Claude Code, Plugin
aphanis
🛡️ APHANIS :: Zero-Trust AI Provenance Firewall, Automatic Humanizer Engine & Stego Defense Platform
Compatibility: Not stated.
Grade D
Two or more Medium findings, or a High finding. Only try it in a sandbox.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit 8ac760ae2bed, unchanged since the check below.
INSTALL_LIFECYCLE_HOOK OBFUSCATION_ENCODED_BLOB
Why this grade
- INSTALL_LIFECYCLE_HOOK Medium
A package install hook (preinstall, install, postinstall or prepare) runs a script.
README.md, line 201
curl -fsSL https://raw.githubusercontent.com/sanyamk23/aphanis/main/install.sh | bash - OBFUSCATION_ENCODED_BLOB Medium
Contains a long base64 shaped string in a file that should be readable.
llm-cost-optimization-case-study.docx, line 1
PK
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
install.js, line 40
fs.unlink(dest, () => {});
aphanis/clipboard.py, line 23
return subprocess.check_output(['pbpaste'], text=True)
aphanis/clipboard.py, line 25
return subprocess.check_output(['xclip', '-selection', 'clipboard', '-o'], text=True)
Show more
aphanis/clipboard.py, line 27
return subprocess.check_output(['powershell', '-command', 'Get-Clipboard'], text=True)
aphanis/clipboard.py, line 37
p = subprocess.Popen(['pbcopy'], stdin=subprocess.PIPE, text=True)
aphanis/clipboard.py, line 40
p = subprocess.Popen(['xclip', '-selection', 'clipboard'], stdin=subprocess.PIPE, text=True)
aphanis/clipboard.py, line 43
p = subprocess.Popen(['powershell', '-command', 'Set-Clipboard'], stdin=subprocess.PIPE, text=True)
aphanis/office.py, line 89
shutil.rmtree(temp_dir)
Install and update
Concern
runs a script at install time. README documents an installer that pipes a download into a shell. The docs document an installer that pipes a download into a shell.
INSTALL_LIFECYCLE_HOOK INSTALL_DOCUMENTED_INSTALLER
README.md, line 201
curl -fsSL https://raw.githubusercontent.com/sanyamk23/aphanis/main/install.sh | bash
README.md, line 285
curl -fsSL https://raw.githubusercontent.com/sanyamk23/aphanis/main/install.sh | bash
README.md, line 295
curl -fsSL https://raw.githubusercontent.com/sanyamk23/aphanis/main/install-system.sh | sudo bash
Show more
README.md, line 477
curl -fsSL https://raw.githubusercontent.com/sanyamk23/aphanis/main/install.sh | bash
cli-wrapper.js, line 35
console.error(' Install with: curl -fsSL https://aphanis.ai/install.sh | bash');
install-system.sh, line 6
# Usage: curl -fsSL https://aphanis.ai/install-system.sh | sudo bash
install-system.sh, line 37
echo "⚠ System-wide install requires root. Use: sudo curl -fsSL https://aphanis.ai/install-system.sh | sudo bash"
install-system.sh, line 38
echo " Or for user-only install: curl -fsSL https://aphanis.ai/install.sh | bash"
install.js, line 71
console.error(" Manual install: curl -fsSL https://aphanis.ai/install.sh | bash");
install.sh, line 6
# Usage: curl -fsSL https://aphanis.ai/install.sh | bash
package.json, line 9
postinstall
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
install-system.sh, line 53
curl -fsSL "$URL" -o "${TMP_DIR}/win.zip" || {
install-system.sh, line 60
curl -fsSL "$URL" -o "${TMP_DIR}/${BINARY_FILE}" || {
install.js, line 32
https.get(url, (response) => {
Show more
install.sh, line 53
if curl -fsSL "$URL" -o "$DOWNLOAD_PATH" 2>/dev/null; then
install.sh, line 58
if curl -fsSL "$ZIP_URL" -o "${TMP_DIR}/win.zip" 2>/dev/null; then
aphanis/dashboard.py, line 364
const res = await fetch('/api/audit', {
webapp/src/api.ts, line 16
const res = await fetch(path, {
webapp/src/api.ts, line 49
const res = await fetch("/api/clean-file", { method: "POST", body: fd });
Secrets
Pass
No read of a credential file or secret environment variable found.
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Concern
contains an encoded blob in a file that should be readable.
OBFUSCATION_ENCODED_BLOB
llm-cost-optimization-case-study.docx, line 1
PK
aphanis/dashboard_static/assets/index-bjGKKcAW.js, line 1
var G0=Object.defineProperty;var Q0=(t,e,n)=>e in t?G0(t,e,{enumerable:!0,configurable:!0,writable:!0,value:n}):t[e]=n;var V=(t,e,n)=>Q0(t,typeof e!="symbol"?e+"":e,n);(function(){
.agents/skills/skill-finder/README.md, line 26
<img src="https://img.shields.io/badge/Skills%20Delivered-12%2C847-6366F1?style=for-the-badge&logo=data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZ
Show more
.agents/skills/skill-finder/README.md, line 27
<img src="https://img.shields.io/badge/Active%20Users-3%2C291-8B5CF6?style=for-the-badge&logo=data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdC
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 8ac760ae2bed. can delete files. runs a script at install time. README documents an installer that pipes a download into a shell. The docs document an installer that pipes a download into a shell. can reach a host that is not written as a fixed address. contains an encoded blob in a file that should be readable.
Date and source
Date checked:
github.com
Commit graded: 8ac760ae2bedc54a649a90ceca64b4da30fb5c10
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.