io.github.theoddden/terradev

What we checked

Six static checks, weighted by risk. Every result reflects only what could be observed in the published package and repository — never intent.

• Injection surface

  fail25% of grade

  Tool descriptions/manifest scanned for instruction-injection patterns (imperatives at the model, hidden text, 'ignore previous', data-exfil URLs).

  tool "vllm_inference" param "endpoint" description: raw-IP URL in a description (http://10.0.0.1:8000) — strong exfil tell. tool "vllm_info" param "endpoint" description: raw-IP URL in a description (http://10.0.0.1:8000) — strong exfil tell. tool "sglang_inference" param "endpoint" description: raw-IP URL in a description (http://10.0.0.1:8000) — strong exfil tell. tool "lora_list" param "endpoint" description: raw-IP URL in a description (http://10.0.0.1:8000) — strong exfil tell. tool "lora_add" param "endpoint" description: raw-IP URL in a description (http://10.0.0.1:8000) — strong exfil tell. tool "lora_remove" param "endpoint" description: raw-IP URL in a description (http://10.0.0.1:8000) — strong exfil tell. tool "vllm_analyze" param "endpoint" description: off-vendor URL in a description (localhost); capability text should not name where data goes.

• Supply chain

  pass25% of grade

  Package provenance: namespace verification, repo linkage, maintainer count, account age, postinstall scripts, typosquat distance.

  Python build script has no build-time network/exec; repository linkage verified

• Credential hygiene

  fail15% of grade

  How the server takes secrets (env vs plaintext config vs hardcoded); secrets appearing in tool schemas.

