Security: SmooAI/smooth-operator

Security

Report a vulnerability

SECURITY.md

Security Policy

smooth-operator is an AI agent service. It runs models with tools, executes extensions, holds conversation history, and terminates authenticated WebSocket connections — so a bug here can reach data and systems well outside this repository. Please report suspected vulnerabilities privately.

Reporting a vulnerability

Use GitHub private vulnerability reporting — it gives you a tracked, private thread with the maintainers and a path to a CVE. If you would rather not use GitHub, email dev@smoo.ai instead.

Please do not open a public issue, a Discussion, or a pull request for a suspected vulnerability. A public report is a public exploit for everyone running the affected version.

Include whatever you have; a partial report is better than a silent one:

  • The version you are on, and which language — the Rust, TypeScript, Python, Go, or .NET client/server. The same logical bug is often present in one port and not the others.
  • How it is deployed — the standalone server, the AWS Lambda adapter, a Kubernetes deploy, an embedded client, or the hosted service.
  • Reproduction steps, a proof of concept, and the impact you believe it has.
  • Whether any of it is already public.

If you would like to be credited in the advisory, say so and give us the name or handle to use.

What to expect

smooth-operator is maintained by a small team at Smoo AI. We will acknowledge your report, tell you whether we could reproduce it, and keep you updated while we work on a fix. We are not going to publish an hours-and-minutes SLA we cannot staff around the clock — but silence is a failure of this process, not an answer. If a report goes unanswered, reply on the same thread and escalate.

We ask that you give us a reasonable window to ship a fix before disclosing publicly, and we will credit you in the advisory unless you would rather stay anonymous.

Supported versions

Only the latest published release receives security fixes.

Every published artifact — npm, NuGet, PyPI, crates.io, and the Go module — ships at one lockstep version, so "latest" is the same number in every language. There are no maintained release branches; fixes land on main and go out in the next release.

Scope

In scope: the servers (rust/, typescript/server, python/server, go/server, dotnet/server), the clients, the adapters under adapters/, the extension SDK and its sandboxing, and the wire protocol in spec/.

Also in scope, and worth calling out for an agent framework specifically: prompt-injection paths that cross a trust boundary (untrusted content reaching a tool call with real authority), extension sandbox escapes, tool-permission or deny-policy bypasses, authentication and session-isolation failures on the WebSocket protocol, and anything that leaks one tenant's conversation data to another.

Out of scope: findings that require an already-compromised host or an already-leaked credential, missing hardening with no demonstrated impact, and results from automated scanners submitted without a working proof of concept. Vulnerabilities in the hosted Smoo AI platform (rather than this code) also go to dev@smoo.ai — same address, we will route it.

There aren't any published security advisories

, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
Security: SmooAI/smooth-operator
Security
Report a vulnerability

SECURITY.md

Security Policy
smooth-operator is an AI agent service. It runs models with tools, executes extensions, holds
conversation history, and terminates authenticated WebSocket connections — so a bug here can reach
data and systems well outside this repository. Please report suspected vulnerabilities privately.
Reporting a vulnerability
Use GitHub private vulnerability reporting —
it gives you a tracked, private thread with the maintainers and a path to a CVE. If you would
rather not use GitHub, email dev@smoo.ai instead.
Please do not open a public issue, a Discussion, or a pull request for a suspected
vulnerability. A public report is a public exploit for everyone running the affected version.
Include whatever you have; a partial report is better than a silent one:
  • The version you are on, and which language — the Rust, TypeScript, Python, Go, or .NET
client/server. The same logical bug is often present in one port and not the others.
  • How it is deployed — the standalone server, the AWS Lambda adapter, a Kubernetes deploy, an
embedded client, or the hosted service.
  • Reproduction steps, a proof of concept, and the impact you believe it has.
  • Whether any of it is already public.
If you would like to be credited in the advisory, say so and give us the name or handle to use.
What to expect
smooth-operator is maintained by a small team at Smoo AI. We will acknowledge your report, tell you
whether we could reproduce it, and keep you updated while we work on a fix. We are not going to
publish an hours-and-minutes SLA we cannot staff around the clock — but silence is a failure of this
process, not an answer. If a report goes unanswered, reply on the same thread and escalate.
We ask that you give us a reasonable window to ship a fix before disclosing publicly, and we will
credit you in the advisory unless you would rather stay anonymous.
Supported versions
Only the latest published release receives security fixes.
Every published artifact — npm, NuGet, PyPI, crates.io, and the Go module — ships at one lockstep
version, so "latest" is the same number in every language. There are no maintained release
branches; fixes land on main and go out in the next release.
Scope
In scope: the servers (rust/, typescript/server, python/server, go/server, dotnet/server),
the clients, the adapters under adapters/, the extension SDK and its sandboxing, and the wire
protocol in spec/.
Also in scope, and worth calling out for an agent framework specifically: prompt-injection paths
that cross a trust boundary (untrusted content reaching a tool call with real authority), extension
sandbox escapes, tool-permission or deny-policy bypasses, authentication and session-isolation
failures on the WebSocket protocol, and anything that leaks one tenant's conversation data to
another.
Out of scope: findings that require an already-compromised host or an already-leaked credential,
missing hardening with no demonstrated impact, and results from automated scanners submitted without
a working proof of concept. Vulnerabilities in the hosted Smoo AI platform (rather than this code)
also go to dev@smoo.ai — same address, we will route it.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: SmooAI/smooth-operator
Security
Report a vulnerability

