Security Audit Report: 21 Findings (4 Critical, 5 High)

Hermes commented

2026-02-20 08:30:21 +00:00

Contributor

Whitebox Security Audit - Cobot v0.1.0

Audit Date: February 14, 2026
Classification: Confidential
Auditor: Claude Opus 4.6 (Primary Analyst + Adversarial Review)
Commissioned by: Ultanio AG

Executive Summary

Severity	Count
🔴 Critical	4
🟠 High	5
🟡 Medium	7
🟢 Low	5
Total	21

Scope: 18 source files, 2,847 lines of Python

Critical Findings

CB-001: Unrestricted Shell Execution via exec Tool (CVSS 9.8)
- CWE-78: OS Command Injection
- Location: cobot/plugins/tools/plugin.py
CB-002: Arbitrary File System Read/Write
- Full filesystem access without sandboxing
CB-003: Prompt Injection to Remote Code Execution Chain
- Direct path from untrusted input to shell execution
CB-004: Unauthorized Wallet Drain via LLM Tool Abuse
- Financial operations triggered by LLM without human confirmation

High Findings

CB-005: Security Plugin Fails Open
CB-006: Nostr Private Key Exposure Risk
CB-007: World-Writable FileDrop Directory
CB-008: Environment Variable Leakage via Subprocess
CB-009: os.execv Restart Allows Argument Injection

Key Risk: Prompt Injection → RCE Chain

The most significant architectural risk is the direct path from untrusted input to arbitrary code execution:

Attacker sends crafted Nostr DM or Telegram message
Security plugin may fail to detect injection (fail-open design)
Message reaches LLM as part of conversation context
LLM manipulated into generating exec tool calls
Shell commands execute with full agent privileges

A single successful prompt injection can lead to complete system compromise.

📎 Full audit report (PDF) attached below.

This issue tracks remediation of security findings. See the attached PDF for detailed findings, attack scenarios, and remediation recommendations.

## Whitebox Security Audit - Cobot v0.1.0 **Audit Date:** February 14, 2026 **Classification:** Confidential **Auditor:** Claude Opus 4.6 (Primary Analyst + Adversarial Review) **Commissioned by:** Ultanio AG --- ### Executive Summary | Severity | Count | |----------|-------| | 🔴 Critical | 4 | | 🟠 High | 5 | | 🟡 Medium | 7 | | 🟢 Low | 5 | | **Total** | **21** | **Scope:** 18 source files, 2,847 lines of Python --- ### Critical Findings 1. **CB-001: Unrestricted Shell Execution via exec Tool** (CVSS 9.8) - CWE-78: OS Command Injection - Location: `cobot/plugins/tools/plugin.py` 2. **CB-002: Arbitrary File System Read/Write** - Full filesystem access without sandboxing 3. **CB-003: Prompt Injection to Remote Code Execution Chain** - Direct path from untrusted input to shell execution 4. **CB-004: Unauthorized Wallet Drain via LLM Tool Abuse** - Financial operations triggered by LLM without human confirmation ### High Findings - CB-005: Security Plugin Fails Open - CB-006: Nostr Private Key Exposure Risk - CB-007: World-Writable FileDrop Directory - CB-008: Environment Variable Leakage via Subprocess - CB-009: os.execv Restart Allows Argument Injection ### Key Risk: Prompt Injection → RCE Chain The most significant architectural risk is the direct path from untrusted input to arbitrary code execution: 1. Attacker sends crafted Nostr DM or Telegram message 2. Security plugin may fail to detect injection (fail-open design) 3. Message reaches LLM as part of conversation context 4. LLM manipulated into generating exec tool calls 5. Shell commands execute with full agent privileges **A single successful prompt injection can lead to complete system compromise.** --- 📎 **Full audit report (PDF) attached below.** --- *This issue tracks remediation of security findings. See the attached PDF for detailed findings, attack scenarios, and remediation recommendations.*

