diff --git a/.mcp.json b/.mcp.json new file mode 100644 index 00000000000..70bce79cb57 --- /dev/null +++ b/.mcp.json @@ -0,0 +1,8 @@ +{ + "mcpServers": { + "robinhood-trading": { + "type": "http", + "url": "https://agent.robinhood.com/mcp/trading" + } + } +} diff --git a/.notify-hunter22.md b/.notify-hunter22.md new file mode 100644 index 00000000000..3f156f5f899 --- /dev/null +++ b/.notify-hunter22.md @@ -0,0 +1,7 @@ +**1 real bounty match** (scanned 25, rest were shilling / tweet-threads / video / on-chain deploys — dropped). + +**Veilo mainnet smart-contract audit** — $2,000 · Superteam +Find a critical fund-loss vuln in Veilo's Solana program, ship a reproducible PoC + written report with fix. No live funds moved — pure audit + writeup, exactly the vuln-scan work already demonstrated. Deadline 2026-08-20 (~3 weeks). +https://superteam.fun/earn/listing/veilo-bounty + +Discovery only — not claimed or submitted. diff --git a/.pending-notify-veilo.md b/.pending-notify-veilo.md new file mode 100644 index 00000000000..42c21b0135a --- /dev/null +++ b/.pending-notify-veilo.md @@ -0,0 +1,7 @@ +*Vuln Scanner — VeiloSolana/privacy-program* + +Clean audit. ~10 candidates reviewed across 5 deep passes, 0 confirmed exploitable. + +Tornado-style ZK privacy pool (Solana/Anchor, ~14.5k LoC). Full-surface manual review vs the repo's own AUDIT.md invariants: Groth16 public-input binding, Merkle/nullifier double-spend, account/authority validation, and swap/positions/phoenix/perps/predictions CPI value-accounting — all held. Note amounts are bound to measured token flow + the proof; nullifiers use plain-init markers; relayers whitelist-bound to ext_data. The only observations are documented trust-model items (swap_data not proof-bound = bounded relayer MEV) or defense-in-depth suggestions defended by the circuit — nothing to disclose. + +Scanners: semgrep=ok (0), trufflehog=ok (0 verified), osv=ok (8 transitive/informational crate advisories, not routable). Report: output/articles/vuln-scan-2026-07-31-veilo-privacy-program.md diff --git a/.pending-notify-vuln.md b/.pending-notify-vuln.md new file mode 100644 index 00000000000..27dca4bf149 --- /dev/null +++ b/.pending-notify-vuln.md @@ -0,0 +1,3 @@ +*Vuln Scanner — rainbow-me/rainbow* +Clean code audit. semgrep 0 findings (2,510 files) and 0 verified secrets (filesystem + git history). The 313 osv dependency CVEs are all public and transitive-only (every crypto primitive — secp256k1, pbkdf2, elliptic, sha.js — is a transitive dep, not directly bumpable) in a repo that already runs Dependabot, so nothing routes to a disclosure channel; the public-PR path is fork-403-blocked regardless. +Scanners: semgrep=ok, trufflehog=ok, osv=ok. diff --git a/.pvr-payload.json b/.pvr-payload.json new file mode 100644 index 00000000000..ab46dbf5b29 --- /dev/null +++ b/.pvr-payload.json @@ -0,0 +1 @@ +{"summary": "Path traversal in docs:save-new IPC handler \u2014 unsanitized filename escapes the default save directory (arbitrary file write)", "description": "## Summary\n\nThe `docs:save-new` IPC handler in the Docs app writes a renderer-supplied\nfilename into the default save directory with `path.join(dir, name)` and **no\npath confinement**, so a filename containing `..` segments (or an absolute path)\nescapes the intended directory. Because this is the *silent* first-save path\n(no save dialog, no user confirmation), a renderer that supplies a traversal\nname causes fully attacker-controlled bytes to be written to an\nattacker-chosen location.\n\nThis is a **defense-in-depth / trust-boundary** finding: the app's current\nrenderer code always sanitizes the name before calling this channel, so it is\n**not** triggerable by merely opening a malicious document or via the AI agent.