SECURITY.md

Security Policy
smooth-operator is an AI agent service. It runs models with tools, executes extensions, holds
conversation history, and terminates authenticated WebSocket connections — so a bug here can reach
data and systems well outside this repository. Please report suspected vulnerabilities privately.
Reporting a vulnerability
Use GitHub private vulnerability reporting —
it gives you a tracked, private thread with the maintainers and a path to a CVE. If you would
rather not use GitHub, email dev@smoo.ai instead.
Please do not open a public issue, a Discussion, or a pull request for a suspected
vulnerability. A public report is a public exploit for everyone running the affected version.
Include whatever you have; a partial report is better than a silent one:
  • The version you are on, and which language — the Rust, TypeScript, Python, Go, or .NET
client/server. The same logical bug is often present in one port and not the others.
  • How it is deployed — the standalone server, the AWS Lambda adapter, a Kubernetes deploy, an
embedded client, or the hosted service.
  • Reproduction steps, a proof of concept, and the impact you believe it has.
  • Whether any of it is already public.
If you would like to be credited in the advisory, say so and give us the name or handle to use.
What to expect
smooth-operator is maintained by a small team at Smoo AI. We will acknowledge your report, tell you
whether we could reproduce it, and keep you updated while we work on a fix. We are not going to
publish an hours-and-minutes SLA we cannot staff around the clock — but silence is a failure of this
process, not an answer. If a report goes unanswered, reply on the same thread and escalate.
We ask that you give us a reasonable window to ship a fix before disclosing publicly, and we will
credit you in the advisory unless you would rather stay anonymous.
Supported versions
Only the latest published release receives security fixes.
Every published artifact — npm, NuGet, PyPI, crates.io, and the Go module — ships at one lockstep
version, so "latest" is the same number in every language. There are no maintained release
branches; fixes land on main and go out in the next release.
Scope
In scope: the servers (rust/, typescript/server, python/server, go/server, dotnet/server),
the clients, the adapters under adapters/, the extension SDK and its sandboxing, and the wire
protocol in spec/.
Also in scope, and worth calling out for an agent framework specifically: prompt-injection paths
that cross a trust boundary (untrusted content reaching a tool call with real authority), extension
sandbox escapes, tool-permission or deny-policy bypasses, authentication and session-isolation
failures on the WebSocket protocol, and anything that leaks one tenant's conversation data to
another.
Out of scope: findings that require an already-compromised host or an already-leaked credential,
missing hardening with no demonstrated impact, and results from automated scanners submitted without
a working proof of concept. Vulnerabilities in the hosted Smoo AI platform (rather than this code)
also go to dev@smoo.ai — same address, we will route it.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: SmooAI/smooth-operator
Security
Report a vulnerability