  tool "provision_gpu" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "preflight_report" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "preflight_gpu_check" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "preflight_network_check" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "local_scan" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "status" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "manage_instance" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "analytics" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "optimize" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "setup_provider" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "configure_provider" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "train" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "preflight" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "stage" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "up" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "rollback" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "manifests" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "run_workflow" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "active_context" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "governance_request_consent" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "governance_record_consent" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "governance_evaluate_opa" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "governance_move_data" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "governance_movement_history" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "governance_compliance_report" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "inferx_deploy" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "inferx_status" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "inferx_list" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "inferx_optimize" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "inferx_configure" has a secret-shaped input parameter "api_key" — secrets must never be tool parameters (the model would supply/handle the credential). tool "inferx_configure" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "inferx_delete" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "inferx_usage" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "inferx_quote" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "infer_route" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "infer_route_disagg" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "infer_failover" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "gpu_topology" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "vllm_start" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "vllm_stop" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "vllm_inference" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "vllm_info" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "vllm_sleep" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "vllm_wake" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "sglang" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "sglang_start" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "sglang_stop" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "sglang_inference" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "ollama_list" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "ollama_pull" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "ollama_generate" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "ollama_chat" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "ollama_model_info" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "vllm_auto_optimize" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "vllm_analyze" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "vllm_benchmark" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "ollama_ps" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "langfuse_configure" has a secret-shaped input parameter "secret_key" — secrets must never be tool parameters (the model would supply/handle the credential). tool "langfuse_configure" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "langfuse_test" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "langfuse_traces" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "langfuse_trace" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "langfuse_scores" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "langfuse_score" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "langfuse_datasets" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "langfuse_export_training_data" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "langfuse_quality" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "langfuse_otel_env" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "langfuse_k8s" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "k8s_create" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "k8s_list" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "k8s_info" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "k8s_destroy" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "helm_generate" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "kserve_generate_yaml" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "kserve_list" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "kserve_status" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "k8s_gpu_operator_install" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "k8s_device_plugin" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "k8s_mig_configure" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "k8s_time_slicing" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "hf_space_deploy" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "hf_space_status" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "ray_status" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "ray_start" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "ray_stop" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "ray_submit_job" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "ray_list_jobs" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "ray_wide_ep_deploy" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "ray_disagg_pd_deploy" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "ray_parallelism_strategy" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "wandb_list_projects" has a secret-shaped input parameter "api_key" — secrets must never be tool parameters (the model would supply/handle the credential). tool "wandb_list_projects" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "wandb_list_runs" has a secret-shaped input parameter "api_key" — secrets must never be tool parameters (the model would supply/handle the credential). tool "wandb_list_runs" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "wandb_run_details" has a secret-shaped input parameter "api_key" — secrets must never be tool parameters (the model would supply/handle the credential). tool "wandb_run_details" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "mlflow_list_experiments" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "mlflow_log_run" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "mlflow_register_model" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "dvc_status" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "dvc_diff" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "dvc_stage_checkpoint" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "dvc_push" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "hf_list_models" has a secret-shaped input parameter "api_key" — secrets must never be tool parameters (the model would supply/handle the credential). tool "hf_list_models" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "hf_list_datasets" has a secret-shaped input parameter "api_key" — secrets must never be tool parameters (the model would supply/handle the credential). tool "hf_list_datasets" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "hf_model_info" has a secret-shaped input parameter "api_key" — secrets must never be tool parameters (the model would supply/handle the credential). tool "hf_model_info" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "hf_create_endpoint" has a secret-shaped input parameter "api_key" — secrets must never be tool parameters (the model would supply/handle the credential). tool "hf_create_endpoint" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "hf_list_endpoints" has a secret-shaped input parameter "api_key" — secrets must never be tool parameters (the model would supply/handle the credential). tool "hf_list_endpoints" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "hf_endpoint_info" has a secret-shaped input parameter "api_key" — secrets must never be tool parameters (the model would supply/handle the credential). tool "hf_endpoint_info" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "hf_delete_endpoint" has a secret-shaped input parameter "api_key" — secrets must never be tool parameters (the model would supply/handle the credential). tool "hf_delete_endpoint" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "hf_endpoint_infer" has a secret-shaped input parameter "api_key" — secrets must never be tool parameters (the model would supply/handle the credential). tool "hf_endpoint_infer" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "hf_smart_template" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "hf_hardware_recommend" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "hf_hardware_compare" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "langchain_create_workflow" has a secret-shaped input parameter "api_key" — secrets must never be tool parameters (the model would supply/handle the credential). tool "langchain_create_workflow" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "langchain_create_sglang_pipeline" has a secret-shaped input parameter "api_key" — secrets must never be tool parameters (the model would supply/handle the credential). tool "langchain_create_sglang_pipeline" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "langgraph_create_workflow" has a secret-shaped input parameter "api_key" — secrets must never be tool parameters (the model would supply/handle the credential). tool "langgraph_create_workflow" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "langgraph_orchestrator_worker" has a secret-shaped input parameter "api_key" — secrets must never be tool parameters (the model would supply/handle the credential). tool "langgraph_orchestrator_worker" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "langgraph_evaluation_workflow" has a secret-shaped input parameter "api_key" — secrets must never be tool parameters (the model would supply/handle the credential). tool "langgraph_evaluation_workflow" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "langgraph_workflow_status" has a secret-shaped input parameter "api_key" — secrets must never be tool parameters (the model would supply/handle the credential). tool "langgraph_workflow_status" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "wandb_create_dashboard" has