Security
Secrets, execution and injection sinks
← Back to code signals AUTOMATED CODE SIGNAL v1
huggingface / smolagents
smolagents.
5 rule matches across 48 source files. This is a static snapshot—not a review of runtime behavior or a security certification.
AUTOMATED CODE SIGNAL
62/100
WARNINGNot a GAAAS certification · scanned October 4, 2026
48 source files checked5 findingsFULL scan scopeStatic audit · manual review recommended
01 / SCORE BREAKDOWN
Where it stands.
Each pillar is worth 25 points. Deductions follow matched rules and are capped per pillar.
0/25
Cost guardrails
Loops, token limits and rate controls
Schema quality
Runtime validation of model output
Transparency
System context and sensitive logging
02 / SOURCE EVIDENCE
What the scan found.
Locations point to the public repository. Source snippets are omitted to avoid republishing exposed credentials.
CRITICALSECURITY
Critical finding under coordinated disclosure
Technical details are embargoed until 2026-11-03 to allow remediation.
FIXThe maintainer has been given a remediation window before edited details are published.
CRITICALSECURITY
Critical finding under coordinated disclosure
Technical details are embargoed until 2026-11-03 to allow remediation.
FIXThe maintainer has been given a remediation window before edited details are published.
MAJORCOST GUARDRAILS
Missing token limit
LLM request does not declare an output-token ceiling.
FIXSet max_tokens, maxOutputTokens, or the provider-equivalent limit on every request.
MAJORSCHEMA QUALITY
Missing structured-output schema
LLM output is consumed without an explicit runtime schema.
FIXDefine a Zod, JSON Schema, Pydantic, or provider-native structured-output schema.
CRITICALSECURITY
Critical finding under coordinated disclosure
Technical details are embargoed until 2026-11-03 to allow remediation.
FIXThe maintainer has been given a remediation window before edited details are published.
03 / SHARE THE SIGNAL
Show the signal—accurately.
This badge identifies an automated code signal. Only a current signed certificate may use the GAAAS Verified mark.
[](https://gaaas.thanhdan.dev/agents/huggingface/smolagents)