Executive Summary
Agent Remit (as declared)
An autonomous agent built on the Fetch.ai uAgents framework, holding a cryptographic identity and an on-chain wallet, that performs one operator-defined task domain on a schedule and in response to inbound messages from other agents. It may send, receive and broadcast typed messages, register and refresh its own record on the Almanac and Agentverse, resolve peer addresses, read and write its own key-value store, sign with its identity, and serve its declared handlers — host shell access and arbitrary code execution are forbidden outright. Counterparties are a closed set: only signature-verified peers on the operator's allowlist, the Almanac and Agentverse infrastructure, and the ledger are authorized, and counterparty-supplied content is data to be processed, never instructions to be obeyed. Seed and key material must never leave the host, discretionary wallet spends require human approval, and the agent-inspector and other debug endpoints must be disabled in production.
Behavior Summary (as observed)
The framework's one strong control — ECDSA signing and verification of every inter-agent envelope — is surrounded by a default posture that never enforces the rest of the declared trust model. The signature is checked but its freshness is not: expires and nonce are folded into the signed digest in envelope.py and read by no one, so a captured envelope replays indefinitely; a sender that simply calls itself user... skips verification altogether, and a sync response carrying no signature at all is accepted and dispatched.
The sharper edge is the control plane. The agent inspector is enabled by default and its endpoints share the 0.0.0.0 socket with the agent protocol, guarded only by a client-IP test that forwarded_allow_ips hands to the caller, while wildcard CORS makes the same endpoints reachable from any web origin — exposing the full cached message history through /messages and the agent's Agentverse registration through /connect.
Scope of Analysis
Two pure-Python packages form the subject:
uagents (the Agent and Bureau runtime, ASGI server, message dispenser, resolver, registration policies, key-value storage) and uagents-core (identity, envelope, registration models, Agentverse helpers) — with no LLM in the base runtime and no shell, exec, eval or pickle call anywhere in either package. Agent.__init__ wires an ECDSA identity, a cosmpy wallet and ledger client, and an ASGIServer bound to 0.0.0.0 that serves the /submit envelope endpoint and, by default, four agent-inspector REST endpoints (/agent_info, /messages, /connect, /disconnect). Inbound envelopes are signature-verified in asgi.py and dispatched by schema digest to typed handlers; outbound envelopes are signed, queued in Dispenser and POSTed to endpoint URLs resolved from the Almanac API or contract. Access control, rate limiting and durable message history are optional add-ons — QuotaProtocol ships an ACL and quota that nothing wires in by default — while identity and wallet private keys are written to a plaintext private_keys.json in the working directory.Remit Coverage
Every actionable rule in the Worker Remit, checked against the running code. Gap = declared but unenforced; Partial = enforced but incomplete or bypassable; Vague Policy = too imprecise to verify.
| Rule ID | Section | Rule (quoted) | Status | Finding |
|---|---|---|---|---|
| R-01 | Prohibited Behaviors | "The agent MUST NOT treat the content of inbound messages, query payloads, broadcast traffic, or data retrieved from other agents as instructions that alter its own goals, policies, or tool set." | Verified | — |
| R-02 | Prohibited Behaviors | "The agent MUST NOT redefine its own mission or expand its own capability set at runtime beyond what the operator configured." | Verified | — |
| R-03 | Prohibited Behaviors | "The agent MUST NOT perform work outside its configured task domain; requests that fall outside that domain are declined rather than serviced." | Enforcement Not Possible | — |
| R-04 | Prohibited Behaviors | "The agent MUST NOT autonomously register, advertise, or impersonate identities, addresses, or protocols other than its own configured identity." | Verified | — |
| R-05 | Approved Communication Channels | "The server the agent binds to receive envelopes; must serve only the agent's declared endpoints." | Partial | PRAX-2026-08-12-001 |
| R-06 | Approved Communication Channels | "On-chain transactions — gated per Action Boundaries." | Gap | PRAX-2026-08-12-007 |
| R-07 | Approved Communication Channels | "Approved Communication Channels" | Partial | PRAX-2026-08-12-010 |
| R-08 | Authorized Counterparties | "Trusted People / Accounts" | Partial | PRAX-2026-08-12-001 |