a secret-shaped input parameter "api_key" — secrets must never be tool parameters (the model would supply/handle the credential). tool "wandb_create_dashboard" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "wandb_create_terradev_dashboard" has a secret-shaped input parameter "api_key" — secrets must never be tool parameters (the model would supply/handle the credential). tool "wandb_create_terradev_dashboard" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "wandb_create_report" has a secret-shaped input parameter "api_key" — secrets must never be tool parameters (the model would supply/handle the credential). tool "wandb_create_report" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "wandb_create_terradev_report" has a secret-shaped input parameter "api_key" — secrets must never be tool parameters (the model would supply/handle the credential). tool "wandb_create_terradev_report" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "wandb_setup_alerts" has a secret-shaped input parameter "api_key" — secrets must never be tool parameters (the model would supply/handle the credential). tool "wandb_setup_alerts" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "wandb_create_terradev_alerts" has a secret-shaped input parameter "api_key" — secrets must never be tool parameters (the model would supply/handle the credential). tool "wandb_create_terradev_alerts" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "wandb_dashboard_status" has a secret-shaped input parameter "api_key" — secrets must never be tool parameters (the model would supply/handle the credential). tool "wandb_dashboard_status" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "phoenix_test" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "phoenix_projects" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "phoenix_spans" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "phoenix_trace" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "phoenix_otel_env" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "phoenix_snippet" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "phoenix_k8s" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "guardrails_test" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "guardrails_chat" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "guardrails_generate_config" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "guardrails_k8s" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "qdrant_test" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "qdrant_collections" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "qdrant_create_collection" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "qdrant_info" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "qdrant_count" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "qdrant_k8s" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "deepeval_run" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "deepeval_metrics" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "deepeval_evaluate" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "deepeval_init" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "egress_cheapest_route" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "egress_optimize_staging" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "orchestrator_start" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "orchestrator_register" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "orchestrator_load" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "orchestrator_evict" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "orchestrator_status" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "orchestrator_infer" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "warm_pool_start" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "warm_pool_status" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "price_intel" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "cost_analyze" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "cost_optimize_recommend" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "cost_simulate" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "price_trends" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "price_spot_risk" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "moe_deploy" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "train_status" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "train_monitor" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "checkpoint_list" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "checkpoint_save" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "train_stop" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "train_resume" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "checkpoint_restore" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "checkpoint_promote" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "checkpoint_delete" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "lora_list" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "lora_add" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "lora_remove" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "training_config_generate" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "training_launch_distributed" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "train_snapshot" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "train_detect_stragglers" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "agent_agentic_serving_configure" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "agent_agentic_serving_helm_values" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "agent_agentic_serving_k8s" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "agent_agentic_serving_launch_args" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "agent_agentic_serving_lmcache_env" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "agent_agentic_serving_show_config" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "agent_cost" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "agent_deploy" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "agent_langchain_create_langgraph" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "agent_langchain_create_pipeline" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "agent_langchain_create_workflow" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "agent_langchain_test" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "agent_langgraph_create_workflow" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "agent_langgraph_deploy" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "agent_langgraph_status" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "agent_langgraph_test" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "agent_letta_chat" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "agent_letta_create" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "agent_letta_delete" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "agent_letta_list" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "agent_letta_remember" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "agent_letta_status" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "agent_mem0_add" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "agent_mem0_configure" has a secret-shaped input parameter "api_key" — secrets must never be tool parameters (the model would supply/handle the credential). tool "agent_mem0_configure" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "agent_mem0_delete" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "agent_mem0_forget" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "agent_mem0_get" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "agent_mem0_list" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "agent_mem0_search" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "agent_mem0_test" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "agent_mem0_update" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "agent_list" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "agent_plan" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "agent_scale" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "agent_skill_attach" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "agent_skill_init" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "agent_status" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "agent_teardown" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "agent_vector_db_down" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "agent_vector_db_up" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "ml_vllm_lora_link" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "ml_vllm_lora_list" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "ml_vllm_lora_load" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "ml_vllm_lora_sync" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "ml_vllm_lora_unload" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "database_weaviate_create_collection" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "database_weaviate_delete_collection" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "database_weaviate_hybrid_search" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "database_weaviate_insert" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "database_weaviate_list_collections" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "database_weaviate_query" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "database_weaviate_up" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "train_unsloth_run" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "train_unsloth_start" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "train_unsloth_stop" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "create_sqlite_connection" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "create_postgresql_connection" has a secret-shaped input parameter "password" — secrets must never be tool parameters (the model would supply/handle the credential). tool "create_postgresql_connection" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "query_database" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "upsert_database" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "get_database_connection" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "secrets_set" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "secrets_get" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "secrets_list" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "secrets_remove" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "secrets_sync" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "secrets_verify" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "secrets_env" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tool "secrets_run" has a secret-shaped input parameter "credentials" — secrets must never be tool parameters (the model would supply/handle the credential). tests/test_drift_auth_and_errors.py: assigns a literal to token (azur…en (len 15)) — non-provider secret literal; prefer environment intake. Reads secrets from the environment (e.g. terradev_cli/cli.py) — the recommended intake shape.

