io.github.AiDimag/aidimag

What was checked

Plain notes from the hygiene checks.

• Permissions

  Note

  requests shell access. The manifest names this permission.

  PERMISSION_SHELL_DECLARED

  integrations/hermes/aidimag_hermes_provider.py, line 83

  self._proc: Optional[subprocess.Popen] = None

  integrations/hermes/aidimag_hermes_provider.py, line 110

  self._proc = subprocess.Popen(

  integrations/hermes/aidimag_hermes_provider.py, line 140

  def _reader(self, proc: subprocess.Popen) -> None:

• Install and update

  Serious

  install fetches a script from the network.

  INSTALL_REMOTE_SCRIPT

  src/cli/commands/setup.ts, line 752

  execSync('curl -fsSL https://ollama.com/install.sh | sh', { stdio: "inherit" });

  src/ui/server.ts, line 465

  execSync("curl -fsSL https://ollama.com/install.sh | sh", { stdio: "pipe", timeout: 120000 });

• Network

  Concern

  can reach a host that is not written as a fixed address. can reach api.openai.com. The description does not name that host. can reach api.linear.app. The description does not name that host. can reach api.notion.com. The description does not name that host.

  NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST

  scripts/build-sample-repo.sh, line 166

  return fetch("/retry");

  scripts/fetch-icons.mjs, line 29

  https.get(url, { timeout: 15000 }, (res) => {

  src/cli/commands/setup.ts, line 566

  const res = await fetch("http://localhost:11434/api/tags", { signal: ctl.signal });

  Show more

  src/cli/commands/setup.ts, line 798

  const res = await fetch("http://localhost:11434/api/embeddings", {

  src/cli/commands/sync.ts, line 331

  const res = await fetch(`${server}${pathq}`, {

  src/cli/commands/sync.ts, line 385

  const res = await fetch(`${server}${pathq}`, {

  src/cli/commands/sync.ts, line 455

  const res = await fetch(`${server}${pathq}`, {

  src/cli/commands/tickets.ts, line 73

  const res = await fetch(`${cloud.server}/v1/ticket-config?brain=${encodeURIComponent(cloud.brain)}`, {

  src/cli/commands/tickets.ts, line 192

  const res = await fetch(endpoint, { method: "DELETE", headers: { Authorization: `Bearer ${admin}` } });

  src/cli/commands/tickets.ts, line 204

  const res = await fetch(endpoint, {

  src/ui/server.ts, line 415

  const r2 = await fetch("http://localhost:11434/api/tags", { signal: ctl.signal });

  src/ui/server.ts, line 492

  const r2 = await fetch("http://localhost:11434/api/tags", { signal: ctl.signal });

  src/ui/server.ts, line 546

  const r2 = await fetch("http://localhost:11434/api/embeddings", {

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_CREDENTIAL

  src/cli/shared.ts, line 205

  if (process.env.OPENAI_API_KEY) return true;

  src/cli/commands/memory.ts, line 183

  if (!embProvider && !llmProvider && !process.env.OPENAI_API_KEY) {

  deploy/README.md, line 55

  | `aidimag_sk_…` key | one brain, sync only | each member's `~/.aidimag/credentials.json` |

  Show more

  src/cli/commands/setup.ts, line 366

  if (!embProvider && !llmProvider && !process.env.OPENAI_API_KEY) {

  src/cli/commands/setup.ts, line 441

  const llmKey = process.env.OPENAI_API_KEY || process.env.AIDIMAG_LLM;

  src/cli/commands/sync.ts, line 19

  const token = opts.token ?? process.env.AIDIMAG_SYNC_TOKEN;

  src/cli/commands/sync.ts, line 328

  const admin = opts.adminToken ?? process.env.AIDIMAG_ADMIN_TOKEN;

  src/cli/commands/sync.ts, line 382

  const admin = opts.adminToken ?? process.env.AIDIMAG_ADMIN_TOKEN;

  src/cli/commands/sync.ts, line 452

  const admin = opts.adminToken ?? process.env.AIDIMAG_ADMIN_TOKEN;

  RELEASE_NOTES_v2.0.0.md, line 16

  - **Per-repo ticket credentials**: Ticket credentials are now stored per-repo in `.aidimag/config.json` under `tickets.token`, matching the pattern used for cloud sync tokens. This

  docs/cli-reference.md, line 358

  dim audit sign abc12345 --key ~/.ssh/ed25519.pem --signed-by [email protected]

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Concern

  contains an encoded blob in a file that should be readable.

  OBFUSCATION_ENCODED_BLOB

  src/ui/icons-generated.ts, line 1

  // AUTO-GENERATED by scripts/fetch-icons.mjs - do not edit manually.

  docs/public/features/brain.svg, line 1

  <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512" width="48" height="48"><image href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAgAAAAIACAYAAAD0eNT6AAAACXBIWXMAAA7D

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 528b53ae497b. requests shell access. The manifest names this permission. install fetches a script from the network. can reach a host that is not written as a fixed address. can reach api.openai.com. The description does not name that host. can reach api.linear.app. The description does not name that host. can reach api.notion.com. The description does not name that host. reads a credential or environment file. contains an encoded blob in a file that should be readable.

Date and source

Date checked: 17 Oct 2026

Read how this letter is chosen