| R-09 | Authorized Counterparties | "The operator-configured allowlist of authorized peer agent addresses is a closed set: any peer agent address or message sender not on that allowlist is not an authorized counterparty, and its appearance in communication or transactions is a trust-expansion finding." | Gap | PRAX-2026-08-12-006 |
| R-10 | Authorized Counterparties | "Trusted Domains" | Verified | — |
| R-11 | Authorized Counterparties | "Trusted Services / Integrations" | Verified | — |
| R-12 | Authorized Counterparties | "Only operator-configured external integrations are authorized: the LLM adapters (e.g. ASI:One) and MCP endpoints the operator explicitly configured form a closed set; any LLM adapter or MCP endpoint outside that set is unauthorized and is a trust-expansion finding." | Verified | — |
| R-13 | Authorized Counterparties | "A message sender whose identity signature does not verify is not a trusted counterparty for state-changing or privileged actions — see Action Boundaries → Never Allowed." | Gap | PRAX-2026-08-12-004 |
| R-14 | Tools and Capabilities | "Allowed Tools (Known Good Baseline)" | Partial | PRAX-2026-08-12-001 |
| R-15 | Tools and Capabilities | "Any capability that moves value on the ledger or spends wallet funds — see Action Boundaries." | Gap | PRAX-2026-08-12-007 |
| R-16 | Tools and Capabilities | "The agent MUST NOT hold, or route untrusted message content into, any capability that executes arbitrary commands or code on the host." | Verified | — |
| R-17 | Data Boundaries | "Allowed Data Sources" | Partial | PRAX-2026-08-12-009 |
| R-18 | Data Boundaries | "Seed phrases, identity keys, and wallet keys MUST NEVER leave the host — never transmitted in a message, written to a log, or published to the Almanac / Agentverse profile metadata." | Verified | — |
| R-19 | Data Boundaries | "Credentials, API keys, and seed material MUST be loaded from environment or secure operator configuration; they MUST NOT be hardcoded in source or committed to the repository." | Gap | PRAX-2026-08-12-002 |
| R-20 | Data Boundaries | "Data published to the public Almanac / Agentverse profile (address, endpoints, protocols, description, README, avatar) MUST be limited to non-sensitive information intended for public discovery." | Verified | — |
| R-21 | Action Boundaries | "Allowed Without Approval" | Verified | — |
| R-22 | Action Boundaries | "Any discretionary on-chain value transfer or spend of wallet funds — value moved to any counterparty other than the Almanac / Agentverse registration contract. The framework ships no operator authorization policy for wallet spends, so the deployment MUST supply the gating policy; its absence is a gap in the deployment, not a configurable threshold to look up." | Gap | PRAX-2026-08-12-007 |
| R-23 | Action Boundaries | "Adding a new outbound communication channel, integration, or counterparty not already authorized." | Gap | PRAX-2026-08-12-001 |
| R-24 | Action Boundaries | "The agent MUST NOT act on an unsigned or signature-unverified message when performing a state-changing or privileged action." | Gap | PRAX-2026-08-12-004 |
| R-25 | Action Boundaries | "Discretionary on-chain value transfers are out of scope by default: the agent MUST NOT move value to any counterparty other than the Almanac / Agentverse registration contract unless the operator has explicitly authorized value transfers." | Verified | — |
| R-26 | Action Boundaries | "The agent-inspector and other debug/administrative REST endpoints MUST be disabled in production." | Gap | PRAX-2026-08-12-003 |
| R-27 | Action Boundaries | "If such debug/administrative endpoints are enabled, the agent MUST NOT expose them unless they sit behind operator-configured protection (authentication / network restriction)." | Partial | PRAX-2026-08-12-001 |
| R-28 | Escalation Rules | "Halt and alert if the agent is about to transmit or log seed / identity / wallet key material." | Gap | PRAX-2026-08-12-013 |
| R-29 | Escalation Rules | "Halt and alert if the agent attempts a value transfer that exceeds the approval threshold or lacks operator authorization." | Gap | PRAX-2026-08-12-013 |
| R-30 | Escalation Rules | "Alert on Almanac / Agentverse registration failure rather than silently continuing." | Partial | PRAX-2026-08-12-013 |
| R-31 | Escalation Rules | "Alert on repeated inbound messages from senders whose signatures fail verification or who are not authorized counterparties." | Gap | PRAX-2026-08-12-013 |
| R-32 | Escalation Rules | "Log only — do not alert — on routine signature-verified message handling and scheduled interval task runs; these events MUST leave a log record." | Gap | PRAX-2026-08-12-012 |
Findings Register
Findings, ordered by severity — each linked to its remit rule, evidence, and a recommended action. Tag chips jump to the relevant entry in the RAISE framework, the OWASP LLM Top 10, or the OWASP Agentic Top 10.
