44 lines
2.1 KiB
Markdown
44 lines
2.1 KiB
Markdown
|
# Security Note — AI Persona OS
|
||
|
|
|
||
|
|
Some automated security scanners (e.g. VirusTotal Code Insight) may flag this skill due to heuristic pattern matching. This document explains why those flags are **false positives**.
|
||
|
|
|
||
|
|
## What scanners detect vs. what the code actually does
|
||
|
|
|
||
|
|
### "Crypto key handling patterns"
|
||
|
|
- **Trigger:** `scripts/security-audit.sh` contains regex patterns like `api_key`, `secret_key`, `access_token`, etc.
|
||
|
|
- **Reality:** This script *searches your workspace for accidentally leaked credentials*. It does not store, transmit, or handle any secrets. All checks are local `grep` scans with no network calls.
|
||
|
|
- **Trigger:** `examples/coding-assistant/KNOWLEDGE.md` references environment variable names like `YOUR_API_KEY` and `DATABASE_URL`.
|
||
|
|
- **Reality:** These are placeholder names in a documentation template — no actual credentials are present.
|
||
|
|
|
||
|
|
### "External API calls"
|
||
|
|
- **Trigger:** Code examples in `examples/coding-assistant/KNOWLEDGE.md` show a TypeScript `fetch()` pattern.
|
||
|
|
- **Reality:** This is an illustrative code snippet (`/api/endpoint` is not a real URL). No files in this skill make any network requests.
|
||
|
|
- **Trigger:** URLs to `jeffjhunter.com` and `aimoneygroup.com` appear in attribution footers.
|
||
|
|
- **Reality:** These are the author's homepage links in documentation — not API endpoints.
|
||
|
|
|
||
|
|
### "Eval or dynamic code execution"
|
||
|
|
- **Trigger:** Words like "execute," "execution," and "execute commands" appear frequently in documentation.
|
||
|
|
- **Reality:** These describe the *concept* of AI agent task execution within the persona framework. There are **zero** `eval()`, `exec()`, or dynamic code execution calls in any script.
|
||
|
|
|
||
|
|
## Verification
|
||
|
|
|
||
|
|
You can verify this yourself:
|
||
|
|
|
||
|
|
```bash
|
||
|
|
# Confirm no eval/exec calls exist
|
||
|
|
grep -rn "eval\|exec(" scripts/ --include="*.sh"
|
||
|
|
|
||
|
|
# Confirm no network calls exist in scripts
|
||
|
|
grep -rn "curl\|wget\|nc \|netcat\|/dev/tcp" scripts/ --include="*.sh"
|
||
|
|
|
||
|
|
# Review the security audit script directly
|
||
|
|
cat scripts/security-audit.sh
|
||
|
|
```
|
||
|
|
|
||
|
|
## Questions?
|
||
|
|
|
||
|
|
If you have security concerns, please open an issue or contact the author directly.
|
||
|
|
|
||
|
|
- **Author:** Jeff J Hunter
|
||
|
|
- **Website:** https://jeffjhunter.com
|