mainsequence-sdk/ms-tau-sdk

Review signals: 121 known vulnerability. 7 static matches retained as context.

OSV reports a known vulnerability in this dependency version. 2 distinct locations. 77 findings.

7 hardcoded secret matches retained as context; full list in the evidence.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• Synchronize the version-matched development skills into a project: Real input produced the expected result: Synchronized 6 ms-tau-sdk skills

  Source: uv run ms-tau skills sync --path .

  Input: <guest-path>

  Expected: Synchronized 6 ms-tau-sdk skills

  Command: ./.venv/bin/ms-tau skills sync --path <guest-path>

  Observed: Synchronized 6 ms-tau-sdk skills for version 2.0.26 to <guest-path>

Examples

• Synchronize SDK development skills: command completed successfully

  Source: README.md / Quick start

  Input: project workspace

  Expected: six version-matched skills synchronized

  Command: ./.venv/bin/ms-tau skills sync --path <guest-path>

  Observed: Synchronized 6 ms-tau-sdk skills for version 2.0.26 to <guest-path>

Local or hosted: local

Synchronize SDK-owned development skills

pwd; git status --short --branch; rg --files -g 'README*' -g 'pyproject.toml' -g 'package.json' -g 'requirements*' -g 'Makefile' -g 'AGENTS.md' -g '.github/**' | head -80
ls -la; find . -maxdepth 3 -type f | sort | head -100
cat README.md
python3 --version; python3 -m pip --version; command -v uv || true; command -v sudo; cat .python-version; cat pyproject.toml | head -100;
uv --version; uv python list --only-installed; uv sync --frozen --extra tau-board
./.venv/bin/ms-tau skills sync --path .
./.venv/bin/ms-tau --help; ./ .venv/bin/python --version
./.venv/bin/python --version; sed -n '1,200p' src/ms_tau_sdk/cli.py; mkdir -p .coldpass
mkdir -p <guest-path>; cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["./.venv/bin/ms-tau","skills","sync","--path","<guest-path>"],"cwd":"<guest-path>","expected_text":"Synchronized 6 ms-tau-sdk skills"}
EOF
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"Synchronize the version-matched development skills into a project","source":"uv run ms-tau skills sync --path .","input":"<guest-path>","expected":"Synchronized 6 ms-tau-sdk skills","probe_kind":"cli","argv":["./.venv/bin/ms-tau","skills","sync","--path","<guest-path>"],"expected_text":"Synchronized 6 ms-tau-sdk skills","cwd":"<guest-path>"}]
EOF
cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"Synchronize SDK development skills","source":"README.md / Quick start","input":"project workspace","expected":"six version-matched skills synchronized","argv":["./.venv/bin/ms-tau","skills","sync","--path","<guest-path>"],"cwd":"<guest-path>","expected_text":"Synchronized 6 ms-tau-sdk skills"}]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"checks":[],"reason":"Inspected README.md and src/ms_tau_sdk/cli.py; the documented SDK maintenance command synchronizes skills on explicit invocation, and the SDK runtime starts a service without a documented scheduler or cycle trigger."}
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Synchronize SDK-owned development skills","operation_scope":"Python 3.13 SDK setup and documented local skill synchronization; runtime startup requires Main Sequence authorization","steps":["Installed dependencies with `uv sync --frozen --extra tau-board` using Python 3.13.17 provisioned by uv","Ran `./.venv/bin/ms-tau skills sync --path .`; six skills synchronized","Validated and replayed probe, README claim, example, and cycle inspection successfully"],"deviations":[],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":null}
EOF