osobh/clawmates
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(readme): say what now limits a leaked provider key, and what does not
deploy / test (push) Failing after 3m51s
Details
deploy / build (push) Skipped
Details

Browse Source 
Proven live with a canary (missions 01a0cf3d, 01a0cf4c): push refused, patch
redacted, 0 of 19 events and 0 judge fields carrying the value.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
This commit is contained in:
Omar Sobh
2026-09-23 12:27:46 -05:00
co-authored by Claude Opus 5.5
parent 4602e9b896
commit 60a1fef5e5
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+4 -2
View File
@@ -257,8 +257,10 @@ structures, never gives an agent more reach than its sandbox. What that means to
gets only a narrowly scoped skills token, never a ClawMates session. **Model-provider keys are the gets only a narrowly scoped skills token, never a ClawMates session. **Model-provider keys are the
exception:** Claude Code inside a mission needs its own credential, so container-tier missions carry exception:** Claude Code inside a mission needs its own credential, so container-tier missions carry
the provider keys (`CLAUDE_CODE_OAUTH_TOKEN`, and `ZAI_API_KEY` / `KIMI_API_KEY` for the fallback the provider keys (`CLAUDE_CODE_OAUTH_TOKEN`, and `ZAI_API_KEY` / `KIMI_API_KEY` for the fallback
chain) in their environment, readable by the agent. The server reaches Docker through an allow-listed chain) in their environment, readable by the agent. What limits the damage: delivery refuses to push
socket proxy. any change containing one of those keys (exact values, verbatim or base64), and every recorded event,
judge verdict and judge input is redacted before it is stored or sent. A key sent straight to a host
over the network is not covered yet. The server reaches Docker through an allow-listed socket proxy.
- The gate is a guardrail against accidents and obvious exfiltration, not a boundary against a - The gate is a guardrail against accidents and obvious exfiltration, not a boundary against a
determined agent (indirection defeats string matching). The boundaries are the VM, the network policy determined agent (indirection defeats string matching). The boundaries are the VM, the network policy
and the broker. and the broker.