Sample report

What you receive

Illustrative

This is a sample. The system, its findings and its dates are fictional and describe no real product or client. It exists to show the format of an ArkLink report.

R/01Summary

System under test: HarborAn internal support agent that triages GitHub issues. It reads issue text, queries a Postgres replica and posts to Slack, with its tools exposed through an MCP server over Streamable HTTP.
Scope: Agent prompt and tool wiring, the MCP server, the deployment network, and the dependency scan supplied by the client.

Findings by severity

1Critical
1High
1Medium
1Low
1Informational

R/02Findings

F-01Critical

Issue text can make the agent post its own credentials

Reachability: Reachable
Retest: Fixed, verified on retest

What is wrong

The agent places issue bodies in the same context as its instructions and holds a tool that reads environment variables. Anyone who can open an issue can instruct it to read the deployment token and paste it into a public comment.

Reproduction

1. Open an issue whose body contains a short instruction addressed to the triage agent. 2. Wait for the triage run. 3. The agent calls the environment tool and replies with the token in the issue thread.

Fix

Remove the environment tool from this agent entirely, move the token to a scoped secret the agent never sees, and mark issue content as untrusted input in the prompt structure. Egress filtering on outbound comments is a second layer, not the fix.

F-02High

MCP server accepts unauthenticated calls from the whole network

Reachability: Reachable
Retest: Fixed, verified on retest

What is wrong

The MCP endpoint listens on every interface with no authentication and no Origin check. Any workload on the same network can list and call the agent's tools directly, bypassing the agent and its prompt entirely.

Reproduction

1. From any host on the network, send an initialize request to the MCP endpoint. 2. Send tools/list, then tools/call for the database query tool. 3. The query runs with the agent's database role.

Fix

Bind to localhost or a private socket, require a per-client token, and validate the Origin header on every request as the MCP transport specification requires.

F-03Medium

A model-supplied path can write outside the working directory

Reachability: Reachable with conditions
Retest: Fixed, verified on retest

What is wrong

The attachment tool joins a path chosen by the model to its working directory without canonicalising it. A relative path climbing out of the directory is written as given. Reachable only when an attacker also controls content the agent reads, which F-01 shows they do.

Reproduction

1. Using the vector from F-01, ask the agent to save an attachment under a path that starts with two parent-directory segments. 2. The file appears outside the attachment directory.

Fix

Resolve the final path, then check that it is still inside the working directory before writing. Apply the same validation to model-supplied values that already exists for user-supplied ones.

F-04Low

Model provider key stored in a world-readable config file

Reachability: Reachable with conditions
Retest: Risk accepted by client

What is wrong

The provider API key sits in plain text in a configuration file readable by every local user on the host. Exploitation requires a foothold on that host first.

Reproduction

1. As any unprivileged local user, read the agent's configuration file. 2. The key is present in clear.

Fix

Move the key to the platform's secret store and restrict the file's permissions. The client accepted the residual risk until the planned migration, with a written owner and date.

F-05Informational

Scanner critical in a transitive XML parser: not reachable, downgraded

Reachability: Not reachable
Retest: No action needed

What is wrong

The dependency scan flagged a critical issue in an XML parser pulled in by a reporting library. The vulnerable entry point is never called: Harbor uses that library only for CSV export. We downgraded it and recorded why, so the decision survives the next scan.

Reproduction

Call-graph analysis from every entry point of the service shows no path to the vulnerable function. Evidence attached in the full report.

Fix

None required now. Upgrade with the next routine dependency update, and re-check reachability if XML import is ever added.

A real report also carries raw evidence, affected versions, a timeline of communication and an executive summary for non-technical readers.

Start an engagement