{"id":"7bab208e-bc43-491e-93d3-42e270060770","repo":"si16z/ElizaOS","status":"done","verdict":"red_flags","headline":"Red flags: 1 serious issue. README claims backed by the code: 3 of 8.","error":null,"report":{"ai":{"kind":"framework","claims":[{"claim":"elizaOS is an open-source TypeScript framework and product stack for autonomous AI agents, with the core runtime, app, CLI, cloud services, native bridges and plugins in one monorepo","verdict":"supported","evidence":"Workspace layout in package.json:111-137 and the file tree (packages/agent, packages/app, packages/cloud, plugins/*). The packages/core directory is not in the excerpt."},{"claim":"The framework is model-agnostic and extended through plugins that register actions, providers, evaluators, services, model handlers, routes and views","verdict":"supported","evidence":"Plugin-system exports at packages/agent/src/index.ts (plugin-collector/lifecycle/types); provider credential map in credentials.ts:552-605"},{"claim":"Local inference (Eliza-1 on-device models with 2B/4B/9B/27B tiers) can run without a network connection after assets are downloaded","verdict":"unverifiable","evidence":"The plugin-local-inference sources are not in the provided excerpt; only the lazy import wiring appears (packages/app/src/api/server.ts:165-175)."},{"claim":"Eliza Cloud is optional; local runtime and direct provider configuration remain first-class","verdict":"supported","evidence":"Provider scan covers local files, env vars and Ollama (credentials.ts:137-300, 607-635); cloud routes are separate compat handlers (app server.ts:584-623)."},{"claim":"Non-custodial EVM/Solana wallet operations run with approval boundaries","verdict":"partial","evidence":"A signing-policy evaluator, pending approvals and a hardened wallet-export rejection exist (agent index.ts:680-742; app server.ts:64-66). Full approval-flow behavior is not visible in the excerpt."},{"claim":"Linux and Android distribution tooling lives in packages/os","verdict":"unverifiable","evidence":"packages/os does not appear in the provided file tree excerpt."},{"claim":"Benchmarks run via the Python orchestrator in packages/benchmarks","verdict":"unverifiable","evidence":"packages/benchmarks is not in the excerpt; only a TypeScript benchmark CLI is shown (agent/src/cli/index.ts:113-120)."},{"claim":"Repo description: 'Super Intelligence agentic operating system'","verdict":"unsupported","evidence":"The README only says 'Your agentic operating system' and describes a TypeScript agent framework. Nothing in the code implements 'super intelligence'."}],"costUsd":0.290928,"summary":"This is the elizaOS monorepo (package name \"eliza\"), a large TypeScript/Bun codebase for an AI agent runtime and the Eliza app. The excerpt shows an agent host with an HTTP API, plugin loading, shell/terminal actions, wallet and signing routes, TEE attestation, backup/restore, and sandboxing. It also shows an Electrobun desktop shell with native bridges, plus Android and iOS projects. The repo is a mirror of the upstream elizaOS project, with a marketing-style description that differs from the actual README.","capabilities":[{"evidence":"packages/agent/src/cli/index.ts:40-120","capability":"Boots a standalone agent runtime and HTTP server via the CLI (serve/start/runtime/benchmark/ios-bridge/android-bridge commands)"},{"evidence":"packages/agent/src/api/server.ts:1-380, 590-650","capability":"Local HTTP API layered over the agent runtime, with route kernel, auth, CORS, WebSocket upgrade authorization and lazy-loaded optional plugins"},{"evidence":"packages/app/src/api/server.ts:484-560, 566-790","capability":"Compat route pipeline in the app wrapper that handles auth, cloud proxy/billing, secrets, sensitive requests, local inference and agent reset (deletes the PGlite data dir)"},{"evidence":"packages/app/platforms/electrobun/src/native/credentials.ts:137-300, 607-720, 725-804","capability":"Scans local credential sources for model providers (Codex/Claude/Copilot/Gemini files, Ollama, env vars) and validates keys against provider endpoints; keys are masked before being returned over IPC"},{"evidence":"packages/app/platforms/electrobun/src/native/credentials.ts:292-346, 429-518, 522-546","capability":"Reads and decrypts Chromium-browser cookies on macOS (Chrome/Arc/Brave/Edge/Chromium) using the Safe Storage key from the Keychain, to detect an Eliza Cloud 'privy-session' cookie"},{"evidence":"packages/agent/src/index.ts (plugin-collector, plugin-lifecycle, plugin-resolver exports); README.md:106-109","capability":"Pluggable architecture where plugins register actions, providers, services, routes and views"},{"evidence":"packages/agent/src/index.ts:3-39; services/shell-execution-router.ts exported at index.ts:727-735","capability":"Agent actions for terminal/shell execution, plugin management, runtime control, database