• Permission scope

  fail15% of grade

  Declared tools vs. breadth (filesystem, network, exec); flags shell-exec and unbounded filesystem access.

  HIGH: terradev_cli/providers/crusoe_provider.py reads a credential path, executes commands, and makes network calls in the same file — the combination that makes exfiltration possible. references credential paths: terradev_cli/providers/crusoe_provider.py: references a credential path (/.ssh/) installer script pipes a download into a shell — conventional, but worth reading before running (terradev_cli/terraform/modules/gpu-node-aws/bootstrap.sh: pipes a download into a shell). has both shell/exec and network egress — capable of download-and-run, though no such path was observed (terradev_cli/commands/agent_infra/dependency_manager.py: subprocess.* call; terradev_cli/cli_hf_spaces.py: outbound HTTP/socket call). has both shell/exec and destructive filesystem writes (terradev_cli/commands/agent_infra/dependency_manager.py: subprocess.* call; terradev_cli/cli.py: open(…, 'w'/'a'/'x') write-mode file access). discloses shell/exec capability: 42 files (terradev_cli/commands/agent_infra/dependency_manager.py, terradev_cli/commands/agent_infra/landlock.py, terradev_cli/commands/inference.py, +39 more) discloses dynamic code execution: terradev_cli/commands/mlops.py: uses eval()/exec() discloses broad/destructive filesystem access: 53 files (terradev_cli/cli.py, terradev_cli/commands/_api.py, terradev_cli/commands/agent_infra/sandbox.py, +50 more) Capability DISCLOSURE, not a verdict: static analysis sees the primitive is present and reachable, not whether its use is attacker-controlled.

• Version behavior

  fail10% of grade

  Diff of tool definitions between versions; new permissions or changed descriptions in a patch release (the postmark-mcp class).

