CoProgrammer

What was checked

Plain notes from the hygiene checks.

• Permissions

  Note

  requests shell access. The manifest names this permission.

  PERMISSION_SHELL_DECLARED

  eval/make_synthetic_case.py, line 21

  result = subprocess.run(

  eval/run_eval.py, line 24

  return subprocess.run(

  eval/run_eval.py, line 59

  result = subprocess.run(

  Show more

  src/coprogrammer/cli.py, line 408

  result = subprocess.run(

  src/coprogrammer/demo.py, line 229

  result = subprocess.run([sys.executable, "-c", worker], cwd=root, env=env,

  src/coprogrammer/evidence.py, line 64

  exit_code = subprocess.run(command, cwd=cwd, stdin=subprocess.DEVNULL,

  src/coprogrammer/integrations.py, line 152

  result = subprocess.run(command, cwd=cwd, env=env, capture_output=True,

  src/coprogrammer/review.py, line 19

  result = subprocess.run(["git", *args], cwd=cwd, stdout=output,

• Install and update

  Pass

  No install-time script found, and dependencies are pinned or absent.

• Network

  Concern

  can reach a host that is not written as a fixed address.

  NETWORK_NO_FIXED_HOST

  eval/make_synthetic_case.py, line 44

  "def fetch(url):\n return url\n\n\ndef parse(data):\n return data\n",

  eval/make_synthetic_case.py, line 46

  write(repo / "src/app.py", "from src.util import fetch\n\n\ndef main():\n return fetch('x')\n")

  eval/make_synthetic_case.py, line 51

  # Agent A: adds retry logic to fetch (core contribution) and reformats

  Show more

  eval/make_synthetic_case.py, line 57

  "def fetch(url, retries=3):\n"

  eval/make_synthetic_case.py, line 74

  "def fetch(url, timeout=10):\n return url\n\n\ndef parse_json(data):\n return data\n",

  eval/make_synthetic_case.py, line 78

  "from src.util import fetch, parse_json\n\n\ndef main():\n return parse_json(fetch('x'))\n",

  eval/make_synthetic_case.py, line 156

  "notes": "Textual conflict on fetch(); semantic conflict via rename.",

  docs/EVAL_REPORT_2026-06-10.md, line 13

  | synthetic-001 | Textual conflict (both agents edit `fetch()`) + noise (whole-file reformat) | agent-a clean, agent-b **conflict** on `src/util.py` | n/a (blocked at conflict) |

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV

  src/coprogrammer/cli.py, line 113

  "security": ("auth", "permission", "role", "payment", "secret", ".env"),

  src/coprogrammer/cli.py, line 1283

  token = os.environ.get("GITHUB_TOKEN")

  src/coprogrammer/review.py, line 67

  or name.startswith(".env") or name.startswith(("id_rsa", "id_ed25519"))

  Show more

  src/coprogrammer/review.py, line 68

  or name in {"credentials.json", "credentials", "secrets.json", "secrets.yml", "secrets.yaml"}

  docs/MULTI_PLATFORM_QUICKSTART.md, line 133

  证据只覆盖指定提交，不包含未提交修改。常见敏感路径（如 `.env*`、私钥文件）

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Pass

  No encoded or minified payload found.

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit d9e55083b506. requests shell access. The manifest names this permission. can reach a host that is not written as a fixed address. reads a credential or environment file.

Date and source

Date checked: 25 Oct 2026

Read how this letter is chosen