# Defense-in-Depth Score: Shannon

**Repo:** https://github.com/KeygraphHQ/shannon · **Commit:** `a14c7944d87b30ed7bfecd4bad06562e24002b01` · **Reviewed:** 2026-10-03
**What it is:** AI pentester for web apps/APIs: analyzes source code and executes real exploits
**Category:** Cybersecurity
**Scored configuration:** `npx @keygraph/shannon start -u URL -r REPO` with no config file: unauthenticated scan, exploitation phase on, agentic SAST off, one ephemeral Docker worker container per scan, provider API key from the environment.
**Agent surface (default):** code execution yes · filesystem write yes · network egress yes · external credentials yes · persistent memory no · untrusted input yes · third party extensions yes · sub agents yes · external communication yes

## Score: 2.6 / 10.0 (Minimal)

| # | Criterion | S | C | D | B | Raw | Cap | Score | Confidence |
|---|---|---|---|---|---|---|---|---|---|
| C1 | Identity & least privilege | L2 | L1 | L2 | L2 | 0.42 | — | **0.42** | Medium |
| C2 | Approval gates | L0 | L0 | L0 | L1 | 0.05 | C2-POWERBYPASS | **0.05** | High |
| C3 | Tool & action scoping | L1 | L1 | L0 | L1 | 0.20 | G1 | **0.20** | High |
| C4 | Code-execution isolation | L2 | L3 | L3 | L0 | 0.53 | — | **0.53** | High |
| C5 | Untrusted input blast radius | L0 | L0 | L0 | L0 | 0.00 | C5-WORSTCASE | **0.00** | High |
| C6 | Memory, context & configuration integrity | L0 | L1 | L1 | L1 | 0.17 | C6-REPOCONFIG | **0.17** | Medium |
| C7 | Third-party extensions | L2 | L1 | L0 | L0 | 0.23 | G2 | **0.23** | Medium |
| C8 | Secrets & sensitive-data protection | L1 | L1 | L1 | L1 | 0.25 | — | **0.25** | High |
| C9 | Audit & traceability | L2 | L2 | L2 | L1 | 0.45 | — | **0.45** | High |
| C10 | Limits & kill switch | L1 | L2 | L1 | L1 | 0.33 | — | **0.33** | High |


Shannon is an offensive-security agent: by design it runs model-chosen shell commands and real exploits against a live target with no human approval step. Everything runs inside a throwaway non-root Docker container with the scanned repo mounted read-only, which contains the damage to the host, but the container keeps the model provider key in the environment that every model-run shell inherits, has the default seccomp profile switched off, no resource limits, and shares a network with an unauthenticated Temporal server and a writable mount of every scan workspace. Scope limits (target URL, rules of engagement) are prompt text, not code; the only code-enforced restriction is an optional path deny list, and the repo being scanned can add its own instruction files to the agents without any trust decision; other repository-supplied resources are not integrity-protected either. Use it only against disposable, authorized, non-production targets, ideally inside a throwaway VM, as its own documentation advises.

## Critical gaps
- Shell execution and live exploitation have no approval gate of any kind in the default configuration. (ASI02, ASI09, T2; C2) — [apps/worker/src/ai/pi/pi-executor.ts:59-60](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/worker/src/ai/pi/pi-executor.ts#L59-L60)
- A hijacked agent can leak secrets and take irreversible actions unattended, because untrusted target content, an unrestricted shell, unrestricted egress and the provider key share one session. (ASI01, T6, LLM01; C5) — [apps/cli/src/env.ts:103](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/cli/src/env.ts#L103); [apps/worker/src/ai/pi/pi-executor.ts:60](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/worker/src/ai/pi/pi-executor.ts#L60)
- Main agents load the scanned repo's own instruction files with no trust gate, so repo content can add prompts without consent; other repository-supplied resources are not integrity-protected either. (ASI06, ASI04, T1; C6) — [apps/worker/src/ai/pi/pi-executor.ts:97-109](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/worker/src/ai/pi/pi-executor.ts#L97-L109)
- The execution sandbox holds the provider key in its environment, mounts every scan workspace read-write, shares a network with an unauthenticated Temporal server, and runs with seccomp disabled and no resource limits. (ASI05, T11, LLM05; C4) — [apps/cli/src/docker.ts:491-495](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/cli/src/docker.ts#L491-L495); [apps/cli/src/docker.ts:452](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/cli/src/docker.ts#L452); [apps/cli/infra/compose.yml:9](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/cli/infra/compose.yml#L9)

## Criterion details

### C1 Identity & least privilege — 0.42 (medium)

The scan worker runs as a dedicated non-root user in its own container and receives only the selected provider's API key, not the operator's home directory, cloud credentials or other providers' keys. Inside that container nothing narrows the key further: it stays in the worker's process environment and the model's bash tool is spawned with that full environment, so any command the model runs can read it. Target login credentials and TOTP secrets exist only when the operator supplies a config file. A hijacked agent can therefore spend or exfiltrate the one provider credential, but not reach other systems with it.

