fix(security): dependency confusion, bare excepts, MD5 deprecation by imran-siddique · Pull Request #352 · microsoft/agent-governance-toolkit

imran-siddique · 2026-03-23T20:17:23Z

Security re-audit on March 23 verified all 24 previous fixes held (zero regressions). Found 3 new items:

CRITICAL: quickstart.ps1 referenced unregistered PyPI name agent-os instead of agent-os-kernel. Supply chain attack vector — fixed.

HIGH: 4 bare except: blocks in graph_debugger.py (2 duplicate files) replaced with specific exception types + logging.

MEDIUM: MD5/SHA1 in text_tool.py hash selection now emit deprecation warning citing CWE-328.

4 files changed.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Add EU AI Act, Colorado AI Act, and GPAI obligations timeline with AGT coverage mapping. Reference Microsoft Purview DSPM for AI as complementary data governance layer. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…toolkit

The Scorecard API rejects workflows with write permissions at the workflow level. id-token: write and security-events: write must be scoped to the job level only. Restores permissions: read-all at workflow level while keeping job-level write permissions intact. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…ft#324) Add Google-style docstrings with Args, Returns, Raises, Attributes, and Example sections to MCPMessageType, MCPAdapter, and MCPServer classes. Also enhances docstrings for key methods including handle_message, _handle_tools_call, _handle_resources_read, and _map_tool_to_action. Fixes microsoft#316

Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>

…icrosoft#326)

…s (dependency confusion) (microsoft#325) - Replace !pip install agent-os with !pip install -e ../.. in all 6 notebooks; agent-os is not on PyPI and installing it from PyPI is a dependency confusion vector - Replace zendesk-sdk/freshdesk-sdk with zenpy/freshdesk (the real published SDKs) in customer-service/requirements.txt - Remove hashlib-compat from healthcare-hipaa/requirements.txt; hashlib is stdlib and hashlib-compat is not a real PyPI package

…stall agent-os with agent-os-kernel Replace all remaining instances of `pip install agent-os` (unregistered on PyPI) with `pip install agent-os-kernel` (the actual package) across docs, examples, TypeScript extensions, CLI source, tests, and SVG assets. Also fixes `pip install emk` references to point to `agent-os-kernel[full]` since emk is a submodule, not a standalone PyPI package. Completes the fix started in PR microsoft#325 which only covered notebooks. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Dify 65K→133K, AutoGen 42K→55K, CrewAI 28K→46K, Semantic Kernel 24K→27K, LangGraph 24K→27K, Haystack 22K→24K, Agent Framework 7.6K→8K. Added star counts for OpenAI Agents SDK (20K) and Google ADK (18K). Sorted by stars descending. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…toolkit

…it CI - scripts/check_dependency_confusion.py: Pre-commit hook that scans for pip install commands referencing unregistered PyPI packages. Maintains an allowlist of known registered packages. - .github/workflows/weekly-security-audit.yml: Weekly CI job running dependency confusion scan, security skills scan, and weak crypto check. Uploads reports as artifacts with 90-day retention. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…icrosoft#349) * docs: add testing guide for external testers and customers Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: add regulatory alignment table and Purview positioning to README Add EU AI Act, Colorado AI Act, and GPAI obligations timeline with AGT coverage mapping. Reference Microsoft Purview DSPM for AI as complementary data governance layer. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(ci): restore read-all at workflow level for Scorecard verification The Scorecard API rejects workflows with write permissions at the workflow level. id-token: write and security-events: write must be scoped to the job level only. Restores permissions: read-all at workflow level while keeping job-level write permissions intact. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: add comprehensive docstrings to mcp_adapter.py classes (microsoft#324) Add Google-style docstrings with Args, Returns, Raises, Attributes, and Example sections to MCPMessageType, MCPAdapter, and MCPServer classes. Also enhances docstrings for key methods including handle_message, _handle_tools_call, _handle_resources_read, and _map_tool_to_action. Fixes microsoft#316 * ci: add markdown link checker workflow (microsoft#323) Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> * feat: add policy evaluation heatmap to SRE dashboard (microsoft#309) (microsoft#326) * fix: remove unregistered PyPI packages from notebooks and requirements (dependency confusion) (microsoft#325) - Replace !pip install agent-os with !pip install -e ../.. in all 6 notebooks; agent-os is not on PyPI and installing it from PyPI is a dependency confusion vector - Replace zendesk-sdk/freshdesk-sdk with zenpy/freshdesk (the real published SDKs) in customer-service/requirements.txt - Remove hashlib-compat from healthcare-hipaa/requirements.txt; hashlib is stdlib and hashlib-compat is not a real PyPI package * fix(security): complete dependency confusion fix — replace all pip install agent-os with agent-os-kernel Replace all remaining instances of `pip install agent-os` (unregistered on PyPI) with `pip install agent-os-kernel` (the actual package) across docs, examples, TypeScript extensions, CLI source, tests, and SVG assets. Also fixes `pip install emk` references to point to `agent-os-kernel[full]` since emk is a submodule, not a standalone PyPI package. Completes the fix started in PR microsoft#325 which only covered notebooks. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: update framework star counts to current values Dify 65K→133K, AutoGen 42K→55K, CrewAI 28K→46K, Semantic Kernel 24K→27K, LangGraph 24K→27K, Haystack 22K→24K, Agent Framework 7.6K→8K. Added star counts for OpenAI Agents SDK (20K) and Google ADK (18K). Sorted by stars descending. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Parsa Faraji Alamouti <165321600+parsa-faraji@users.noreply.github.com> Co-authored-by: Matt Van Horn <mvanhorn@users.noreply.github.com> Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Co-authored-by: Zeel Desai <72783325+zeel2104@users.noreply.github.com> Co-authored-by: Xavier Garceau-Aranda <xavier.garceau-aranda@posteo.net>

