Is Manus too smart? A prompt word even outputs its own core configuration file to the user (/opt/.manus/)

0. Overview (refer to the author's published content)

1. Based on Claude Sonnet model 

2. Claude Sonnet with 29 tools 

3. Claude Sonnet does not support Multi-Agents 

4. It uses the @browser_use feature 

5. The browser_use code is obfuscated 

6. The tools and prompt words have jailbreak cracks

1. Analysis of Architecture Composition

1. Capability definition layer (prompt.txt)

- Define the core capabilities of AI in the form of structured documents

- Contains 4 core modules:

  * General skills (information processing/content creation/problem solving)

  * Tool interface (browser/file system/shell/deployment, etc.)

  * Programming support (language/framework/database)

  * Task methodology (demand understanding/execution process/quality assurance)

2. Tool execution layer (tools.json)

- Implemented as 32 function definitions in JSON format

- Covers 6 functional areas:

│─Communication tools (user message notification/inquiry) │─File system (read/write/search/replace) │─Shell operation (command execution/process management) │─Browser control (navigation/click/scroll/console) │─Deployment capabilities (port exposure/application deployment) │─Accessibility (idle state identification)

2. Core Function Design

1. Multimodal interaction capabilities

- Browser Automation:

"browser_input": { "parameters": { "coordinate_x": "number", "coordinate_y": "number", "text": "Input content", "press_enter": "boolean" } }

Supports refined web page operations such as coordinate click, text input, and enter confirmation

- Shell Integration:

"shell_exec": { "parameters": { "exec_dir": "absolute path", "command": "execute command" } }

Supports executing any Linux command in the specified directory and has complete command line operation capabilities

2. Security sandbox mechanism

- File operations are limited to absolute paths:

 "file_read": { "parameters": { "file": "/absolute/path/to/file" } }

- Permission control parameters:

"sudo": { "type": "boolean", "description": "Whether to use privileged permissions" }

All sensitive operations require explicit sudo permissions

3. Engineering deployment capabilities

- Static website deployment:

"deploy_apply_deployment": { "parameters": { "type": "static", "local_dir": "/project/path" } }

- Service exposure:

"deploy_expose_port": { "parameters": { "port": 8080 } }

Supports cloud deployment of modern frameworks such as Next.js

3. Interaction Protocol Analysis

1. Session Management

- Shell session persistence:

"shell_view": { "parameters": { "id": "Session ID" } }

Maintain multiple shell session contexts through unique IDs

2. Exception handling mechanism

- Process Monitoring:

"shell_wait": { "parameters": { "seconds": 30 } }

You can set a timeout to wait for command execution

- Forced Termination:

"shell_kill_process": { "parameters": { "id": "session ID" } }

3. User collaboration mode

- Progressive Interaction:

"message_ask_user": { "parameters": { "suggest_user_takeover": "browser" } }

It is possible to suggest that users take over the browser for manual operation

4. Development Paradigm Characteristics

1. Hybrid Programming Model

- Support direct execution of code snippets:

"browser_console_exec": { "parameters": { "javascript": "console.log('Hello World')" } }

- Support file-level programming:

"file_write": { "parameters": { "content": "Complete code content" } }

2. Agent Collaboration Features

- Context-aware: 

"browser_view": {} // Automatically get the current page status

- Autonomous decision making:

"file_str_replace": { "parameters": { "old_str": "Error content", "new_str": "Corrected content" } }

Can correct file content errors independently

5. Security Boundary Design

1. Privacy protection mechanism

- Obtaining web content requires explicit operation:

"browser_scroll_down": { "parameters": { "to_bottom": true } }

Unable to automatically crawl the full page content

2. Operational audit capabilities

- All file modification records:

  "file_write": { "parameters": { "append": false // Force overwrite } }

Keep clear records of file changes

6. Typical application scenarios

1. Automated Operation and Maintenance

sequenceDiagram User->>Manus: Request to deploy website Manus->>Shell: Execute git pull Manus->>File system: Modify nginx configuration Manus->>Deployment tool: Execute docker-compose up Manus->>User: Return deployment result

2. Data collection tasks

# Pseudocode example browser_navigate("https://news.site")for i in range(5): browser_scroll_down()articles = browser_console_exec("document.querySelectorAll('.title')")file_write("/data/articles.txt", articles)