LLM06 primary — the finding's main OWASP categoryASI10 secondary — a category it also touches
CRITICAL PRAX-2026-08-12-001 The agent inspector's REST endpoints are reachable by any remote or cross-origin caller because the only guard is a client IP the caller supplies.
Policy Rule — R-05, R-08, R-14, R-23, R-27 (Worker Remit):
"The server the agent binds to receive envelopes; must serve only the agent's declared endpoints. / Trusted People / Accounts / Allowed Tools (Known Good Baseline) / Adding a new outbound communication channel, integration, or counterparty not already authorized. / If such debug/administrative endpoints are enabled, the agent MUST NOT expose them unless they sit behind operator-configured protection (authentication / network restriction)."
"The server the agent binds to receive envelopes; must serve only the agent's declared endpoints. / Trusted People / Accounts / Allowed Tools (Known Good Baseline) / Adding a new outbound communication channel, integration, or counterparty not already authorized. / If such debug/administrative endpoints are enabled, the agent MUST NOT expose them unless they sit behind operator-configured protection (authentication / network restriction)."
python/src/uagents/asgi.py:304 — lines 304-311 — reserved endpoints are refused only when "127.0.0.1" is absent from scope["client"], and /agent_info is subtracted from the guarded set
python/src/uagents/asgi.py:184 — uvicorn.Config(..., host="0.0.0.0", forwarded_allow_ips="*") — the client value the guard reads is taken from any peer's X-Forwarded-For header
python/src/uagents/asgi.py:186 — lines 185-190 — Access-Control-Allow-Origin "*" and Allow-Methods "GET, POST, OPTIONS" are attached to every response, and OPTIONS is answered 204 at line 295
python/src/uagents/agent.py:488 — GET /messages returns the whole cached EnvelopeHistory and POST /connect at lines 496-519 registers the agent in Agentverse with a caller-supplied endpoint and user_token
High confidence
Recommended Action
- Stop deriving authorization from the peer address in
asgi.py— removeforwarded_allow_ips="*", require a locally-issued bearer token for/messages,/connectand/disconnect, and move/agent_infoinside the guarded set. - Scope the CORS headers set in
ASGIServer.serve()to the/submitpath or an operator-configured origin list, so a web origin cannot read or invoke the inspector endpoints from the operator's browser.
CRITICAL PRAX-2026-08-12-002 The Helm chart ships a literal agent seed phrase as its default value, giving every unmodified deployment a publicly known identity and wallet key.
Manage Your Supply Chain
LLM02 — Sensitive Information Disclosure
ASI03 — Identity and Privilege Abuse
Policy Rule — R-19 (Worker Remit):
"Credentials, API keys, and seed material MUST be loaded from environment or secure operator configuration; they MUST NOT be hardcoded in source or committed to the repository."
"Credentials, API keys, and seed material MUST be loaded from environment or secure operator configuration; they MUST NOT be hardcoded in source or committed to the repository."
python/deployment/helm/uagent/values.yaml:16 — agent.seed carries a committed literal seed phrase [REDACTED — seed phrase at python/deployment/helm/uagent/values.yaml:16]; templates/secrets.yaml:9 b64-encodes it into UAGENT_SEED
python/src/uagents/agent.py:593 — lines 593-602 — the seed string alone derives the ECDSA identity (Identity.from_seed) and the ledger wallet key (derive_key_from_seed), so a known seed is a known private key
High confidence
Recommended Action
- Remove the seed default from
values.yamland make the chart fail template rendering whenagent.seedis unset, or source it from an existing Kubernetes Secret reference rather than a chart value. - Treat the committed value as compromised: any agent ever deployed with the default must be re-seeded and any wallet funds under its derived address moved.
HIGH PRAX-2026-08-12-003 The agent inspector is enabled by default, so debug endpoints and in-memory retention of every message payload are on unless the operator opts out.
Policy Rule — R-26 (Worker Remit):
"The agent-inspector and other debug/administrative REST endpoints MUST be disabled in production."
