HoloCore

What was checked

Plain notes from the hygiene checks.

• Permissions

  Concern

  can delete files.

  PERMISSION_DELETE_FILES

  src/holocore/animus_mining.py, line 101

  raw = subprocess.check_output(["git", "-C", str(o.root), "log", "--format=%H%x1f%aI%x1f%s%x1e", f"-{o.limit}"], text=True, stderr=subprocess.DEVNULL)

  src/holocore/atlas.py, line 553

  listed = subprocess.run(

  src/holocore/auto_update.py, line 93

  subprocess.Popen(

  Show more

  src/holocore/auto_update.py, line 102

  subprocess.Popen(

  src/holocore/cleanup.py, line 35

  if path.is_dir(): shutil.rmtree(path)

  src/holocore/cli.py, line 138

  subprocess.Popen(["open", str(path)])

  src/holocore/cli.py, line 140

  subprocess.Popen(["xdg-open", str(path)])

  src/holocore/install.py, line 443

  subprocess.run(["git", "init"], cwd=root, check=True, capture_output=True, text=True)

  src/holocore/lifecycle.py, line 36

  completed = subprocess.run(command, check=True, capture_output=True, text=True)

• Install and update

  Pass

  No install-time script found, and dependencies are pinned or absent.

• Network

  Serious

  accepts a host from input, with no fixed list in this file.

  NETWORK_HOST_FROM_INPUT

  src/holocore/animus_retrieval.py, line 42

  with urllib.request.urlopen(request, timeout=self.timeout) as response:

  src/holocore/auto_update.py, line 126

  with urllib.request.urlopen(request, timeout=2.5) as response:

  src/holocore/console.py, line 108

  ment.getElementById('wikiSelect').value;fetch('/api/wiki?path='+encodeURIComponent(p))

  Show more

  src/holocore/ingest.py, line 405

  response = urllib.request.urlopen(request, timeout=self.url_timeout)

  src/holocore/llm.py, line 98

  with urllib.request.urlopen(request, timeout=self.timeout) as response:

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV

  .gitignore, line 45

  # Local environment and secrets

  .gitignore, line 46

  .env

  .gitignore, line 50

  credentials.json

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Concern

  contains a minified payload.

  OBFUSCATION_MINIFIED_PAYLOAD

  src/holocore/atlas_html.py, line 44

  :root{color-scheme:dark;font-family:"IBM Plex Sans","Segoe UI",system-ui,sans-serif;background:#0f172a;color:#f8fafc;--panel:#111c30;--line:#334155;--muted:#a8b4c5;--focus:#38bdf8;

  src/holocore/atlas_html.py, line 67

  function forceLayout(nodes,links,w,h){const pos=new Map(),vel=new Map(),degree=new Map(nodes.map(n=>[String(n.id),0]));links.forEach(e=>{const a=endpoint(e.source??e.from),b=endpoi

  src/holocore/atlas_html.py, line 72

  function draw(){loading.hidden=false;requestAnimationFrame(()=>{const q=search.value.trim().toLowerCase(),m=mode.value,k=kind.value,r=relation.value;let nodes=allNodes.filter(n=>(m

  Show more

  src/holocore/atlas_html.py, line 73

  let timer;search.addEventListener('input',()=>{clearTimeout(timer);timer=setTimeout(draw,120)});[mode,kind,relation,moreLabels].forEach(el=>el.addEventListener('change',draw));docu

  src/holocore/atlas_html.py, line 84

  (()=>{'use strict';const D=JSON.parse(document.getElementById('data').textContent),N=D.nodes||[],L=D.links||D.edges||[],W=N.filter(n=>String(n.kind||'').toLowerCase()==='world'),ca

  src/holocore/atlas_html.py, line 93

  (()=>{'use strict';const D=JSON.parse(document.getElementById('data').textContent),N=D.nodes||[],L=D.links||D.edges||[],W=N.filter(n=>String(n.kind||'').toLowerCase()==='world'),st

  src/holocore/console.py, line 94

  <style>body{margin:0;background:#0b1020;color:#dce7ff;font:14px system-ui;overflow-x:hidden}header{padding:20px 28px;background:#121a31;display:flex;justify-content:space-between;g

  src/holocore/console.py, line 108

  function switchWorld(){window.location='?root='+encodeURIComponent(document.getElementById('worldSelect').value)}function loadWiki(){let p=document.getElementById('wikiSelect').val

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit d317a9303cf8. can delete files. accepts a host from input, with no fixed list in this file. reads a credential or environment file. contains a minified payload.

Date and source

Date checked: 23 Oct 2026

Read how this letter is chosen