- **S L2:** The CLI forwards only the selected provider's credential variables by name into the worker container and mounts no host credential directories, but the credential is static for the whole run and shared by all tools. — [apps/cli/src/env.ts:97-110](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/cli/src/env.ts#L97-L110); [apps/cli/src/docker.ts:483-486](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/cli/src/docker.ts#L483-L486) (verified)
  - *To reach the next level:* No per-tool or per-capability credentials; read, write and shell tools all share the one provider key.
- **C L1:** The worker reads the key from process.env and never scrubs it; the pi bash tool spawns with a copy of the full process.env, so every model-run shell command, in main agents and in child task sessions alike, inherits the key. — [apps/worker/src/ai/models.ts:140-150](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/worker/src/ai/models.ts#L140-L150); [apps/worker/src/ai/pi/pi-executor.ts:333-346](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/worker/src/ai/pi/pi-executor.ts#L333-L346); searched `rg -n -e 'delete process\.env' -e spawnHook -e shellCommandPrefix` in `apps/worker/src` → 0 hits (No env scrubbing or spawn hook anywhere in the worker. The inherited-environment behaviour is from the pinned @earendil-works/pi-coding-agent 0.84.4 package (utils/shell.js getShellEnv returns {...process.env}), read from the published tarball, not from this repo.) (inferred)
  - *To reach the next level:* Subprocesses are not given a scrubbed environment; no spawn hook or env filter exists.
- **D L2:** By default only the one selected provider key is forwarded and the worker runs as non-root `pentest`; widening (SHANNON_USE_PI_AUTH=1, which mounts the host pi auth.json read-write) is an operator environment variable with no warning in code. — [apps/cli/src/env.ts:59-76](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/cli/src/env.ts#L59-L76); [entrypoint.sh:18](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/entrypoint.sh#L18) (verified)
  - *To reach the next level:* Widening via an env var is silent, and the default key is long-lived rather than task-scoped.
- **B L2:** If the model misuses the credential it holds, the damage is use and exfiltration of one provider API key (spend, quota, possible account use) plus, for authenticated scans, whatever target logins the operator supplied; no host, cloud or code-hosting credentials are present. — [apps/cli/src/env.ts:97-110](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/cli/src/env.ts#L97-L110); [apps/cli/src/docker.ts:451-453](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/cli/src/docker.ts#L451-L453) (verified)
  - *To reach the next level:* The key is long-lived and shared with every subprocess; no per-run ephemeral or provider-side budget-limited credential is issued.
- **Cap:** none

### C2 Approval gates — 0.05 (high)

There is no approval step anywhere between the model and the shell or the target. Main agents get bash, edit and write plus the exploitation prompts run live attacks by default, and sub-agents get the same shell. The only human-facing gates are an authorized-use banner at launch and confirmations on stop/reset commands. Effects on the target (created users, modified or deleted data) cannot be undone by the tool; local deliverables are git-checkpointed and the scanned repo is read-only.