  vs prior 6.2.19 (patch bump): new tool "provision_gpu" appeared; new tool "preflight_report" appeared; new tool "preflight_gpu_check" appeared; new tool "preflight_network_check" appeared; new tool "local_scan" appeared; new tool "status" appeared; new tool "manage_instance" appeared; new tool "analytics" appeared; new tool "optimize" appeared; new tool "setup_provider" appeared; new tool "configure_provider" appeared; new tool "train" touches a sensitive surface (email/exec/net/fs); new tool "preflight" appeared; new tool "stage" touches a sensitive surface (email/exec/net/fs); new tool "up" appeared; new tool "rollback" appeared; new tool "manifests" appeared; new tool "run_workflow" touches a sensitive surface (email/exec/net/fs); new tool "active_context" appeared; new tool "governance_request_consent" appeared; new tool "governance_record_consent" appeared; new tool "governance_evaluate_opa" appeared; new tool "governance_move_data" appeared; new tool "governance_movement_history" appeared; new tool "governance_compliance_report" appeared; new tool "inferx_deploy" appeared; new tool "inferx_status" appeared; new tool "inferx_list" appeared; new tool "inferx_optimize" appeared; new tool "inferx_configure" appeared; new tool "inferx_delete" touches a sensitive surface (email/exec/net/fs); new tool "inferx_usage" appeared; new tool "inferx_quote" appeared; new tool "infer_route" appeared; new tool "infer_route_disagg" appeared; new tool "infer_failover" touches a sensitive surface (email/exec/net/fs); new tool "gpu_topology" appeared; new tool "vllm_start" appeared; new tool "vllm_stop" appeared; new tool "vllm_inference" appeared; new tool "vllm_info" appeared; new tool "vllm_sleep" appeared; new tool "vllm_wake" appeared; new tool "sglang" appeared; new tool "sglang_start" appeared; new tool "sglang_stop" appeared; new tool "sglang_inference" appeared; new tool "ollama_list" appeared; new tool "ollama_pull" appeared; new tool "ollama_generate" appeared; new tool "ollama_chat" appeared; new tool "ollama_model_info" appeared; new tool "vllm_auto_optimize" appeared; new tool "vllm_analyze" appeared; new tool "vllm_benchmark" appeared; new tool "ollama_ps" appeared; new tool "langfuse_configure" touches a sensitive surface (email/exec/net/fs); new tool "langfuse_test" appeared; new tool "langfuse_traces" appeared; new tool "langfuse_trace" appeared; new tool "langfuse_scores" appeared; new tool "langfuse_score" appeared; new tool "langfuse_datasets" appeared; new tool "langfuse_export_training_data" appeared; new tool "langfuse_quality" appeared; new tool "langfuse_otel_env" touches a sensitive surface (email/exec/net/fs); new tool "langfuse_k8s" appeared; new tool "k8s_create" appeared; new tool "k8s_list" appeared; new tool "k8s_info" appeared; new tool "k8s_destroy" appeared; new tool "helm_generate" appeared; new tool "kserve_generate_yaml" appeared; new tool "kserve_list" appeared; new tool "kserve_status" touches a sensitive surface (email/exec/net/fs); new tool "k8s_gpu_operator_install" appeared; new tool "k8s_device_plugin" appeared; new tool "k8s_mig_configure" appeared; new tool "k8s_time_slicing" appeared; new tool "hf_space_deploy" appeared; new tool "hf_space_status" appeared; new tool "ray_status" appeared; new tool "ray_start" appeared; new tool "ray_stop" appeared; new tool "ray_submit_job" appeared; new tool "ray_list_jobs" appeared; new tool "ray_wide_ep_deploy" appeared; new tool "ray_disagg_pd_deploy" appeared; new tool "ray_parallelism_strategy" appeared; new tool "wandb_list_projects" appeared; new tool "wandb_list_runs" appeared; new tool "wandb_run_details" touches a sensitive surface (email/exec/net/fs); new tool "mlflow_list_experiments" appeared; new tool "mlflow_log_run" touches a sensitive surface (email/exec/net/fs); new tool "mlflow_register_model" appeared; new tool "dvc_status" appeared; new tool "dvc_diff" appeared; new tool "dvc_stage_checkpoint" appeared; new tool "dvc_push" appeared; new tool "hf_list_models" appeared; new tool "hf_list_datasets" appeared; new tool "hf_model_info" appeared; new tool "hf_create_endpoint" appeared; new tool "hf_list_endpoints" touches a sensitive surface (email/exec/net/fs); new tool "hf_endpoint_info" touches a sensitive surface (email/exec/net/fs); new tool "hf_delete_endpoint" touches a sensitive surface (email/exec/net/fs); new tool "hf_endpoint_infer" touches a