Containerization Assist

What was checked

Plain notes from the hygiene checks.

• Permissions

  Concern

  can delete files.

  PERMISSION_DELETE_FILES

  scripts/clean-build.cjs, line 20

  fs.rmSync(path.join(root, target), { recursive: true, force: true });

  scripts/clean-build.cjs, line 26

  fs.rmSync(path.join(root, entry), { recursive: true, force: true });

  scripts/remove-backward-compat.ts, line 70

  await fs.unlink(path.join(process.cwd(), 'scripts', 'migrate-tools.ts'));

  Show more

  scripts/restore-package.cjs, line 23

  fs.unlinkSync(backupPath);

  src/lib/file-utils.ts, line 31

  fs.unlink(dest).catch(() => {}); // Delete the file on error

  src/lib/file-utils.ts, line 59

  await fs.unlink(filePath);

  src/validation/dockerfilelint-adapter.ts, line 169

  fs.unlinkSync(tmpFile);

  src/validation/dockerfilelint-adapter.ts, line 205

  fs.unlinkSync(tmpFile);

• Install and update

  Serious

  install fetches a script from the network.

  INSTALL_REMOTE_SCRIPT

  package.json, line 91

  prepare

  .github/workflows/individual-tool-integration-tests.yml, line 297

  curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin

  knowledge/packs/dotnet-mediatr-pack.json, line 209

  "example": "# Security scanning stage\nFROM build AS security\nRUN dotnet list package --vulnerable --include-transitive\nRUN dotnet tool install -g dotnet-outdated-tool && \\\n

• Network

  Concern

  can reach a host that is not written as a fixed address. can reach api.github.com. The description does not name that host. can reach api.osv.dev. The description does not name that host.

  NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST

  docs/examples/mcp-integration-with-telemetry.ts, line 60

  // - Custom backend: await fetch('/api/telemetry', { body: JSON.stringify(event) });

  scripts/integration-test-local-registry.ts, line 68

  execSync(`curl -sf http://${registryUrl}/v2/`, { stdio: 'pipe' });

  scripts/integration-test-local-registry.ts, line 94

  execSync(`curl -sf http://${registryUrl}/v2/test-app/tags/list`, { stdio: 'inherit' });

  Show more

  scripts/refresh-action-pins.ts, line 53

  const res = await fetch(url, { signal: controller.signal, headers: headers() });

  scripts/refresh-action-pins.ts, line 67

  const res = await fetch('https://api.github.com/zen', {

  scripts/validate-action-refs.ts, line 59

  const res = await fetch(url, { signal: controller.signal, headers });

  src/infra/docker/registry.ts, line 76

  const response = await fetch(url, {

  src/infra/docker/registry.ts, line 314

  const response = await fetch(url, {

  src/tools/generate-dockerfile/tool.ts, line 821

  lines.push('HEALTHCHECK CMD curl --fail http://localhost:8080/health || exit 1');

  src/validation/dockerfile-validator.ts, line 125

  fix: 'Add HEALTHCHECK CMD curl -f http://localhost/health || exit 1',

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_DOTENV

  scripts/refresh-action-pins.ts, line 33

  const token = process.env.GH_TOKEN ?? process.env.GITHUB_TOKEN ?? '';

  scripts/toggle-mcp-mode.ts, line 116

  const env = server?.env || {

  scripts/toggle-mcp-mode.ts, line 147

  const env = server?.env || {

  Show more

  scripts/validate-action-refs.ts, line 41

  const token = process.env.GH_TOKEN ?? process.env.GITHUB_TOKEN ?? '';

  src/cli/guidance.ts, line 48

  'Copy .env.example to .env: cp .env.example .env',

  src/infra/security/snyk-scanner.ts, line 138

  if (process.env.SNYK_TOKEN) {

  src/infra/security/snyk-scanner.ts, line 197

  ...(process.env.SNYK_TOKEN && { SNYK_TOKEN: process.env.SNYK_TOKEN }),

  src/tools/analyze-repo/env-detector.ts, line 4

  * Pure detection module - scans .env files, docker-compose.yml,

  src/tools/analyze-repo/env-detector.ts, line 22

  'Where this env var was detected (e.g., ".env.example", "docker-compose.yml", "framework-inferred")',

  src/tools/analyze-repo/env-detector.ts, line 102

  * Parse KEY=value lines from .env-style files.

  src/tools/analyze-repo/schema.ts, line 55

  'Environment variables detected from config files (.env, docker-compose, Spring config) and framework inference',

  src/tools/analyze-repo/tool.ts, line 42

  '\\.env\\.(?:example|sample|template))$',

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  a file was over the read cap and was not fully read. the file cap was reached before every file was read.

  OBFUSCATION_FILE_OVER_READ_CAP OBFUSCATION_FILE_CAP_REACHED

  NOTICE.md, line 1

  NOTICES AND INFORMATION

  package-lock.json, line 1

  {

  test/__support__/utilities/integration-test-utils.ts, line 1

  /**

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit c72427198a38. can delete files. install fetches a script from the network. can reach a host that is not written as a fixed address. can reach api.github.com. The description does not name that host. can reach api.osv.dev. The description does not name that host. reads a credential or environment file. a file was over the read cap and was not fully read. the file cap was reached before every file was read.

Date and source

Date checked: 17 Oct 2026

Read how this letter is chosen