Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

security: tool output scrubbing misses raven's own oauth token files

Closed Beginner friendly
  • Is something wrong?
#842 2 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

@akushonkamen is already working on this.

Since Oct 11, 2026.

  • #917 by @akushonkamen — open

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
88/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
python
Domain
security

Research direction

Start in raven/config/held_secrets.py at scrub_tool_output and trace _home_config(), then compare the pattern handling in raven/security/redact.py. Update the exclusion scope and its docstring so OAuth files remain covered by pattern redaction while workspace and tmp paths do not. Verify the behavior in tests/test_security_untrusted_context.py with uv run pytest -q tests/test_security_untrusted_context.py.

Written by the indexing model from the issue text.

Description

Problem

Tool output scrubbing (added in #833) does not cover Raven's own OAuth token files, so a turn that reads one hands the access and refresh tokens to the model.

Two passes scrub a tool result before a model sees it (raven/config/held_secrets.py scrub_tool_output):

  1. scrub_held_secrets -- exact match on the values in config.json only;
  2. redact_home_config_read (raven/security/redact.py) -- pattern redaction when the call reaches into a dot-directory of the home.

The fix for the workspace false positive in #833 made _home_config() skip all of Raven's home (~/.raven), on the grounds that Raven's own keys are covered by pass 1. That holds for config.json, but not for the sign-in tokens under get_oauth_dir() (~/.raven/oauth/<provider>/...: chatgpt/auth.json, github_copilot/, MiniMax, litellm). They are in neither pass.

Repro

With #833 in, using a fake token:

import os
from raven.config.held_secrets import scrub_tool_output

home = os.path.expanduser("~")
tok = '{"access_token": "eyJhbGciOiJSUzI1NiJ9.FAKEPAYLOAD.sig", "refresh_token": "rt_FAKE0123456789abcdef"}'
print(scrub_tool_output({"path": f"{home}/.raven/oauth/chatgpt/auth.json"}, tok))  # unchanged
print(scrub_tool_output({"path": f"{home}/.codex/auth.json"}, tok))                # [redacted]

A refresh token is a long-lived account credential; once in a tool result it is in the session record and the provider's logs. The self-config skill tells the agent not to open credential stores, but #833's own measurement is that a model diagnosing an agent reads its settings anyway.

Suggested fix

Narrow the exclusion in _home_config() from Raven's whole home to the directories where a coding turn reads its own source: <raven home>/workspace and <raven home>/tmp (and the bound workdir). ~/.raven/oauth/... and the rest of Raven's home then stay under the pattern pass. Correct the _home_config() docstring, which says Raven's own keys are covered by the exact-match pass.

Verify: in tests/test_security_untrusted_context.py, assert a read of ~/.raven/oauth/<provider>/auth.json is redacted, next to the existing case that ~/.raven/workspace/... and ~/.raven/tmp/... stay unchanged; uv run pytest -q tests/test_security_untrusted_context.py.

Not a regression against the release before #833 (there was no scrubbing then); a gap in the new protection.

Dominant language
Python
Stars
4.1k
Forks
94
Avg merge
1d 14h
Merged PRs (30d)
209

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from EverMind-AI/Raven

All issues in EverMind-AI/Raven

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.