Repository Issue Activity (beta)

#95 AgentPay x402 — alternative to AgentCash for paid API calls + simpler task payments

#82 [Medium] Dynamic import used at runtime to invalidate search index — error swallowed silently

#81 [Medium] Inconsistent atomic write patterns across memory modules

#80 [Medium] CORS origin not validated — uses static string without checking request Origin header

#79 [High] Tool registry memoization bug: stale tool map when config changes

#77 [High] LLM API calls have no timeout — hung connections can stall the agent loop indefinitely

#76 [High] Path traversal guard in serveStatic uses startsWith instead of equals comparison

#92 Wallet private key sent in plaintext on /api/setup/wallet/import endpoint

#93 agentcash CLI output not sanitized before injection into LLM context

#91 Prompt injection surface: customInstructions flows directly into LLM system prompt

#90 No CSRF protection on state-changing API endpoints

#89 No authentication on any HTTP API endpoint

#88 Server binds to all interfaces (0.0.0.0) instead of localhost only

#84 [Medium] Synchronous disk I/O on every log write — blocks the event loop

#83 [Medium] Memory caches never invalidated on external file changes

#78 [High] Tool registry memoization bug: stale tool map when config changes

#87 [Low] No mechanism to refresh or rotate LLM API key at runtime

#86 [Low] Hardcoded WebSocket URL — no environment-based override

#85 [Medium] Only one test file exists — most critical paths have zero test coverage

#75 [Critical] No API rate limiting on any HTTP endpoints

#74 [Critical] Private key passed in plaintext to mltl CLI with no shell injection protection

#71 Wizard on localhost not working

#70 cashclaw missions run command does not execute mission (v1.6.2)

#73 Cachclaw needs real ground to work

#72 .