- **S L0:** No approval mechanism exists for any tool call; the model's bash, edit and write calls execute immediately. — [apps/worker/src/ai/pi/pi-executor.ts:59-60](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/worker/src/ai/pi/pi-executor.ts#L59-L60); searched `rg -n -i -e requireApproval -e requires_approval -e askUser` in `apps/worker/src apps/cli/src` → 0 hits (No approval hooks in worker or CLI.); searched `rg -n -i -e approval` in `apps/worker/src/ai/pi apps/worker/src/ai/extensions` → 0 hits (No approval handling in the agent executor or its extensions.) (verified)
  - *To reach the next level:* Needs per-call human approval of the exact command, with risk tiers.
- **C L0:** The most powerful tool, raw bash, is exempt (there is no gate at all), and child task sessions get bash too. — [apps/worker/src/ai/pi/task-tool.ts:47](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/worker/src/ai/pi/task-tool.ts#L47); [apps/worker/src/ai/pi/pi-executor.ts:311-312](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/worker/src/ai/pi/pi-executor.ts#L311-L312) (verified)
  - *To reach the next level:* Shell and exploit paths must cross a gate.
- **D L0:** Approval is not present, so it is not on by default; the exploitation phase is on by default (exploit defaults to true). — [apps/worker/src/config-parser.ts:686](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/worker/src/config-parser.ts#L686); [apps/cli/src/splash.ts:70-73](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/cli/src/splash.ts#L70-L73) (verified)
  - *To reach the next level:* An approval gate must exist and be on by default.
- **B L1:** Exploit side effects on the target (account creation, data modification or deletion, injection side effects) are irreversible and unattended, per the project's own safety doc; only local state is reversible (repo mounted read-only, scan container ephemeral, deliverables checkpointed in git). — [apps/cli/src/docker.ts:453](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/cli/src/docker.ts#L453); [apps/worker/src/ai/pi/pi-executor.ts:7-9](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/worker/src/ai/pi/pi-executor.ts#L7-L9); [docs/safety.md:17-24](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/docs/safety.md#L17-L24) (verified)
  - *To reach the next level:* Needs checkpoints or dry-runs for external actions and rate or quantity limits on consequential actions.
- **Cap:** C2-POWERBYPASS — Shell execution, the most powerful action path, has no approval gate in the default configuration.

### C3 Tool & action scoping — 0.20 (high)

Agents are given a raw bash tool and a browser/curl path to any host, with no argument validation beyond a required 1-600 second timeout on each bash call. Scope (which host to attack, rules of engagement) is stated in the prompt only. The one code-enforced restriction is an optional path deny list (code_path avoid rules) delivered through a third-party permission extension; it applies to file tools and recognised bash file commands, and its loading is not tamper-resistant. A separate task-formation step does use a copied, jailed source tree with a fixed read-only tool allowlist.

- **S L1:** When an operator configures code_path avoid rules they become a path deny list enforced by a permission extension; otherwise the main tool is a raw shell string with only a bash timeout bound. — [apps/worker/src/ai/pi/permission-system.ts:114-127](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/worker/src/ai/pi/permission-system.ts#L114-L127); [apps/worker/src/ai/extensions/bash-timeout/index.ts:18-38](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/worker/src/ai/extensions/bash-timeout/index.ts#L18-L38) (verified)
  - *To reach the next level:* Not allowlist validation: no resolved-path containment, no host or URL allowlist, no parsing of bash commands.
- **C L1:** Only a few paths validate: the bash timeout hook and (when configured) the path-deny extension; its loading is not tamper-resistant, and url_path/domain/method avoid rules are prompt text only. — [apps/worker/src/ai/pi/permission-system.ts:88-92](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/worker/src/ai/pi/permission-system.ts#L88-L92) (verified)
  - *To reach the next level:* Most built-in tools (bash content, browser, curl, write, edit) have no input validation.
- **D L0:** Every tool, including write, edit and bash, is enabled for every agent by a hard-coded list that no operator option changes. — [apps/worker/src/ai/pi/pi-executor.ts:59-60](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/worker/src/ai/pi/pi-executor.ts#L59-L60); [apps/worker/src/ai/pi/pi-executor.ts:286-312](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/worker/src/ai/pi/pi-executor.ts#L286-L312) (verified)
  - *To reach the next level:* A read-only default tool set with write/exec enabled explicitly, or per-task tool allowlists.
- **B L1:** A misused shell reaches any host the container can route to (the target, the internet, the shared shannon-net with Temporal, the host via host-gateway) and can write anywhere in the container and in the mounted workspaces, with no quantity limits; the repo mount is read-only. — [apps/cli/src/docker.ts:309-316](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/cli/src/docker.ts#L309-L316); [apps/cli/src/docker.ts:452](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/cli/src/docker.ts#L452) (verified)
  - *To reach the next level:* Egress is not limited to the target and writes are not limited to the scan's own directories.
- **Cap:** G1 — The only code-enforced scoping control (code_path avoid deny list) exists only when the operator configures avoid rules; with no config file it is not loaded.

