io.github.alejooroncoy/campus-cli

What was checked

Plain notes from the hygiene checks.

• Permissions

  Concern

  can delete files.

  PERMISSION_DELETE_FILES

  src/account/store.ts, line 35

  if (fs.existsSync(ACCOUNT_FILE)) fs.unlinkSync(ACCOUNT_FILE);

  src/providers/banner/auth/session.ts, line 39

  if (fs.existsSync(SESSION_FILE)) fs.unlinkSync(SESSION_FILE);

  src/providers/blackboard/auth/session.ts, line 69

  if (fs.existsSync(SESSION_FILE)) fs.unlinkSync(SESSION_FILE);

  Show more

  src/providers/blackboard/auth/session.ts, line 79

  if (fs.existsSync(PROFILE_DIR)) fs.rmSync(PROFILE_DIR, { recursive: true, force: true });

  src/security/files.ts, line 30

  fs.rmSync(claimed, { recursive: true });

  src/security/files.ts, line 151

  fs.rmSync(item, { recursive: true });

  src/security/files.ts, line 156

  fs.unlinkSync(item);

  src/security/files.ts, line 285

  if (temporary) try { fs.unlinkSync(temporary); } catch {}

• Install and update

  Pass

  No install-time script found, and dependencies are pinned or absent.

• Network

  Serious

  accepts a host from input, with no fixed list in this file.

  NETWORK_HOST_FROM_INPUT

  scripts/mendeley-connect.cjs, line 32

  const r = await fetch('https://api.mendeley.com/oauth/token',

  site/api/markdown-not-found.js, line 36

  async fetch(request) {

  site/public/app.js, line 272

  const response = await fetch(source);

  Show more

  site/public/campus-conversation-bootstrap.js, line 7

  promise: fetch(`/api/app/profes/conversation?id=${encodeURIComponent(id)}&limit=5`, {

  site/public/campus-session-bootstrap.js, line 5

  const promise = fetch('/api/app/session', {

  site/public/sw.js, line 123

  fetch(request).catch(() => {

  site/public/sw.js, line 139

  fetch(request).then((response) => {

  site/public/sw.js, line 162

  return fetch(request).then((networkResponse) => {

  site/scripts/verify-agent-discovery.mjs, line 61

  const response = await markdownNotFoundHandler.fetch(new Request("https://campuscli.com/a-path-that-does-not-exist"));

  site/scripts/verify-agent-discovery.mjs, line 67

  const nestedResponse = await markdownNotFoundHandler.fetch(new Request(`https://campuscli.com${path}`));

  site/src/scripts/campus-app.ts, line 156

  universityRequest ??= fetch("/api/app/universities", { cache: "no-store" }).then(async response => {

  site/src/scripts/campus-app.ts, line 389

  const response = await fetch("/api/app/university", {

  site/src/scripts/campus-app.ts, line 438

  const response = await fetch("/api/app/logout", { method: "POST", headers: analyticsHeaders() });

  site/src/scripts/miupc-profile.ts, line 52

  const response = await fetch('/api/app/miupc/connect/', { cache: 'no-store', signal: AbortSignal.timeout(50_000) });

  site/src/scripts/miupc-profile.ts, line 63

  const response = await fetch('/api/app/miupc/connect/', { method: 'POST', headers: { 'content-type': 'application/json' }, body: '{}', signal: AbortSignal.timeout(50_000) });

  site/src/scripts/turnitin-report-viewer.ts, line 139

  const response = await fetch(reportUrl(currentOrder, selected), {

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_DOTENV

  scripts/mendeley-connect.cjs, line 20

  const id = process.env.MENDELEY_CLIENT_ID, secret = process.env.MENDELEY_CLIENT_SECRET;

  scripts/mendeley-connect.cjs, line 22

  const tokenFile = process.env.MENDELEY_TOKEN_FILE || path.join(os.homedir(), '.campus-cli', 'mendeley-tokens.json');

  src/analytics.ts, line 11

  const POSTHOG_KEY = process.env.POSTHOG_API_KEY ?? 'phc_mVYDii8qujKLxaCagZomJjR4B2Cd53FieYqDyBPe4zGw';

  Show more

  src/providers/academic/mendeley-service.ts, line 65

  constructor(private file = process.env.MENDELEY_TOKEN_FILE || join(homedir(), '.campus-cli', 'mendeley-tokens.json')) {}

  .gitignore, line 4

  *.js.map

  .gitignore, line 5

  .env

  .gitignore, line 7

  !.env.example

  .npmignore, line 5

  *.js.map

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Concern

  contains a minified payload.

  OBFUSCATION_MINIFIED_PAYLOAD

  .agents/skills/apa7-review-campus/references/upc-considerations.json, line 1

  {

  .agents/skills/apa7-review-campus/references/upc-semantic-coverage.json, line 1

  {

  .agents/skills/apa7-review-campus/references/upc-source-audit.json, line 1

  {

  Show more

  site/package-lock.json, line 1

  {

  site/scripts/miupc-reconnect-e2e.mjs, line 273

  await page.route('**/api/app/miupc/connect/',route=>{if(route.request().method()==='POST'){posts++;return route.fulfill({contentType:'application/json',body:JSON.stringify({status:

  tests/research.test.ts, line 1

  import assert from 'node:assert/strict';

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 7f07a8de387b. can delete files. accepts a host from input, with no fixed list in this file. reads a credential or environment file. contains a minified payload.

Date and source

Date checked: 21 Oct 2026

Read how this letter is chosen