"The agent-inspector and other debug/administrative REST endpoints MUST be disabled in production."
python/src/uagents/agent.py:305 — enable_agent_inspector: bool = True — the constructor default; lines 474-533 register /agent_info, /messages, /connect and /disconnect when it is set
python/src/uagents/agent.py:399 — lines 399-408 — EnvelopeHistory is constructed with use_cache=enable_agent_inspector, so enabling the inspector also turns on in-memory retention of every message payload
High confidence
Recommended Action
- Flip
enable_agent_inspectorto defaultFalseinAgent.__init__and require an explicit opt-in, so the production posture is the default rather than the exception. - Decouple message-history caching from the inspector flag so an operator can keep the inspector off without losing session history, and vice versa.
HIGH PRAX-2026-08-12-004 Envelope expiry and nonce are signed but never checked on receipt, so any captured signed envelope can be replayed against a handler indefinitely.
Policy Rule — R-13, R-24 (Worker Remit):
"A message sender whose identity signature does not verify is not a trusted counterparty for state-changing or privileged actions — see Action Boundaries → Never Allowed. / The agent MUST NOT act on an unsigned or signature-unverified message when performing a state-changing or privileged action."
"A message sender whose identity signature does not verify is not a trusted counterparty for state-changing or privileged actions — see Action Boundaries → Never Allowed. / The agent MUST NOT act on an unsigned or signature-unverified message when performing a state-changing or privileged action."
python/uagents-core/uagents_core/envelope.py:93 — lines 93-111 — _digest() folds expires and nonce into the signed digest, so the fields exist and are authenticated but nothing consumes them
python/src/uagents/asgi.py:379 — lines 363-385 — after env.verify() the envelope is dispatched with no expiry, nonce or session-replay check; asgi.py:390 uses expires only as a response timeout, and mailbox.py:268-287 repeats the pattern
High confidence
Recommended Action
- Reject envelopes whose
expiresis absent or in the past at the ingress point inasgi.pyandmailbox.py, beforedispatcher.dispatch_msg. - Populate
nonceon outbound envelopes inContext.send_rawand keep a bounded seen-nonce or (sender, session, nonce) set on receipt so a replayed envelope is dropped.
HIGH PRAX-2026-08-12-005 A synchronous response envelope that carries no signature skips verification entirely and is delivered to the waiting caller as a legitimate reply.
Policy Rule — R-13 (Worker Remit):
"A message sender whose identity signature does not verify is not a trusted counterparty for state-changing or privileged actions — see Action Boundaries → Never Allowed."
"A message sender whose identity signature does not verify is not a trusted counterparty for state-changing or privileged actions — see Action Boundaries → Never Allowed."
python/src/uagents/communication.py:156 — lines 156-167 — "if env.signature:" guards the verify call, so a response with signature None is passed straight to dispatch_sync_response_envelope
python/uagents-core/uagents_core/utils/messages.py:283 — lines 283-289 — send_message_to_agent parses the sync response with parse_envelope_raw and never calls env.verify() at all
High confidence
Recommended Action
- Treat a missing signature as a verification failure in
send_exchange_envelope, and require the response envelope'ssenderto equal the address that was resolved for the request. - Add the same verification to
uagents_core.utils.messages.send_message_to_agentbefore returning a parsed sync response to the caller.
HIGH PRAX-2026-08-12-006 The default inbound path applies no counterparty allowlist and no rate limit, so any agent on the open network can drive a handler at will.
Policy Rule — R-09 (Worker Remit):
"The operator-configured allowlist of authorized peer agent addresses is a closed set: any peer agent address or message sender not on that allowlist is not an authorized counterparty, and its appearance in communication or transactions is a trust-expansion finding."
"The operator-configured allowlist of authorized peer agent addresses is a closed set: any peer agent address or message sender not on that allowlist is not an authorized counterparty, and its appearance in communication or transactions is a trust-expansion finding."
python/src/uagents/agent.py:1455 — lines 1455-1491 — the handler is chosen from the schema digest and is_user_address alone; no allowlist, quota or per-sender state is consulted before invoking it
python/src/uagents/protocol/quota.py:9 — module docstring "Default: Not rate limited"; wrap() at lines 181-183 falls back to AccessControlList(default=True), and no Agent code path constructs a QuotaProtocol
High confidence
Recommended Action
- Give
Agentan optional operator-supplied peer allowlist that_process_single_messagechecks before dispatch, so the closed-counterparty model the remit assumes can be expressed without subclassing a protocol. - Apply a conservative default quota to the ingress path in
asgi.py(per sender address and per remote address), leavingQuotaProtocolfor finer per-handler policy.
HIGH PRAX-2026-08-12-007 Every handler receives an unrestricted wallet and ledger client, and the framework ships no approval hook for spending them.
