Taint Flow Analysis Report
Taint analysis traces untrusted data (user input, external sources) through the call graph
to dangerous operations (SQL queries, command execution, buffer copies). Each flow represents
a potential vulnerability where unsanitized input reaches a security-sensitive sink.
36
Total Flows
2
Unique CWEs
4
Source→Sink Patterns
CWE Breakdown
| CWE | Count | Name | Remediation |
|---|---|---|---|
| CWE-22: Path Traversal → findings | 33 | Path Traversal | - |
| CWE-78: OS Command Injection → findings | 3 | OS Command Injection | Use subprocess with explicit argument lists instead of shell=True. Never pass user input to os.system() or exec(). |
Taint Flows
| # | Source | Sink | CWE | Call Chain |
|---|---|---|---|---|
| 1 | read in createHostEditOperations src/agents/agent-tools.read.ts:1011 |
open in createHostEditOperations src/agents/agent-tools.read.ts:1029 |
CWE-22: Path Traversal | createHostEditOperations |
| 2 | read in load_payload skills/model-usage/scripts/model_usage.py:53 |
open in load_payload skills/model-usage/scripts/model_usage.py:55 |
CWE-22: Path Traversal | load_payload |
| 3 | read in transcodeAudioBuffer src/media/audio-transcode.ts:152 |
open in beginSpeakerTurn extensions/discord/src/voice/realtime.ts:634 |
CWE-22: Path Traversal | transcodeAudioBuffer → runAfconvert → spawn → spawnSubagentDirect → buildSubagentInitialUserMessage → join → joinUnlocked → handleSpeakingStart → beginSpeakerTurn |
| 4 | read in createHostWriteOperations src/agents/agent-tools.read.ts:981 |
open in beginSpeakerTurn extensions/discord/src/voice/realtime.ts:634 |
CWE-22: Path Traversal | createHostWriteOperations → writeWorkspaceFile → toCanonicalRelativeWorkspacePath → join → joinUnlocked → handleSpeakingStart → beginSpeakerTurn |
| 5 | read in readLogSlice src/logging/log-tail.ts:117 |
open in beginSpeakerTurn extensions/discord/src/voice/realtime.ts:634 |
CWE-22: Path Traversal | readLogSlice → stat → assertLocalPathSafety → join → joinUnlocked → handleSpeakingStart → beginSpeakerTurn |
| 6 | read in readBoundedResponseText scripts/pre-commit/pnpm-audit-prod.mjs:745 |
open in beginSpeakerTurn extensions/discord/src/voice/realtime.ts:634 |
CWE-22: Path Traversal | readBoundedResponseText → join → joinUnlocked → handleSpeakingStart → beginSpeakerTurn |
| 7 | read in runProof test/proof/thinking-signature-real-proof.ts:298 |
open in beginSpeakerTurn extensions/discord/src/voice/realtime.ts:634 |
CWE-22: Path Traversal | runProof → parse → assertAllowedKeys → join → joinUnlocked → handleSpeakingStart → beginSpeakerTurn |
| 8 | read in streamProxy src/agents/runtime/proxy.ts:217 |
open in beginSpeakerTurn extensions/discord/src/voice/realtime.ts:634 |
CWE-22: Path Traversal | streamProxy → parse → assertAllowedKeys → join → joinUnlocked → handleSpeakingStart → beginSpeakerTurn |
| 9 | read in runSingleCheck scripts/run-additional-boundary-checks.mjs:289 |
open in beginSpeakerTurn extensions/discord/src/voice/realtime.ts:634 |
CWE-22: Path Traversal | runSingleCheck → createBoundedOutputBuffer → join → joinUnlocked → handleSpeakingStart → beginSpeakerTurn |
| 10 | read in readTranscriptLeafInfo src/config/sessions/transcript-append.ts:80 |
open in beginSpeakerTurn extensions/discord/src/voice/realtime.ts:634 |
CWE-22: Path Traversal | readTranscriptLeafInfo → lineParentLinkedEntryId → parse → assertAllowedKeys → join → joinUnlocked → handleSpeakingStart → beginSpeakerTurn |
| 11 | read in buildManagedResponse src/agents/provider-transport-fetch.ts:345 |
open in beginSpeakerTurn extensions/discord/src/voice/realtime.ts:634 |
