Third-Party Software Security Review — ScorpioX Code

Software: ScorpioX Code Type: AI-Powered Development Tool / CLI Platform Language: Pure C (zero external dependencies) Audit Date: 2026-04-28 Codebase Commit: 4d61a6ad4bd4c6e535dd7f57d3eff860eaf61168 Classification: CONFIDENTIAL — For Corporate Review Only

---

1. Executive Summary

This report presents a comprehensive security audit of ScorpioX Code, an AI-powered development tool and CLI platform written in pure C with vendored dependencies. The audit was conducted across 11 specialized security domains by independent automated agents analyzing the same codebase at commit 4d61a6a.

Key Metrics

Assessment Overview

The software demonstrates strong fundamentals in several areas: zero use of unsafe C string functions (sprintf, strcpy, strcat), fully static linking, no setuid binaries, proper namespace isolation in container runtimes, and no external package manager dependencies for the core build. Two well-known vendored libraries (Mbed TLS 3.6.3, yyjson 0.12.0) are properly maintained and licensed.

However, the audit identified significant security gaps in three critical areas:

TLS/Certificate Verification (CRITICAL): SSL certificate verification is disabled on all token-fetching endpoints. Authentication tokens are transmitted over plaintext HTTP. The traffic proxy globally disables TLS verification for child processes.

Command Injection (HIGH): Despite a recent commit specifically fixing command injection (the HEAD commit), numerous residual system()/popen() calls remain where network-sourced or user-controlled data flows into shell command strings without adequate escaping — particularly in messaging integrations.

Memory Safety (HIGH): Systemic missing-NULL-check patterns across 495 allocation calls, several use-after-free vulnerabilities in network-facing server components, and 35 unsafe realloc() patterns that leak memory on failure.

The Windows deployment surface is significantly narrower: 10 Linux/macOS-only binaries (including the container runtimes and messaging bridges where the most critical command injection and privilege findings reside) are excluded from Windows builds.

---

2. Deployment Scope — Windows Workstation vs. Server-Side

2.1 Primary Deployment: Windows Workstation

ScorpioX Code is deployed as a statically-linked Windows application distributed as a ZIP archive containing executables and bundled GNU/BusyBox Unix tools. The build uses MinGW (WinLibs POSIX UCRT) with static linking against all libraries.

2.2 Windows Binaries (54 total)

The following executables are compiled for and deployed on Windows:

2.3 Linux/macOS-Only Binaries — NOT Deployed on Windows

2.4 Windows-Filtered Findings

When scoped to Windows workstation deployment only (excluding Linux/macOS-only binaries), the finding counts are reduced:

---

3. Changes Since Last Audit

The most recent previous audit was conducted on the same date against commit f7f14b4.

Interpretation: The significant increase in findings is primarily attributable to the expanded audit scope — from 5 general-purpose agents to 11 specialized agents with deeper analysis (particularly the memory safety agent which contributed 230 findings alone, including 92 LOW-severity missing-NULL-checks and 93 INFO-severity leak candidates). The HEAD commit (security: fix command injection — replace system()/popen() with fork+execvp) demonstrates active remediation of previously identified command injection vectors.

---

4. Supply Chain & Dependencies

Agent Risk Rating: LOW

Key Findings

The core build has zero external package manager dependencies. All third-party code is vendored in-tree:

System dependencies (linked statically): libcurl, OpenSSL, zlib, pthreads, nghttp2/3, brotli, zstd, c-ares, libpsl, libidn2, libunistring.

---

5. Build System & Code Provenance

Agent Risk Rating: LOW-MEDIUM

Build System

• Primary: CMake 3.16+ with static linking (SX_STATIC_LINK=ON)
• Windows: MinGW (WinLibs POSIX UCRT) via Ninja
• 66 executable targets defined in scorpiox/CMakeLists.txt

Security Hardening Gaps

The following compiler hardening flags are absent from all build configurations:

> Note: Static linking provides inherent protection against shared library attacks, but the absence of stack protectors and FORTIFY_SOURCE remains a gap.

Code Provenance

---

6. Network Endpoints

Agent Risk Rating: HIGH

Endpoint Inventory

The codebase contains 53 unique hardcoded endpoints in project code:

Critical Network Findings

---

7. TLS/SSL Security

Agent Risk Rating: CRITICAL

This domain represents the most severe findings in the audit.

Critical Findings

Additional TLS Findings

---

8. Hardcoded Credentials

Agent Risk Rating: MEDIUM No active credentials (real API keys, production passwords, or live tokens) were found hardcoded in the codebase. Findings relate to placeholder values and internal infrastructure details.

