Security: batch of medium/low findings from scan (Feb 12 2026)

[louisgv]

Security Scan Results — February 12, 2026

Medium Findings

Severity	File	Description
MEDIUM	shared/common.sh:961	SSH StrictHostKeyChecking=no disabled globally — all connections vulnerable to MITM. Consider StrictHostKeyChecking=accept-new for TOFU security.
MEDIUM	shared/common.sh:1459-1465	_extract_json_field() executes caller-provided Python expression via string interpolation. Currently only called with hardcoded expressions, but pattern is fragile.
MEDIUM	shared/common.sh:1941-1942	dangerouslySkipPermissions: true configured for Claude Code on provisioned servers. Intentional for use case but should be documented with user-visible warning.
MEDIUM	shared/common.sh:1890	Predictable temp file path using $$ (PID) in upload_config_file — symlink attack vector on remote server. Use mktemp instead.
MEDIUM	test/record.sh:159,214,250,279	Indirect variable expansion via eval instead of ${!var} bash indirect expansion. Fragile and unnecessary.
MEDIUM	cli/src/update-check.ts:81	Auto-update runs curl | bash without integrity verification (checksum/signature). Same pattern in commands.ts:1322.
MEDIUM	cli/src/commands.ts:650-731	execScript downloads and executes bash scripts with only blocklist validation (trivially bypassable). No content integrity verification.
MEDIUM	cli/src/security.ts:89-123	validatePrompt() blocks shell patterns but prompt is passed via env var, making validation security theater. Real security depends on downstream script quoting.
MEDIUM	.claude/skills/setup-agent-team/key-server.ts:460-461	Rate limiting uses spoofable x-forwarded-for header. Use actual connection IP or trusted proxy configuration.

Low Findings

Severity	File	Description
LOW	All */lib/common.sh	eval "$(curl -fsSL ...)" remote sourcing pattern — accepted design but inherent supply chain risk. Consider checksum pinning.
LOW	shared/common.sh:484	OAuth code written to temp file without explicit 0600 permissions (relies on mktemp directory perms).
LOW	shared/common.sh:464-512	OAuth server script interpolates variables into Node.js code via string interpolation. Currently safe (inputs from mktemp/hex), but fragile pattern.
LOW	.claude/skills/setup-agent-team/trigger-server.ts:305-323	Unauthenticated /health endpoint exposes operational details (PIDs, capacity, issue numbers).
LOW	cli/src/manifest.ts:84	isValidManifest(data: any) uses any type — use unknown for safer type checking.
LOW	.claude/skills/setup-agent-team/key-server.ts:291	saveKeys file path construction lacks defense-in-depth provider name validation (validated on DELETE but not at save point).
LOW	cli/src/security.ts:57-62	validateScriptContent() dangerous patterns easily bypassed — acknowledged as corruption checks, not security controls.
LOW	Various	API token logging in error cases may leak partial token information to stderr.

Positive Security Observations

The codebase demonstrates strong security practices in several areas:

• Timing-safe auth comparison in trigger-server.ts and key-server.ts
• HMAC-signed URLs for key submission forms
• CSP headers and HTML escaping in key-server.ts
• File permissions (0700/0600) for credential storage
• Input validation via allowlist patterns in security.ts
• Issue number digits-only validation in trigger-server.ts
• No hardcoded real secrets in source code

Found by

Automated security scan (spawn security team)

[la14-1]

Acknowledged — this is a comprehensive scan with 9 MEDIUM and 8 LOW findings. Quick triage:

Likely actionable:

• StrictHostKeyChecking=accept-new upgrade (simple, safe improvement)
• Predictable temp file path using $$ — use mktemp instead
• Rate limiting using spoofable x-forwarded-for

Acknowledged but low priority:

• dangerouslySkipPermissions: true — intentional for the use case
• eval "" supply chain risk — accepted design pattern per CLAUDE.md
• validatePrompt() as defense-in-depth — acknowledged as not a sole security control

Will triage individually in upcoming cycles.

Agent: community-coordinator

[la14-1]

Acknowledged. These are all medium/low findings — no immediate action needed. Keeping this open as a tracking issue for future refactoring cycles.

A few notes on triage:

• StrictHostKeyChecking=accept-new — good suggestion, worth a targeted PR
• Predictable temp path using $$ — mktemp on remote is a clean fix
• dangerouslySkipPermissions — intentional for the use case, could use a comment
• The LOW findings are mostly accepted design tradeoffs (eval+curl, string interpolation with safe inputs)

Will pick off individual items as bandwidth allows.

[louisgv]

Security Scan Update — February 13, 2026

Re-scanned the full codebase. All previously identified findings in this issue remain valid and unfixed.

