AI Agent Security Posture Report

A AWS access key was found in `main.tf` (line 3). Credentials in source code end up in git history, CI logs, and every clone.

Location: infra-automation / main.tf:3

AKIA3XQ7TL…4W (20 chars)

Fix: Rotate the credential, move it to a secrets manager, and issue per-agent scoped credentials.

A Shopify admin token was found in `.mcp.json` (line 7). Credentials in source code end up in git history, CI logs, and every clone.

Location: refund-agent / .mcp.json:7

shpat_9f3b…b7 (26 chars)

Fix: Rotate the credential, move it to a secrets manager, and issue per-agent scoped credentials.

A Anthropic API key was found in `agent.py` (line 6). Credentials in source code end up in git history, CI logs, and every clone.

Location: refund-agent / agent.py:6

sk-ant-api…Xq (63 chars)

Fix: Rotate the credential, move it to a secrets manager, and issue per-agent scoped credentials.

A Database connection string was found in `claude_desktop_config.json` (line 7). Credentials in source code end up in git history, CI logs, and every clone.

Location: support-copilot / claude_desktop_config.json:7

postgresql…rs (73 chars)

Fix: Rotate the credential, move it to a secrets manager, and issue per-agent scoped credentials.

A Anthropic API key was found in `src/index.ts` (line 4). Credentials in source code end up in git history, CI logs, and every clone.

Location: support-copilot / src/index.ts:4

sk-ant-api…Xq (63 chars)

Fix: Rotate the credential, move it to a secrets manager, and issue per-agent scoped credentials.

Credential fingerprint `a63f60af6e57` appears in refund-agent, support-copilot. Shared credentials make agent actions unattributable and multiply blast radius: one leak compromises every agent using it.

Location: refund-agent, support-copilot / refund-agent/agent.py:6 • support-copilot/src/index.ts:4

sk-ant-api…Xq (63 chars)

Fix: Issue one identity per agent so actions are attributable and revocation is surgical.

MCP configuration `.mcp.json` passes `SHOPIFY_ACCESS_TOKEN` as a plaintext env value. Anyone with repo access — and any agent that can read the file — holds this credential.

Location: refund-agent / .mcp.json

SHOPIFY_ACCESS_TOKEN=shpat_9f…

Fix: Reference secrets from a manager or OS keychain; never inline them in MCP configs.

Tools `refund_order`, `delete_customer` can irreversibly modify or move data against Shopify (financial system). Any agent (or prompt-injected agent) connected to this server can invoke them.

Location: refund-agent / mcp_server.py

refund_order, delete_customer

Fix: Gate destructive tools behind approval, split them into a separate restricted server, or scope them out for agents that only need reads.

This workload can read personal data (HubSpot) and write to financial systems (Shopify, Shopify). A single prompt injection here reaches both.

Workload: refund-agent

Fix: Split into two agents with separate identities, or gate the financial-write path behind human approval.

MCP configuration `claude_desktop_config.json` passes `DATABASE_URL` as a plaintext env value. Anyone with repo access — and any agent that can read the file — holds this credential.

Location: support-copilot / claude_desktop_config.json

DATABASE_URL=postgres…

Fix: Reference secrets from a manager or OS keychain; never inline them in MCP configs.

A OpenAI API key was found in `.env` (line 1). Env files are frequently committed or copied between machines; verify this file is git-ignored and rotate if it ever left the machine.

Location: refund-agent / .env:1

sk-proj-Tq…7u (40 chars)

Fix: Rotate the credential, move it to a secrets manager, and issue per-agent scoped credentials.

A Shopify admin token was found in `.env` (line 2). Env files are frequently committed or copied between machines; verify this file is git-ignored and rotate if it ever left the machine.

Location: refund-agent / .env:2

shpat_9f3b…b7 (26 chars)

Fix: Rotate the credential, move it to a secrets manager, and issue per-agent scoped credentials.

3 write/destructive-shaped tools are declared without `readOnlyHint`/`destructiveHint` annotations. Clients and gateways that gate on annotations will treat these as unknown risk — or worse, assume they are safe.

Location: refund-agent / mcp_server.py

refund_order, delete_customer, update_inventory

Fix: Declare MCP tool annotations, then verify declared behavior matches actual behavior (annotation drift).

2 write/destructive-shaped tools are declared without `readOnlyHint`/`destructiveHint` annotations. Clients and gateways that gate on annotations will treat these as unknown risk — or worse, assume they are safe.

Location: support-copilot / src/crm-server.ts

update_customer, send_email

Fix: Declare MCP tool annotations, then verify declared behavior matches actual behavior (annotation drift).

No CODEOWNERS entry and no attributable commit author. When this agent misbehaves at 2am, nobody knows who to page.

Workload: infra-automation

Fix: Assign an owning team in CODEOWNERS and register the agent in your inventory.

`npx -y @thirdparty/shopify-mcp-server` pulls and executes an external package at runtime. The postmark-mcp incident (Sep 2025) showed a benign MCP server turning malicious in a point release.

Location: refund-agent / .mcp.json

npx -y @thirdparty/shopify-mcp-server

Fix: Pin exact versions, vendor the server, or route it through a vetted internal registry.

`npx -y hubspot-mcp` pulls and executes an external package at runtime. The postmark-mcp incident (Sep 2025) showed a benign MCP server turning malicious in a point release.

Location: refund-agent / .mcp.json

npx -y hubspot-mcp

Fix: Pin exact versions, vendor the server, or route it through a vetted internal registry.

No CODEOWNERS entry and no attributable commit author. When this agent misbehaves at 2am, nobody knows who to page.

Workload: refund-agent

Fix: Assign an owning team in CODEOWNERS and register the agent in your inventory.

`uvx mcp-server-postgres` pulls and executes an external package at runtime. The postmark-mcp incident (Sep 2025) showed a benign MCP server turning malicious in a point release.

Location: support-copilot / claude_desktop_config.json

uvx mcp-server-postgres

Fix: Pin exact versions, vendor the server, or route it through a vetted internal registry.

`npx -y @thirdparty/gmail-mcp-server` pulls and executes an external package at runtime. The postmark-mcp incident (Sep 2025) showed a benign MCP server turning malicious in a point release.

Location: support-copilot / claude_desktop_config.json

npx -y @thirdparty/gmail-mcp-server

Fix: Pin exact versions, vendor the server, or route it through a vetted internal registry.

Workflow `.github/workflows/nightly-fix.yml` invokes Claude Code. CI agents run with repository credentials and no human in the loop — include them in your agent inventory.

Location: infra-automation / .github/workflows/nightly-fix.yml

Claude Code

Fix: Scope CI agent permissions to the minimum and log its actions like any production agent.