---

9. File I/O & Data Handling

Agent Risk Rating: MEDIUM

---

10. Buffer Safety

Agent Risk Rating: LOW

This is a strong area for the codebase.

Safe Function Usage (Project Code)

Safe-to-unsafe ratio: ∞ — No unsafe string functions in project code.

---

11. Memory Safety

Agent Risk Rating: HIGH

The memory safety audit analyzed 495 allocation calls and 1,309 free() calls across 150 non-vendor source files. This domain produced the highest finding count.

Summary

Critical Memory Findings

> Note: Two initially-reported critical use-after-free findings (CRIT-01 in sxmail_queue.c and CRIT-02 in ws2tcp.c) were verified as false positives upon detailed analysis — control flow prevents the freed pointers from being used.

Systemic Patterns

• Unsafe realloc (35 instances): Pattern ptr = realloc(ptr, new_size) loses the old pointer on failure, causing memory leaks. Affects dynamic buffer growth in JSON parsing, HTTP response accumulation, and agent output collection.
• Missing NULL checks (92 instances): Most malloc/calloc calls proceed without verifying the allocation succeeded. On memory pressure, this results in NULL pointer dereference crashes.

---

12. Command Injection

Agent Risk Rating: HIGH

The HEAD commit (4d61a6a: security: fix command injection — replace system()/popen() with fork+execvp) demonstrates active remediation. However, residual vulnerabilities remain.

Critical Command Injection Findings

High Severity

Recommendations

Replace all remaining system() calls with fork() + execvp() — the codebase already demonstrates this pattern correctly in scorpiox-websearch.c and the editor launch.

Fix is_safe_shell_arg() to block single quotes — add ' to the rejected character list.

Implement proper shell escaping for any remaining system()/popen() usage.

---

13. Privilege & Access Control

Agent Risk Rating: MEDIUM

Positive Findings

• No setuid/setgid binaries shipped
• Container runtime (scorpiox-unshare) targets rootless execution via user namespaces
• Proper pivot_root with old root cleanup
• Environment cleared (clearenv()) and rebuilt with minimal set in containers
• cgroup v2 memory limits enforced
• slirp4netns with --disable-host-loopback for network isolation

Findings

---

14. Windows Deployment Analysis

Agent Risk Rating: LOW

Windows-Specific Implementation

The Windows build demonstrates good cross-platform hygiene:

Windows-Specific Findings

Assessment: No additional Windows-specific vulnerabilities were identified beyond those already documented in the cross-platform audit sections. The Windows deployment surface is narrower due to the exclusion of 10 Linux/macOS-only binaries.

---

15. Telemetry and Tracking

Note: The telemetry-tracking audit branch was not available for merge. Assessment is based on static analysis of telemetry-related binaries identified in other audit reports.

Identified Telemetry Components

Observations

• Both telemetry endpoints use HTTPS (encrypted)
• Telemetry binaries are included in the Windows build
• No evidence of covert data collection channels beyond the two documented endpoints
• Session emit writes temporary files to /tmp/ before transmission (see File I/O findings)

---

16. Consolidated Risk Matrix

---

17. Conclusion & Recommendations

Overall Assessment

ScorpioX Code demonstrates a mature C codebase with strong fundamentals — zero unsafe string functions, comprehensive static linking, no privilege escalation vectors, and careful namespace isolation in container components. The HEAD commit shows active security remediation.

However, three systemic issues elevate the overall risk to HIGH:

TLS verification bypass is the most urgent issue — authentication tokens are transmitted in cleartext and certificate verification is disabled on critical endpoints.

Residual command injection via system()/popen() calls remains widespread despite recent fixes.

Memory safety gaps (unchecked allocations, unsafe realloc patterns) are typical of C codebases but create denial-of-service risk in network-facing components.

Priority Remediation

Windows Workstation Risk Rating

For the scoped Windows workstation deployment: MEDIUM-HIGH — The most severe findings (TLS bypass, credential plaintext transmission, hook command injection) apply to Windows. However, the highest-CVSS command injection vectors (WhatsApp/iMessage message injection) are Linux/macOS-only.

---

18. Appendix: Audit Methodology

Audit Framework

This audit employed 11 specialized automated agents, each analyzing the complete codebase from a specific security domain:

Scope

• In Scope: All non-vendor .c and .h source files (150 files, 170,860 lines)
• Vendor Analysis: Vendored libraries (Mbed TLS, yyjson) reviewed for known vulnerabilities and configuration issues
• Out of Scope: Runtime behavior, dynamic analysis, penetration testing, third-party API security

Severity Classification