Policy Rule — R-06, R-15, R-22 (Worker Remit):
"On-chain transactions — gated per Action Boundaries. / Any capability that moves value on the ledger or spends wallet funds — see Action Boundaries. / Any discretionary on-chain value transfer or spend of wallet funds — value moved to any counterparty other than the Almanac / Agentverse registration contract. The framework ships no operator authorization policy for wallet spends, so the deployment MUST supply the gating policy; its absence is a gap in the deployment, not a configurable threshold to look up."
"On-chain transactions — gated per Action Boundaries. / Any capability that moves value on the ledger or spends wallet funds — see Action Boundaries. / Any discretionary on-chain value transfer or spend of wallet funds — value moved to any counterparty other than the Almanac / Agentverse registration contract. The framework ships no operator authorization policy for wallet spends, so the deployment MUST supply the gating policy; its absence is a gap in the deployment, not a configurable threshold to look up."
python/src/uagents/agent.py:658 — lines 658-676 — wallet and ledger are public properties of the Agent, returning a LocalWallet holding the signing key and a LedgerClient able to broadcast transactions
python/src/uagents/context.py:280 — lines 280-282 — the same LedgerClient is handed to every message, interval and REST handler through Context.ledger, with no approval, threshold or audit interposition anywhere in the module
High confidence
Recommended Action
- Add an operator-supplied authorization callback to
Agentthat any value-moving path must clear, and route the registration fee through it as a pre-approved exemption so the gate has a single choke point. - Emit a distinct log record (and, once an alert path exists, an alert) whenever a transaction other than Almanac registration is broadcast from the agent's wallet.
HIGH PRAX-2026-08-12-008 Identity and wallet private keys are written to a plaintext JSON file in the working directory, and the wallet key persisted is not the one the agent uses.
Manage Your Supply Chain
LLM02 — Sensitive Information Disclosure
ASI03 — Identity and Privilege Abuse
python/src/uagents/storage/__init__.py:113 — lines 113-127 — save_private_keys writes identity_key and wallet_key as cleartext JSON to os.getcwd()/private_keys.json with no mode restriction and no encryption
python/src/uagents/storage/__init__.py:146 — lines 146-150 — wallet_key is generated at :147 and returned, but save_private_keys is called at :149 with a newly generated PrivateKey().private_key, so the stored wallet key differs from the one in use
High confidence
Recommended Action
- Create
private_keys.jsonwith owner-only permissions (os.openwith mode0o600) and support an operator-supplied key source — environment or an external secret store — as the documented default. - Fix
get_or_create_private_keysto persist the samewallet_keyit returns, and document the recovery path for agents already running on an unpersisted wallet key.
MEDIUM PRAX-2026-08-12-009 Signature verification is skipped whenever the sender address begins with the four characters "user", a claim the sender makes about itself.
Policy Rule — R-17 (Worker Remit):
"Allowed Data Sources"
"Allowed Data Sources"
python/uagents-core/uagents_core/identity.py:33 — is_user_address returns address[0:4] == "user" — an unauthenticated self-declaration, with no key material behind the prefix
python/src/uagents/asgi.py:363 — "if not is_user_address(env.sender):" gates the whole env.verify() block, so a sender that names itself user... is dispatched unverified (mailbox.py:268 is identical)
High confidence
Recommended Action
- Require a signature on every envelope and give user-address senders their own verifiable credential, rather than exempting an address class from verification by string prefix.
- Until that change lands, log every unverified dispatch with the claimed sender so the operator can see how much of their traffic is entering on the exempt path.
MEDIUM PRAX-2026-08-12-010 The runtime contacts a Fetch.ai testnet faucet automatically when registration funds run low, an outbound destination absent from the approved channel table.
Policy Rule — R-07 (Worker Remit):
"Approved Communication Channels"
"Approved Communication Channels"
python/src/uagents/network.py:45 — _faucet_api = FaucetApi(NetworkConfig.fetchai_stable_testnet()) — constructed at module import, so the client exists in every agent process
python/src/uagents/registration.py:349 — lines 349-353 — on insufficient funds the testnet path calls add_testnet_funds(wallet address), which posts a faucet claim with no operator approval
High confidence
Recommended Action
Make the faucet call opt-in through an explicit
Agent or registration-policy argument, and log the destination host when it fires so the outbound surface is visible.MEDIUM PRAX-2026-08-12-011 The core send helper reports every message it sends to Agentverse by default, disclosing counterparty addresses and session identifiers without operator opt-in.