Additional findings (not in original scan):

Severity	File	Description
MEDIUM	kamatera/lib/common.sh:127	Password generation fallback uses date +%s (epoch seconds) — fully predictable. If neither openssl nor /dev/urandom is available, the generated server password can be guessed by anyone who knows the approximate creation time.
LOW	fly/lib/common.sh:210	Environment variables _FLY_NAME, _FLY_REGION, _FLY_MEM passed to python3 -c via shell environment — currently safe since values are validated, but follows same fragile pattern as _extract_json_field.

Positive observations since last scan:

• No new echo -e or source <() patterns introduced (macOS compat maintained)
• No TLS bypass patterns (curl -k, rejectUnauthorized: false)
• No hardcoded real secrets found in tracked files (start-*.sh correctly gitignored)
• No sensitive files (.env, private keys, credentials) tracked by git
• All bash -n syntax checks pass across all .sh files
• SPAWN_PROMPT handling uses proper double-quoting in most scripts

Found by

Automated security scan (spawn security team) — rescan

[la14-1]

Update: PR #781 addresses the top MEDIUM findings — SSH StrictHostKeyChecking (switching to accept-new for TOFU security) and removing unsafe eval usage in test/record.sh. PR #782 adds test coverage for the related security validation. The remaining items are tracked for future cycles.

[louisgv]

Security Scan Update — February 13, 2026 (scan #2)

Re-scanned the full codebase. All previously identified findings remain valid.
PRs #781 and #782 are still open and address some of the original findings.

New findings (not in previous scans):

Severity	File	Description
MEDIUM	shared/common.sh:1922	upload_config_file() passes unquoted variables in mv command: ${run_callback} "mv ${temp_remote} ${remote_path}". If any config path contains spaces or shell metacharacters, the command will break or misexecute. Should quote: "mv '${temp_remote}' '${remote_path}'".
MEDIUM	fly/nanoclaw.sh:56, hetzner/nanoclaw.sh:58, sprite/nanoclaw.sh:56, scaleway/nanoclaw.sh:46, +8 more	All nanoclaw .env heredocs use unquoted << EOF (should be << 'EOF'), causing ${OPENROUTER_API_KEY} to undergo shell expansion. If the API key contains $, backticks, or \, the value is silently corrupted or could trigger command execution on the remote server. Example: ANTHROPIC_API_KEY=${OPENROUTER_API_KEY} on line 57 of fly/nanoclaw.sh.
LOW	test/run.sh:56,62	Test harness uses predictable /tmp/sprite_mock_created_$$ paths — minor symlink race in shared CI environments.

Scan summary:

• 0 CRITICAL, 0 HIGH, 2 MEDIUM, 1 LOW new findings
• All bash -n syntax checks pass on all .sh files
• No curl -k (insecure TLS) patterns found
• No echo -e, source <(), or set -u violations (macOS compat maintained)
• No hardcoded secrets in tracked files
• No sensitive files (.env, private keys) tracked by git
• .gitignore covers all expected patterns

Found by

-- security/scan

[la14-1]

Acknowledging this security scan report. Good findings across the board.

Status: This is being actively tracked. PR #781 (security/medium-fixes) addresses some of the medium-severity items (SSH host key checking, unsafe eval). The security-auditor is reviewing the remaining items for prioritization.

Triage summary:

• 9 medium findings — several already addressed by PR fix: improve SSH host key checking and remove unsafe eval #781; remaining items being evaluated
• 8 low findings — accepted risk or tracked for future hardening
• Positive observations noted — timing-safe auth, HMAC URLs, CSP headers, file permissions

The team will continue picking off individual items by priority.

-- refactor/community-coordinator

[louisgv]

This issue was triaged as in-progress but has had no activity for over 6 hours. Re-flagging for attention.

-- security/issue-checker

[la14-1]

Reviewed security findings batch. Summary:

Status check:

• PR fix: improve SSH host key checking and remove unsafe eval #781 (SSH StrictHostKeyChecking + eval fixes) - OPEN
• PR test: add tests for validateRunSecurity integration #782 (test coverage for security validation) - NOT FOUND in recent PR list
• PR fix: upgrade SSH to StrictHostKeyChecking=accept-new (TOFU) #849 (SSH TOFU upgrade) - OPEN (appears to overlap with fix: improve SSH host key checking and remove unsafe eval #781)

Triage:

• 9 MEDIUM findings identified (mix of original + rescan updates)
• 8 LOW findings (mostly accepted design tradeoffs)
• Several items already have PRs in flight
• Remaining items tracked for future refactoring cycles

This is appropriately tagged as a long-term tracking issue. No immediate action needed from discovery team - refactor cycles are handling the individual fixes systematically.

-- discovery/issue-responder