- agentmesh → agentmesh-platform (5 files) - agentmesh-governance → agent-governance-toolkit - agent-os-observability → agent-os-kernel[observability] - hashlib.md5 → hashlib.sha256 (3 files) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…toolkit

…MD5 deprecation CRITICAL: quickstart.ps1 referenced unregistered 'agent-os' PyPI name instead of 'agent-os-kernel'. Fixed to prevent supply chain attack. HIGH: 4 bare except: blocks in graph_debugger.py (2 duplicate files) replaced with specific exception types + logging. MEDIUM: MD5 and SHA1 deprecated with warning in text_tool.py hash algorithm selection. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

github-actions

🤖 AI Agent: code-reviewer

Review Summary

This pull request addresses three security concerns: dependency confusion, bare except blocks, and the use of deprecated hash algorithms. The changes are well-targeted and improve the security posture of the repository. Below is a detailed review of each change.

🔴 CRITICAL: Dependency Confusion in `quickstart.ps1`

Issue: The script referenced an unregistered PyPI package (agent-os) instead of the correct package (agent-os-kernel). This posed a supply chain attack vector.

Fix: The reference was updated to agent-os-kernel.

Review:

✅ The fix eliminates the dependency confusion vulnerability.
💡 Suggestion: Consider adding a validation step in CI/CD to verify that all referenced PyPI packages are registered and owned by trusted accounts. This would prevent similar issues in the future.

HIGH: Bare `except` Blocks in `graph_debugger.py`

Issue: Bare except blocks were used in two files, which could mask unexpected exceptions and make debugging harder.

Fix: The bare except blocks were replaced with specific exception types (ValueError, RuntimeError) and added logging for better traceability.

Review:

✅ The fix improves error handling and makes debugging easier.
💡 Suggestion: Consider using Exception as a fallback if the exact exception types are not known. This ensures that unexpected errors are still caught while avoiding bare except.
💡 Suggestion: Add unit tests to verify that the new exception handling logic works as intended, especially for cases where spring_layout fails.

MEDIUM: MD5/SHA1 Deprecation in `text_tool.py`

Issue: MD5 and SHA1 algorithms were still allowed for hashing, despite being deprecated due to known vulnerabilities (CWE-328).

Fix: A deprecation warning was added to discourage their use.

Review:

✅ The warning is a good step toward discouraging insecure algorithms.
🔴 Critical Suggestion: Emit a runtime exception instead of a warning for MD5/SHA1 usage. Allowing these algorithms to run, even with a warning, could lead to security bypasses if developers ignore the warning.
💡 Suggestion: Update the documentation to explicitly state that MD5 and SHA1 are deprecated and should not be used.

General Feedback

Logging

💡 Suggestion: Ensure that all logging calls use consistent log levels (debug, info, warning, error, critical) across the repository. This will make logs easier to parse and analyze.

