zeroclaw-labs/zeroclaw · error · anyhow::Error

agents.{agent_alias}.risk_profile is empty

Error message

agents.{agent_alias}.risk_profile is empty

What it means

Thrown while building the security status report: resolve_agent_context loads agents.<alias> from the ZeroClaw config and trims its risk_profile string. If that field is empty or whitespace-only, the agent cannot be mapped to a risk profile and report generation aborts before SecurityPolicy::for_agent runs. The check just after this one would reject a risk_profile that names a nonexistent risk_profiles.<name> entry, so an empty value is a distinct, earlier failure.

Source

Thrown at src/security_status.rs:367

struct ResolvedAgentContext<'a> {
    profile_alias: String,
    _risk_profile: &'a RiskProfileConfig,
    agent_enabled: bool,
    policy: SecurityPolicy,
}

fn resolve_agent_context<'a>(
    config: &'a Config,
    agent_alias: &str,
) -> Result<ResolvedAgentContext<'a>> {
    let agent_config = config
        .agents
        .get(agent_alias)
        .with_context(|| format!("agents.{agent_alias} is not configured"))?;
    let profile_alias = agent_config.risk_profile.trim();
    if profile_alias.is_empty() {
        bail!("agents.{agent_alias}.risk_profile is empty");
    }
    let risk_profile = config.risk_profiles.get(profile_alias).with_context(|| {
        format!("agents.{agent_alias}.risk_profile names missing risk_profiles.{profile_alias}")
    })?;
    let policy = SecurityPolicy::for_agent(config, agent_alias)?;

    Ok(ResolvedAgentContext {
        profile_alias: profile_alias.to_string(),
        _risk_profile: risk_profile,
        agent_enabled: agent_config.enabled,
        policy,
    })
}

fn sandbox_config_from_policy(policy: &SecurityPolicy) -> SandboxConfig {
    SandboxConfig {
        enabled: policy.sandbox_enabled,
        backend: policy

View on GitHub (pinned to 88bb9c8533)

Solutions

1. Open the active config at [agents.<alias>] and set risk_profile to an existing key, e.g. risk_profile = "standard"
2. Confirm a matching [risk_profiles.<name>] table exists — otherwise the next check fails with 'names missing risk_profiles.<name>'
3. Re-run the security status command and confirm the report renders
4. If unsure which profiles exist, list the top-level risk_profiles map in the config before choosing

Example fix

# before
[agents.helper]
enabled = true
risk_profile = ""

# after
[agents.helper]
enabled = true
risk_profile = "standard"

[risk_profiles.standard]
sandbox_enabled = true

// Rust, before building the security report
fn agent_risk_profile_ready(config: &zeroclaw_config::config::Config, alias: &str) -> bool {
    config.agents.get(alias).is_some_and(|a| {
        let profile = a.risk_profile.trim();
        !profile.is_empty() && config.risk_profiles.get(profile).is_some()
    })
}

if !agent_risk_profile_ready(&config, "helper") {
    eprintln!("agent 'helper' needs a non-empty risk_profile that exists under [risk_profiles]");
}

match build_report(&config) {
    Err(e) if e.to_string().contains("risk_profile is empty") => { /* fill the field, do not retry unchanged */ }
    Err(e) if e.to_string().contains("names missing risk_profiles") => { /* add the profile entry */ }
    other => other,
}

When it happens

Trigger: Running the security status command (build_report path) for an agent whose [agents.<alias>] entry exists but has risk_profile = "", a risk_profile key absent so it defaults to empty, or a value made only of spaces/tabs.

Common situations: A new agent block copied from a template with the profile left blank; risk_profile dropped during a config migration or hand-edit; TOML indentation putting risk_profile under the wrong table so the agent entry sees the empty default.

Related errors

• Agent has no transcription_provider configured. Set `agent.<
• Edge TTS binary_path must be a bare command name without pat
• Agent has no tts_provider configured. Set `agent.<alias>.tts
• webhook channel requires a `secret` configured for request a
• Refusing to transmit sensitive data over non-HTTPS URL: URL

AI-assisted analysis of zeroclaw-labs/zeroclaw@88bb9c8533 (2026-08-23). Data as JSON: /api/errors/6c17f52e5419b38b. Report an issue: GitHub.