SECURITY.md

Security Policy
smooth-operator is an AI agent service. It runs models with tools, executes extensions, holds
conversation history, and terminates authenticated WebSocket connections — so a bug here can reach
data and systems well outside this repository. Please report suspected vulnerabilities privately.
Reporting a vulnerability
Use GitHub private vulnerability reporting —
it gives you a tracked, private thread with the maintainers and a path to a CVE. If you would
rather not use GitHub, email dev@smoo.ai instead.
Please do not open a public issue, a Discussion, or a pull request for a suspected
vulnerability. A public report is a public exploit for everyone running the affected version.
Include whatever you have; a partial report is better than a silent one:
  • The version you are on, and which language — the Rust, TypeScript, Python, Go, or .NET
client/server. The same logical bug is often present in one port and not the others.
  • How it is deployed — the standalone server, the AWS Lambda adapter, a Kubernetes deploy, an
embedded client, or the hosted service.
  • Reproduction steps, a proof of concept, and the impact you believe it has.
  • Whether any of it is already public.
If you would like to be credited in the advisory, say so and give us the name or handle to use.
What to expect
smooth-operator is maintained by a small team at Smoo AI. We will acknowledge your report, tell you
whether we could reproduce it, and keep you updated while we work on a fix. We are not going to
publish an hours-and-minutes SLA we cannot staff around the clock — but silence is a failure of this
process, not an answer. If a report goes unanswered, reply on the same thread and escalate.
We ask that you give us a reasonable window to ship a fix before disclosing publicly, and we will
credit you in the advisory unless you would rather stay anonymous.
Supported versions
Only the latest published release receives security fixes.
Every published artifact — npm, NuGet, PyPI, crates.io, and the Go module — ships at one lockstep
version, so "latest" is the same number in every language. There are no maintained release
branches; fixes land on main and go out in the next release.
Scope
In scope: the servers (rust/, typescript/server, python/server, go/server, dotnet/server),
the clients, the adapters under adapters/, the extension SDK and its sandboxing, and the wire
protocol in spec/.
Also in scope, and worth calling out for an agent framework specifically: prompt-injection paths
that cross a trust boundary (untrusted content reaching a tool call with real authority), extension
sandbox escapes, tool-permission or deny-policy bypasses, authentication and session-isolation
failures on the WebSocket protocol, and anything that leaks one tenant's conversation data to
another.
Out of scope: findings that require an already-compromised host or an already-leaked credential,
missing hardening with no demonstrated impact, and results from automated scanners submitted without
a working proof of concept. Vulnerabilities in the hosted Smoo AI platform (rather than this code)
also go to dev@smoo.ai — same address, we will route it.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
Security: SmooAI/smooth-operator
Security
Report a vulnerability

SECURITY.md

Security Policy
smooth-operator is an AI agent service. It runs models with tools, executes extensions, holds
conversation history, and terminates authenticated WebSocket connections — so a bug here can reach
data and systems well outside this repository. Please report suspected vulnerabilities privately.
Reporting a vulnerability
Use GitHub private vulnerability reporting —
it gives you a tracked, private thread with the maintainers and a path to a CVE. If you would
rather not use GitHub, email dev@smoo.ai instead.
Please do not open a public issue, a Discussion, or a pull request for a suspected
vulnerability. A public report is a public exploit for everyone running the affected version.
Include whatever you have; a partial report is better than a silent one:
  • The version you are on, and which language — the Rust, TypeScript, Python, Go, or .NET
client/server. The same logical bug is often present in one port and not the others.
  • How it is deployed — the standalone server, the AWS Lambda adapter, a Kubernetes deploy, an
embedded client, or the hosted service.
  • Reproduction steps, a proof of concept, and the impact you believe it has.
  • Whether any of it is already public.
If you would like to be credited in the advisory, say so and give us the name or handle to use.
What to expect
smooth-operator is maintained by a small team at Smoo AI. We will acknowledge your report, tell you
whether we could reproduce it, and keep you updated while we work on a fix. We are not going to
publish an hours-and-minutes SLA we cannot staff around the clock — but silence is a failure of this
process, not an answer. If a report goes unanswered, reply on the same thread and escalate.
We ask that you give us a reasonable window to ship a fix before disclosing publicly, and we will
credit you in the advisory unless you would rather stay anonymous.
Supported versions
Only the latest published release receives security fixes.
Every published artifact — npm, NuGet, PyPI, crates.io, and the Go module — ships at one lockstep
version, so "latest" is the same number in every language. There are no maintained release
branches; fixes land on main and go out in the next release.
Scope
In scope: the servers (rust/, typescript/server, python/server, go/server, dotnet/server),
the clients, the adapters under adapters/, the extension SDK and its sandboxing, and the wire
protocol in spec/.
Also in scope, and worth calling out for an agent framework specifically: prompt-injection paths
that cross a trust boundary (untrusted content reaching a tool call with real authority), extension
sandbox escapes, tool-permission or deny-policy bypasses, authentication and session-isolation
failures on the WebSocket protocol, and anything that leaks one tenant's conversation data to
another.
Out of scope: findings that require an already-compromised host or an already-leaked credential,
missing hardening with no demonstrated impact, and results from automated scanners submitted without
a working proof of concept. Vulnerabilities in the hosted Smoo AI platform (rather than this code)
also go to dev@smoo.ai — same address, we will route it.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: SmooAI/smooth-operator
Security
Report a vulnerability

