Task Pipeline

What was checked

Plain notes from the hygiene checks.

• Permissions

  Concern

  can delete files.

  PERMISSION_DELETE_FILES

  bin/task-pipeline.js, line 91

  fs.rmSync(staging, { recursive: true, force: true });

  bin/task-pipeline.js, line 98

  fs.rmSync(prev, { recursive: true, force: true });

  bin/task-pipeline.js, line 101

  fs.rmSync(prev, { recursive: true, force: true });

  Show more

  bin/task-pipeline.js, line 105

  fs.rmSync(staging, { recursive: true, force: true });

  docs/evidence/plans/2026-10-13-negative-lock-namespace/probe.py, line 29

  paths.append(Path(subprocess.check_output([sys.executable, '-c', command], env=env, text=True).strip()))

  docs/evidence/plans/2026-10-13-negative-lock-namespace/probe.py, line 38

  different = subprocess.run([sys.executable, '-c', child, str(paths[1])]).returncode

  docs/evidence/plans/2026-10-13-negative-lock-namespace/probe.py, line 39

  same = subprocess.run([sys.executable, '-c', child, str(paths[0])]).returncode

  docs/evidence/runs/2026-10-13-fw07-child-lock/baseline-probe.py, line 17

  helper = subprocess.check_output(['git', 'show', source + ':test/negative_lock.py'], cwd=repo)

  docs/evidence/runs/2026-10-13-fw07-child-lock/baseline-probe.py, line 32

  p=subprocess.Popen([sys.executable,'-B',str(r/'plant.py'),str(r)],stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL)

  docs/evidence/runs/2026-10-13-fw07-child-lock/baseline-probe.py, line 36

  parent = subprocess.Popen([sys.executable, '-B', str(root/'holder.py'), folder],

  docs/evidence/runs/2026-10-13-fw07-child-lock/baseline-probe.py, line 50

  contender = subprocess.run([sys.executable, '-B', '-c', code, folder],

  docs/evidence/runs/2026-10-13-fw07-child-lock/preintegration-driver.py, line 4

  def git(*args): return subprocess.check_output(['git',*args],cwd=root,text=True).strip()

  docs/evidence/runs/2026-10-13-fw07-child-lock/preintegration-driver.py, line 34

  shutil.rmtree(tmp);receipt['owned_tmp_removed']=not pathlib.Path(tmp).exists()

  plugins/task-pipeline/skills/project-audit/scripts/audit.py, line 1160

  shutil.rmtree(work, ignore_errors=True)

• Install and update

  Pass

  No install-time script found, and dependencies are pinned or absent.

• Network

  Concern

  can reach a host that is not written as a fixed address. can reach api.github.com. The description does not name that host.

  NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST

  plugins/task-pipeline/skills/project-audit/scripts/audit.py, line 1105

  with urllib.request.urlopen(url, timeout=TIMEOUT) as resp:

  plugins/task-pipeline/skills/task-pipeline/references/conventions.md, line 68

  curl -s "https://api.github.com/repos/<owner>/<repo>/commits/<sha>/check-runs"

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV

  plugins/task-pipeline/skills/project-audit/scripts/audit.py, line 1062

  if os.path.basename(p) in (".env", ".npmrc", ".pypirc",

  plugins/task-pipeline/skills/project-audit/scripts/audit.py, line 1063

  "id_rsa", "credentials")

  plugins/task-pipeline/skills/task-pipeline/references/deploy-targets.md, line 70

  - Stored in: <Heroku config vars | DO app-level secrets | .env on server | GitHub secrets>

  Show more

  .gitignore, line 10

  # agent-sync

  .gitignore, line 16

  # untracked-but-unignored .env at a sibling's repo root, one `git add -A`

  .gitignore, line 17

  # away from a public repository. The hole was open in all nine.

  .gitignore, line 18

  .env

  .gitignore, line 20

  !.env.example

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Concern

  contains a minified payload.

  OBFUSCATION_MINIFIED_PAYLOAD

  CHANGELOG.md, line 1

  ## v1.101.1 (2026-10-23)

  docs/evidence/runs/2026-10-13-fw07-child-lock/preintegration-driver.py, line 33

  receipt={'source':sha,'tree':tree,'kind':'pre-integration complete owner gate, not accepted-tag release gate','command':['npm','run','test:all'],'started':started,'duration_seconds

  plugins/task-pipeline/skills/task-pipeline/references/spec.md, line 1

  # Spec - stage 3, built in

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 83b5e8ec7767. can delete files. can reach a host that is not written as a fixed address. can reach api.github.com. The description does not name that host. reads a credential or environment file. contains a minified payload.

Date and source

Date checked: 23 Oct 2026

Read how this letter is chosen