### C4 Code-execution isolation — 0.53 (high)

Model-run commands execute inside a per-scan Docker container started by the CLI, as a non-root user, with the scanned repo mounted read-only and no unsandboxed fallback if Docker is missing. The container is not hardened beyond that: Docker's default seccomp profile is turned off for the whole container, no capabilities are dropped, there are no memory, CPU or PID limits, and egress is unrestricted. The sandbox environment holds the model provider key, mounts every scan workspace read-write (world-writable on the host), and shares a network with an unauthenticated Temporal dev server, so a hijacked command can read the key and reach the control plane or other scans' data.

- **S L2:** A stock container with a dedicated low-privilege user (entrypoint drops to `pentest`), but with seccomp=unconfined and no cap-drop, no-new-privileges, read-only root or limits. — [apps/cli/src/docker.ts:491-495](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/cli/src/docker.ts#L491-L495); [entrypoint.sh:18](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/entrypoint.sh#L18); searched `rg -n -e cap-drop -e no-new-privileges -e read-only -e '--memory' -e '--cpus' -e pids-limit` in `apps/cli/src` → 0 hits (No hardening or resource-limit flags on docker run.) (verified)
  - *To reach the next level:* Needs a hardened container profile (dropped capabilities, no-new-privileges, seccomp or equivalent, read-only root) or a microVM/gVisor boundary.
- **C L3:** Every model-reachable execution path (bash tool, child task sessions, playwright-cli browser) runs inside the worker container, and the CLI refuses to start without Docker, so there is no host fallback. — [apps/cli/src/docker.ts:107-116](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/cli/src/docker.ts#L107-L116); [apps/cli/src/docker.ts:501](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/cli/src/docker.ts#L501) (verified)
  - *To reach the next level:* L4 additionally needs sandbox setup failure handling and spawned processes proven confined to a hardened boundary; the container itself is unhardened.
- **D L3:** The container is always used, its run arguments are fixed in the host CLI, and there is no model-reachable flag or escalation path to unsandboxed execution. — [apps/cli/src/docker.ts:422-427](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/cli/src/docker.ts#L422-L427); [apps/cli/src/docker.ts:495](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/cli/src/docker.ts#L495) (verified)
  - *To reach the next level:* Policy hardening is weak (see S); no per-call escalation mechanism or operator flag exists to reason about because the sandbox cannot be turned off.
- **B L0:** Inside the sandbox the provider key sits in the environment, all scan workspaces are mounted read-write (host dir chmod 0777), the container shares shannon-net with an unauthenticated Temporal server, host-gateway is routed, egress is unrestricted, seccomp is off and there are no resource limits. — [apps/cli/src/docker.ts:452](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/cli/src/docker.ts#L452); [apps/cli/src/commands/start.ts:253](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/cli/src/commands/start.ts#L253); [apps/cli/infra/compose.yml:9](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/cli/infra/compose.yml#L9); [apps/cli/src/docker.ts:427](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/cli/src/docker.ts#L427) (verified)
  - *To reach the next level:* No secrets in the sandbox environment, workspace-only mount, egress allowlist and CPU/memory/PID limits would be needed for L3.
- **Cap:** none

### C5 Untrusted input blast radius — 0.00 (high)

The agent's job is to read hostile content: live responses from the target application and the target's source code. Nothing in code separates that content from instructions or limits what a hijacked agent can do after reading it. The same agents that read it hold an unrestricted shell, unrestricted network access and the provider key, and run unattended, so a successful injection could both exfiltrate the key or workspace data and take irreversible actions against the target. The project's own safety doc warns against pointing it at adversarial codebases.

