Security audit

Wip Ai Devops Toolbox Private

Security checks for vulnerabilities and agentic risk

Overview

This DevOps toolbox is mostly disclosed, but it needs Review because it installs persistent agent hooks/MCP tools and contains confirmed unsafe shell-command paths plus bundled browser-cookie tooling outside the main purpose.

Install only if you are comfortable granting this package persistent control over developer tooling: global CLIs, Claude/OpenClaw hooks, user-scope MCP servers, repo/release mutation, and publishing credentials. Avoid using it on untrusted repositories until the installer and license scanner replace shell-string execSync calls with argument-vector execution, and do not load or use the bundled gstack browser cookie-import features unless you explicitly want local browser session cookies read into automation.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

Location: ai/repos/gstack-private/SKILL.md:203
Finding: Unverified Remote Installer Is Piped Directly to Bash
Content: View full analysis
&& ./setup` 3. If `bun` is not installed: `curl -fsSL https://bun.sh/install | bash` ``` The same command is repeated in several generated or bundled gstack Skills: ```bash curl -fsSL https://bun.sh/install | bash ``` ### Technical Analysis The instruction downloads mutable content from an external domain and sends it directly to a command interpreter. The downloaded script is neither pinned to a version nor checked against a cryptographic hash or signature. It is also not saved locally for inspection before execution. Although `bun.sh` is associated with the Bun runtime required by the nested gstack tooling, executing a mutable network response means the effective code is not the same fixed code that was reviewed in this repository. Compromise of the remote service, its deployment pipeline, DNS resolution, or the TLS trust chain could change the executed payload without modifying this project. The command appears in active Skill instructions and in the source generator, so regenerating the documentation will preserve the unsafe behavior. ### Attack Path 1. An agent loads one of the bundled gstack Skills. 2. The setup check determines that the compiled browser command or Bun runtime is una ...[truncated 913 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: tools/wip-universal-installer/install.js:765
Finding: Command Injection Through Installer Target and Flag Arguments
Content: View full analysis
a.startsWith('--')); const rawTarget = process.argv[2]; execSync(`ldm install ${rawTarget} ${flags.join(' ')}`, { stdio: 'inherit' }); ``` The same unsafe delegation is repeated after automatic LDM bootstrap: ```js const flags = args.filter(a => a.startsWith('--')); const rawTarget = process.argv[2]; try { execSync(`ldm install ${rawTarget} ${flags.join(' ')}`, { stdio: 'inherit' }); process.exit(0); } catch (delegateErr) { if (!JSON_OUTPUT) console.error(' ldm install failed. Falling back to standalone installer.'); } ``` The values originate from raw process arguments: ```js const args = process.argv.slice(2); const DRY_RUN = args.includes('--dry-run'); const JSON_OUTPUT = args.includes('--json'); const target = args.find(a => !a.startsWith('--')); ``` ### Technical Analysis `execSync()` executes a command string through a shell. Both `rawTarget` and every argument beginning with `--` are concatenated into that string without shell escaping, validation, or an allowlist. Consequently, shell metacharacters, substitutions, redirections, and command separators in an attacker-influenced target or flag can be interpreted as shell syntax rather than as literal `ldm` arguments. Filtering flags only by the `--` prefix does not make them safe. An argument can begin with `--` and still contain shell syntax. The vulnerable command is used both when LDM is already installed and after the installer silently installs LDM, providing two reachable execution paths. ### Attack Path 1. An attacker supplies a crafted installation target or persuades an agent to invoke `wip-install` with attacker-controlled text. 2. `wip-install` copies the raw target and `--`-prefixed arguments fr ...[truncated 883 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: tools/wip-universal-installer/install.js:370
Finding: Repository-Controlled Package Metadata Reaches MCP Registration Shell Commands
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: tools/wip-license-hook/src/core/scanner.ts:62
Finding: Dependency Names Are Interpolated Into License-Scanner Shell Commands
Content: View full analysis
/dev/null`, { encoding: "utf-8", timeout: 10000 } ).trim(); if (out) detectedLicense = normalizeSpdx(out); } catch { /* offline or not found */ } } } ``` Parsed Python dependency names reach another shell command: ```ts const name = trimmed.split(/[=<>!~\[]/)[0].trim(); if (name) names.push(name); // ... const out = execSync( `pip show ${name} 2>/dev/null`, { encoding: "utf-8", timeout: 10000 } ); ``` Cargo dependency names are handled similarly: ```ts const match = line.match(/^(\S+)\s*=/); if (!match) continue; const name = match[1]; // ... const out = execSync( `cargo info ${name} 2>/dev/null`, { encoding: "utf-8", timeout: 10000 } ); ``` ### Technical Analysis The license scanner treats project manifests as data sources but executes shell command strings derived from them. A repository being audited may be untrusted, and its dependency names can be attacker-controlled. JSON property names are not constrained by npm's package-name grammar merely because they ...[truncated 1651 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: tools/wip-release/core.mjs:241
Finding: Package Publishing Tokens Are Exposed in Child-Process Arguments
Content: View full analysis
/dev/null`, { encoding: 'utf8' } ).trim(); } catch { throw new Error('Could not fetch npm token from 1Password. Check op CLI and SA token.'); } } ``` The retrieved token is placed directly in npm's argument vector: ```js export function publishNpm(repoPath) { const token = getNpmToken(); runNpmPublish([ 'publish', '--access', 'public', `--//registry.npmjs.org/:_authToken=${token}`, ], repoPath); } export function publishNpmWithTag(repoPath, tag) { const token = getNpmToken(); runNpmPublish([ 'publish', '--access', 'public', '--tag', tag, `--//registry.npmjs.org/:_authToken=${token}`, ], repoPath); } ``` GitHub Packages uses the same pattern: ```js export function publishGitHubPackages(repoPath) { const ghToken = execSync('gh auth token', { encoding: 'utf8' }).trim(); execFileSync('npm', [ 'publish', '--registry', 'https://npm.pkg.github.com', `--//npm.pkg.github.com/:_authToken=${ghToken}` ], { cwd: repoPath, stdio: 'inherit' }); } ``` The helper redacts errors but not operating-system process arguments: ```js const res = spawnSync('npm', args, { cwd, encoding: 'utf8', stdio: ['inherit', 'inherit', 'pipe'] }); const safeArgs = args.map( a => a.replace(/_authToken=[^&\s]+/, '_authToken=***') ); ``` ### Technical Analysis Error-message redaction protects only the code-generated error string. It does not rem ...[truncated 1482 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (865)