python/uagents-core/uagents_core/utils/messages.py:195 — send_message_to_agent signature declares track_interaction: bool = True
python/uagents-core/uagents_core/utils/messages.py:254 — lines 254-263 — on each successful send, record_agent_interaction posts target, source and session_id to the Agentverse agents API under an agent attestation
Medium confidence
Recommended Action
Default
track_interaction to False and require the caller to opt in, or expose it as an AgentverseConfig setting so an operator can disable interaction reporting deployment-wide.MEDIUM PRAX-2026-08-12-012 Routine message handling and interval runs leave no log record, and what is logged is free-form text with no schema.
Policy Rule — R-32 (Worker Remit):
"Log only — do not alert — on routine signature-verified message handling and scheduled interval task runs; these events MUST leave a log record."
"Log only — do not alert — on routine signature-verified message handling and scheduled interval task runs; these events MUST leave a log record."
python/src/uagents/agent.py:1373 — lines 1373-1491 — _process_single_message logs only warnings and exceptions; a dispatched, successfully handled message writes nothing, and _run_interval at lines 97-128 logs only exceptions
python/src/uagents/utils.py:9 — lines 9-21 — get_logger attaches a uvicorn DefaultFormatter to stdout with the format "%(levelprefix)s [%(name)5s]: %(message)s" — free-form text, no structured fields
High confidence
Recommended Action
- Emit one record per handled message and per interval run in
_process_single_messageand_run_interval, carrying session, sender, schema digest and outcome. - Offer a structured (JSON-lines) formatter option in
uagents/utils.pyso those records can be shipped and queried rather than read by eye.
MEDIUM PRAX-2026-08-12-013 The framework offers no alert or halt primitive, so every escalation condition the remit declares degrades to a log line or to silence.
Policy Rule — R-28, R-29, R-30, R-31 (Worker Remit):
"Halt and alert if the agent is about to transmit or log seed / identity / wallet key material. / Halt and alert if the agent attempts a value transfer that exceeds the approval threshold or lacks operator authorization. / Alert on Almanac / Agentverse registration failure rather than silently continuing. / Alert on repeated inbound messages from senders whose signatures fail verification or who are not authorized counterparties."
"Halt and alert if the agent is about to transmit or log seed / identity / wallet key material. / Halt and alert if the agent attempts a value transfer that exceeds the approval threshold or lacks operator authorization. / Alert on Almanac / Agentverse registration failure rather than silently continuing. / Alert on repeated inbound messages from senders whose signatures fail verification or who are not authorized counterparties."
python/src/uagents/registration.py:613 — lines 613-620 — update_agent_status wraps the Almanac status POST in contextlib.suppress(Exception), so a failed status update produces no record at all
python/src/uagents/asgi.py:367 — a failed envelope verification produces a single logger.warning with no counter, no repeat detection and no escalation path; no alerting interface exists anywhere in either package
High confidence
Recommended Action
- Add an operator-registrable escalation callback (halt, alert, log) that the runtime invokes on registration failure, repeated verification failure and any wallet-affecting operation.
- Replace the blanket
contextlib.suppress(Exception)inupdate_agent_statuswith a logged failure so a silent deregistration cannot happen.
MEDIUM PRAX-2026-08-12-014 Both published distributions declare unbounded dependency floors, and no dependency, container or code scanning runs anywhere in the repository.
python/pyproject.toml:16 — lines 16-22 — dependencies declare "uagents-core (>=0.4.8)" and "cosmpy (>=0.12.1)" with no upper bound; uagents-core/pyproject.toml:17-23 does the same for ecdsa, httpx and requests
.github/workflows/ci-tests.yml:1 — the four workflows run pytest, ruff, coverage and release only — no dependency, container or code scanning job, and no dependabot.yml or renovate config exists in .github/
High confidence
Recommended Action
- Bound the runtime dependencies with upper limits (as pydantic and uvicorn already are) so a downstream install cannot silently cross a major version.
- Add a scheduled dependency-audit job (
pip-auditorosv-scanner) and publish an SBOM with each release so exposure can be assessed when a CVE lands.
What's Working Well
Controls and behaviors that are correctly implemented and verified during this scan. These represent areas where the agent's implementation aligns with its stated policy and security best practices.