access, triggers/scheduled tasks and settings"},{"evidence":"packages/agent/src/index.ts:189-192, 680-689, 736-742","capability":"Wallet and remote-signing functions with a policy evaluator and TEE-gated signing"},{"evidence":"packages/agent/src/index.ts:743-756; file tree services/tee-*.ts","capability":"TEE / confidential-compute support: dstack attestation, GPU evidence, key release, sealed volumes, boot gate"},{"evidence":"packages/agent/src/index.ts:690-714","capability":"Container/VM sandbox engines (Docker, Apple Container) and a sandbox manager"},{"evidence":"packages/agent/src/index.ts:475-476; services/agent-backup*.ts","capability":"Agent backup/restore and export/import"},{"evidence":"packages/agent/src/index.ts:622-678","capability":"Remote capability router and endpoint providers (cloud sandbox, home machine, TEE) that expose plugins over the network"}],"findingReviews":[{"id":"exfil.wallet_storage","path":"packages/app/platforms/electrobun/src/native/credentials.ts","reason":"Lines 308-320 are only a static table of Chromium browser cookie paths and Keychain service names. The code that uses them (readChromiumCookies, lines 429-518) does read the user's browser Cookies SQLite DB and the Safe Storage Keychain key, then decrypts cookies. That is a credential-harvesting technique, though here it is narrowly scoped to the host eliza.app / cloud.eliza.app and the 'privy-session' cookie. The code comments state its purpose is the user's own Eliza Cloud session import. The decrypted values are not returned over IPC; only a boolean-derived provider entry is. It is a sensitive capability but a documented, narrow, local one. This is not wallet-file reading, and I see no network exfiltration in the shown code. The same file also reads ~/.codex, ~/.claude, Copilot and gcloud credential files and sends detected keys to the respective provider validation endpoints, which deserves user awareness.","assessment":"uncertain"}]},"url":"https://github.com/si16z/ElizaOS","depth":"standard","stats":{"files":20000,"binaries":433,"textFiles":2697,"truncated":true},"verdict":"red_flags","findings":[{"id":"exfil.wallet_storage","title":"Reads browser or wallet storage on your machine","detail":"The code references where browsers and wallets keep passwords, cookies or keys. Stealers go straight for these files; a legitimate project that touches them should explain why in its README.","evidence":[{"line":308,"path":"packages/app/platforms/electrobun/src/native/credentials.ts","excerpt":"cookiePath: \"Google/Chrome/Default/Cookies\","},{"line":314,"path":"packages/app/platforms/electrobun/src/native/credentials.ts","excerpt":"cookiePath: \"Arc/User Data/Default/Cookies\","},{"line":320,"path":"packages/app/platforms/electrobun/src/native/credentials.ts","excerpt":"cookiePath: \"BraveSoftware/Brave-Browser/Default/Cookies\","}],"severity":"high"},{"id":"install.npm_hook","title":"Runs code automatically on install (postinstall)","detail":"npm runs this as soon as someone installs the package: \"bun packages/scripts/patch-punycode-deprecation.ts && bun packages/scripts/patch-llama-cpp-capacitor.ts && bun packages/scripts/patch-electrobun-linux-cef-profi\".","evidence":[{"path":"package.json"}],"severity":"info"},{"id":"install.pipe_to_shell","title":"Install command pipes a download straight into a shell","detail":"Common for installers, but it runs whatever the server sends. Make sure the domain is the project's own.","evidence":[{"line":88,"path":"packages/app/src/cli/doctor/checks.ts","excerpt":"fix: \"curl -fsSL https://bun.sh/install | bash\","}],"severity":"info"},{"id":"keys.handles_private_keys","title":"Handles wallet private keys or seed phrases","detail":"Expected for agents that sign transactions. The keys should stay on your machine and only be used to sign.","evidence":[{"line":155,"path":"packages/agent/src/api/bug-report-routes.ts","excerpt":"/\\b(mnemonic|private[_ -]?key|seed phrase)\\b\\s*[:=]\\s*.+/gi,"},{"line":500,"path":"packages/agent/src/api/config-routes.ts","excerpt":"delete envPatch.SOLANA_PRIVATE_KEY;"},{"line":359,"path":"packages/agent/src/api/first-run-routes.ts","excerpt":"\"SOLANA_PRIVATE_KEY\","},{"line":448,"path":"packages/agent/src/api/server-helpers-config.ts","excerpt":"typeof process.env.SOLANA_PRIVATE_KEY !== \"string\" ||"},{"line":3299,"path":"packages/agent/src/api/server.ts","excerpt":"\"SOLANA_PRIVATE_KEY\","},{"line":224,"path":"packages/agent/src/api/wallet-capability.ts","excerpt":"process.env.SOLANA_PRIVATE_KEY?.trim(),"}],"severity":"info"}],"headline":"Red flags: 1 serious issue. README claims backed by the code: 3 of 8.","provenance":[{"id":"prov.fork","title":"Fork of elizaOS/eliza","detail":"Check what was changed compared with the original, and whether it's credited.","evidence":[{"path":"elizaOS/eliza"}],"severity":"info"}],"generatedAt":"2026-10-15T10:35:25.676Z"}}