CWE-22: Path Traversal | buildManagedResponse → finalize → join → joinUnlocked → handleSpeakingStart → beginSpeakerTurn |
| 12 | read in runCrestodianRescueMessage src/crestodian/rescue-message.ts:175 |
exec in getTailnetHostname src/infra/tailscale.ts:123 |
CWE-78: OS Command Injection | runCrestodianRescueMessage → executeCrestodianOperation → statusCommand → scanStatus → collectStatusScanOverview → getTailnetHostname |
| 13 | read in runCrestodianRescueMessage src/crestodian/rescue-message.ts:175 |
open in beginSpeakerTurn extensions/discord/src/voice/realtime.ts:634 |
CWE-22: Path Traversal | runCrestodianRescueMessage → executeCrestodianOperation → join → joinUnlocked → handleSpeakingStart → beginSpeakerTurn |
| 14 | read in transcodeToWhatsAppVoiceOpus extensions/whatsapp/src/outbound-media-contract.ts:249 |
open in beginSpeakerTurn extensions/discord/src/voice/realtime.ts:634 |
CWE-22: Path Traversal | transcodeToWhatsAppVoiceOpus → withTempWorkspace → join → joinUnlocked → handleSpeakingStart → beginSpeakerTurn |
| 15 | read in renderLazyView ui/src/ui/lazy-view.ts:78 |
open in beginSpeakerTurn extensions/discord/src/voice/realtime.ts:634 |
CWE-22: Path Traversal | renderLazyView → render → renderApp → renderSkills → join → joinUnlocked → handleSpeakingStart → beginSpeakerTurn |
| 16 | read in createHostEditOperations src/agents/agent-tools.read.ts:1011 |
open in beginSpeakerTurn extensions/discord/src/voice/realtime.ts:634 |
CWE-22: Path Traversal | createHostEditOperations → writeWorkspaceFile → toCanonicalRelativeWorkspacePath → join → joinUnlocked → handleSpeakingStart → beginSpeakerTurn |
| 17 | read in readLastMessagePreviewFromOpenTranscriptAsync src/gateway/session-utils.fs.ts:1118 |
open in beginSpeakerTurn extensions/discord/src/voice/realtime.ts:634 |
CWE-22: Path Traversal | readLastMessagePreviewFromOpenTranscriptAsync → parse → assertAllowedKeys → join → joinUnlocked → handleSpeakingStart → beginSpeakerTurn |
| 18 | read in readResponseBodyText extensions/openai/image-generation-provider.ts:421 |
open in beginSpeakerTurn extensions/discord/src/voice/realtime.ts:634 |
CWE-22: Path Traversal | readResponseBodyText → join → joinUnlocked → handleSpeakingStart → beginSpeakerTurn |
| 19 | read in readSseEvent src/gateway/sessions-history-http.test.ts:191 |
open in beginSpeakerTurn extensions/discord/src/voice/realtime.ts:634 |
CWE-22: Path Traversal | readSseEvent → join → joinUnlocked → handleSpeakingStart → beginSpeakerTurn |
| 20 | read in buildGuardedModelFetch src/agents/provider-transport-fetch.ts:541 |
open in beginSpeakerTurn extensions/discord/src/voice/realtime.ts:634 |
CWE-22: Path Traversal | buildGuardedModelFetch → join → joinUnlocked → handleSpeakingStart → beginSpeakerTurn |
| 21 | read in resolveReply src/crestodian/tui-backend.ts:290 |
open in beginSpeakerTurn extensions/discord/src/voice/realtime.ts:634 |
CWE-22: Path Traversal | resolveReply → join → joinUnlocked → handleSpeakingStart → beginSpeakerTurn |
| 22 | read in resolveReply src/crestodian/tui-backend.ts:290 |
exec in getTailnetHostname src/infra/tailscale.ts:123 |
CWE-78: OS Command Injection | resolveReply → executeCrestodianOperation → statusCommand → scanStatus → collectStatusScanOverview → getTailnetHostname |
| 23 | read in readLastNonzeroUsageFromSessionLog src/auto-reply/reply/agent-runner-memory.ts:521 |
open in beginSpeakerTurn extensions/discord/src/voice/realtime.ts:634 |
CWE-22: Path Traversal | readLastNonzeroUsageFromSessionLog → estimatePostUsageTrailingBytes → join → joinUnlocked → handleSpeakingStart → beginSpeakerTurn |
| 24 | read in readResponseText src/agents/tools/web-shared.ts:236 |
exec in sh scripts/e2e/parallels/guest-transports.ts:368 |