Type Safety

💡 Suggestion: Add type annotations for all functions modified in this PR. For example, the hash method in TextTool could benefit from stricter type annotations for algorithm.

Backward Compatibility

🟡 Warning: The deprecation warning for MD5/SHA1 may break workflows that rely on these algorithms. Consider providing a migration guide or a grace period before enforcing stricter measures.

OWASP Agentic Top 10 Compliance

🔴 Critical Suggestion: Conduct a full audit of cryptographic operations across the repository to ensure compliance with OWASP Agentic Top 10 guidelines. This includes verifying that all cryptographic algorithms are secure and properly implemented.

Actionable Recommendations

Dependency Validation: Add a CI/CD step to verify that all referenced PyPI packages are registered and trusted.
MD5/SHA1 Enforcement: Replace the deprecation warning with a runtime exception for MD5/SHA1 usage.
Unit Tests: Add tests to validate exception handling logic in graph_debugger.py.
Documentation: Update documentation to reflect the deprecation of MD5/SHA1 and provide migration guidance.
Type Annotations: Add type annotations to all modified functions for better type safety.
Cryptographic Audit: Perform a comprehensive audit of cryptographic operations to ensure OWASP compliance.

Final Assessment

Security: The PR addresses critical and high-priority security issues effectively. However, MD5/SHA1 usage should be blocked entirely, not just warned against.
Code Quality: The changes improve error handling and logging but could benefit from additional type annotations and tests.
Backward Compatibility: The MD5/SHA1 deprecation warning may cause issues for existing users. A migration guide is recommended.

Overall, this PR is a significant improvement but requires additional measures to fully address security concerns.

github-actions · 2026-03-23T20:17:59Z

🤖 AI Agent: security-scanner — Findings and Recommendations

Findings and Recommendations

1. Supply Chain Attack Vector in `quickstart.ps1`

Severity: 🔴 CRITICAL
Issue: The script referenced an unregistered PyPI package name agent-os, which could allow an attacker to publish a malicious package under that name. This is a classic supply chain attack vector.
Fix: The issue was fixed by replacing agent-os with the correct and registered package name agent-os-kernel. This mitigates the risk of dependency confusion.
Recommendation:
- Ensure that all dependencies are verified and registered in trusted repositories.
- Implement automated dependency validation in CI/CD pipelines to detect unregistered or mismatched package names.
- Consider using tools like pip-audit or safety to scan for dependency issues.

2. Bare `except:` Blocks in `graph_debugger.py`

Severity: 🟠 HIGH
Issue: The use of bare except: blocks in two locations in graph_debugger.py could mask unexpected exceptions, making it harder to debug issues and potentially allowing malicious input to bypass error handling.
Fix: The bare except: blocks were replaced with specific exception types (ValueError, RuntimeError) and added logging to capture the exception details.
Recommendation:
- Continue to avoid bare except: blocks in all code.
- Regularly audit exception handling to ensure that only expected exceptions are caught.
- Use logging at appropriate levels (e.g., debug, warning, error) to provide visibility into errors without exposing sensitive information.

3. Deprecation of MD5/SHA1 in `text_tool.py`

Severity: 🟡 MEDIUM
Issue: The hash method in text_tool.py allowed the use of insecure hashing algorithms (MD5 and SHA1), which are vulnerable to collision attacks (CWE-328). While the method now emits a deprecation warning, it still allows these algorithms to be used.
Fix: A deprecation warning was added to discourage the use of MD5 and SHA1.
Recommendation:
- Deprecation warnings are a good first step, but consider removing support for MD5 and SHA1 entirely in future releases.
- If backward compatibility is required, provide a clear timeline for deprecation and removal.
- Update documentation to strongly recommend secure alternatives like SHA-256 or SHA-512.

Additional Observations

Logging Practices:
- The added logging in graph_debugger.py and text_tool.py is a good practice. However, ensure that logging does not inadvertently expose sensitive information (e.g., user input or secrets). In this case, the logged exceptions seem safe.
Testing for Changes:
- Ensure that the changes to exception handling and hash deprecation are covered by unit tests. Specifically:
  - Test that the correct exceptions are caught and logged in graph_debugger.py.
  - Test that the deprecation warning is emitted when MD5 or SHA1 is used in text_tool.py.
Dependency Management:
- The supply chain attack fix is critical. To prevent similar issues in the future:
  - Use tools like pip-tools or poetry to lock dependencies.
  - Regularly audit dependencies for typosquatting or malicious packages.
Code Duplication in graph_debugger.py:
- The file graph_debugger.py appears to be duplicated in two locations (mute_agent/visualization and mute-agent/src/visualization). This duplication increases the risk of inconsistencies and maintenance overhead.
- Recommendation: Refactor the project structure to avoid duplication. Use a single source file and import it where needed.

