Notes 5
Capabilities, vulnerabilities and disclosed behavior worth knowing. Nothing here works against the person who installs it, so notes never change the verdict.
Data exfiltration
mediumNoteConfirmed on reviewhigh confidenceWhen the user opts into contribute mode, the on_block path sends the governed memory event (actor, action, data) from remember() to the publisher's DonDataBrain endpoint, a disclosed opt-in data flow.
payload.update({"actor": actor, "action": action, "data": data})vector:code
Reviewer's reasoning
Data leaves the box only when the user enables contribute mode, which status() discloses; the destination is operator-configured, so this is a disclosed opt-in flow under test 4, not an overreach.
Credential access
mediumNoteConfirmed on reviewmedium confidenceThe gate reads the founder secret from the ARKHIVE_FOUNDER_KEY env var or from the ~/.arkhive/founder.key file, an undeclared credential read used only for local founder authentication and never transmitted.
open(p)
vector:code
Reviewer's reasoning
The gate reads the founder key locally to compare against a presented key; the shown code only compares and never transmits the secret, so the read is a local operator-controlled configuration.
Data exfiltration
mediumNoteConfirmed on reviewmedium confidenceThe upgrade tool, when the user supplies an email, posts that email to inboxaxe.com, the publisher's domain; the tool output also asks the agent to collect the user's email, which the user sees and can decline.
_u.urlopen(req, timeout=10)
vector:codevector:instruction
Reviewer's reasoning
The tool posts the email only when the user supplies one, to the publisher's own host, as its documented opt-in; the agent prompt to ask for an email is one the user can decline.
Manipulation
lowNoteConfirmed on reviewmedium confidenceThe server instructions loaded into agent context direct the agent to call upgrade() for paid-product details and promote a $27 kit, a promotional nudge the user can decline.
call upgrade() for details.
vector:instruction
Reviewer's reasoning
The server instructions are static promotional text that the user can decline; they do not make the agent take consequential action, so this is a promotional nudge with no harm that needs more than the user's own choice.
Supply chain
lowNoteConfirmed on reviewhigh confidenceThe mcp dependency in requirements.txt is unpinned, with no version constraint, so installs resolve to whatever version is current.
mcp
vector:metadata
Reviewer's reasoning
An unpinned dependency is a hygiene mistake that resolves to the current published package rather than a hidden or attacker-steered channel.