sensitive surface (email/exec/net/fs); new tool "hf_smart_template" appeared; new tool "hf_hardware_recommend" appeared; new tool "hf_hardware_compare" appeared; new tool "langchain_create_workflow" appeared; new tool "langchain_create_sglang_pipeline" appeared; new tool "langgraph_create_workflow" appeared; new tool "langgraph_orchestrator_worker" appeared; new tool "langgraph_evaluation_workflow" appeared; new tool "langgraph_workflow_status" appeared; new tool "wandb_create_dashboard" appeared; new tool "wandb_create_terradev_dashboard" appeared; new tool "wandb_create_report" appeared; new tool "wandb_create_terradev_report" appeared; new tool "wandb_setup_alerts" appeared; new tool "wandb_create_terradev_alerts" appeared; new tool "wandb_dashboard_status" appeared; new tool "phoenix_test" appeared; new tool "phoenix_projects" appeared; new tool "phoenix_spans" appeared; new tool "phoenix_trace" appeared; new tool "phoenix_otel_env" appeared; new tool "phoenix_snippet" appeared; new tool "phoenix_k8s" appeared; new tool "guardrails_test" appeared; new tool "guardrails_chat" touches a sensitive surface (email/exec/net/fs); new tool "guardrails_generate_config" appeared; new tool "guardrails_k8s" appeared; new tool "qdrant_test" appeared; new tool "qdrant_collections" appeared; new tool "qdrant_create_collection" appeared; new tool "qdrant_info" appeared; new tool "qdrant_count" appeared; new tool "qdrant_k8s" appeared; new tool "deepeval_run" touches a sensitive surface (email/exec/net/fs); new tool "deepeval_metrics" appeared; new tool "deepeval_evaluate" appeared; new tool "deepeval_init" touches a sensitive surface (email/exec/net/fs); new tool "egress_cheapest_route" appeared; new tool "egress_optimize_staging" appeared; new tool "orchestrator_start" appeared; new tool "orchestrator_register" appeared; new tool "orchestrator_load" appeared; new tool "orchestrator_evict" appeared; new tool "orchestrator_status" appeared; new tool "orchestrator_infer" appeared; new tool "warm_pool_start" appeared; new tool "warm_pool_status" appeared; new tool "price_intel" appeared; new tool "cost_analyze" appeared; new tool "cost_optimize_recommend" appeared; new tool "cost_simulate" appeared; new tool "price_trends" appeared; new tool "price_spot_risk" appeared; new tool "moe_deploy" appeared; new tool "train_status" appeared; new tool "train_monitor" appeared; new tool "checkpoint_list" appeared; new tool "checkpoint_save" appeared; new tool "train_stop" appeared; new tool "train_resume" appeared; new tool "checkpoint_restore" appeared; new tool "checkpoint_promote" appeared; new tool "checkpoint_delete" touches a sensitive surface (email/exec/net/fs); new tool "lora_list" appeared; new tool "lora_add" appeared; new tool "lora_remove" appeared; new tool "training_config_generate" appeared; new tool "training_launch_distributed" appeared; new tool "train_snapshot" appeared; new tool "train_detect_stragglers" appeared; new tool "agent_agentic_serving_configure" appeared; new tool "agent_agentic_serving_helm_values" appeared; new tool "agent_agentic_serving_k8s" appeared; new tool "agent_agentic_serving_launch_args" appeared; new tool "agent_agentic_serving_lmcache_env" appeared; new tool "agent_agentic_serving_show_config" appeared; new tool "agent_cost" appeared; new tool "agent_deploy" appeared; new tool "agent_langchain_create_langgraph" appeared; new tool "agent_langchain_create_pipeline" appeared; new tool "agent_langchain_create_workflow" appeared; new tool "agent_langchain_test" appeared; new tool "agent_langgraph_create_workflow" appeared; new tool "agent_langgraph_deploy" appeared; new tool "agent_langgraph_status" appeared; new tool "agent_langgraph_test" appeared; new tool "agent_letta_chat" touches a sensitive surface (email/exec/net/fs); new tool "agent_letta_create" appeared; new tool "agent_letta_delete" touches a sensitive surface (email/exec/net/fs); new tool "agent_letta_list" appeared; new tool "agent_letta_remember" appeared; new tool "agent_letta_status" appeared; new tool "agent_mem0_add" appeared; new tool "agent_mem0_configure" appeared; new tool "agent_mem0_delete" touches a sensitive surface (email/exec/net/fs); new tool "agent_mem0_forget" touches a sensitive surface (email/exec/net/fs); new tool "agent_mem0_get" appeared; new tool "agent_mem0_list" appeared; new tool "agent_mem0_search" appeared; new tool "agent_mem0_test" appeared; new tool "agent_mem0_update" appeared; new tool "agent_list" appeared; new tool "agent_plan" appeared; new tool "agent_scale" appeared; new tool "agent_skill_attach" appeared; new tool "agent_skill_init" appeared; new tool "agent_status" appeared; new tool "agent_teardown" appeared; new tool "agent_vector_db_down" appeared; new tool "agent_vector_db_up" appeared; new tool "ml_vllm_lora_link" appeared; new tool "ml_vllm_lora_list" appeared; new tool "ml_vllm_lora_load" appeared; new tool "ml_vllm_lora_sync" appeared; new tool "ml_vllm_lora_unload" appeared; new tool "database_weaviate_create_collection" appeared; new tool "database_weaviate_delete_collection" touches a sensitive surface (email/exec/net/fs); new tool "database_weaviate_hybrid_search" appeared; new tool "database_weaviate_insert" appeared; new tool "database_weaviate_list_collections" appeared; new tool "database_weaviate_query" appeared; new tool "database_weaviate_up" appeared; new tool "train_unsloth_run" touches a sensitive surface (email/exec/net/fs); new tool "train_unsloth_start" appeared; new tool "train_unsloth_stop" touches a sensitive surface (email/exec/net/fs); new tool "create_sqlite_connection" appeared; new tool "create_postgresql_connection" appeared; new tool "query_database" appeared; new tool "upsert_database" appeared; new tool "get_database_connection" appeared; new tool "secrets_set" touches a sensitive surface (email/exec/net/fs); new tool "secrets_get" touches a sensitive surface (email/exec/net/fs); new tool "secrets_list" touches a sensitive surface (email/exec/net/fs); new tool "secrets_remove" touches a sensitive surface (email/exec/net/fs); new tool "secrets_sync" touches a sensitive surface (email/exec/net/fs); new tool "secrets_verify" appeared; new tool "secrets_env" appeared; new tool "secrets_run" touches a sensitive surface (email/exec/net/fs); new capability primitive(s) in source: dynamic-eval, fs-write, http-client, subprocess; new hardcoded outbound host/BCC destination(s): 10.0.0.1, 127.0.0.1, 169.254.169.254, accounts.google.com, aka.ms, api-inference.huggingface.co, api., api.baseten.co, api.crusoecloud.com, api.datadoghq.com, api.datadoghq.eu, api.digitalocean.com, api.e2enetworks.com, api.endpoints.huggingface.cloud, api.gcore.com, api.inferx.net, api.latitude.sh, api.mem0.ai, api.runpod.io, api.siliconflow.cn, api.siliconflow.com, api.smith.langchain.com, api.telinea.cloud, api.tensordock.com, api.terradev.cloud, api.wandb.ai, api.yottalabs.ai, app., app.mem0.ai, app.phoenix.arize.com, argoproj.github.io, aws.amazon.com, baseten.co, claude.ai, cloud.google.com, cloud.langfuse.com, cloud.oracle.com, cloud.siliconflow.cn, cloudpricingcalculator.appspot.com, compute.googleapis.com, computeinstanceagent., console.aws.amazon.com, console.cloud.google.com, console.vast.ai, crusoe.ai, d1, d2, dashboard.tensordock.com, demo.example.com, developer.download.nvidia.com, dl.k8s.io, docs.crusoecloud.com, docs.e2enetworks.com, docs.gcore.com, docs.letta.com, docs.lmcache.ai, docs.mem0.ai, docs.oracle.com, docs.vllm.ai, docs.yottalabs.ai, download.docker.com, e2enetworks.com, ec2.amazonaws.com, ecs., example.com, flashinfer.ai, github.com, helm.ngc.nvidia.com, helm.sh, host, huggingface.co, iaas., infrahub-api.nexgencloud.com, internal., kubernetes.default.svc, kubernetes.io, langfuse-svc., langfuse.github.io, latitude.sh, login.microsoftonline.com, loraexchange.ai, m1, management.azure.com, metadata.google.internal, model.inferx.net, myproj.example.com, myserver.com, new.example.com, nvidia.github.io, old.example.com, ollama.com, p1, p2, phoenix-svc, pkgs.k8s.io, portal.azure.com, pricing.us-east-1.amazonaws.com, proxy, public.example.com, qdrant.github.io, raw.githubusercontent.com, runpod.io, smith.langchain.com, storage.googleapis.com, tailscale.com, tensordock.com, terradev-mcp.terradev.cloud, terradev.cloud, terradev.dev, test.example.com, unsloth.ai, us.cloud.langfuse.com, vast.ai, vllm-svc, wandb.ai, www.apache.org, www.claude.ai, www.googleapis.com, www.runpod.io, www.terradev.cloud, www.webpagetest.org, xyz.qdrant.io, yottalabs.ai.

• Transport config

  warn10% of grade

  Remote servers: TLS and auth mode (none/token/OAuth). Local servers: whether the manifest indicates it phones home.

  sends telemetry to third-party SDK (Datadog) — disclosure, verify opt-in; manifest/source references analytics behavior — disclosure