mirror of
https://github.com/calesthio/OpenMontage.git
synced 2026-08-05 15:20:40 +08:00
b69ce5f9a2
math_animate writes caller-supplied Python to scene.py and runs Manim on it — arbitrary local code execution with no boundary surfaced in the tool contract. In an agent-driven system the scene_code may be LLM-generated or influenced by untrusted prompt content, so import-time code or construct() could read secrets/SSH material, open network connections, or spawn subprocesses. Add a static AST safety scan that rejects dangerous imports (os, subprocess, socket, requests, ctypes, ...), dangerous builtins (eval/exec/compile/open/ __import__), and sandbox-escape dunders (__globals__, __subclasses__, ...) before Manim runs. Genuine math scenes (manim, numpy, math, ...) pass untouched. This is defense-in-depth, not a sandbox: a determined attacker can evade a static denylist, so it is paired with an explicit allow_unsafe_code opt-out and a tool contract (schema + side_effects) that names the boundary. Closes #219