HKUDS/nanobot agent hook skill
agent framework
nanobot is a self-hosted Python AI agent framework that runs in a browser WebUI, terminal, or chat applications. It combines tools (file operations, shell, web search, image generation), long-term memory, MCP integrations, model routing, multi-agent delegation, and scheduled automation in a compact, readable codebase with an OpenAI-compatible API.
Deploy as a personal AI agent gateway on your local machine or server with WebUI and terminal interfaces Connect to Telegram, Discord, Slack, WeChat, Email, Mattermost, and other chat apps for multi-channel access Run scheduled automations and long-horizon goals with persistent memory and session history Integrate with multiple LLM providers and local models using OpenAI-compatible APIs or MCP Extend with custom tools, subagents, and workflows through Python SDK or API ⚠ REVIEW
Risk score 60/100
20 HIGH✓ 39 MEDIUM 6 LOW 2 INFO
✓ CRITICAL/HIGH reflect AI-verified findings (false positives excluded) · MEDIUM/LOW/INFO are unverified scanner output
AI-verified (CRITICAL/HIGH): 20 likely real (100%) 6 false positive — excluded from CRITICAL/HIGH count above
Findings by checker · 4 high-signal, 2 mostly false-positive (hidden by default)
CHK-129 11 findings 9 likely 2 false positive
18% FP CHK-099 7 findings 7 likely
0% FP CHK-047 5 findings 3 likely 2 false positive
40% FP CHK-103 1 finding 1 likely
0% FP ▼ Show 2 checkers that are mostly false positives (2 findings) 67 findings click to expand
CHK-047 Potential SSRF — user-controlled URL passed to HTTP client in nanobot/channels/feishu.py
nanobot/channels/feishu.py
AI: likely real likely ▼
CHK-047 Potential SSRF — user-controlled URL passed to HTTP client in nanobot/webui/settings_api.py
nanobot/webui/settings_api.py
AI: likely real likely ▼
CHK-047 Potential SSRF — user-controlled URL passed to HTTP client in nanobot/apps/cli/service.py
nanobot/apps/cli/service.py
AI: likely real likely ▼
CHK-099 Potential IDOR — 'message_id' accessed without ownership check
nanobot/agent/tools/message.py
AI: likely real possible ▼
CHK-099 Potential IDOR — 'account_id' accessed without ownership check
nanobot/webui/settings_api.py
AI: likely real possible ▼
CHK-099 Potential IDOR — 'message_id' accessed without ownership check
nanobot/agent/loop.py
AI: likely real possible ▼
CHK-099 Potential IDOR — 'message_id' accessed without ownership check
nanobot/channels/whatsapp.py
AI: likely real possible ▼
CHK-099 Potential IDOR — 'message_id' accessed without ownership check
nanobot/channels/telegram.py
AI: likely real possible ▼
CHK-099 Potential IDOR — 'thread_id' accessed without ownership check
nanobot/channels/discord.py
AI: likely real possible ▼
CHK-099 Potential IDOR — 'user_id' accessed without ownership check
nanobot/channels/mattermost.py
AI: likely real possible ▼
CHK-103 Destructive operation without authorization check
nanobot/channels/mattermost.py
AI: likely real possible ▼
CHK-129 Sensitive field in return type/schema — api_key: str
nanobot/audio/transcription.py
AI: likely real likely ▼
CHK-129 Sensitive field in return type/schema — api_key: str
nanobot/audio/transcription_registry.py
AI: likely real likely ▼
CHK-129 Sensitive field in return type/schema — "token"
nanobot/webui/gateway_tokens.py
AI: likely real likely ▼
CHK-129 Sensitive field in return type/schema — token: str
nanobot/channels/telegram.py
AI: likely real likely ▼
