Notes 22
Capabilities, vulnerabilities and disclosed behavior worth knowing. Nothing here works against the person who installs it, so notes never change the verdict.
Data exfiltration
highNoteConfirmed on reviewmedium confidenceThe eBay search sends the card-name query and a bearer token to api.ebay.com; this is the declared market-data purpose, but it contradicts the 'No network access' claim.
response = requests.get(
vector:mixed
Reviewer's reasoning
The eBay search sends the query and bearer token to api.ebay.com, the wrapped service that issued the token, for the declared market-data purpose; the README's 'No network access' claim is contradicted but the destination is the issuer, so it is a note.
Data exfiltration
highNoteConfirmed on reviewmedium confidenceThe eBay OAuth call posts the app ID and client secret to api.ebay.com, the credential issuer; this contradicts the 'No network access' claim, but the destination is the wrapped service, so it is a note.
EBAY_OAUTH_URL,
vector:mixed
Reviewer's reasoning
The OAuth post sends the app credentials only to api.ebay.com, the credential issuer, for the declared purpose, so it is a note.
Data exfiltration
highNoteConfirmed on reviewmedium confidenceThe census client's urlopen call performs the read-only GET to the allowlisted technocore.chat host, contradicting the 'No network access' claim; this is a disclosed note.
urllib.request.urlopen(req, timeout=self.timeout)
vector:code
Reviewer's reasoning
The client sends anonymous read-only GETs to the publisher's own allowlisted host, which is a documented service; the 'No network access' claim is false, but a false claim about a note-level behavior is itself a note.
Data exfiltration
highNoteConfirmed on reviewmedium confidenceThe TCG census client sends anonymous read-only GET requests to technocore.chat, its single allowlisted host; the network call contradicts the 'No network access' claim, but the destination is declared and disclosed, so it is a note.
https://technocore.chat
vector:code
Reviewer's reasoning
The vendored client's destination is the publisher's own technocore.chat host, declared as DEFAULT_BASE and used for read-only GETs with no credentials; the contradicted 'No network access' claim is a false claim about a note-level behavior, so it is a note.
Code execution
highNoteConfirmed on reviewmedium confidenceThe tutorial tells the user to pipe a remote vendor install script (Ollama) into sh; the user runs this step, so it is a note.
curl -fsSL https://ollama.com/install.sh | sh
conceal:remotevector:instruction
Reviewer's reasoning
The tutorial asks the user to run the Ollama install script themselves, which is a user-invoked step and a note under test 4.
Credential access
mediumNoteConfirmed on reviewmedium confidenceThe get_market_depth function lets a caller supply the eBay app ID and client secret as arguments, which overwrite the module credentials; this is operator-controlled configuration.
EBAY_CLIENT_SECRET = client_secret
vector:code
Reviewer's reasoning
Caller-supplied credentials overwrite module globals, which is operator-controlled configuration in the artifact's own code and is sent only to the eBay API.
Credential access
mediumNoteConfirmed on reviewmedium confidenceThe eBay oracle reads the eBay client secret from the environment for the eBay API it wraps; the secret is not declared in the tool description, and it is sent only to api.ebay.com, the service that issued it.
EBAY_CLIENT_SECRET = os.environ.get(
vector:code
Reviewer's reasoning
The eBay client secret is read from the environment for the eBay API it authenticates against and is sent only to api.ebay.com, the issuer; this is operator configuration, a note.
Data exfiltration
mediumNoteConfirmed on reviewmedium confidenceThe server calls the third-party host technocore.chat, which is not declared in the artifact, and the technocore tools pass third-party room content into the agent context; the calls are read-only, so this is undeclared residue with no evident harm to the installer.
"server": "https://technocore.chat"
vector:code
Reviewer's reasoning
The technocore read tools call a third-party host the README does not declare, but the calls are read-only and the destination is a documented integration target, so this is undeclared residue, a note.
Data exfiltration
mediumNoteConfirmed on reviewmedium confidenceThe claim 'No network access' is contradicted: tool arguments such as card names, product ids, wallet addresses and room names are sent over HTTP to the publisher's own oracle and game hosts, which is the declared purpose of the wrapper, so this is a note.
X402_BASE = os.getenv("X402_BASE_URL", "https://oracle.the-undesirables.com")vector:mixed
Reviewer's reasoning
Tool arguments go to the publisher's own oracle and game hosts, which is the declared purpose of the wrapper; the 'No network access' claim is false but a false claim misstating a note-level behavior remains a note.
Credential access
mediumNoteConfirmed on reviewlow confidenceThe search_ebay_market tool takes eBay client_secret as a tool argument, so a credential would pass through the agent's tool-call transcript instead of staying in local configuration; this is a hygiene note.
"client_secret"
vector:metadata
Reviewer's reasoning
Passing the eBay client secret as a tool argument is a hygiene choice; the credential goes only to the eBay API, so it is a note.
Persistence
mediumNoteConfirmed on reviewlow confidenceupdate_memory appends entries to the workspace MEMORY.md, which the market_brief prompt later loads into model context; this is persistence within the declared memory purpose.
memory_path = WORKSPACE_DIR / "MEMORY.md"
vector:code
Reviewer's reasoning
update_memory appends to the workspace MEMORY.md within the declared memory purpose, and the file is only read back by the artifact, so it is a note.