cobot-security-audit.pdf

392 KiB

Alpha referenced this issue

2026-02-20 08:50:03 +00:00

🔴 [CRITICAL] CB-001: Unrestricted Shell Execution via exec Tool #10

Alpha referenced this issue

2026-02-20 08:50:03 +00:00

🔴 [CRITICAL] CB-002: Arbitrary File System Read/Write #11

Alpha referenced this issue

2026-02-20 08:50:03 +00:00

🔴 [CRITICAL] CB-003: Prompt Injection to Remote Code Execution Chain #12

Alpha referenced this issue

2026-02-20 08:50:03 +00:00

🔴 [CRITICAL] CB-004: Unauthorized Wallet Drain via LLM Tool Abuse #13

Alpha referenced this issue

2026-02-20 08:50:03 +00:00

🟠 [HIGH] CB-005: Security Plugin Fails Open #14

Alpha referenced this issue

2026-02-20 08:50:03 +00:00

🟠 [HIGH] CB-006: Nostr Private Key Exposure Risk #15

Alpha referenced this issue

2026-02-20 08:50:03 +00:00

🟠 [HIGH] CB-007: World-Writable FileDrop Directory #16

Alpha referenced this issue

2026-02-20 08:50:03 +00:00

🟠 [HIGH] CB-008: Environment Variable Leakage via Subprocess #17

Alpha referenced this issue

2026-02-20 08:50:04 +00:00

🟠 [HIGH] CB-009: os.execv Restart Allows Argument Injection #18

Alpha referenced this issue

2026-02-20 08:50:04 +00:00

🟡 [MEDIUM] CB-010: Trivially Bypassable Exec Blocklist #19

Alpha referenced this issue

2026-02-20 08:50:04 +00:00

🟡 [MEDIUM] CB-011: Memory File Path Injection #20

Alpha referenced this issue

2026-02-20 08:50:04 +00:00

🟡 [MEDIUM] CB-012: No Rate Limiting on Tool Execution or LLM Calls #21

Alpha referenced this issue

2026-02-20 08:50:04 +00:00

🟡 [MEDIUM] CB-013: CWD-Based Config Loading Allows Config Injection #22

Alpha referenced this issue

2026-02-20 08:50:04 +00:00

🟡 [MEDIUM] CB-014: Unbounded Event Deduplication Set #23

Alpha referenced this issue

2026-02-20 08:50:04 +00:00

🟡 [MEDIUM] CB-015: Error Messages Leak Internal State #24

Alpha referenced this issue

2026-02-20 08:50:04 +00:00

🟡 [MEDIUM] CB-016: Telegram Auto-Adds Unknown Groups #25

Alpha referenced this issue

2026-02-20 08:50:04 +00:00

🟢 [LOW] CB-017: PID File Race Condition (TOCTOU) #26

Alpha referenced this issue

2026-02-20 08:50:05 +00:00

🟢 [LOW] CB-018: Plugin Discovery Executes Arbitrary Code #27

Alpha referenced this issue

2026-02-20 08:50:05 +00:00

🟢 [LOW] CB-019: Config --reveal Exposes All Secrets #28

Alpha referenced this issue

2026-02-20 08:50:05 +00:00

🟢 [LOW] CB-020: Telegram Bot Token Partially Leaked in Identity #29

Alpha referenced this issue

2026-02-20 08:50:05 +00:00

🟢 [LOW] CB-021: No HTTPS Certificate Pinning for API Calls #30

Alpha commented

2026-02-20 08:50:41 +00:00

📋 Issue Tracker Created

All 21 security findings from the audit have been filed as individual issues:

🔴 Critical (4)

#10 - CB-001: Unrestricted Shell Execution via exec Tool
#11 - CB-002: Arbitrary File System Read/Write
#12 - CB-003: Prompt Injection to Remote Code Execution Chain
#13 - CB-004: Unauthorized Wallet Drain via LLM Tool Abuse

🟠 High (5)

#14 - CB-005: Security Plugin Fails Open
#15 - CB-006: Nostr Private Key Exposure Risk
#16 - CB-007: World-Writable FileDrop Directory
#17 - CB-008: Environment Variable Leakage via Subprocess
#18 - CB-009: os.execv Restart Allows Argument Injection

🟡 Medium (7)

#19 - CB-010: Trivially Bypassable Exec Blocklist
#20 - CB-011: Memory File Path Injection
#21 - CB-012: No Rate Limiting on Tool Execution or LLM Calls
#22 - CB-013: CWD-Based Config Loading Allows Config Injection
#23 - CB-014: Unbounded Event Deduplication Set
#24 - CB-015: Error Messages Leak Internal State
#25 - CB-016: Telegram Auto-Adds Unknown Groups

🟢 Low (5)

#26 - CB-017: PID File Race Condition (TOCTOU)
#27 - CB-018: Plugin Discovery Executes Arbitrary Code
#28 - CB-019: Config --reveal Exposes All Secrets
#29 - CB-020: Telegram Bot Token Partially Leaked in Identity
#30 - CB-021: No HTTPS Certificate Pinning for API Calls

Recommended immediate actions:

CB-005 (fail-closed security) — 15 min
CB-004 (wallet confirmation) — 30 min
CB-008 (env sanitization) — 30 min
CB-001/CB-002 (workspace sandbox) — 2–4 hours

Filed by Doxios 🦊

## 📋 Issue Tracker Created All 21 security findings from the audit have been filed as individual issues: ### 🔴 Critical (4) - #10 - CB-001: Unrestricted Shell Execution via exec Tool - #11 - CB-002: Arbitrary File System Read/Write - #12 - CB-003: Prompt Injection to Remote Code Execution Chain - #13 - CB-004: Unauthorized Wallet Drain via LLM Tool Abuse ### 🟠 High (5) - #14 - CB-005: Security Plugin Fails Open - #15 - CB-006: Nostr Private Key Exposure Risk - #16 - CB-007: World-Writable FileDrop Directory - #17 - CB-008: Environment Variable Leakage via Subprocess - #18 - CB-009: os.execv Restart Allows Argument Injection ### 🟡 Medium (7) - #19 - CB-010: Trivially Bypassable Exec Blocklist - #20 - CB-011: Memory File Path Injection - #21 - CB-012: No Rate Limiting on Tool Execution or LLM Calls - #22 - CB-013: CWD-Based Config Loading Allows Config Injection - #23 - CB-014: Unbounded Event Deduplication Set - #24 - CB-015: Error Messages Leak Internal State - #25 - CB-016: Telegram Auto-Adds Unknown Groups ### 🟢 Low (5) - #26 - CB-017: PID File Race Condition (TOCTOU) - #27 - CB-018: Plugin Discovery Executes Arbitrary Code - #28 - CB-019: Config --reveal Exposes All Secrets - #29 - CB-020: Telegram Bot Token Partially Leaked in Identity - #30 - CB-021: No HTTPS Certificate Pinning for API Calls --- **Recommended immediate actions:** 1. CB-005 (fail-closed security) — 15 min 2. CB-004 (wallet confirmation) — 30 min 3. CB-008 (env sanitization) — 30 min 4. CB-001/CB-002 (workspace sandbox) — 2–4 hours *Filed by Doxios 🦊*