Context-Inappropriate Capability

Critical

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The setup instructions direct the agent to fetch and execute https://bun.sh/install through bash if Bun is missing. Remote software installation is a high-impact host modification capability and is not a direct or obvious requirement of a browser QA skill as described in the manifest.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Critical

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The code can discover installed browsers and import cookies from them for a chosen domain, then inject those cookies into the automation context. Harvesting authentication material from local browser profiles is not an obvious or necessary requirement for release pipelines, license compliance, copyright enforcement, repo visibility guards, identity file protection, manifest reconciliation, or best-practices tooling.
Content: No source excerpt is available for this finding.

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · CHANGELOG.md (reported line 1532)May include surrounding context.
md
## 1.9.18 (2026-03-14) Rewrite SKILL.md install flow to use ldm install. Conversational AI-guided pattern matching Memory Crystal. ## 1.9.17 (2026-03-14)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The code implements only one narrow part of the declared toolkit: a release/deployment pipeline that publishes a private repository to a public GitHub repository and syncs releases. It does not show functionality for license compliance, copyright enforcement, repo visibility protection, identity file protection, manifest reconciliation, or MCP-exposed agent-callable tooling. While excluding ai/ and some local config files is loosely related to publication hygiene, that is not enough to substantiate the broader declared description. Therefore the supplied code chunk materially underdelivers relative to the declared capabilities and represents a narrower purpose than advertised.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The supplied code does not implement any of the declared DevOps/security/compliance toolkit functions such as release pipelines, license checking, copyright enforcement, repository visibility protection, identity file protection, manifest reconciliation, or best-practice validation. Instead, it is a browser manager for automated web interaction using Chromium via Playwright. This is a materially different primary purpose and introduces undeclared capabilities related to browser control, web navigation, event capture, and session handoff. Therefore the description does not accurately represent the code.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description promises a broad DevOps and repository-governance toolkit with capabilities like release pipelines, license compliance, copyright enforcement, repo visibility guarding, identity file protection, manifest reconciliation, and MCP-callable core tools. The supplied code does none of those things. Instead, it implements a shared TypeScript utility module containing a fixed-capacity ring buffer and three buffer instances for log, network, and dialog entries. Its purpose is operational event storage for a browser or server component, likely to support observability or response matching. There is no evidence of pipeline management, compliance checks, repository protection, identity file handling, manifest reconciliation, or MCP tool exposure in this chunk. This is a clear description-behavior mismatch with a materially different primary purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The supplied code does not implement the declared DevOps/security/compliance toolkit functions. Instead, it is a command-line client for a headless browser service, supporting navigation, DOM inspection, screenshots, cookies, tabs, dialogs, and related browser automation. Its primary behavior is starting/restarting a local server, checking health, and forwarding browser commands over HTTP. None of the declared capabilities—release pipeline, license compliance, copyright enforcement, repo visibility guard, identity file protection, manifest reconciliation, or MCP-exposed DevOps best practices—are evidenced in this code chunk. This is a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description says this skill is a DevOps toolkit focused on software development governance and repository/security workflows. The supplied code does not implement or reference release pipelines, license compliance, copyright enforcement, repo visibility protection, identity file protection, manifest reconciliation, or best-practice auditing. Instead, it is a browser command catalog for an MCP-style browsing/automation server. Its primary purpose is materially different: defining browser automation commands and their descriptions, with load-time validation of registry completeness. This is a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a broad DevOps/security/compliance toolkit with features like release pipelines, license compliance, copyright enforcement, repo visibility guarding, identity protection, manifest reconciliation, and MCP-callable core tools. The supplied code does not implement any of those capabilities. Instead, it is a narrow configuration utility for a browse CLI/server, focused on filesystem path resolution, directory creation, .gitignore maintenance, git metadata lookup, and version-file reading. These are materially different behaviors and constitute undeclared capabilities relative to the stated purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents a DevOps/security/compliance toolkit focused on software development workflows and repository governance. The supplied code instead implements credential/session access functionality: it inspects local browser data, invokes macOS Keychain to obtain safe-storage passwords, decrypts Chromium cookies, and returns usable cookies for automation. This is a materially different primary purpose and includes sensitive capabilities not suggested by the description. While the code contains some validation and safety checks, those