security: redact secrets from execute_code output and all tool results

[0xbyt4]

Summary

Multiple secret exfiltration vectors where API keys and tokens from .env could leak into LLM context or persistent storage, bypassing existing redaction.

Vulnerabilities Fixed

1. execute_code (PTC) — raw stdout returned without redaction

execute_code runs Python scripts and returns stdout to LLM context. No redaction was applied:

import os; print(os.environ["ANTHROPIC_API_KEY"])

This bypasses terminal_tool's redaction entirely.

Fix: Apply redact_sensitive_text to stdout and stderr in code_execution_tool.py.

2. All tool results — no defense-in-depth redaction

Only terminal_tool and file_tools had redaction. Browser, MCP, vision, delegate, and all other tools returned raw output to LLM context.

Fix: Add redact_sensitive_text to both sequential and concurrent tool result paths in run_agent.py — catches any tool that doesn't redact internally.

3. Memory persistence — secrets writable to memory files

Memory entries are injected into the system prompt on every session. A prompt injection that saves ANTHROPIC_API_KEY=sk-ant-... to memory would exfiltrate it across all future sessions.

Fix: Add API key and KEY=value pattern scanning to _scan_memory_content in memory_tool.py.

4. Skill persistence — secrets writable to skill files

Skill files are loaded into context when referenced. Same exfiltration vector as memory.

Fix: Add _scan_skill_for_secrets to skill_manage — blocks create, edit, patch, and write_file actions containing secrets.

What was vulnerable

Vector	Had protection?	Fix
terminal_tool output	Yes (existing)	—
file_tools read	Yes (existing)	—
execute_code stdout	No	redact_sensitive_text on stdout/stderr
All tool results → LLM	No	defense-in-depth in run_agent.py
Memory persistence	No	secret pattern scanning
Skill persistence	No	secret pattern scanning

Test plan

• 48 redaction tests passing (38 existing + 10 new)
• execute_code: env var, OpenRouter key, multi-key dump, non-secret passthrough
• memory: blocks API key, blocks env assignment, allows normal content
• skill: blocks API key, blocks env assignment, allows normal content

[jeremyjh]

Pattern matching is not enough. It is not possible to know the pattern of every secret value and the KEY=VALUE pattern is already defeated in the sample I shared.