SECURITY.md

Security Policy
smooth-operator is an AI agent service. It runs models with tools, executes extensions, holds
conversation history, and terminates authenticated WebSocket connections — so a bug here can reach
data and systems well outside this repository. Please report suspected vulnerabilities privately.
Reporting a vulnerability
Use GitHub private vulnerability reporting —
it gives you a tracked, private thread with the maintainers and a path to a CVE. If you would
rather not use GitHub, email dev@smoo.ai instead.
Please do not open a public issue, a Discussion, or a pull request for a suspected
vulnerability. A public report is a public exploit for everyone running the affected version.
Include whatever you have; a partial report is better than a silent one:
  • The version you are on, and which language — the Rust, TypeScript, Python, Go, or .NET
client/server. The same logical bug is often present in one port and not the others.
  • How it is deployed — the standalone server, the AWS Lambda adapter, a Kubernetes deploy, an
embedded client, or the hosted service.
  • Reproduction steps, a proof of concept, and the impact you believe it has.
  • Whether any of it is already public.
If you would like to be credited in the advisory, say so and give us the name or handle to use.
What to expect
smooth-operator is maintained by a small team at Smoo AI. We will acknowledge your report, tell you
whether we could reproduce it, and keep you updated while we work on a fix. We are not going to
publish an hours-and-minutes SLA we cannot staff around the clock — but silence is a failure of this
process, not an answer. If a report goes unanswered, reply on the same thread and escalate.
We ask that you give us a reasonable window to ship a fix before disclosing publicly, and we will
credit you in the advisory unless you would rather stay anonymous.
Supported versions
Only the latest published release receives security fixes.
Every published artifact — npm, NuGet, PyPI, crates.io, and the Go module — ships at one lockstep
version, so "latest" is the same number in every language. There are no maintained release
branches; fixes land on main and go out in the next release.
Scope
In scope: the servers (rust/, typescript/server, python/server, go/server, dotnet/server),
the clients, the adapters under adapters/, the extension SDK and its sandboxing, and the wire
protocol in spec/.
Also in scope, and worth calling out for an agent framework specifically: prompt-injection paths
that cross a trust boundary (untrusted content reaching a tool call with real authority), extension
sandbox escapes, tool-permission or deny-policy bypasses, authentication and session-isolation
failures on the WebSocket protocol, and anything that leaks one tenant's conversation data to
another.
Out of scope: findings that require an already-compromised host or an already-leaked credential,
missing hardening with no demonstrated impact, and results from automated scanners submitted without
a working proof of concept. Vulnerabilities in the hosted Smoo AI platform (rather than this code)
also go to dev@smoo.ai — same address, we will route it.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: SmooAI/smooth-operator
Security
Report a vulnerability

