests__/tunnel.test.ts:108
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Sends data to a paste site, webhook catcher or chat webhook — common exfiltration channels.

  src/electron/gateway/__tests__/tunnel.test.ts:111
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Sends data to a paste site, webhook catcher or chat webhook — common exfiltration channels.

  src/electron/gateway/__tests__/tunnel.test.ts:191
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).

  src/electron/guardrails/__tests__/blocked-command-patterns.test.ts:48
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).

  src/electron/guardrails/__tests__/blocked-command-patterns.test.ts:49
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).

  src/electron/guardrails/__tests__/blocked-command-patterns.test.ts:50
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).

  src/electron/guardrails/__tests__/blocked-command-patterns.test.ts:51
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).

  src/electron/guardrails/__tests__/blocked-command-patterns.test.ts:54
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).

  src/electron/guardrails/__tests__/blocked-command-patterns.test.ts:55
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).

  src/electron/guardrails/__tests__/shell-control-operators.test.ts:4
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).

  src/electron/guardrails/__tests__/shell-control-operators.test.ts:13
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Turns off TLS certificate checking, allowing traffic interception.

  src/electron/mcp/oauth/__tests__/mcp-oauth.test.ts:259
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Turns off TLS certificate checking, allowing traffic interception.

  src/electron/mcp/oauth/__tests__/workday-agent-setup.test.ts:282
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/electron/pact/__tests__/protocol-adapter.test.ts:224
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/electron/security/__tests__/access-profile-resolver.test.ts:621
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).

  src/electron/security/__tests__/capability-bundle-security.test.ts:88
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Sends data to a paste site, webhook catcher or chat webhook — common exfiltration channels.

  src/electron/security/__tests__/capability-bundle-security.test.ts:584
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Sends data to a paste site, webhook catcher or chat webhook — common exfiltration channels.

  src/electron/security/__tests__/capability-bundle-security.test.ts:602
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/electron/security/__tests__/capability-bundle-security.test.ts:610
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Sends data to a paste site, webhook catcher or chat webhook — common exfiltration channels.

  src/electron/security/__tests__/capability-bundle-security.test.ts:610
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Sends data to a paste site, webhook catcher or chat webhook — common exfiltration channels.

  src/electron/security/__tests__/capability-bundle-security.test.ts:623
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/electron/security/__tests__/credential-store-access.test.ts:55
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/electron/security/__tests__/credential-store-access.test.ts:71
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/electron/security/__tests__/credential-store-access.test.ts:86
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/electron/security/__tests__/credential-store-access.test.ts:105
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/electron/security/__tests__/credential-store-access.test.ts:119
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/electron/security/__tests__/credential-store-access.test.ts:133
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/electron/security/__tests__/credential-store-access.test.ts:158
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/electron/security/__tests__/credential-store-access.test.ts:162
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/electron/security/__tests__/network-policy-internal-hosts.test.ts:34
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/electron/security/__tests__/network-policy-internal-hosts.test.ts:69
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/electron/security/__tests__/network-policy-internal-hosts.test.ts:77
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/electron/security/__tests__/network-policy-internal-hosts.test.ts:87
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/electron/telemetry/__tests__/task-event-exporter.test.ts:140
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/electron/tunnels/__tests__/McpTunnelForwarder.test.ts:132
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/host/services/__tests__/browser-device-methods.test.ts:134
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/host/services/__tests__/browser-device-methods.test.ts:329
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/host/services/__tests__/browser-device-methods.test.ts:348
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).

  src/renderer/__tests__/ui-density.test.ts:30
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/shared/answer-surfaces/__tests__/actions.test.ts:39
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).

  src/shared/answer-surfaces/__tests__/html-bridge.test.ts:55
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).

  src/shared/answer-surfaces/__tests__/html-kit.test.ts:33
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).

  src/shared/answer-surfaces/__tests__/logic-helpers.ts:12
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).