are implementation details and do not align it with the declared DevOps toolkit purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The code chunk does not implement any of the declared DevOps/security-compliance toolkit functions such as release pipeline management, license compliance, copyright enforcement, repo visibility guarding, identity file protection, manifest reconciliation, or best-practices checks. Instead, it provides a local web API and UI for accessing browser cookies and importing them into Playwright sessions. That is a materially different primary purpose and introduces undeclared capabilities related to browser inspection and cookie handling. This is a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is about a DevOps and repository-governance toolkit with MCP-callable tools for software development workflows. The supplied code instead implements a cookie picker interface that interacts with local '/cookie-picker' endpoints to enumerate browsers, list cookie domains, import cookies for chosen domains, and remove them from a session. This is a materially different purpose and introduces undeclared capabilities related to browser cookie handling. There is no evidence in this code chunk of release pipelines, license/copyright enforcement, repo visibility controls, identity file protection, manifest reconciliation, or MCP agent tooling.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The supplied code does not implement any of the declared DevOps toolkit functions such as release pipeline management, license compliance, copyright enforcement, repo visibility protection, identity file protection, manifest reconciliation, or MCP-exposed best-practice tooling. Its actual purpose is narrow and unrelated: locating a local binary on disk and printing its absolute path. While filesystem access and git-root detection are reasonable implementation details for a binary locator, that locator itself is not represented in the declared description. Therefore the description materially misrepresents this code chunk’s primary behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a DevOps/security/compliance toolkit centered on software development workflows and repository governance. The supplied code instead belongs to a browser automation subsystem and exposes interactive browsing meta-commands. Its primary purpose is controlling browser tabs and page capture/inspection, not release pipelines, license compliance, copyright enforcement, repo visibility guarding, identity file protection, manifest reconciliation, or best-practices checks. While the code includes some security-oriented path and URL validation, those are supporting details and do not align the implementation with the declared DevOps toolkit purpose. This is a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description is centered on DevOps/repository governance capabilities, but this code is for a web-browser interaction/inspection subsystem. None of the named declared functions—release pipeline, license compliance, copyright enforcement, repo visibility guard, identity file protection, or manifest reconciliation—are implemented here. Instead, the code exposes browser automation and data-extraction features via Playwright. It also includes capabilities not implied by the description, such as executing arbitrary JS in page context, reading a local file to execute as page JS, exposing cookies/storage/network data, and even modifying localStorage under the 'storage set' branch, which is a side effect and contradicts the file’s stated 'without side effects' comment. This is a material description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This code’s primary purpose is browser automation infrastructure, not DevOps/release/compliance/repository protection tooling. None of the declared functions—release pipeline management, license compliance, copyright enforcement, repo visibility guarding, identity file protection, manifest reconciliation, or best-practice checks—appear in this chunk. Instead, it starts a local authenticated server, launches Chromium, routes browser commands, exposes browser health/cookie routes, and writes runtime/log state to .gstack files. These are materially different capabilities and resources from the declared description, so this is a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The supplied code is not related to DevOps, release pipelines, license compliance, copyright enforcement, repository visibility, identity-file protection, manifest reconciliation, or general software-development governance tooling. Its primary purpose is browser automation/inspection: capturing and parsing accessibility snapshots from a webpage, mapping refs to Playwright locators, optionally scanning for interactive DOM elements, generating annotated screenshots, and diffing snapshots over time. These are materially different capabilities and resources from the declared description, so this is a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The code chunk does not implement any of the declared DevOps toolkit functions such as release automation, license compliance, copyright enforcement, repo visibility protection, identity file protection, manifest reconciliation, or MCP-exposed core tools. Instead, it performs a specific SSRF/navigation safety function: validating URLs, restricting schemes to HTTP/S, and denying access to cloud metadata hosts. This is a materially different primary purpose and introduces security/navigation validation capabilities not represented in the description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description centers on DevOps/repository governance functions, but the code is a web browsing automation command handler. Its primary purpose is controlling a browser and session state, not release pipelines, compliance, copyright enforcement, repo visibility, identity-file protection, or manifest reconciliation. It also accesses resources and capabilities not suggested by the description, including local filesystem reads for uploads/cookie files, browser cookie extraction/import, and