- **S L0:** No code-level isolation, taint tracking, approval-after-read or quarantine applies to the main and child agents; untrusted content and the shell/network tools share one session. — [apps/worker/src/ai/pi/pi-executor.ts:286-312](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/worker/src/ai/pi/pi-executor.ts#L286-L312); searched `rg -n -i -e untrusted -e taint -e spotlight` in `apps/worker/src/ai/pi` → 0 hits (No provenance marking or untrusted-content handling in the agent executor modules.); [docs/safety.md:32](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/docs/safety.md#L32) (verified)
  - *To reach the next level:* Needs Rule of Two enforced in code (egress and state changes disabled or gated once untrusted content is read).
- **C L0:** Target responses, repo source and sub-agent outputs enter context with the same standing as instructions; only the narrow task-formation and opt-in SAST sessions run with confined read-only tools. — [apps/worker/src/ai/pi/task-tool.ts:170-172](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/worker/src/ai/pi/task-tool.ts#L170-L172); [apps/worker/src/ai/pi/task-formation-executor.ts:511-524](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/worker/src/ai/pi/task-formation-executor.ts#L511-L524) (verified)
  - *To reach the next level:* Sources must be distinguished and covered by a structural limit.
- **D L0:** There is no untrusted-input control to be on by default. — [apps/worker/src/ai/pi/pi-executor.ts:97-109](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/worker/src/ai/pi/pi-executor.ts#L97-L109) (verified)
  - *To reach the next level:* A control must exist and be on by default.
- **B L0:** A hijacked agent can leak the provider key or workspace data over any channel (bash with unrestricted egress) and take irreversible actions on the target, all without a human. — [apps/cli/src/env.ts:103](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/cli/src/env.ts#L103); [apps/worker/src/ai/pi/pi-executor.ts:60](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/worker/src/ai/pi/pi-executor.ts#L60) (verified)
  - *To reach the next level:* Leak and irreversible-action paths would both need gating or removal.
- **Cap:** C5-WORSTCASE — B is L0: leak plus irreversible action, unattended, in the default configuration.

### C6 Memory, context & configuration integrity — 0.17 (medium)

Shannon keeps no long-term memory (sessions are in-memory), but its main and child agents are built on a pi resource loader created with the scanned repository as working directory and none of the options that turn off project-level loading. Under the pinned pi version that means the repo's AGENTS.md/CLAUDE.md files and .pi/SYSTEM.md load automatically with no workspace-trust decision; other repository-supplied resources are not integrity-protected either. Only the task-formation and SAST sessions disable project-level loading. Phase hand-off files in the deliverables directory also carry earlier agents' output (including target-derived content) into later agents.

- **S L0:** Main agents and child task sessions are created with a loader that sets none of the project-loading restrictions (e.g. noContextFiles) or a trust-gated SettingsManager, so repo-controlled instruction files load silently (other repo-controlled resources are not integrity-protected either; behaviour read from pi 0.84.4 resource-loader.js and package-manager.js). — [apps/worker/src/ai/pi/pi-executor.ts:97-109](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/worker/src/ai/pi/pi-executor.ts#L97-L109); searched `rg -n -e noExtensions -e noContextFiles -e projectTrusted` in `apps/worker/src/ai/pi/pi-executor.ts apps/worker/src/ai/pi/task-tool.ts` → 0 hits (The main-agent and child-session loaders never disable project extension or context-file loading. Library behaviour (SettingsManager.create defaults projectTrusted=true; AGENTS.md/CLAUDE.md loaded from cwd and ancestors unless noContextFiles) was read from the published @earendil-works/pi-coding-agent 0.84.4 tarball matching pnpm-lock.yaml:311.) (inferred)
  - *To reach the next level:* Needs project config/extensions blocked or gated by an explicit trust decision, and security settings only from user scope.
- **C L1:** One surface is controlled: task-formation and Capella sessions restrict project-level loading; the main agents, child tasks and deliverable hand-off files are not. — [apps/worker/src/ai/pi/task-formation-executor.ts:511-524](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/worker/src/ai/pi/task-formation-executor.ts#L511-L524); [apps/worker/src/ai/pi/capella-agent-executor.ts:379-390](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/worker/src/ai/pi/capella-agent-executor.ts#L379-L390) (verified)
  - *To reach the next level:* All auto-loaded files and settings, including those of main and child agents, need control.
- **D L1:** Sessions are in-memory and per-scan, but all scan workspaces are mounted writable into every worker and there is no namespace enforcement beyond directory naming. — [apps/worker/src/ai/pi/pi-executor.ts:340](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/worker/src/ai/pi/pi-executor.ts#L340); [apps/cli/src/docker.ts:452](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/cli/src/docker.ts#L452) (verified)
  - *To reach the next level:* Per-scan isolation enforced by storage separation rather than by convention.
- **B L1:** A planted file in the scanned repo persists across every scan of that repo and can steer tool use in all main agents. — [apps/worker/src/ai/pi/pi-executor.ts:273-274](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/worker/src/ai/pi/pi-executor.ts#L273-L274) (inferred)
  - *To reach the next level:* Needs repo-provided config to be inert until reviewed.
- **Cap:** C6-REPOCONFIG — Files in the scanned repository (AGENTS.md/CLAUDE.md, .pi/SYSTEM.md and others) are loaded by the main agents without any workspace-trust decision and can add instructions.

