mirror of
https://github.com/j3ssie/osmedeus.git
synced 2026-08-24 16:42:28 +02:00
j3ssie
438d8ec138
- Add AgentExecutor implementing LLM-based agentic loop with tool calling, max iterations, and stop conditions - Introduce agent preset tools (bash, file_exists, http_get, run_module, etc.) with extensible registry pattern - Add sub-agent spawning capability via spawn_agent tool call with recursive depth limits and validation - Implement ToolExecutor for custom tool execution with template rendering and error handling - Add agent session persistence and memory management with sliding window configuration - Create comprehensive E2E test suite covering 15+ agent workflow scenarios (minimal, custom tools, planning, multi-goal, structured output, tracing hooks, file tools, orchestration, Python tools, sub-agents, nested sub-agents, and validation) - Add agent-and-llm test data directory with 17 YAML workflow fixtures - Update integration tests to include agent workflow directories - Add AgentTool and AgentConfig types with validation for duplicate names and unknown presets - Implement LLM streaming test utilities - Update documentation (CLAUDE.md, HACKING.md, README.md) with agent features and CLI examples
1 line
8.6 KiB
JSON
1 line
8.6 KiB
JSON
{"version":"1.151.0","results":[{"check_id":"dockerfile.security.missing-user-entrypoint.missing-user-entrypoint","path":"Dockerfile","start":{"line":16,"col":1,"offset":429},"end":{"line":16,"col":22,"offset":450},"extra":{"metavars":{"$...VARS":{"start":{"line":16,"col":12,"offset":440},"end":{"line":16,"col":22,"offset":450},"abstract_content":"[\"python\"]"}},"message":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'.","fix":"USER non-root\nENTRYPOINT [\"python\"]","metadata":{"cwe":["CWE-269: Improper Privilege Management"],"category":"security","technology":["dockerfile"],"confidence":"MEDIUM","owasp":["A04:2021 - Insecure Design","A06:2025 - Insecure Design"],"references":["https://owasp.org/Top10/A04_2021-Insecure_Design"],"subcategory":["audit"],"likelihood":"LOW","impact":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Improper Authorization"],"source":"https://semgrep.dev/r/dockerfile.security.missing-user-entrypoint.missing-user-entrypoint","shortlink":"https://sg.run/k281","semgrep.dev":{"rule":{"origin":"community","r_id":47272,"rule_id":"ReUW9E","rv_id":1262659,"url":"https://semgrep.dev/playground/r/o5TbD21/dockerfile.security.missing-user-entrypoint.missing-user-entrypoint","version_id":"o5TbD21"}}},"severity":"ERROR","fingerprint":"9ebfc0d726acf772708e18784a26daaf7d2d3b542c4ef4c465778b02a5312329de5ef18d4f8974fe4819eb9db1645a0157a09fb0d5a3f370f6459b964f0b01a7_0","lines":"ENTRYPOINT [\"python\"]","is_ignored":false,"validation_state":"NO_VALIDATOR","engine_kind":"OSS"}},{"check_id":"dockerfile.security.missing-user.missing-user","path":"Dockerfile","start":{"line":17,"col":1,"offset":451},"end":{"line":17,"col":15,"offset":465},"extra":{"metavars":{"$...VARS":{"start":{"line":17,"col":5,"offset":455},"end":{"line":17,"col":15,"offset":465},"abstract_content":"[\"app.py\"]"}},"message":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'.","fix":"USER non-root\nCMD [\"app.py\"]","metadata":{"cwe":["CWE-250: Execution with Unnecessary Privileges"],"category":"security","technology":["dockerfile"],"confidence":"MEDIUM","owasp":["A04:2021 - Insecure Design","A06:2025 - Insecure Design"],"references":["https://owasp.org/Top10/A04_2021-Insecure_Design"],"subcategory":["audit"],"likelihood":"LOW","impact":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Improper Authorization"],"source":"https://semgrep.dev/r/dockerfile.security.missing-user.missing-user","shortlink":"https://sg.run/Gbvn","semgrep.dev":{"rule":{"origin":"community","r_id":20148,"rule_id":"AbUN06","rv_id":1262660,"url":"https://semgrep.dev/playground/r/zyTb2n2/dockerfile.security.missing-user.missing-user","version_id":"zyTb2n2"}}},"severity":"ERROR","fingerprint":"b4e6a9c3caa7f197bfaa44479e111925e766af68481dacdab05ecbf56974c149c1ab2681427306574ab31f35f34bb56157a364823b3df9582974ca121c473863_0","lines":"CMD [\"app.py\"]","is_ignored":false,"validation_state":"NO_VALIDATOR","engine_kind":"OSS"}},{"check_id":"python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_SECRET_KEY","path":"config.py","start":{"line":13,"col":1,"offset":455},"end":{"line":13,"col":45,"offset":499},"extra":{"metavars":{"$M":{"start":{"line":13,"col":1,"offset":455},"end":{"line":13,"col":13,"offset":467},"abstract_content":"vuln_app.app"}},"message":"Hardcoded variable `SECRET_KEY` detected. Use environment variables or config files instead","metadata":{"likelihood":"LOW","impact":"LOW","confidence":"LOW","category":"security","cwe":["CWE-489: Active Debug Code"],"owasp":["A05:2021 - Security Misconfiguration","A02:2025 - Security Misconfiguration"],"references":["https://bento.dev/checks/flask/avoid-hardcoded-config/","https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values","https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features"],"subcategory":["audit"],"technology":["flask"],"license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Active Debug Code"],"source":"https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_SECRET_KEY","shortlink":"https://sg.run/Ekde","semgrep.dev":{"rule":{"origin":"community","r_id":9537,"rule_id":"4bUkX0","rv_id":1263420,"url":"https://semgrep.dev/playground/r/l4TJRA9/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_SECRET_KEY","version_id":"l4TJRA9"}}},"severity":"ERROR","fingerprint":"a6697907ce3488675b4572624002d6856a5ba4e3908eabb52b17e83fb147f3437af6da4e8b52b2073cbe7ab2acac6e2b656aa2a363d2d8744d715e66a0c6b660_0","lines":"vuln_app.app.config['SECRET_KEY'] = 'random'","is_ignored":false,"validation_state":"NO_VALIDATOR","engine_kind":"OSS"}},{"check_id":"generic.secrets.security.detected-jwt-token.detected-jwt-token","path":"openapi_specs/openapi3.yml","start":{"line":193,"col":33,"offset":5902},"end":{"line":193,"col":141,"offset":6010},"extra":{"metavars":{},"message":"JWT token detected","metadata":{"source-rule-url":"https://github.com/Yelp/detect-secrets/blob/master/detect_secrets/plugins/jwt.py","category":"security","technology":["secrets","jwt"],"confidence":"LOW","references":["https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/"],"cwe":["CWE-321: Use of Hard-coded Cryptographic Key"],"owasp":["A02:2021 - Cryptographic Failures","A04:2025 - Cryptographic Failures"],"subcategory":["audit"],"likelihood":"LOW","impact":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Cryptographic Issues"],"source":"https://semgrep.dev/r/generic.secrets.security.detected-jwt-token.detected-jwt-token","shortlink":"https://sg.run/05N5","semgrep.dev":{"rule":{"origin":"community","r_id":12854,"rule_id":"kxU8E8","rv_id":1262879,"url":"https://semgrep.dev/playground/r/d6Tyxvg/generic.secrets.security.detected-jwt-token.detected-jwt-token","version_id":"d6Tyxvg"}}},"severity":"ERROR","fingerprint":"851d262b7d2f01e95b7d06e6f5135a879b472779a00cc92abf565de9fe04bd3afbd5fa34d7580cdce761c37f35799eb374a3241489e74af86194771f76daee93_0","lines":" example: 'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJleHAiOjE2NzAxNjA2MTcsImlhdCI6MTY3MDE2MDU1Nywic3ViIjoiSm9obi5Eb2UifQ.n17N4AxTbL4_z65-NR46meoytauPDjImUxrLiUMSTQw'","is_ignored":false,"validation_state":"NO_VALIDATOR","engine_kind":"OSS"}}],"errors":[],"paths":{"scanned":[".dockerignore",".github/FUNDING.yml",".github/workflows/docker-image.yml",".gitignore","Dockerfile","LICENSE","README.md","api_views/__init__.py","api_views/books.py","api_views/json_schemas.py","api_views/main.py","api_views/users.py","app.py","config.py","database/__init__.py","docker-compose.yaml","models/__init__.py","models/books_model.py","models/user_model.py","openapi_specs/VAmPI.postman_collection.json","openapi_specs/openapi3.yml","requirements.txt"]},"time":{"rules":[],"rules_parse_time":6.271836042404175,"profiling_times":{"config_time":7.641101121902466,"core_time":7.604748964309692,"ignores_time":0.001773834228515625,"total_time":15.253854990005493},"parsing_time":{"total_time":0.0,"per_file_time":{"mean":0.0,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_files":[]},"scanning_time":{"total_time":2.827584743499756,"per_file_time":{"mean":0.04635384825409437,"std_dev":0.017019160223435907},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_files":[]},"matching_time":{"total_time":0.0,"per_file_and_rule_time":{"mean":0.0,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_rules_on_files":[]},"tainting_time":{"total_time":0.0,"per_def_and_rule_time":{"mean":0.0,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_rules_on_defs":[]},"fixpoint_timeouts":[],"prefiltering":{"project_level_time":0.0,"file_level_time":0.0,"rules_with_project_prefilters_ratio":0.0,"rules_with_file_prefilters_ratio":0.9729977116704805,"rules_selected_ratio":0.06453089244851258,"rules_matched_ratio":0.06453089244851258},"targets":[],"total_bytes":0,"max_memory_bytes":9950453248},"engine_requested":"OSS","interfile_languages_used":[],"skipped_rules":[],"profiling_results":[]} |