Third-Party Software Security Review — ScorpioX Code

Software: ScorpioX Code Type: AI-Powered Development Tool / CLI Platform Language: Pure C (zero external dependencies) Audit Date: 2026-04-28 Codebase Commit: 40e8525bd1b39a2512668945e5fbdddaf1101ccc Classification: CONFIDENTIAL — For Corporate Review Only

---

1. Executive Summary

This report presents a comprehensive security assessment of ScorpioX Code, an AI-powered development tool and CLI platform written in pure C. The audit was conducted by 13 specialized automated agents covering supply chain, build provenance, network security, TLS/SSL, credential management, file I/O, buffer safety, memory safety, command injection, privilege/access control, Windows deployment, telemetry/tracking, and install script security.

Key Metrics

Findings by Severity (All Platforms)

Summary Assessment

The software demonstrates strong foundational security practices for a C codebase: comprehensive compiler hardening flags, full static linking, zero use of strcpy/sprintf/gets, a safe-to-unsafe string function ratio of 266:1, and all telemetry disabled by default. The two vendored libraries (mbedTLS 3.6.6, yyjson 0.12.0) are well-known, maintained, and carry minimal supply chain risk.

However, several areas require attention:

• Install & Distribution (CRITICAL): The curl|bash install pattern lacks cryptographic code signing, and SHA256 verification degrades gracefully to no verification when checksum files are unavailable.
• Command Injection (HIGH): Three critical injection vectors exist in macOS-only iMessage integration and the interactive shell-out feature. Windows deployment is not affected by the iMessage findings.
• Network Endpoints (HIGH): A hardcoded Git PAT in a release script and plaintext HTTP for token-fetching endpoints.
• File I/O (HIGH): Predictable temp file paths in WASM/Linux code paths enable symlink attacks.
• Memory Safety (MEDIUM): 168 unchecked strdup() return values across 39 source files.

For Windows workstation deployment specifically, the risk profile is LOW-MEDIUM — the most severe findings (iMessage injection, Linux container symlink attacks, WASM temp files) do not apply to the Windows platform.

---

2. Deployment Scope — Windows Workstation

2.1 Primary Deployment: Windows Workstation

The following 56 binaries are compiled for Windows (.exe):

Core Application

Shell & Terminal Tools

Configuration & Utilities

Network & API Tools

AI Provider Integrations

Agent & Development Tools

Infrastructure Tools

2.2 Linux/macOS-Only Binaries (Not Deployed on Windows)

2.3 Windows-Filtered Findings

When scoped to Windows workstation deployment only, findings that affect exclusively Linux/macOS code paths are excluded:

---

3. Changes Since Last Audit

Previous Audit: Commit 28b0b1b (2026-04-28) Previous Total Findings: 274 Current Total Findings: 212 Net Change: −62 findings (22.6% reduction) Windows-Specific Delta: Analysis: The codebase shows significant improvement since the previous audit, with a 22.6% overall reduction in findings and a 50% reduction in Windows-scoped findings. The medium-severity category saw the largest improvement (−56 findings), likely due to remediation of systemic patterns. The slight increase in critical findings (+2) is attributable to expanded agent coverage (install script audit now captures additional distribution security concerns). Informational findings increased due to more thorough endpoint cataloguing.

---

4. Supply Chain & Dependencies

Agent Risk Rating: LOW

4.1 Dependency Overview

The project has a minimal supply chain footprint with zero runtime package managers for the core build:

4.2 Vendored Libraries

4.3 Findings

---

5. Build System & Code Provenance

Agent Risk Rating: LOW

5.1 Security Hardening Flags

5.2 Findings

---

6. Network Endpoints

Agent Risk Rating: HIGH

6.1 Overview

78 unique hardcoded endpoints were identified across 38 source files. The software contacts well-defined API endpoints for its AI assistant functionality.

6.2 Authorized External Endpoints

6.3 Findings

---

7. TLS/SSL Security

Agent Risk Rating: MEDIUM

7.1 TLS Posture

The software uses two TLS stacks: libcurl for HTTP/SMTP and mbedTLS (vendored) for FRP tunnels, mail relay, and IMAPS. Most connections enforce certificate verification and use TLS 1.2+.

7.2 Findings

---

8. Hardcoded Credentials

Agent Risk Rating: LOW

8.1 Assessment

The codebase uses a configuration-driven approach where sensitive values are loaded from config files or environment variables at runtime. Most credential fields in templates are empty strings — correct practice.

8.2 Findings

---

9. File I/O & Data Handling

Agent Risk Rating: HIGH

9.1 Key Findings

---

10. Buffer Safety

Agent Risk Rating: LOW

10.1 String Function Usage

10.2 Findings

---

11. Memory Safety

Agent Risk Rating: MEDIUM

11.1 Allocation Statistics

11.2 Findings

---

12. Command Injection

Agent Risk Rating: HIGH

12.1 Attack Surface

• ~55 system() calls, ~30 popen() calls, ~45 exec*() calls across ~20 source files
• Unix code paths use fork()+execvp() (safe) for most operations
• Windows code paths use system() with command string construction

12.2 Findings

Note: CJ-01 (the ! shell-out) is an intentional feature of the interactive CLI — the user explicitly requests shell command execution. The risk is indirect prompt injection where an AI model might suggest malicious commands.