### C7 Third-party extensions — 0.23 (medium)

The extensions Shannon ships are few and pinned: an in-repo bash-timeout extension and the pi-permission-system package, resolved from a lockfile with integrity hashes and installed with a frozen lockfile at image build; the Playwright CLI is pinned by version without a hash. Runtime extension loading, however, is not integrity-protected.

- **S L2:** Shipped extensions are version-pinned (lockfile with sha512 integrity, frozen install) and the Playwright CLI is pinned to 0.1.1 without a hash, but nothing verifies extensions discovered at runtime. — [Dockerfile:119](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/Dockerfile#L119); [Dockerfile:33](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/Dockerfile#L33); [pnpm-lock.yaml:346-347](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/pnpm-lock.yaml#L346-L347) (verified)
  - *To reach the next level:* Integrity checks for every extension source, including the Playwright CLI install and any extension loaded at runtime.
- **C L1:** Pinning covers the bundled npm packages, but not every extension source is verified. — [apps/worker/src/ai/pi/pi-executor.ts:85-94](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/worker/src/ai/pi/pi-executor.ts#L85-L94) (verified)
  - *To reach the next level:* Every extension type needs verification.
- **D L0:** Extensions can be added without operator consent. (inferred)
  - *To reach the next level:* Only user or admin scope should be able to add extensions, with explicit consent.
- **B L0:** Pi extensions run in-process in the worker, with the provider key and every other secret in the worker's environment and the same user as the agent shell. — [apps/worker/src/ai/extensions/bash-timeout/index.ts:40-47](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/worker/src/ai/extensions/bash-timeout/index.ts#L40-L47) (inferred)
  - *To reach the next level:* Out-of-process, scrubbed-environment or per-extension sandboxing.
- **Cap:** G2 — A workspace-controlled file can bypass the pinned-extension control at runtime.

### C8 Secrets & sensitive-data protection — 0.25 (high)

In the default unauthenticated scan the only secret is the provider API key, read from the environment or from a 0600 config file on the host and forwarded by name into the container. It is not scrubbed from the model's shell environment. No telemetry or crash reporting exists. The scan log records every tool call's complete arguments with no redaction, so any password, token or TOTP secret the model types into a command lands in workflow.log; error paths, by contrast, go through a closed vocabulary rather than raw text. When the operator supplies an authenticated-scan config, target usernames, passwords and TOTP secrets are substituted directly into the agents' prompts.

- **S L1:** Secrets come from env vars or a 0600 TOML file; masking exists only for error messages (closed safe-field vocabulary), not for tool-call logs or model-bound text. — [apps/cli/src/config/writer.ts:29](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/cli/src/config/writer.ts#L29); [apps/worker/src/services/prompt-manager.ts:221-229](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/worker/src/services/prompt-manager.ts#L221-L229); searched `rg -n -i -e redact -e scrub -e mask` in `apps/worker/src/audit apps/worker/src/ai/pi/pi-executor.ts apps/worker/src/ai/pi/task-tool.ts` → 0 hits (No redaction in the audit logger or agent executor.) (verified)
  - *To reach the next level:* Redaction before logs and model-bound messages on all major paths, and a secret store or opaque handles.
- **C L1:** One path is protected: error messages are mapped through a fixed safe-field table; tool-call logs, model-bound prompts and subprocess environments are not. — [apps/worker/src/audit/workflow-logger.ts:268](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/worker/src/audit/workflow-logger.ts#L268); [apps/worker/src/audit/safe-fields.ts:115-120](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/worker/src/audit/safe-fields.ts#L115-L120) (verified)
  - *To reach the next level:* Logs and transcripts, then model-bound messages and subprocess environments, need protection.
- **D L1:** No telemetry or crash reporter exists in the CLI or worker, but full tool-call arguments are logged by default and not redacted. — searched `rg -n -w -i -e sentry -e posthog -e mixpanel` in `apps/worker/src apps/cli/src apps/worker/package.json apps/cli/package.json` → 0 hits (No telemetry SDKs.); [apps/worker/src/audit/workflow-logger.ts:262-270](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/worker/src/audit/workflow-logger.ts#L262-L270) (verified)
  - *To reach the next level:* Redaction always on; payload logging of tool arguments off or scrubbed by default.
- **B L1:** A leak exposes a long-lived provider API key (moderately scoped to one provider) reachable by the model and every subprocess; target credentials appear only if the operator supplies a config. — [apps/worker/src/ai/models.ts:140-150](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/worker/src/ai/models.ts#L140-L150); [apps/worker/src/services/prompt-manager.ts:224-229](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/worker/src/services/prompt-manager.ts#L224-L229) (verified)
  - *To reach the next level:* Short-lived or per-run credentials and no secret material reachable by the model.
- **Cap:** none
- **Notes:** C8-MODELSECRETS was considered and not applied: the default (no-config) flow places no target credentials in prompts. With an authenticated config (login_flow, password, TOTP secret) the secrets are substituted into prompts, which would trigger that cap.

