# Risk Discovery & Scanning

Armorer automatically detects security risks in agent code and configuration before and during installation.

## Automated Discovery

The system performs a multi-stage analysis:

1.  **Vulnerability Scan**: Initial pass to check for critical system-level vulnerabilities.
2.  **AI Analysis**: The Agent analyzes the repository's `docker-compose.yml` and `Dockerfile` to detect dangerous patterns:
    *   **Privileged Mode**: Flagged as a high security risk.
    *   **Sensitive Mounts**: Detects if an agent is trying to mount the host's `/var/run/docker.sock` or home directory.
3.  **Risk Interview**: The **AI Security Architect** reviews these findings and interviews the user to select an appropriate isolation profile (`SANDBOXED`, `SCOPED`, etc.).

## Proactive Defense

### 1. Network Gating
During the analysis phase, the Agent identifies required ports. Armorer then generates firewall and network rules to ensure the agent only talks to the outside world if explicitly allowed.

### 2. Secret Protection
By scanning for required environment variables, Armorer ensures that high-value secrets (like API keys) are **never** committed to disk in plain text, instead routing them through the [Credential Vault](credentials.md).

> **Note**: Traditional static analysis tools (`bandit`, `safety`) are currently being refactored to better handle containerized agent contexts.