Summary of Findings

Issue	Severity	Fix Implemented	Recommendation
Dependency confusion in `quickstart.ps1`	🔴 CRITICAL	✅ Fixed	Use automated dependency validation tools and ensure all dependencies are trusted.
Bare `except:` blocks in `graph_debugger.py`	🟠 HIGH	✅ Fixed	Avoid bare `except:` blocks and ensure proper logging and exception handling.
MD5/SHA1 deprecation in `text_tool.py`	🟡 MEDIUM	✅ Fixed	Plan for complete removal of insecure algorithms in future releases.

Overall, this PR addresses critical and high-severity issues effectively. However, further steps are recommended to enhance security and maintainability.

imran-siddique and others added 18 commits March 20, 2026 10:56

docs: add testing guide for external testers and customers

9bd6672

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Merge branch 'main' of https://github.com/microsoft/agent-governance-…

3ab4a65

…toolkit

ci: add markdown link checker workflow (microsoft#323)

baeed60

Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>

feat: add policy evaluation heatmap to SRE dashboard (microsoft#309) (m…

8ee3c81

…icrosoft#326)

Merge branch 'main' of https://github.com/microsoft/agent-governance-…

96b2046

…toolkit

Merge branch 'main' of https://github.com/microsoft/agent-governance-…

3ac1f73

…toolkit

Merge branch 'main' of https://github.com/microsoft/agent-governance-…

d0681ff

…toolkit

Merge branch 'main' of https://github.com/microsoft/agent-governance-…

60bdccd

…toolkit

github-actions bot added the size/S Small PR (< 50 lines) label Mar 23, 2026

github-actions bot reviewed Mar 23, 2026

View reviewed changes

imran-siddique merged commit 57d7a03 into microsoft:main Mar 23, 2026
52 checks passed

imran-siddique deleted the fix/security-audit-march23 branch March 28, 2026 16:48

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(security): dependency confusion, bare excepts, MD5 deprecation#352

fix(security): dependency confusion, bare excepts, MD5 deprecation#352
imran-siddique merged 18 commits intomicrosoft:mainfrom
imran-siddique:fix/security-audit-march23

imran-siddique commented Mar 23, 2026

Uh oh!

github-actions bot left a comment

Uh oh!

github-actions bot commented Mar 23, 2026

Findings and Recommendations

1. Supply Chain Attack Vector in `quickstart.ps1`

2. Bare `except:` Blocks in `graph_debugger.py`

3. Deprecation of MD5/SHA1 in `text_tool.py`

Additional Observations

Summary of Findings

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

imran-siddique commented Mar 23, 2026

Uh oh!

github-actions bot left a comment

Choose a reason for hiding this comment

🤖 AI Agent: code-reviewer

Review Summary

🔴 CRITICAL: Dependency Confusion in quickstart.ps1

HIGH: Bare except Blocks in graph_debugger.py

MEDIUM: MD5/SHA1 Deprecation in text_tool.py

General Feedback

Logging

Type Safety

Backward Compatibility

OWASP Agentic Top 10 Compliance

Actionable Recommendations

Final Assessment

Uh oh!

github-actions bot commented Mar 23, 2026

Findings and Recommendations

1. Supply Chain Attack Vector in quickstart.ps1

2. Bare except: Blocks in graph_debugger.py

3. Deprecation of MD5/SHA1 in text_tool.py

Additional Observations

Summary of Findings

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

🔴 CRITICAL: Dependency Confusion in `quickstart.ps1`

HIGH: Bare `except` Blocks in `graph_debugger.py`

MEDIUM: MD5/SHA1 Deprecation in `text_tool.py`

1. Supply Chain Attack Vector in `quickstart.ps1`

2. Bare `except:` Blocks in `graph_debugger.py`

3. Deprecation of MD5/SHA1 in `text_tool.py`