CHK-129 Sensitive field in return type/schema — token: str
nanobot/channels/discord.py
AI: likely real likely ▼
CHK-129 Sensitive field in return type/schema — password: str
nanobot/channels/email.py
AI: likely real likely ▼
CHK-129 Sensitive field in return type/schema — token: str
webui/src/providers/ClientProvider.tsx
AI: likely real likely ▼
CHK-129 Sensitive field in return type/schema — token: str
webui/src/components/FilePreviewPanel.tsx
AI: likely real likely ▼
CHK-129 Sensitive field in return type/schema — token: str
webui/src/components/thread/SessionInfoPopover.tsx
AI: likely real likely ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in gateway/service.py
nanobot/gateway/service.py
possible ▼
CHK-125a os.unlink() — file deletion — no scope constraint in channels/msteams.py
nanobot/channels/msteams.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in tools/shell.py
nanobot/agent/tools/shell.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in tools/cli_apps.py
nanobot/agent/tools/cli_apps.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in cli/service.py
nanobot/apps/cli/service.py
possible ▼
CHK-125a shutil.rmtree() — recursive directory deletion — no scope constraint in cli/service.py
nanobot/apps/cli/service.py
possible ▼
CHK-125b sudo invocation — privilege escalation — no scope constraint in workflows/ci.yml
.github/workflows/ci.yml
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in components/MarkdownTextRenderer.tsx
webui/src/components/MarkdownTextRenderer.tsx
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in components/CliAppMentionText.tsx
webui/src/components/CliAppMentionText.tsx
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in settings/SettingsView.tsx
webui/src/components/settings/SettingsView.tsx
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in thread/AgentActivityCluster.tsx
webui/src/components/thread/AgentActivityCluster.tsx
possible ▼
CHK-125b sudo invocation — privilege escalation — no scope constraint in SECURITY.md
SECURITY.md
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in nanobot/optional_features.py
nanobot/optional_features.py
possible ▼
CHK-125a shutil.rmtree() — recursive directory deletion — no scope constraint in utils/helpers.py
nanobot/utils/helpers.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in cli/gateway.py
nanobot/cli/gateway.py
possible ▼
CHK-125a shutil.rmtree() — recursive directory deletion — no scope constraint in webui/transcript.py
nanobot/webui/transcript.py
possible ▼
CHK-125a shutil.rmtree() — recursive directory deletion — no scope constraint in webui/mcp_presets_api.py
nanobot/webui/mcp_presets_api.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in command/builtin.py
nanobot/command/builtin.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in gateway/runtime.py
nanobot/gateway/runtime.py
possible ▼
CHK-027 Outbound network call in skill — external network call (verify direction — could be benign API fetch)
nanobot/skills/weather/SKILL.md
possible ▼
CHK-036 [GHSA-4xgf-cpjx-pc3j] pydantic-settings 2.12.0 — see advisory: GHSA-4xgf-cpjx-pc3j
possible ▼
CHK-036 [GHSA-4jhm-jv67-739f] lxml-html-clean 0.4.0 — see advisory: GHSA-4jhm-jv67-739f
possible ▼
CHK-036 [GHSA-hw26-mmpg-fqfg] lxml-html-clean 0.4.0 — see advisory: GHSA-hw26-mmpg-fqfg
possible ▼
CHK-036 [GHSA-xvp8-3mhv-424c] lxml-html-clean 0.4.0 — see advisory: GHSA-xvp8-3mhv-424c