CWE-78: OS Command Injection | readResponseText → decodeResponseBytes → sniffCharset → exec → run → resolveDesktopHome → run → resolveHostIp → sh |
| 25 | read in computeFileSha256 extensions/file-transfer/src/tools/dir-fetch-tool.ts:157 |
open in beginSpeakerTurn extensions/discord/src/voice/realtime.ts:634 |
CWE-22: Path Traversal | computeFileSha256 → digest → stableStringify → join → joinUnlocked → handleSpeakingStart → beginSpeakerTurn |
| 26 | read in downloadAndSaveTelegramFile extensions/telegram/src/bot/delivery.resolve-media.ts:212 |
open in writeMediaStreamToFile src/media/store.ts:403 |
CWE-22: Path Traversal | downloadAndSaveTelegramFile → saveRemoteMedia → saveRemoteMediaOnce → saveOkMediaResponse → saveMediaStream → writeMediaStreamToFile |
| 27 | read in handleControlUiAssistantMediaRequest src/gateway/control-ui.ts:593 |
open in resolveMediaBufferPath src/media/store.ts:656 |
CWE-22: Path Traversal | handleControlUiAssistantMediaRequest → assertLocalMediaAllowed → resolveInboundMediaReference → resolveInboundMediaPath → resolveMediaBufferPath |
| 28 | accept in requestJsonlSocket src/infra/jsonl-socket.ts:53 |
open in beginSpeakerTurn extensions/discord/src/voice/realtime.ts:634 |
CWE-22: Path Traversal | requestJsonlSocket → parse → assertAllowedKeys → join → joinUnlocked → handleSpeakingStart → beginSpeakerTurn |
| 29 | read in transcodeToFeishuVoiceOpus extensions/feishu/src/media.ts:969 |
open in beginSpeakerTurn extensions/discord/src/voice/realtime.ts:634 |
CWE-22: Path Traversal | transcodeToFeishuVoiceOpus → withTempWorkspace → join → joinUnlocked → handleSpeakingStart → beginSpeakerTurn |
| 30 | accept in attachWebInboxToSocket extensions/whatsapp/src/inbound/monitor.ts:789 |
open in writeMediaStreamToFile src/media/store.ts:403 |
CWE-22: Path Traversal | attachWebInboxToSocket → downloadInboundMedia → saveMediaStream → writeMediaStreamToFile |
| 31 | read in transcodeAudioBufferToOpus src/media/audio-transcode.ts:98 |
open in beginSpeakerTurn extensions/discord/src/voice/realtime.ts:634 |
CWE-22: Path Traversal | transcodeAudioBufferToOpus → withTempWorkspace → join → joinUnlocked → handleSpeakingStart → beginSpeakerTurn |
| 32 | read in register extensions/voice-call/index.ts:511 |
open in beginSpeakerTurn extensions/discord/src/voice/realtime.ts:634 |
CWE-22: Path Traversal | register → join → joinUnlocked → handleSpeakingStart → beginSpeakerTurn |
| 33 | accept in handleCall extensions/voice-call/src/webhook/realtime-handler.ts:861 |
open in beginSpeakerTurn extensions/discord/src/voice/realtime.ts:634 |
CWE-22: Path Traversal | handleCall → scheduleForcedAgentConsult → runForcedAgentConsult → buildForcedConsultSpeechPrompt → join → joinUnlocked → handleSpeakingStart → beginSpeakerTurn |
| 34 | read in readTailLines src/commands/channels/logs.ts:81 |
open in beginSpeakerTurn extensions/discord/src/voice/realtime.ts:634 |
CWE-22: Path Traversal | readTailLines → stat → assertLocalPathSafety → join → joinUnlocked → handleSpeakingStart → beginSpeakerTurn |
| 35 | getenv in collectMacLaunchctlGatewayEnvOverrideWarning src/commands/doctor-platform-notes.ts:128 |
open in beginSpeakerTurn extensions/discord/src/voice/realtime.ts:634 |
CWE-22: Path Traversal | collectMacLaunchctlGatewayEnvOverrideWarning → join → joinUnlocked → handleSpeakingStart → beginSpeakerTurn |
| 36 | read in readScannableText scripts/audit-seams.mjs:63 |
open in beginSpeakerTurn extensions/discord/src/voice/realtime.ts:634 |
CWE-22: Path Traversal | readScannableText → stat → assertLocalPathSafety → join → joinUnlocked → handleSpeakingStart → beginSpeakerTurn |