\nThe impact requires the renderer to be compromised first (e.g. a script-execution\nbug in the local SPA). I'm reporting it because the app's own hardening model\n(`contextIsolation: true`, `sandbox: true`, \"renderers reach main only through\ntyped, validated IPC\") is explicitly designed to *contain* a compromised\nrenderer \u2014 and this handler hands that renderer an arbitrary-path, arbitrary-\ncontent file-write primitive, which is exactly what the sandbox is meant to\nprevent. The sibling write handlers already validate; this one is the outlier.\n\n## Location\n\n`apps/docs/src/main/docs-main.ts`\n\n- `docs:save-new` handler \u2014 builds the target with `uniquePathIn(defaultSaveDir(), defaultName)` where `defaultName` is the untrusted IPC argument.\n- `uniquePathIn(dir, fileName)` \u2014 `let candidate = join(dir, fileName)` with no\n `..` / absolute-path / containment check.\n\nReached from preload `saveDocxNew` \u2192 `ipcRenderer.invoke('docs:save-new', defaultName, data)`.\n\n## Why the silent path specifically\n\n- `docs:save-as` passes its `defaultName` into the OS **save dialog** as\n `defaultPath`; the user sees and confirms the final location, so a traversal\n string is harmless there.\n- The Slides equivalent runs the draft name through `sanitizeDraftBaseName`\n **in the main process** before writing.\n- `docs:save-new` is the only write path that is both **silent** (no dialog)\n and **does not re-validate** the name in main \u2014 the two properties that make\n the missing check matter.\n\n## Impact\n\nA compromised/misbehaving renderer can invoke `saveDocxNew` with, e.g.,\n`\"../../../..//.config/autostart/x.desktop\"` (Linux),\n`\"..\\\\..\\\\..\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\\\\x.bat\"`\n(Windows), or any path traversing out of the default folder. `data` is an\narbitrary `ArrayBuffer` (not constrained to valid `.docx`), so both the path and\nthe file contents are fully attacker-controlled \u2014 an arbitrary file-write\nprimitive that can lead to persistence or code execution. Severity is kept\n**low** because it depends on a prior renderer-compromise precondition and is\nnot reachable from untrusted document content in the shipping code paths.\n\n## Suggested fix\n\nConfine the target to the default directory in the main process, mirroring the\nsibling handlers \u2014 validate the resolved path stays inside `defaultSaveDir()`\nand/or reduce the name to its basename before joining. For example, reject any\nname where `path.basename(name) !== name`, or assert\n`resolve(dir, name)` starts with `resolve(dir) + sep` before writing. Applying\nthe same `sanitize*BaseName` used by Slides/Docs-renderer inside the handler\nwould also close it.\n\n## Detected by\n\nManual security review (audit of main-process IPC file sinks). Semgrep OSS /\nTruffleHog runs on this repo were clean; this finding is logic-level and not\nflagged by those rule sets.\n", "severity": "low", "cwe_ids": ["CWE-22"], "vulnerabilities": [{"package": {"ecosystem": "npm", "name": "genoffice"}}]} \ No newline at end of file diff --git a/.seen-filter.jq b/.seen-filter.jq new file mode 100644 index 00000000000..8947144f019 --- /dev/null +++ b/.seen-filter.jq @@ -0,0 +1 @@ +.matches | map({id: .id, title: .title, reward: .rewardUsd, seen_at: $now}) diff --git a/.vuln-probe.sh b/.vuln-probe.sh new file mode 100644 index 00000000000..cdd82943a91 --- /dev/null +++ b/.vuln-probe.sh @@ -0,0 +1,12 @@ +#!/usr/bin/env bash +PATH="/tmp/bin:$PATH"; export PATH +echo "=== bin ===" +ls -la /tmp/bin 2>/dev/null || echo "no /tmp/bin" +echo "=== versions ===" +for t in semgrep trufflehog osv-scanner slither; do + if command -v "$t" >/dev/null 2>&1; then + echo "$t=OK $(command -v "$t")" + else + echo "$t=MISSING" + fi +done diff --git a/STRATEGY.md b/STRATEGY.md index e6e2be722f6..499a275118d 100644 --- a/STRATEGY.md +++ b/STRATEGY.md @@ -1,49 +1,35 @@ # Strategy -Aeon's north-star. Every skill reads this — it's imported into `CLAUDE.md`, so it -sits in context on **every** run. Skills should align their output to it: what to -work on, what to prioritise, what to flag, what to skip. - -Keep it short (it costs tokens each run): one north-star, 3–5 priorities, the -constraints. Replace the defaults below with your own. - -> **Status:** unconfigured defaults. Until you tailor this file, skills operate -> with general best judgment and no specific bias. Remove this line once it's yours. +Aeon's north-star for this fork. Read on every run — align output to it. ## North-star metric -The single outcome everything should move toward. -*e.g. "weekly active users of my app", "MRR", "reach of my research".