  src/shared/answer-surfaces/__tests__/logic.test.ts:103
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  src/cli/__tests__/drill-interrupt.test.ts:53
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  scripts/qa/secrets-upgrade-smoke-checks.test.mjs:25
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  2 matches in this file

  src/electron/agent/__tests__/daemon-agent-messaging.test.ts:1818
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  5 matches in this file

  src/electron/agent/llm/__tests__/openrouter-oauth.test.ts:142
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  src/electron/agent/tools/__tests__/mcp-write-preview.test.ts:13
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  src/electron/agent/tools/__tests__/mcp-idempotency.test.ts:14
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: private-key

  2 matches in this file

  src/electron/agent/tools/__tests__/terminal-tab-tools.test.ts:195
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: stripe-access-token

  src/electron/agent/tools/__tests__/terminal-tab-tools.test.ts:233
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  src/electron/agent/tools/__tests__/terminal-tab-tools.test.ts:232
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  src/electron/agent-import/__tests__/agent-import.test.ts:35
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  src/electron/control-plane/__tests__/deployment-posture.test.ts:8
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  2 matches in this file

  src/electron/database/__tests__/task-admission-service.test.ts:144
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: aws-access-token

  2 matches in this file

  src/electron/managed/__tests__/session-handoff.test.ts:138
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  src/electron/mcp/__tests__/connector-write-preview.test.ts:4
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  src/electron/mcp/__tests__/connector-idempotency.test.ts:3
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: aws-access-token

  2 matches in this file

  src/electron/managed/__tests__/ManagedSessionService.handoff.test.ts:502
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  src/electron/managed/__tests__/ManagedSessionService.handoff.test.ts:500
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  2 matches in this file

  src/electron/mcp/client/__tests__/tool-call-meta.test.ts:31
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  src/electron/memory/__tests__/MarkdownMemoryIndexService.test.ts:65
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: private-key

  src/electron/memory/__tests__/MemoryService.test.ts:422
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  src/electron/memory/__tests__/evals/fixtures/write-hygiene.json:45
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: github-pat

  3 matches in this file

  src/electron/memory/__tests__/evals/fixtures/write-hygiene.json:15
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: aws-access-token

  2 matches in this file

  src/electron/memory/__tests__/evals/fixtures/write-hygiene.json:17
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: aws-access-token

  src/electron/memory/__tests__/MemoryWriteGate.test.ts:207
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: aws-access-token

  2 matches in this file

  src/electron/memory/__tests__/memory-privacy.test.ts:31
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: jwt

  src/electron/memory/__tests__/memory-privacy.test.ts:36
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  src/electron/pact/__tests__/policy-routing-redaction.test.ts:152
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: private-key

  src/electron/security/__tests__/http-message-signature.test.ts:17
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  src/electron/security/secret-references/__tests__/resolver.test.ts:12
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  src/electron/tunnels/__tests__/relay.test.ts:26
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  src/host/services/__tests__/browser-approval-methods.test.ts:73
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  src/host/services/__tests__/browser-desktop-rpc.test.ts:20
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  src/host/services/__tests__/browser-follow-up-methods.test.ts:35
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  3 matches in this file

  src/electron/utils/__tests__/validation.test.ts:633
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  src/host/services/__tests__/browser-mcp-methods.test.ts:555
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  2 matches in this file

  src/host/web/__tests__/WebApplication.test.ts:939
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  2 matches in this file

  src/renderer/components/__tests__/openrouter-settings-signin.test.ts:15
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  src/shared/__tests__/secret-references.test.ts:43
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  4 matches in this file

  src/renderer-web/TaskGovernance.test.ts:30
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  tests/dev-log-utils.test.ts:147
• lowLow. Minor, or common in normal tools. Shown for information.
  glob@13.0.6: 1 known vulnerability

  GHSA-3g3m-2fjr-6pw4

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  minimatch@10.2.6: 1 known vulnerability

  GHSA-g3hv-75wg-m249

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  minimatch@9.0.9: 1 known vulnerability

  GHSA-g3hv-75wg-m249

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  package.json has a postinstall script

  node scripts/codesign_electron_dev.mjs

  package.json
• lowLow. Minor, or common in normal tools. Shown for information.
  No manifest declaring network access and environment variables (agent.json)
• infoInfo. A note about the project, not a problem.
  Ignored the repo's scanner suppression config (1 file)

  .gitleaks.toml

Network activity