### C9 Audit & traceability — 0.45 (high)

Each tool call by a main agent or sub-agent is written to a per-scan workflow.log with a timestamp, an actor label and the full JSON arguments, plus delegation lines linking sub-agents to parents; success is implied rather than recorded and only failures or slow calls get a second line. There are no correlation IDs and no approvals to record. The log lives in the scan workspace directory that the agent's own shell can write, trace lines are not flushed per write, and a log-write failure is swallowed (warned once) while the scan continues.

- **S L2:** Structured per-call records with arguments and timestamps exist for all tools, with actor names but no correlation IDs, principal, or tamper evidence; result status is logged only for failures and slow calls. — [apps/worker/src/audit/workflow-logger.ts:262-270](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/worker/src/audit/workflow-logger.ts#L262-L270); [apps/worker/src/ai/pi/trace-emitter.ts:51-56](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/worker/src/ai/pi/trace-emitter.ts#L51-L56) (verified)
  - *To reach the next level:* Needs correlation IDs across sub-agents and a requesting-principal/approver field, then tamper-evident storage.
- **C L2:** Main-agent and child-session tool calls are all traced, but calls blocked by an extension, configuration changes and credential use are not recorded. — [apps/worker/src/ai/pi/task-tool.ts:155-163](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/worker/src/ai/pi/task-tool.ts#L155-L163); [apps/worker/src/ai/pi/pi-executor.ts:374-377](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/worker/src/ai/pi/pi-executor.ts#L374-L377) (verified)
  - *To reach the next level:* Denials and credential/config events are not logged.
- **D L2:** Logging is on by default and written to the scan workspace directory outside the scanned repo, but by the worker process that runs the agent's shell, in a directory that is mounted writable. — [apps/worker/src/audit/utils.ts:74-79](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/worker/src/audit/utils.ts#L74-L79); [apps/cli/src/docker.ts:452](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/cli/src/docker.ts#L452) (verified)
  - *To reach the next level:* Written by a component the model cannot control or shipped off-host.
- **B L1:** Trace writes are best-effort: failures are swallowed with a one-time warning, queued writes ignore errors, and per-call trace lines are not fsynced. — [apps/worker/src/audit/workflow-logger.ts:154-176](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/worker/src/audit/workflow-logger.ts#L154-L176); [apps/worker/src/ai/pi/trace-emitter.ts:66-72](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/worker/src/ai/pi/trace-emitter.ts#L66-L72) (verified)
  - *To reach the next level:* Errors surfaced and records durable per action.
- **Cap:** none

### C10 Limits & kill switch — 0.33 (high)

Time is bounded at several layers: each bash call needs a timeout of at most 10 minutes, each agent activity has a 2 hour wall-clock limit, and at most five pipelines run concurrently. But main and child agent sessions have no turn or token/cost cap, retries run up to 50 attempts with minutes of backoff, so total runtime and spend before limits trip is measured in many hours. Stopping a scan cancels the workflow, aborts the sessions, force-terminates after a grace period and stops the container, which kills in-flight commands; there is nothing scheduled to continue afterwards, though effects on the target are not reverted.