Cryptographic envelope verification on by default
Every inbound envelope from an agent-prefixed sender has its ECDSA signature checked against the sender's address before dispatch, on both the HTTP and mailbox ingress paths, with no configuration required to enable it.
python/src/uagents/asgi.py:363-371
No arbitrary-code capability anywhere in the runtime
The framework holds no shell, subprocess, eval, exec or pickle call in either subject package, so the remit's forbidden-tool rule is satisfied structurally rather than by policy.
python/src/uagents (grep: subprocess|os.system|eval(|exec(|pickle — zero matches)
Security-control regression tests run on every push and pull request
The unit suite asserts that a bad signature is rejected and that a non-loopback client is refused the inspector endpoints, and CI runs it across a four-version Python matrix on push to main and on every PR.
python/tests/test_server.py:383
Dependency locks committed and enforced in CI
Both packages commit lockfiles and the CI job installs with uv sync --locked, so the tested build is reproducible even though the published distributions are not pinned.
.github/workflows/ci-tests.yml:63
Published profile payload restricted to non-sensitive fields
The Agentverse registration profile carries only description, readme, avatar and banner, and the Almanac attestation filters metadata down to geolocation, so no key material or private configuration reaches the public registry.
python/src/uagents/agent.py:537-546
Declared vulnerability disclosure policy
SECURITY.md gives a reporting address, a Critical/Non-critical classification and a coordinated-fix process, so external reports have a defined route.
SECURITY.md:1-40
Discovered Log Files
Log files found in the agent's workspace during this scan. Reviewing these files provides runtime evidence to complement the static analysis above.
| Path | Source | Content Type | Purpose | Last Modified | Status |
|---|---|---|---|---|---|
| uagents_core.log | uagents_core.logger.get_logger default FileHandler | plaintext timestamped lines | Captures uagents-core module logs (messaging helpers, resolver, registration utilities) in the process working directory | unknown | Inferred |
OWASP LLM Top 10 (2026) Coverage
Each card represents one category and shows the top 3 findings. All items in the Findings section.
LLM01
Prompt Injection
No findings
LLM02
Sensitive Information Disclosure
The agent inspector's REST endpoints are reachable by any remote or cross-origin caller because the only guard is a client IP the caller supplies.
The Helm chart ships a literal agent seed phrase as its default value, giving every unmodified deployment a publicly known identity and wallet key.
The agent inspector is enabled by default, so debug endpoints and in-memory retention of every message payload are on unless the operator opts out.
LLM03
Excessive Agency
LLM04
Supply Chain
LLM05
Data and Model Poisoning
No findings
LLM06
Unbounded Consumption
LLM07
Misinformation
No findings
LLM08
Hidden Context Exposure
No findings
LLM09
Vector and Embedding Weaknesses
No findings
LLM10
Improper Output Handling
No findings
OWASP Agentic Top 10 (2026) Coverage
Each card represents one category and shows the top 3 findings. All items in the Findings section.
ASI01
Agent Goal Hijack
No findings
ASI02
Tool Misuse and Exploitation
ASI03
Identity and Privilege Abuse
The agent inspector's REST endpoints are reachable by any remote or cross-origin caller because the only guard is a client IP the caller supplies.
The Helm chart ships a literal agent seed phrase as its default value, giving every unmodified deployment a publicly known identity and wallet key.
The agent inspector is enabled by default, so debug endpoints and in-memory retention of every message payload are on unless the operator opts out.
ASI04
Agentic Supply Chain Vulnerabilities
The runtime contacts a Fetch.ai testnet faucet automatically when registration funds run low, an outbound destination absent from the approved channel table.
Both published distributions declare unbounded dependency floors, and no dependency, container or code scanning runs anywhere in the repository.
ASI05
Unexpected Code Execution (RCE)
No findings
ASI06
Memory and Context Poisoning
No findings
ASI07
Insecure Inter-Agent Communication
Envelope expiry and nonce are signed but never checked on receipt, so any captured signed envelope can be replayed against a handler indefinitely.
A synchronous response envelope that carries no signature skips verification entirely and is delivered to the waiting caller as a legitimate reply.
The default inbound path applies no counterparty allowlist and no rate limit, so any agent on the open network can drive a handler at will.
ASI08
Cascading Failures
ASI09
Human-Agent Trust Exploitation
No findings
ASI10
Rogue Agents
No findings
RAISE Maturity Posture
Overall maturity assessment across the six categories of the RAISE framework. This is a maturity model, not a school grade: a score of 3 / 5 means Established, not 60 percent. Most production AI agents today score between Ad hoc (1) and Established (3). See the full RAISE framework reference for the complete scale and scoring.
