app.anakior/atlas-mind

What was checked

Plain notes from the hygiene checks.

• Permissions

  Concern

  can delete files.

  PERMISSION_DELETE_FILES

  examples/demo-mind/build-demo.py, line 129

  subprocess.run(["git", *args], cwd=repo, env=env, check=True,

  examples/demo-mind/build-demo.py, line 213

  subprocess.run([sys.executable, str(SRC / "cli.py"), "build",

  examples/demo-mind/build-demo.py, line 221

  shutil.rmtree(tmp, ignore_errors=True)

  Show more

  src/cli.py, line 98

  completed = subprocess.run(command, cwd=str(mind), env=env)

  src/cli.py, line 521

  result = subprocess.run(["git", "init", "-q", "-b", "main"],

  src/cli.py, line 525

  fallback = subprocess.run(["git", "init", "-q"], cwd=str(mind),

  src/cli.py, line 658

  return subprocess.run([sys.executable, "-m", "server"], env=env).returncode

  src/cli.py, line 724

  shutil.rmtree(path, onexc=_onexc)

  src/cli.py, line 726

  shutil.rmtree(path, onerror=lambda f, p, _info: _onexc(f, p, None))

  src/cli.py, line 805

  return subprocess.run([sys.executable, "-m", "server"], env=env).returncode

  src/cli.py, line 887

  remotes = subprocess.run(["git", "remote"], cwd=str(mind),

  src/server/routes/admin.py, line 346

  shutil.rmtree(mirror, ignore_errors=True)

• Install and update

  Concern

  dependencies are not pinned.

  INSTALL_UNPINNED

  requirements.txt, line 5

  bcrypt>=4.1

• Network

  Serious

  accepts a host from input, with no fixed list in this file.

  NETWORK_HOST_FROM_INPUT

  examples/extensions/pob/pob.js, line 673

  const r = await fetch('/api/pob-tree', {

  examples/extensions/pob/pob.js, line 908

  const res = await fetch('/api/file', {

  examples/extensions/pob/pob.py, line 54

  with urllib.request.urlopen(req, timeout=20) as r:

  Show more

  src/server/extensions.py, line 35

  automatically, so an extension using `fetch()` needs no special handling; a

  src/server/services/update_check.py, line 56

  with urllib.request.urlopen(self._pypi_url, timeout=4) as resp:

  src/viewer/sw.js, line 92

  fetch(req)

  src/viewer/sw.js, line 111

  fetch(req)

  src/viewer/sw.js, line 126

  const network = fetch(req)

  src/viewer/lib/admin/access-dialog.ts, line 46

  const r = await fetch('/api/directory');

  src/viewer/lib/admin/access-dialog.ts, line 135

  const res = await fetch('/api/acl?path=' + encodeURIComponent(this.cur!.path));

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_DOTENV

  src/cli.py, line 1036

  # an initialized git repo. SESSION_SECRET is provided at runtime (see .env).

  src/cli.py, line 1044

  # 2. cp .env.example .env and set a long random SESSION_SECRET

  src/cli.py, line 1052

  env_file: .env

  Show more

  src/cli.py, line 1085

  # (see .env), which is what this single value provides.

  src/cli.py, line 1093

  # Copy to .env and fill in. NEVER commit .env.

  src/cli.py, line 1238

  ("deploy/.env.example", DEPLOY_ENV_EXAMPLE),

  src/cli.py, line 1421

  print( " 3. cd deploy && cp .env.example .env then set a long random SESSION_SECRET")

  src/cli.py, line 1425

  print( " Cloud mode commits content writes into the mounted repo; set GITHUB_REPO_URL in .env")

  src/server/__init__.py, line 677

  env_secret = os.environ.get("SESSION_SECRET")

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Concern

  contains an encoded blob in a file that should be readable.

  OBFUSCATION_ENCODED_BLOB

  docs/demo/index.html, line 1

  <!DOCTYPE html>

  docs/index.html, line 16

  <link rel="icon" type="image/svg+xml" href="data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIi

  docs/index.html, line 329

  <img src="data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB2aWV3Qm94PSIwIDAgMTAwIDEwMCIgcm9s

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit d37545ca350e. can delete files. dependencies are not pinned. accepts a host from input, with no fixed list in this file. reads a credential or environment file. contains an encoded blob in a file that should be readable.

Date and source

Date checked: 16 Oct 2026

Read how this letter is chosen