Agent/MCP Audit Sprint

Public AI agent scan brief

huggingface/smolagents AI agent security scan

Partial no-execution triage for the public smolagents repo. This is a heuristic scan of 90 selected public text files, not a commissioned audit, vulnerability disclosure, or security certification. These are not confirmed vulnerabilities.

Repohuggingface/smolagents
Score62/100 heuristic
Snapshot90 selected public text files
Signals1 high / 2 medium / 0 low

Top findings

Code-thinking agents need sandbox and secret handling checks

The scan snapshot saw 27,935 stars and review signals around credentials, async or remote examples, and write-capable browser or code paths. A paid review would validate sandbox defaults, tool permissions, provider tokens, and documentation-to-runtime gaps.

HighCredential signals detected without redaction signals.
MedRemote listener needs explicit exposure policy.
MedWrite actions should have confirmation and test coverage.

Evidence slice

Files that triggered review signals

Credential and workflow signals appeared near `.github/workflows/build_documentation.yml`, `.github/workflows/trufflehog.yml`, `docs/source/en/examples/web_browser.md`, `docs/source/en/tutorials/inspect_runs.md`, and `docs/source/en/tutorials/memory.md`.

Remote and write-action signals appeared in async-agent, secure-code-execution, memory, web-browser, and localized inspect-runs documentation paths.

Confirm sandbox defaults for code execution, browser actions, and filesystem access.
Validate token, key, and memory redaction across traces, docs, and runtime logs.
Test write actions and remote examples against realistic attacker-controlled prompts.

Paid handoff

Convert this scan into a fixed-scope review

  1. Confirm the current agent, code-execution, and browser tool surfaces in scope.
  2. Review sandbox, network, token, memory, and trace boundaries for agent runs.
  3. Validate redaction, approval, remote runtime, and write-action regression tests.
  4. Pay USD $1,000 only after written scope acceptance.