opening a local UI endpoint. This is a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is about DevOps/repository governance and compliance tooling, but the supplied code clearly belongs to a browser automation system and its test suite. The tested capabilities center on controlling a browser, inspecting pages, interacting with DOM elements, capturing screenshots/PDFs, handling cookies/headers/storage, and enforcing safe file-path handling for browser-related outputs. None of the declared primary functions—release pipeline, license compliance, copyright enforcement, repo visibility guard, identity file protection, manifest reconciliation, or software-development best practices—are represented in this code chunk. This is therefore a strong description/behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description promises a comprehensive DevOps toolkit with multiple security/compliance and release-management capabilities exposed via MCP. The supplied code chunk instead contains unit tests for configuration-related functions of a 'browse' component. It operates on local filesystem paths, .gitignore contents, git metadata parsing, version hash reading, and server script path resolution. While it does touch repository-related details and local state handling, these are supporting config behaviors for a browse utility, not the declared core toolkit features. Therefore the description materially overstates and misrepresents this code chunk's actual purpose and capabilities.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description describes a DevOps-oriented toolkit with release, compliance, repository visibility, identity-file protection, manifest reconciliation, and best-practices functions exposed via MCP. The supplied code does none of that. Instead, it is focused on browser cookie import functionality and its tests: handling Chromium cookie DB schemas, decrypting encrypted cookies, mocking keychain access, and validating browser/profile-related behavior. This is a materially different purpose and introduces security-relevant capabilities around browser cookie handling that are not mentioned in the declaration.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description describes a DevOps-oriented toolkit with governance, compliance, release, visibility, identity-file, and manifest features exposed via MCP. The supplied code chunk does not implement or test any of those capabilities. Instead, it is narrowly focused on testing web routes for a cookie-picker feature, including CORS headers, JSON error responses, HTML route handling, and mocked browser cookie operations. This is a materially different purpose and includes undeclared browser/cookie-management-related capabilities unrelated to the declared DevOps toolkit.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The supplied code chunk does not implement any of the declared toolkit capabilities such as release automation, license compliance, copyright enforcement, repo visibility guarding, identity file protection, manifest reconciliation, or MCP-callable core tools. Instead, it is a narrow unit test for locating a local 'browse' binary on disk and checking whether the resolved path exists. That behavior is materially different from the declared purpose and introduces filesystem inspection capability not represented in the description. While this may belong somewhere in a larger repository, this specific chunk is unrelated to the stated primary purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The supplied code does not implement or expose the broad DevOps/security/compliance toolkit described. Instead, it is narrowly focused test code for a local configuration helper script that reads and writes a config.yaml file in a state directory. There is no evidence in this chunk of release automation, license scanning, copyright enforcement, repository visibility checks, identity file protection, manifest reconciliation, or MCP agent-callable interfaces. This is a materially different primary purpose, so the description does not accurately represent the behavior of the provided code chunk.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: ai/repos/gstack-private/browse/test/commands.test.ts:672

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: ai/repos/gstack-private/scripts/dev-skill.ts:24

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: ai/repos/gstack-private/scripts/skill-check.ts:103

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: ai/repos/gstack-private/test/helpers/eval-store.ts:523

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: ai/repos/gstack-private/test/helpers/touchfiles.ts:165

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: ai/repos/gstack-private/test/hook-scripts.test.ts:12

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: ai/repos/gstack-private/test/skill-e2e.test.ts:163

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: ai/repos/gstack-private/test/skill-routing-e2e.test.ts:72

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: ai/repos/gstack-private/test/touchfiles.test.ts:155

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: tools/wip-branch-guard/guard.mjs:180

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: tools/wip-license-hook/dist/core/scanner.js:73

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: tools/wip-license-hook/src/core/scanner.ts:97

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: tools/wip-readme-format/format.mjs:354

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: tools/wip-release/core.mjs:227

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: tools/wip-universal-installer/install.js:35

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: ai/repos/gstack-private/browse/src/cli.ts:20

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: ai/repos/gstack-private/test/skill-e2e.test.ts:22

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: ai/repos/gstack-private/browse/src/server.ts:33

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: ai/repos/gstack-private/browse/test/cookie-import-browser.test.ts:8