* - -**Default:** sustainable, compounding progress on the operator's active projects. +Tradeable, correct crypto signal surfaced inside Skopos chat — the read a trader +acts on, not a data dump. Conclusion first, in the first ~150 characters. ## Priorities -The few things that matter most right now, most important first. - -1. Correct, verifiable work over work that merely looks finished. -2. Depth on the operator's core projects over broad, shallow coverage. -3. Surface signal early — don't sit on something that needs a decision. - -*Replace with your own; cap at ~5.* +1. Correct and verifiable over comprehensive. A wrong regime call is worse than a + narrow one. +2. Decision-grade output — a regime verdict and explicit position calls + (front-run / ride / fade / watch), never an unlabeled table. +3. Freshness and honesty over completeness. "No signal today" and "no obvious + catalyst" are valid; an invented narrative is not. ## Audience -Who the output is for, and their level. -*e.g. "technical founders on X", "my internal team", "just me".* - -**Default:** the operator — assume technical and time-constrained. +Crypto traders using Skopos — technical, time-poor, already in-market. They want +the take and the move, not the background. ## Hard constraints -Lines never to cross. - -- Never publish secrets, private data, or unverified claims as fact. -- Stay within any configured spend and rate limits. - -*Add your own — budget caps, tone, topics to avoid, compliance limits.* +- Never invent numbers or catalysts. If a source fails and there's no prior value, + write `n/a`. +- Stay qualitative on live prices. Skopos supplies live quotes; this fork supplies + the regime and narrative read. Don't headline a hard price a user will trade on. +- Public, unauthenticated data only. Never publish secrets or unverified claims. ## Optimize for / avoid -- **Optimize for:** signal, correctness, and the priorities above. -- **Avoid:** filler, hype, busywork, anything off-strategy. +- Optimize for: signal, correctness, conclusion-first phrasing, explicit position calls. +- Avoid: filler, hype, unlabeled yields, narratives without an evidence anchor. diff --git a/aeon.yml b/aeon.yml index d73bf810bcc..9dfe7e97351 100644 --- a/aeon.yml +++ b/aeon.yml @@ -15,13 +15,14 @@ skills: pr-review: { enabled: false, schedule: "0 9 * * *", var: "" } # var: empty/owner/repo=per-PR review (posts comments) | --survey [dry-run] [owner/repo]=risk-tiered PR triage digest (folds in pr-merge) auto-merge: { enabled: false, schedule: "0 14 * * *" } # merge green PRs daily at 2 PM UTC; max 3 per run github-monitor: { enabled: false, schedule: "0 9 * * *", var: "" } # watch your repos. var: empty=combined monitor (PRs/issues/releases) | issues | releases | prs | owner/repo (folds in github-issues/github-releases/pr-tracker) - github-trending: { enabled: false, schedule: "0 9 * * *", var: "" } # trending repos + Hugging Face Hub. var: empty=GitHub | | hf | hf:{models,datasets,spaces} + github-trending: { enabled: true, schedule: "0 9 * * *", var: "" } # trending repos + Hugging Face Hub. var: empty=GitHub | | hf | hf:{models,datasets,spaces} # --- Midday (12 PM UTC) --- token-movers: { enabled: false, schedule: "0 12 * * *", var: "" } # market-movers scan + single-token deep report. var: empty=movers (CoinGecko) | geckoterminal[:chain]=on-chain runners | category: | =single-token report. Optional COINGECKO/ALCHEMY/XAI/BASE_RPC keys. onchain-monitor: { enabled: false, schedule: "0 12 * * *" } distribute-tokens: { enabled: false, schedule: "workflow_dispatch", var: "" } # on-demand contributor rewards. var: empty/