Review Pro

What was checked

Plain notes from the hygiene checks.

• Permissions

  Concern

  can delete files.

  PERMISSION_DELETE_FILES

  cli/build-assets.mjs, line 13

  fs.rmSync(catalogDst, { recursive: true, force: true });

  cli/build-assets.mjs, line 14

  fs.rmSync(pluginDst, { recursive: true, force: true });

  cli/build-assets.mjs, line 19

  fs.rmSync(path.join(catalogDst, "README.md"), { force: true });

  Show more

  cli/build-assets.mjs, line 20

  fs.rmSync(path.join(catalogDst, "CONTRIBUTING.md"), { force: true });

  cli/src/lib/plugin.ts, line 108

  for (const f of listSharedNames(src)) fs.rmSync(path.join(dst, f), { force: true });

  cli/src/lib/plugin.ts, line 122

  fs.rmSync(target, { recursive: true, force: true });

  cli/src/lib/plugin.ts, line 200

  for (const s of listSkillNames(src)) fs.rmSync(path.join(dst, s), { recursive: true, force: true });

  cli/src/lib/plugin.ts, line 208

  fs.rmSync(path.join(dst, a), { force: true });

  studies/2026-09-anchor-spike/measure.py, line 15

  r = subprocess.run([GIT, "-C", repo, "show", f"{commit}:{path}"], capture_output=True, text=True)

  studies/2026-09-anchor-spike/measure.py, line 130

  head = subprocess.run([GIT, "-C", repo, "rev-parse", "HEAD"], capture_output=True, text=True).stdout.strip()

  studies/2026-09-cost-measurement/anchor.py, line 26

  head = subprocess.run([GIT, "-C", repo, "rev-parse", "HEAD"], capture_output=True, text=True).stdout.strip()

  studies/2026-09-cost-measurement/anchor.py, line 27

  base = subprocess.run([GIT, "-C", repo, "rev-parse", "main"], capture_output=True, text=True).stdout.strip()

  studies/2026-09-cost-measurement/cases.py, line 39

  return subprocess.run([GIT, "-C", repo, *args], capture_output=True, text=True, env=ENV, check=check).stdout

  studies/2026-09-cost-measurement/cases.py, line 43

  out = subprocess.run(["gh", "pr", "view", num, "--json", "mergeCommit", "-q", ".mergeCommit.oid"],

  studies/2026-09-cost-measurement/cases.py, line 51

  subprocess.run([GIT, "clone", "-q", ROOT, dest], check=True, env=ENV)

  studies/2026-09-cost-measurement/cases.py, line 66

  tar = subprocess.run([GIT, "-C", ROOT, "archive", PRODUCT, f"core/{sub}"], capture_output=True, check=True).stdout

• Install and update

  Pass

  No install-time script found, and dependencies are pinned or absent.

• Network

  Concern

  can reach a host that is not written as a fixed address.

  NETWORK_NO_FIXED_HOST

  scripts/verify-npm-integrity.test.sh, line 25

  # 3: an empty file never matches a real digest (the zero-byte curl -f/-L hazard)

  stacks/python/correctness.md, line 9

  - `requests.get(url)` with no `timeout=` → can hang a worker indefinitely.

  stacks/swift/db.md, line 16

  - Main-thread DB fetch (UI hang): High.

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_PATH_UNCONFIRMED

  core/shared/context-policy.md, line 10

  | correctness | consumers of changed functions; related error paths; in-repo traces of any env var / flag / config key the change reads (definition, other read sites, CI workflows,

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  the file cap was reached before every file was read.

  OBFUSCATION_FILE_CAP_REACHED

  studies/2026-09-coverage-spike/raw/correctness.analysis.txt, line 1

  == correctness

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 43cb455b2f81. can delete files. can reach a host that is not written as a fixed address. reads a credential or environment file. the file cap was reached before every file was read.

Date and source

Date checked: 23 Oct 2026

Read how this letter is chosen