[etserend]

Summary

• CrewAIEventListener._hash_to_uuid used hashlib.md5 to derive deterministic UUIDs for event correlation, which Semgrep flags (insecure-hash-algorithm-md5).
• It now builds the UUID from the first 16 bytes of a SHA-256 digest. Still deterministic and still a UUID; run IDs derived from the same inputs change value.
• Resolves VULN-115244.

Test plan

• poetry run pytest tests/test_crewai_handler.py -n 0 (92 passed)
• ruff check / ruff format --check clean on handler.py

🤖 Generated with Claude Code

[etserend]

🤖 This review was generated by the Astra agent (claude-opus-5-5). It may contain mistakes.

Verdict: approve — The one-line swap from MD5 to SHA-256 keeps run IDs deterministic and internally consistent, so CrewAI correlation still works.

Follow-ups

Suggested follow-up work that could be tracked as Jira tickets:

• src/splunk_ao/handlers/crewai/handler.py:290-290: _hash_to_uuid builds a UUID from raw digest bytes and does not set the version or variant bits. This was also true with MD5. src/splunk_ao/utils/uuid_utils.py:74 uses UUID(bytes=digest[:16], version=4) for the same pattern. Passing version=4, or calling a shared helper, would give RFC 4122-compliant IDs. It would also stop a digest from looking like a UUIDv7 by chance. No current CrewAI path calls convert_uuid_if_uuid7, so this does not block the change.

[etserend]

🤖 This review was generated by the Astra agent (claude-opus-5-5). It may contain mistakes.

Verdict: approve — The SHA-256 swap removes the MD5 finding and keeps run IDs deterministic, with RFC 4122 version bits now set.

Follow-ups

Suggested follow-up work that could be tracked as Jira tickets:

• src/splunk_ao/handlers/crewai/handler.py:288-290: _hash_to_uuid and src/splunk_ao/utils/uuid_utils.py:71-74 repeat the same SHA-256-to-UUIDv4 logic. Extract a shared helper such as deterministic_uuid4(value: str) in uuid_utils.py. Both call sites can then use it, so the two derivations cannot drift apart.

[etserend]

🤖 This review was generated by the Astra agent (claude-opus-5-5). It may contain mistakes.

Verdict: approve — The SHA-256 helper removes the only MD5 use, keeps run IDs deterministic, and keeps uuid7_to_uuid4 output byte-identical.

General Comments

• 🔵 nit (documentation): The PR description is out of date with the branch, which can mislead the human reviewer:
• The Summary does not say that the version and variant bits are now set.
• The Summary does not mention the new shared deterministic_uuid4 helper in src/splunk_ao/utils/uuid_utils.py:37, or that uuid7_to_uuid4 now calls it.
• The test plan reports "92 passed" and only handler.py lint. That predates commits 6efd50d and a66ec13, which add a test and touch two more files.

Update the Summary and re-run the test plan on the head commit.