possible ▼
CHK-036 [GHSA-cpwx-vrp4-4pq7] jinja2 3.1.0 — see advisory: GHSA-cpwx-vrp4-4pq7
possible ▼
CHK-036 [GHSA-gmj6-6f8f-6699] jinja2 3.1.0 — see advisory: GHSA-gmj6-6f8f-6699
possible ▼
CHK-036 [GHSA-h5c8-rqwp-cp95] jinja2 3.1.0 — see advisory: GHSA-h5c8-rqwp-cp95
possible ▼
CHK-036 [GHSA-h75v-3vvj-5mfj] jinja2 3.1.0 — see advisory: GHSA-h75v-3vvj-5mfj
possible ▼
CHK-036 [GHSA-q2x7-8rv6-6q7h] jinja2 3.1.0 — see advisory: GHSA-q2x7-8rv6-6q7h
possible ▼
CHK-036 [PYSEC-2026-1471] jinja2 3.1.0 — see advisory: PYSEC-2026-1471
possible ▼
CHK-036 [PYSEC-2026-1472] jinja2 3.1.0 — see advisory: PYSEC-2026-1472
possible ▼
CHK-036 [PYSEC-2026-1473] jinja2 3.1.0 — see advisory: PYSEC-2026-1473
possible ▼
CHK-036 [PYSEC-2026-1474] jinja2 3.1.0 — see advisory: PYSEC-2026-1474
possible ▼
CHK-036 [PYSEC-2026-1475] jinja2 3.1.0 — see advisory: PYSEC-2026-1475
possible ▼
CHK-036 [GHSA-897w-fcg9-f6xj] dulwich 0.22.0 — see advisory: GHSA-897w-fcg9-f6xj
possible ▼
CHK-036 [GHSA-xrvj-v92f-53gj] dulwich 0.22.0 — see advisory: GHSA-xrvj-v92f-53gj
possible ▼
CHK-125b chown — ownership change — no scope constraint in Dockerfile
Dockerfile
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in hatch_build.py
hatch_build.py
possible ▼
CHK-125b sudo invocation — privilege escalation — no scope constraint in entrypoint.sh
entrypoint.sh
possible ▼
CHK-025 Hardcoded endpoint in skill: https://summarize.sh
nanobot/skills/summarize/SKILL.md
possible ▼
CHK-025 Hardcoded endpoint in skill: https://clawhub.ai
nanobot/skills/clawhub/SKILL.md
possible ▼
CHK-032 Agent 'AGENTS' has no explicit 'cannot do' boundary
AGENTS.md
possible ▼
CHK-125c urllib.request — unconstrained HTTP — no scope constraint in security/network.py
nanobot/security/network.py
possible ▼
CHK-025 Hardcoded endpoint in skill: https://wttr.in/:help
nanobot/skills/weather/SKILL.md
possible ▼
CHK-025 Hardcoded endpoint in skill: https://open-meteo.com/en/docs
nanobot/skills/weather/SKILL.md
possible ▼
CHK-133 Real secret in example output block — Password value in example output [low-entropy — likely placeholder, verify manually]
docs/guides/email-ai-agent.md
possible ▼
CHK-133 Real secret in example output block — Password value in example output [low-entropy — likely placeholder, verify manually]
docs/chat-apps.md
possible ▼
▼ Show 6 false positives (8% of this view) Last scanned: Jul 11, 2026
More servers
google-gemini/gemini-cli 85
An open-source AI agent that brings the power of Gemini directly into your terminal.
106k★
skypilot-org/skypilot 85
obra/superpowers 85
Foundational skill pack by Jesse Vincent now in anthropics/claude-plugins-official. Includes ffuf web-fuzzing/pentest skill. Partial analysis done — full hook and plugin inspection pending. tier=T2
191k★
Significant-Gravitas/AutoGPT 85
AutoGPT is the vision of accessible AI for everyone, to use and to build on. Our mission is to provide the tools, so that you can focus on what matters.
186k★
nanocoai/nanoclaw 85
A lightweight alternative to OpenClaw that runs in containers for security. Connects to WhatsApp, Telegram, Slack, Discord, Gmail and other messaging apps,, has memory, scheduled jobs, and runs directly on Anthropic's Agents SDK
30k★
google-gemini/gemini-cli 85
An open-source AI agent that brings the power of Gemini directly into your terminal.
106k★
Scan your entire org's MCP deployment
2,500+ repos pre-scored. 22% carry CRITICAL findings.