github.com / vxcontrol

vxcontrol/pentagi

Go·1728 files·commit cffed94·scanned 1d ago·cached ✓

15/100

LOW RISK

Minor findings consistent with the project type. Nothing reachable from install hooks.

score capped at 15 — 32,593+ stars — findings likely false positives

verdict accurate?

32,593 stars

Research / educational context

Partial architecture graph

threat-state: lowlive

FINDINGS ░▒▓

criticalGo os/exec usageos/exec is used to run external commands. In malware it drops payloads, modifies the system, or opens shells.backend/cmd/installer/checker/helpers.go


	cmd := exec.Command("docker", "version", "--format", "{{.Client.Version}}")
	output, err := cmd.Output()
	if err != nil && len(output) == 0 {

criticalGo os/exec usageos/exec is used to run external commands. In malware it drops payloads, modifies the system, or opens shells.backend/cmd/installer/processor/compose.go

	args = append([]string{"compose", "--env-file", envPath, "-f", composePath}, args...)
	cmd := exec.CommandContext(ctx, "docker", args...)
	cmd.Dir = workingDir
	cmd.Env = os.Environ()

criticalGo os/exec usageos/exec is used to run external commands. In malware it drops payloads, modifies the system, or opens shells.backend/cmd/installer/processor/docker.go


	cmd := exec.CommandContext(ctx, "docker", "pull", name)
	cmd.Env = d.getWorkerDockerEnv()

infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2

warningSSH/credential path accessAccessing .ssh, .aws/credentials, or .env files to steal authentication credentials.backend/pkg/tools/terminal_test.go

			{"/work/$TARGET/notes.txt", "$TARGET"},
			{"$HOME/.ssh/config", "$HOME"},
		} {
			err := validateFilePath(tt.path)

warningSSH/credential path accessAccessing .ssh, .aws/credentials, or .env files to steal authentication credentials.scripts/entrypoint.sh

SERVER_SSL_CA_CRT=ssl/service_ca.crt
OLLAMA_KEY=/root/.ollama/id_ed25519

if [ ! -f "$OLLAMA_KEY" ]; then

warningClipboard read accessnavigator.clipboard.readText() reads the user's clipboard. In a wallet/crypto context this is often used to steal copied seed phrases or private keys.frontend/e2e/specs/flows/report.spec.ts

        await expect(page.getByText('Report copied to clipboard')).toBeVisible();
        expect(await page.evaluate(() => navigator.clipboard.readText())).toContain('E2E Task Alpha');
        expectC...

warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.backend/pkg/graph/model/models_gen.go+4

warningLarge base64-encoded blobA 96-character base64 blob was found. May hide a remote payload or encoded executable code.frontend/e2e/mocks/cassettes/flows.ts

iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8...

infoSuspicious file in repoVery large source file (1477KB) — could contain obfuscated payloadbackend/pkg/graph/generated.go+2

infoSuspicious file in repoVery large source file (599KB) — could contain obfuscated payloadfrontend/src/graphql/types.ts+2

infoSuspicious file in repoExecutable file (version.ps1) in repositoryscripts/version.ps1+2

infoNative addon dependency"@xterm/addon-fit" includes native compiled code. Native addons can hide behavior that static JS analysis cannot see.package.json+2

infoNative addon dependency"@xterm/addon-search" includes native compiled code. Native addons can hide behavior that static JS analysis cannot see.package.json+2

infoNative addon dependency"@xterm/addon-unicode11" includes native compiled code. Native addons can hide behavior that static JS analysis cannot see.package.json+2

infoAuthor has no other public repositoriesGitHub user "sirozha" has no other public repositories, common for burner accounts used in scams.+2

warningHardcoded secret/credentialAPI keys, passwords, or tokens hardcoded in source code. Should be in environment variables.backend/cmd/installer/processor/pg.go

	EnvPostgreSQLUser     = "PENTAGI_POSTGRES_USER"
	EnvPostgreSQLPassword = "PENTAGI_POSTGRES_PASSWORD"
	EnvPostgreSQLDatabase = "PENTAGI_POSTGRES_DB"
)

warningHardcoded secret/credentialAPI keys, passwords, or tokens hardcoded in source code. Should be in environment variables.frontend/e2e/mocks/cassettes/api-tokens.ts

export const CREATED_TOKEN = makeToken('3', 'E2E created token');
export const CREATED_TOKEN_SECRET = 'e2e-fake-token-secret';

export const CREATED_TOKEN_WITH_SECRET: ApiTokenWithSecretFragmentFragme...

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

1325 files scanned @ cffed94 | 10/28/2026 | heuristic scan — always review manually

risk by category

code execution25

network & exfiltration0

file system access14

obfuscation7

supply chain15

owasp / injection6

telemetry

files 1325/1728rules hit 18engine v7commit cffed94

github

vxcontrol/pentagi

Fully autonomous AI Agents system capable of performing complex penetration testing tasks

32593

5080

661d

1728 files

1325 scanned(77%)

cffed94

architecture░▒▓

entry (1) flagged (12) pkg (220)

620 nodes · 1816 edgesscroll to zoom · click node to jump to finding