articulate

What was checked

Plain notes from the hygiene checks.

• Permissions

  Concern

  can delete files.

  PERMISSION_DELETE_FILES

  scripts/build_claude_plugin.py, line 69

  return subprocess.run([git, *args], cwd=repo, capture_output=True, timeout=120)

  scripts/build_claude_plugin.py, line 156

  shutil.rmtree(target)

  scripts/build_native_articulate.py, line 56

  subprocess.run(cmd, cwd=root, env=env, stdout=log, stderr=subprocess.STDOUT, check=True)

  Show more

  scripts/check_release_ruleset.py, line 83

  result = subprocess.run([sys.executable, "-I", "-S", "-c", code, temp],

  scripts/native_release_source.py, line 17

  result = subprocess.run(['git', '-C', str(root), *args], capture_output=True, text=True)

  scripts/provenance_detectors.py, line 139

  head = subprocess.run(["git", "rev-parse", "HEAD"], cwd=C.ROOT, capture_output=True, text=True)

  scripts/smoke_claude_plugin.py, line 102

  with subprocess.Popen(argv, env=env, stdin=subprocess.PIPE,

  scripts/smoke_claude_plugin.py, line 224

  done = subprocess.run(hook_argv, input=data, capture_output=True, env=env, timeout=60)

  scripts/smoke_claude_plugin.py, line 260

  done = subprocess.run(hook_argv, input=data, capture_output=True, env=e, timeout=60)

  src/articulate/claude_cli.py, line 171

  shutil.rmtree(path)

• Install and update

  Pass

  No install-time script found, and dependencies are pinned or absent.

• Network

  Concern

  can reach a host that is not written as a fixed address.

  NETWORK_NO_FIXED_HOST

  scripts/provenance_generate.py, line 46

  with urllib.request.urlopen(req, timeout=timeout) as r:

  scripts/provenance_generate.py, line 51

  with urllib.request.urlopen(OLLAMA + path, timeout=30) as r:

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV

  scripts/build_claude_plugin.py, line 19

  An untracked or git-ignored file in those folders, such as a .env, never ships.

  scripts/claude_plugin_rules.py, line 57

  SECRET_NAME = re.compile(r"(?i)^(?:\.env(?!\.example$)(?:\..*)?|.*\.(?:pem|key|p12|pfx|jks)"

  scripts/claude_plugin_rules.py, line 58

  r"|id_(?:rsa|dsa|ecdsa|ed25519)(?:\.pub)?|\.netrc|\.npmrc|\.pypirc)$")

  Show more

  scripts/pangram_rescore.py, line 121

  if not os.environ.get("PANGRAM_API_KEY"):

  src/articulate/backends.py, line 126

  key = os.environ.get('ANTHROPIC_API_KEY')

  src/articulate/backends.py, line 141

  key = os.environ.get('ARTICULATE_OPENAI_API_KEY')

  src/articulate/backends.py, line 143

  key = key or os.environ.get('OPENAI_API_KEY')

  .gitignore, line 1

  # Secrets / env (standard workspace rule; the negation must follow .env.*)

  .gitignore, line 2

  .env

  .gitignore, line 4

  !.env.example

  claude-plugin/.gitignore, line 3

  # a cache out of a commit made in the plugin repository itself.

  claude-plugin/.gitignore, line 4

  .env

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  a file was over the read cap and was not fully read. the file cap was reached before every file was read.

  OBFUSCATION_FILE_OVER_READ_CAP OBFUSCATION_FILE_CAP_REACHED

  corpus/provenance/detector-records.jsonl, line 1

  {"detector": "binoculars", "direction": "lower reads as machine-like", "environment": {"articulate_commit": "9e451ee490f73fb3643126ce17ca69a6e0fb3cf8", "python": "3.13.2", "script_

  src/articulate/receipt.py, line 1

  #!/usr/bin/env python

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 530dab44ee33. can delete files. can reach a host that is not written as a fixed address. reads a credential or environment file. a file was over the read cap and was not fully read. the file cap was reached before every file was read.

Date and source

Date checked: 26 Oct 2026

Read how this letter is chosen