Crbro Memory

What was checked

Plain notes from the hygiene checks.

• Permissions

  Concern

  can delete files.

  PERMISSION_DELETE_FILES

  bin/crbro.mjs, line 565

  else { try { fs.rmSync(ep.stateFile(root, st.build), { force: true }); } catch { /* stale file, best effort */ } }

  bin/crbro.mjs, line 798

  for (const f of [hookScript, replacedPath]) { try { fs.unlinkSync(f); } catch { /* not there */ } }

  src/daemon/daemon.ts, line 279

  if (process.platform !== 'win32') await fs.rm(endpoint, { force: true });

  Show more

  src/daemon/daemon.ts, line 323

  if (st.dev === ownSocket.dev && st.ino === ownSocket.ino) await fs.rm(endpoint, { force: true });

  src/daemon/endpoint.ts, line 168

  await fs.rm(blockedFile(brainRoot, build), { force: true }).catch(() => undefined);

  src/daemon/endpoint.ts, line 187

  return async () => { await fs.rm(file, { force: true }).catch(() => undefined); };

  src/daemon/endpoint.ts, line 199

  await fs.rm(file, { force: true }).catch(() => undefined);

  src/daemon/endpoint.ts, line 231

  await fs.rm(stateFile(brainRoot, build), { force: true }).catch(() => undefined);

• Install and update

  Pass

  No install-time script found, and dependencies are pinned or absent.

• Network

  Concern

  can reach a host that is not written as a fixed address.

  NETWORK_NO_FIXED_HOST

  benchmarks/security/run.mjs, line 52

  { d: 'basic auth en URL', t: 'curl https://' + G('apiuser:', '8f3kd9sldkfj') + '@api.example.com/v1/data' },

  hooks/crbro-guard.mjs, line 36

  /** A flag names an action only where it changes what the program does to your files. `curl -s` and `grep -n` are not lessons. */

  src/daemon/daemon.ts, line 96

  const s = net.connect(endpoint);

  Show more

  src/daemon/proxy.ts, line 90

  const s = net.connect(state.endpoint);

  src/engine/triggers.ts, line 43

  + 'kubectl helm terraform wp composer php supabase vercel netlify wrangler aws az ssh scp rsync curl wget robocopy '

  src/engine/triggers.ts, line 54

  /** A flag names an action only where it changes what the program does to your files. `curl -s` and `grep -n` are not lessons. */

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_CREDENTIAL

  benchmarks/retrieval/run.mjs, line 78

  const KEYS = process.env.CRBRO_BENCH_KEYS

  benchmarks/retrieval/run.mjs, line 79

  ? new Map(JSON.parse(readFileSync(process.env.CRBRO_BENCH_KEYS, 'utf8')).map(e => [e.id, e.keys])) : null;

  scripts/check-publication.mjs, line 20

  if (/(^|\/)(\.env(?:\.[^/]+)?|\.npmrc|keys\.dpapi|secrets\.enc[^/]*|id_rsa|id_ed25519|[^/]*service[-_]?account[^/]*\.json)$/i.test(normalized)

  Show more

  bin/crbro.mjs, line 1238

  const dir = process.env['CRBRO_KEYS_DIR'] || join(homedir(), '.crbro-keys');

  mods/crbro-pending/hooks/register.tsx, line 188

  await $.env.get('CRBRO_LANG'),

  mods/crbro-pending/hooks/register.tsx, line 189

  await $.env.get('LC_ALL'),

  mods/crbro-pending/hooks/register.tsx, line 190

  await $.env.get('LC_MESSAGES'),

  mods/crbro-pending/hooks/register.tsx, line 191

  await $.env.get('LANG'),

  mods/crbro-pending/hooks/register.tsx, line 211

  const home = (await $.env.get('HOME')) || (await $.env.get('USERPROFILE'))

  mods/crbro-pending/hooks/register.tsx, line 212

  const dir = brainDir(home, await $.env.get('CRBRO_PATH'))

  src/engine/doctor.ts, line 207

  const raw = entry?.env?.CRBRO_PATH;

  src/engine/keychain.ts, line 45

  const dir = process.env['CRBRO_KEYS_DIR'] || join(homedir(), '.crbro-keys');

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Pass

  No encoded or minified payload found.

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 0ead1c932af7. can delete files. can reach a host that is not written as a fixed address. reads a credential or environment file.

Date and source

Date checked: 22 Oct 2026

Read how this letter is chosen