io.github.bepunk/zoogent

What was checked

Plain notes from the hygiene checks.

• Permissions

  Pass

  No shell or command execution found, and no extra permission was declared.

• Install and update

  Concern

  runs a script at install time.

  INSTALL_LIFECYCLE_HOOK

  package.json, line 31

  postinstall

• Network

  Concern

  can reach a host that is not written as a fixed address.

  NETWORK_NO_FIXED_HOST

  src/mcp.ts, line 18

  const res = await fetch(`${BASE}${path}`, { ...options, headers });

  src/mcp.ts, line 88

  const res = await fetch(`${BASE}/llms.txt`);

  src/client/index.ts, line 29

  const res = await fetch(url, { ...options, headers });

  Show more

  src/client/index.ts, line 210

  const res = await fetch(`${getBaseUrl()}/api/report/skill/${skillPath}`, {

  src/db/seed-skills.ts, line 660

  const res = await axios.post(

  src/routes/api-llms.ts, line 729

  import WebSocket from 'ws' → just use WebSocket (though 'ws' is blessed if needed)

  src/routes/api-llms.ts, line 844

  tasks = requests.get(f"{API}/api/tasks?agentId={AGENT_ID}&status=pending", headers=HEADERS).json()

  src/routes/api-llms.ts, line 848

  r = requests.post(f"{API}/api/tasks/{task['id']}/checkout", headers=HEADERS)

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_DOTENV

  src/cli.ts, line 16

  const envPath = resolve(process.cwd(), '.env');

  src/cli.ts, line 63

  // Create .env with generated secrets

  src/cli.ts, line 64

  const envPath = resolve(process.cwd(), '.env');

  Show more

  src/cli.ts, line 85

  console.log('Created .env with generated secrets');

  src/cli.ts, line 87

  console.log('.env already exists, skipping');

  src/mcp.ts, line 8

  const API_KEY = process.env.ZOOGENT_API_KEY || '';

  src/client/index.ts, line 11

  const getApiKey = () => process.env.ZOOGENT_API_KEY || '';

  src/core/process-manager.ts, line 219

  let anthropicKey = process.env.ANTHROPIC_API_KEY || '';

  src/db/seed-skills.ts, line 271

  const bot = new TelegramBot(process.env.TELEGRAM_TOKEN!, { polling: false });

  src/db/seed-skills.ts, line 284

  client.login(process.env.DISCORD_TOKEN!);

  src/lib/auth.ts, line 11

  const secret = process.env.BETTER_AUTH_SECRET;

  .gitignore, line 3

  data/

  CLAUDE.md, line 177

  - API keys stored in `api_keys` table, not env vars - no `ZOOGENT_API_KEY` in .env needed

  README.md, line 59

  Set `BETTER_AUTH_URL` to your public URL in `.env`. Use a reverse proxy (nginx, Caddy) or deploy via Docker (see [Deployment](#deployment) section). The web UI is the same - just a

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  a file was over the read cap and was not fully read.

  OBFUSCATION_FILE_OVER_READ_CAP

  package-lock.json, line 1

  {

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit d75353a117ec. runs a script at install time. can reach a host that is not written as a fixed address. reads a credential or environment file. a file was over the read cap and was not fully read.

Date and source

Date checked: 21 Oct 2026

Read how this letter is chosen