SECURITY.md

Security Policy
smooth-operator is an AI agent service. It runs models with tools, executes extensions, holds
conversation history, and terminates authenticated WebSocket connections — so a bug here can reach
data and systems well outside this repository. Please report suspected vulnerabilities privately.
Reporting a vulnerability
Use GitHub private vulnerability reporting —
it gives you a tracked, private thread with the maintainers and a path to a CVE. If you would
rather not use GitHub, email dev@smoo.ai instead.
Please do not open a public issue, a Discussion, or a pull request for a suspected
vulnerability. A public report is a public exploit for everyone running the affected version.
Include whatever you have; a partial report is better than a silent one:
  • The version you are on, and which language — the Rust, TypeScript, Python, Go, or .NET
client/server. The same logical bug is often present in one port and not the others.
  • How it is deployed — the standalone server, the AWS Lambda adapter, a Kubernetes deploy, an
embedded client, or the hosted service.
  • Reproduction steps, a proof of concept, and the impact you believe it has.
  • Whether any of it is already public.
If you would like to be credited in the advisory, say so and give us the name or handle to use.
What to expect
smooth-operator is maintained by a small team at Smoo AI. We will acknowledge your report, tell you
whether we could reproduce it, and keep you updated while we work on a fix. We are not going to
publish an hours-and-minutes SLA we cannot staff around the clock — but silence is a failure of this
process, not an answer. If a report goes unanswered, reply on the same thread and escalate.
We ask that you give us a reasonable window to ship a fix before disclosing publicly, and we will
credit you in the advisory unless you would rather stay anonymous.
Supported versions
Only the latest published release receives security fixes.
Every published artifact — npm, NuGet, PyPI, crates.io, and the Go module — ships at one lockstep
version, so "latest" is the same number in every language. There are no maintained release
branches; fixes land on main and go out in the next release.
Scope
In scope: the servers (rust/, typescript/server, python/server, go/server, dotnet/server),
the clients, the adapters under adapters/, the extension SDK and its sandboxing, and the wire
protocol in spec/.
Also in scope, and worth calling out for an agent framework specifically: prompt-injection paths
that cross a trust boundary (untrusted content reaching a tool call with real authority), extension
sandbox escapes, tool-permission or deny-policy bypasses, authentication and session-isolation
failures on the WebSocket protocol, and anything that leaks one tenant's conversation data to
another.
Out of scope: findings that require an already-compromised host or an already-leaked credential,
missing hardening with no demonstrated impact, and results from automated scanners submitted without
a working proof of concept. Vulnerabilities in the hosted Smoo AI platform (rather than this code)
also go to dev@smoo.ai — same address, we will route it.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
Security: SmooAI/smooth-operator
Security
Report a vulnerability

SECURITY.md

Security Policy
smooth-operator is an AI agent service. It runs models with tools, executes extensions, holds
conversation history, and terminates authenticated WebSocket connections — so a bug here can reach
data and systems well outside this repository. Please report suspected vulnerabilities privately.
Reporting a vulnerability
Use GitHub private vulnerability reporting —
it gives you a tracked, private thread with the maintainers and a path to a CVE. If you would
rather not use GitHub, email dev@smoo.ai instead.
Please do not open a public issue, a Discussion, or a pull request for a suspected
vulnerability. A public report is a public exploit for everyone running the affected version.
Include whatever you have; a partial report is better than a silent one:
  • The version you are on, and which language — the Rust, TypeScript, Python, Go, or .NET
client/server. The same logical bug is often present in one port and not the others.
  • How it is deployed — the standalone server, the AWS Lambda adapter, a Kubernetes deploy, an
embedded client, or the hosted service.
  • Reproduction steps, a proof of concept, and the impact you believe it has.
  • Whether any of it is already public.
If you would like to be credited in the advisory, say so and give us the name or handle to use.
What to expect
smooth-operator is maintained by a small team at Smoo AI. We will acknowledge your report, tell you
whether we could reproduce it, and keep you updated while we work on a fix. We are not going to
publish an hours-and-minutes SLA we cannot staff around the clock — but silence is a failure of this
process, not an answer. If a report goes unanswered, reply on the same thread and escalate.
We ask that you give us a reasonable window to ship a fix before disclosing publicly, and we will
credit you in the advisory unless you would rather stay anonymous.
Supported versions
Only the latest published release receives security fixes.
Every published artifact — npm, NuGet, PyPI, crates.io, and the Go module — ships at one lockstep
version, so "latest" is the same number in every language. There are no maintained release
branches; fixes land on main and go out in the next release.
Scope
In scope: the servers (rust/, typescript/server, python/server, go/server, dotnet/server),
the clients, the adapters under adapters/, the extension SDK and its sandboxing, and the wire
protocol in spec/.
Also in scope, and worth calling out for an agent framework specifically: prompt-injection paths
that cross a trust boundary (untrusted content reaching a tool call with real authority), extension
sandbox escapes, tool-permission or deny-policy bypasses, authentication and session-isolation
failures on the WebSocket protocol, and anything that leaks one tenant's conversation data to
another.
Out of scope: findings that require an already-compromised host or an already-leaked credential,
missing hardening with no demonstrated impact, and results from automated scanners submitted without
a working proof of concept. Vulnerabilities in the hosted Smoo AI platform (rather than this code)
also go to dev@smoo.ai — same address, we will route it.
 There aren't any published security advisories