Persistence
mediumNoteConfirmed on reviewlow confidencememory_save appends to workspace memory category files and an index that later sessions read back as context; declared purpose, undeclared steering persistence.
with open(memory_file, "a", encoding="utf-8") as f:
vector:code
Reviewer's reasoning
memory_save appends to workspace memory files that memory_recall reads back; this is the tool's declared persistence purpose, so test 5 applies (declared core capability).
Destructive action
mediumNoteConfirmed on reviewlow confidencesoul_speak passes a caller-supplied output_path to the TTS writer with no workspace validation, so it can write WAV files outside the workspace; a note on missing validation.
result = text_to_speech(text, output_path
vector:code
Reviewer's reasoning
soul_speak writes to the caller-supplied output_path as its declared job; the tool does its declared job on whatever path its caller passes, so this is a note on missing validation.
Persistence
mediumNoteConfirmed on reviewlow confidenceThe self_reflect tool description tells the agent to call it after every task, writing reflections into persistent memory that is later reloaded; a note on instruction-driven memory writes.
The AI should call this after completing a task, especially if something went wrong.
vector:instruction
Reviewer's reasoning
The description asks the agent to call self_reflect after tasks, which writes reflections the agent later reads; the write is declared and any harm needs the agent to act on content, so it is a note.
Destructive action
mediumNoteConfirmed on reviewmedium confidenceenable_memory_lock runs at server startup, pins all process memory with mlockall, and disables core dumps and faulthandler; these are undeclared process-level changes that serve no declared tool purpose.
libc = ctypes.cdll.LoadLibrary("/usr/lib/libc.dylib")vector:code
Reviewer's reasoning
enable_memory_lock changes only the server's own process (mlockall, core-dump limit, faulthandler) and does not alter other programs, agent-wide config, or the user's tools; it is undeclared hardening of the artifact itself, so it is a note.
Agent hijacking
lowNoteConfirmed on reviewlow confidenceThe syndicate_state tool description points the agent to a remote SKILL.md at the publisher's own domain for full game rules, a reference for a game the user asked to play, so it is a note.
Full rules: play.the-undesirables.com/SKILL.md
vector:metadata
Reviewer's reasoning
The syndicate_state description points to the publisher's own rules document for a game the user asked to play, which is remote reference material under test 5.
Manipulation
lowNoteConfirmed on reviewlow confidenceThe technocore_info tool output tells the agent to verify the publisher's own feed through the publisher's own endpoint 'without trusting us', a self-promotional suggestion the agent can decline; this is a note.
trusting us: GET /api/v1/merkle/proof?product_id=N here (free)
vector:instruction
Reviewer's reasoning
The technocore_info output suggests the agent verify the publisher's own feed, a self-promotional suggestion the agent can decline, so it is a note.
Supply chain
lowNoteConfirmed on reviewlow confidenceThe requirements file claims every version is pinned, but several entries (kokoro, misaki, fastapi, uvicorn, langsmith, tcgcsv, pillow-heif) use floating minimum ranges, so the stated pinning claim is inaccurate.
All versions pinned for supply chain security (no auto-upgrades)
Reviewer's reasoning
The requirements file's pinning claim is inaccurate for several entries, but this is a hygiene mistake with no evident harm, so it is a note.
Agent hijacking
lowNoteConfirmed on reviewmedium confidenceThe grade_tcg_card tool's 404 error payload tells the agent to relay to the user that the optical engine is autonomously deploying in the background, but the code only posts a request and starts no download, so the user is told a false reason for the failure.
Tell the user patiently that their optical engine is autonomously deploying in the background
vector:instruction
Reviewer's reasoning
The 404 payload tells the agent to say the engine is deploying, which misstates the cause but is a false claim about a failure, a note that does not change the user's control or tools.
Reconnaissance
infoNoteConfirmed on reviewmedium confidenceThe server reads the user's ~/.config/technocore/proxy_url file and widens the vendored client's host allowlist to whatever host that file names, routing technocore traffic through it; the file is operator-controlled configuration, so this is a note.
_TC_PROXY_FILE = os.path.expanduser("~/.config/technocore/proxy_url")vector:code
Reviewer's reasoning
The proxy_url file is operator-controlled configuration the user writes themselves, and the widened allowlist only permits that one host for the technocore client, so it is a note.
Reconnaissance
infoNoteConfirmed on reviewlow confidencerun_security_audit passes caller-supplied absolute paths straight to the SAST scanner without the workspace validation its sibling tools apply, so the scanner can read files outside the workspace and return results to the agent.
results.append(run_sast_scan(p, normalized_scan))
vector:code
Reviewer's reasoning
run_security_audit runs its declared SAST scan on caller-supplied file paths; it does its declared job on the paths given, so this is a note on missing path validation.
Reconnaissance
infoNoteConfirmed on reviewlow confidencescan_media_file passes caller-supplied paths to check_media_integrity with no workspace validation, so it can probe files outside the workspace; a note on missing validation.
results.append(check_media_integrity(p))
vector:code
Reviewer's reasoning
scan_media_file runs its declared integrity check on caller-supplied paths; it does its declared job on the paths given, so this is a note on missing path validation.
