If you discover a security vulnerability in Tamandua, please report it privately by opening a GitHub security advisory.

Tamandua runs AI agents that execute code on your machine. We take security seriously.

• Curated repo only — Tamandua only installs workflows from the official repository. No arbitrary remote sources.
• Prompt injection review — Every bundled workflow is reviewed for prompt injection attacks before being merged.
• No external commands in YAML — Workflow steps use template placeholders ({{key}}), not shell interpolation, preventing command injection through workflow input.

• Role-based access — Each agent role restricts what it can do:
  • analysis roles cannot write files
  • verification roles cannot modify code they verify
  • testing roles cannot write production code
• Separate workspaces — Each agent has its own workspace directory
• Fresh context — Each agent step runs in a clean session

• All state is stored locally under ~/.tamandua/
• No data is sent to remote servers except through the configured AI provider
• API keys are read from pi's existing config (~/.pi/agent/auth.json)
• No credentials are stored in workflow definitions

Tamandua has minimal dependencies:

• yaml for parsing workflow definitions
• json5 for reading OpenClaw config (fallback compatibility)

All other functionality uses Node.js standard library.