---

13. Privilege & Access Control

Agent Risk Rating: MEDIUM

13.1 Privilege Model

• No setuid/setgid binaries
• No root privileges required for core binary
• All operations run under user context
• Container runtime (scorpiox-unshare) uses rootless Linux user namespaces

13.2 Findings

---

14. Windows Deployment Analysis

Agent Risk Rating: LOW

14.1 Windows Build Configuration

• Compiler: MinGW GCC (cross-compile or native)
• Linking: Fully static with .a libraries (libcurl, OpenSSL, zlib)
• Security Flags: Stack protector, FORTIFY_SOURCE, full warnings
• No DLL dependencies — eliminates DLL hijacking risk

14.2 Windows Behavior Assessment

14.3 Findings

All 12 findings are informational, documenting expected behaviors:

---

15. Telemetry and Tracking

Agent Risk Rating: LOW

15.1 Telemetry Status

Verdict: No tracking by default.

All telemetry features are disabled by default across all configuration layers (compiled-in defaults, runtime config, and config templates). No network calls related to telemetry occur unless explicitly enabled by the user.

15.2 Telemetry Features

15.3 Findings

---

16. Install Script & Distribution Security

Agent Risk Rating: CRITICAL

16.1 Distribution Model

The software uses a curl|bash install pattern (curl -fsSL "get.scorpiox.net?platform=linux" | bash) with archives served from dist.scorpiox.net.

16.2 Findings

---

17. Consolidated Risk Matrix

---

18. Conclusion & Recommendations

18.1 Overall Assessment

ScorpioX Code demonstrates above-average security posture for a C codebase of this size (380K+ lines). The development team has made conscious security decisions including:

• Zero use of strcpy, sprintf, gets — replaced entirely with bounded alternatives
• Full static linking eliminating dynamic library attacks
• Comprehensive compiler hardening (stack protector, FORTIFY_SOURCE, full RELRO, CFI)
• Telemetry disabled by default with explicit opt-in required
• No pre-built binaries in repository
• Configuration-driven secrets with empty defaults

18.2 Priority Recommendations

P0 — Immediate (Critical):

Rotate the hardcoded Git PAT in release scripts and move to credential helpers

Implement code signing for all release binaries (GPG or cosign)

Change token endpoint defaults from http:// to https://

P1 — Short Term (High):

Add explicit SSL verification (CURLOPT_SSL_VERIFYPEER=1L, CURLOPT_SSL_VERIFYHOST=2L) in all HTTP client code

Fail closed on missing SHA256 checksums during install/update

Require user confirmation for Windows auto-updates

Fix realloc memory leak in sx_agent.c

Pass OTP secrets via stdin/environment instead of command line

P2 — Medium Term (Medium):

Create sx_strdup() wrapper that aborts on OOM to address 168 unchecked sites

Replace strcat with bounded operations in Windows command builders

Add NULL checks after all fopen() calls

Make SSL verification explicit rather than relying on libcurl defaults

Replace predictable temp files with mkstemp in WASM/Linux paths

P3 — Long Term (Low):

Add package-lock.json for bridge component

Generate SBOM in release pipeline

Update stale documentation for telemetry defaults

Move infrastructure IPs to environment variables in release scripts

18.3 Windows Deployment Recommendation

For Windows workstation deployment, ScorpioX Code is assessed as LOW-MEDIUM risk. The most severe findings (iMessage injection, WASM temp file attacks, Linux container vulnerabilities) do not apply to the Windows platform. The primary Windows-relevant concerns are:

• Distribution integrity (no code signing) — mitigated if distributed via internal channels with verified hashes
• Plaintext HTTP token endpoint defaults — mitigated by runtime config that correctly uses HTTPS
• Buffer overflow in Windows command builder — exploitable only with extremely long argument lists

With the P0 recommendations addressed (PAT rotation, code signing, HTTPS defaults), the Windows deployment risk would be reduced to LOW.

---

19. Appendix: Audit Methodology

19.1 Agents Deployed

19.2 Analysis Approach

• Static analysis of all 149 non-vendor C source files (151,970 lines)
• Configuration review of CMakeLists.txt, Dockerfiles, release scripts
• Pattern matching for known-dangerous function calls and patterns
• Data flow analysis for user input reaching security-sensitive sinks
• Cross-reference between vendor library versions and known CVE databases
• Platform-specific filtering for Windows deployment scope

19.3 Limitations

• This audit covers source code analysis only; no dynamic testing was performed
• The install script hosted at get.scorpiox.net is not included in the repository and could not be audited
• Runtime behavior may differ from static analysis findings due to configuration overrides
• Vendor library internals (mbedTLS, yyjson) were not deeply audited — version checks only

19.4 Classification

This report is classified as CONFIDENTIAL — For Corporate Review Only. Distribution should be limited to security, engineering, and IT leadership teams involved in the software evaluation and deployment decision.

---

Report generated by ScorpioX Code Security Audit Pipeline — 13-agent automated analysis Audit commit: 40e8525bd1b39a2512668945e5fbdddaf1101ccc