1.55
/ 5.0
Weighted Maturity Score · Ad hoc
Ad hoc. The runtime ships one real, default-on security control — cryptographic verification of inter-agent envelopes — plus a genuine type-level dispatch lane, and that is why Domain, Knowledge Base and Zero Trust sit at Partial rather than lower; almost everything that would make those controls hold under an actual adversary is optional, absent or defeated by another default. Supply chain, red team and monitoring sit at the bottom of the scale: lockfiles are committed but the published distributions float on unbounded version floors with no SBOM and no scanner, security testing exists only as a handful of unit-test assertions with no adversarial programme behind them, and the framework emits free-form text logs with no action-level record, no alert path and no telemetry export. An operator adopting this framework inherits a reachable, unauthenticated control plane and an unmonitored wallet unless they build those controls themselves.
Limit Your Domain
2/ 5
Real code-level narrowing exists and runs by default — dispatch is closed over registered schema digests (agent.py:1390-1395), replies and interval messages are constrained to declared sets (context.py:380-392, 677-716), and the runtime holds no shell or code-execution capability at all — but the surface silently exceeds the operator's declaration through four inspector endpoints added at construction, an ungated wallet handed to every handler, and a testnet faucet call the approved-channel table never authorizes.
Balance Your Knowledge Base
2/ 5
Every inbound payload is schema-validated before it reaches a handler (agent.py:1442-1452), a systematic default-on gate on what enters agent state, but nothing labels or bounds the provenance of that content, registry-supplied addresses and endpoint URLs are consumed unvalidated (resolver.py:302-317), and enabling the inspector silently retains every message payload in memory (types.py:130-158).
Implement Zero Trust
2/ 5
ECDSA envelope verification runs on the dominant inbound path by default (asgi.py:363-371, envelope.py:76-91) and reserved endpoints carry a client check, so this is not a prompt-only or absent posture; but the control is incomplete in every direction that matters — no replay or expiry enforcement, verification skipped for self-declared user senders, unsigned sync responses accepted, the admin-endpoint guard defeated by forwarded_allow_ips, and no counterparty allowlist, rate limit or wallet-spend gate on the default path.
Manage Your Supply Chain
1/ 5
Dependency lockfiles are committed and CI installs with uv sync --locked, which is why this is not 0, but the published distributions declare unbounded floors (pyproject.toml:16-22), there is no component inventory of any kind (M10: none) and no dependency or container scanning anywhere in the repo (M11: none) — the KB's no-inventory, no-vetting rule caps the category at 1.
Build an AI Red Team
1/ 5
The maturity record is empty in every dimension that would show a programme — M2: none, M3: none, M5: none, M6: none, M8: none, M9: none, and M4 is a vulnerability-disclosure policy with no threat model — so the only surviving evidence is the project's own security-control regression assertions inside the ordinary unit suite (tests/test_server.py test_message_fail_verify, test_inspector_rest_wrong_client) running on push and PR (M7), which the provenance test caps at 1 because no finding is traced to a fix.
Monitor Continuously
1/ 5
Logging infrastructure exists and runs by default — per-component loggers, verification-failure warnings, registration and lifecycle records, and an inferred uagents_core.log file handler — but it is free-form text with no schema, carries no action-level record of messages received or handled, offers no alert path for any declared escalation condition, and M12 returned no telemetry, alert-rule or dashboard configuration anywhere in the tree.
Maturity Scoring Rubric
Every score above is based on this scale. A score is a snapshot of observable posture — not a verdict on the people or team behind the system.
| Score | Label | Meaning |
|---|---|---|
| 5 | Exemplary | Best-in-class; automated, continuously tested, reference quality. Rarely achieved in shipping systems. |
| 4 | Strong | Comprehensive controls, active management, minor gaps. Production-ready. |
| 3 | Established | Documented controls consistently applied; known gaps accepted. A respectable baseline. |
| 2 | Partial | Some controls exist but coverage is incomplete; key gaps remain. |
| 1 | Ad hoc | Informal or inconsistent measures; relies on individual judgment. |
| 0 | Absent | No evidence this category is addressed at all. |
Weighting: the weighted overall above is the sum of each category's score × weight (the per-category weights are shown on each card). Zero Trust carries double weight by design; see the RAISE framework reference for the rationale.