- **S L1:** Wall-clock and per-bash timeouts are enforced in code and the halt path works, but there is no iteration cap and no token or cost cap on main or child sessions. — [apps/worker/src/temporal/workflows.ts:115](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/worker/src/temporal/workflows.ts#L115); [apps/worker/src/ai/extensions/bash-timeout/index.ts:19](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/worker/src/ai/extensions/bash-timeout/index.ts#L19); searched `rg -n -i -e maxTurns -e max_turns -e maxCost -e spendLimit -e tokenBudget` in `apps/worker/src/ai/pi/pi-executor.ts apps/worker/src/ai/pi/task-tool.ts` → 0 hits (No turn or cost cap on main or child sessions; turn caps exist only in the separate task-formation executor (task-formation-executor.ts:35-37).) (verified)
  - *To reach the next level:* Needs an iteration cap plus a cost cap on agent sessions.
- **C L2:** The top-level activity timeout and the bash timeout extension apply to main and child sessions (children are bound by the parent's activity and the same resource loader), but sub-agents have no budget of their own and no cap on parallel task calls. — [apps/worker/src/ai/pi/task-tool.ts:133](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/worker/src/ai/pi/task-tool.ts#L133); [apps/worker/src/temporal/workflows.ts:184](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/worker/src/temporal/workflows.ts#L184) (verified)
  - *To reach the next level:* Sub-agent and background work must count against shared step and cost budgets, with caps on delegation fan-out.
- **D L1:** Fixed defaults exist but are very large (2 h per attempt, 50 attempts), and are not operator-configurable. — [apps/worker/src/temporal/workflows.ts:92-97](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/worker/src/temporal/workflows.ts#L92-L97) (verified)
  - *To reach the next level:* Sensible, tight defaults that are operator-configurable, with a cost ceiling.
- **B L1:** Ceilings are hours per attempt with up to 50 retries and no spend ceiling; stop cancels the workflow, force-terminates after a grace period and stops the container, so no process is left running. — [apps/cli/src/commands/stop.ts:196](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/cli/src/commands/stop.ts#L196); [apps/cli/src/commands/stop.ts:216](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/cli/src/commands/stop.ts#L216); [apps/cli/src/docker.ts:634](https://github.com/KeygraphHQ/shannon/blob/a14c7944d87b30ed7bfecd4bad06562e24002b01/apps/cli/src/docker.ts#L634) (verified)
  - *To reach the next level:* Tight per-run time and cost ceilings, ideally enforced provider-side.
- **Cap:** none

## Rule-of-Two check
[A] untrusted input: Target application responses and the target repo's source, read by every agent (apps/worker/src/ai/pi/pi-executor.ts:97-109, prompts under apps/worker/prompts) · [B] sensitive data/systems: Provider API key in the worker environment inherited by the model's bash (apps/cli/src/env.ts:103); target logins and TOTP secrets in prompts when a config is supplied (apps/worker/src/services/prompt-manager.ts:221-229) · [C] state change / egress: Unrestricted bash, browser and curl with exploitation on by default (apps/worker/src/ai/pi/pi-executor.ts:60, apps/worker/src/config-parser.ts:686) · Same default session? Yes

## Highest-impact improvements
1. Disable project-level resource loading for the main and child agents (as the task-formation executor already does), so the scanned repo cannot add instructions or other resources. — C6 S L0→L3, +0.225 before caps (Playbook 2)
2. Spawn the model's bash with a scrubbed environment (spawn hook) and route model traffic through a host-side key-injecting proxy so the provider key is never in the shell's environment. — C1 C L1→L3, +0.150 before caps (Playbook 4)
3. Add a code-enforced egress allowlist for the scan container (target host only, no host-gateway, separate network from Temporal) and mount only the scan's own workspace. — C4 B L0→L2, +0.100 before caps (Playbook 3 step 1)
4. Enforce a turn cap and a cost cap on main and child sessions that sub-agents share, and lower the retry ceiling. — C10 S L1→L3, +0.150 before caps (Playbook 3 step 3)
5. Replace seccomp=unconfined with a custom profile that allows only what Chromium needs, and add cap-drop, no-new-privileges, and memory/CPU/PID limits. — C4 S L2→L3, +0.075 before caps (Playbook 3 step 1)

## Re-audit log
- No changes.

## Limitations
- Static review of the pinned commit only; nothing was executed, installed, built or probed.
- Behaviour of the third-party pi harness (project-resource and context-file auto-loading, bash environment inheritance) was read from the published @earendil-works/pi-coding-agent 0.84.4 package matching pnpm-lock.yaml, not from this repository; the C1 C, C6 and C7 ratings that depend on it are marked inferred.
- The opt-in agentic SAST (Capella) pipeline and authenticated-scan configuration were reviewed only for their tool confinement and credential handling, not scored as the default mode; the @gotgenes/pi-permission-system package's internals were not audited.
- Docker daemon defaults (for example default capabilities for a non-root container user) were taken from the run arguments in the CLI, not tested.
- No attempt to steer reviewers was found in README, docs, CLAUDE.md or llms.txt; they were treated as data.