io.github.chrismcdermut/proletariat-cli

What was checked

Plain notes from the hygiene checks.

• Permissions

  Concern

  can delete files. requests shell access. No manifest field names shell or command execution.

  PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES

  test-epic-debug.cjs, line 66

  fs.rmSync(testDir, { recursive: true, force: true });

  src/commands/action/edit.ts, line 129

  fs.unlinkSync(tmpFile)

  src/commands/autocomplete/setup.ts, line 250

  snippet: 'prlt autocomplete:script powershell | Out-String | Invoke-Expression',

  Show more

  src/commands/claude/index.ts, line 997

  fs.rmSync(tempDir, { recursive: true, force: true })

  src/commands/qa/index.ts, line 841

  fs.rmSync(tempDir, { recursive: true, force: true })

  src/lib/caffeinate.ts, line 65

  fs.unlinkSync(PID_FILE)

  src/lib/machine-config.ts, line 191

  fs.unlinkSync(tempPath);

  src/lib/machine-db.ts, line 255

  fs.unlinkSync(staleDbPath)

• Install and update

  Concern

  runs a script at install time. dependencies are not pinned. The docs document an installer that pipes a download into a shell.

  INSTALL_LIFECYCLE_HOOK INSTALL_UNPINNED INSTALL_DOCUMENTED_INSTALLER

  src/commands/update.ts, line 176

  'curl -fsSL https://raw.githubusercontent.com/chrismcdermut/proletariat/main/scripts/install.sh | bash',

  src/commands/update.ts, line 209

  this.log(` ${colors.textMuted('curl -fsSL https://raw.githubusercontent.com/chrismcdermut/proletariat/main/scripts/install.sh | bash')}`)

  src/lib/update-prompt.ts, line 151

  const parts = ['curl -fsSL https://raw.githubusercontent.com/chrismcdermut/proletariat/main/scripts/install.sh | bash']

  Show more

  package.json, line 115

  postinstall

  package.json, line 15

  @inkjs/ui

• Network

  Concern

  can reach a host that is not written as a fixed address. can reach github.com. The description does not name that host. can reach example.com. The description does not name that host. can reach api.anthropic.com. The description does not name that host. can reach api.sendgrid.com. The description does not name that host.

  NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST

  src/lib/update-check.ts, line 440

  const response = await fetch(BREW_FORMULA_API, {

  src/lib/update-check.ts, line 459

  const response = await fetch(url, {

  src/lib/asana/client.ts, line 38

  const response = await fetch(url, {

  Show more

  src/lib/clickup/client.ts, line 33

  const response = await fetch(url, options)

  src/lib/dashboard/html.ts, line 272

  fetch('/api/data')

  src/lib/execution/devcontainer.ts, line 239

  curl -L "https://github.com/dandavison/delta/releases/download/0.18.2/git-delta_0.18.2_\${ARCH}.deb" -o /tmp/delta.deb && \\

  src/lib/execution/devcontainer.ts, line 244

  RUN sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)" "" --unattended \\

  src/lib/execution/devcontainer.ts, line 426

  if curl -s --max-time 3 https://example.com >/dev/null 2>&1; then

  src/lib/execution/devcontainer.ts, line 432

  if curl -s --max-time 5 https://api.anthropic.com >/dev/null 2>&1; then

  src/lib/execution/devcontainer.ts, line 970

  RUN sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)" "" --unattended \\

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_CREDENTIAL

  src/commands/agent/auth.ts, line 91

  `docker run --rm -v ${CLAUDE_CREDENTIALS_VOLUME}:/data alpine cat /data/.credentials.json 2>/dev/null`,

  src/commands/agent/auth.ts, line 111

  `docker run --rm -v ${CLAUDE_CREDENTIALS_VOLUME}:/data alpine cat /data/.credentials.json 2>/dev/null`,

  src/commands/agent/auth.ts, line 169

  const apiKey = process.env.ANTHROPIC_API_KEY;

  Show more

  src/commands/agent/auth.ts, line 221

  const hasApiKey = !!process.env.ANTHROPIC_API_KEY;

  src/commands/agent/auth.ts, line 314

  const hasApiKey = !!process.env.ANTHROPIC_API_KEY;

  src/commands/work/start.ts, line 1912

  const hasApiKey = !!process.env.ANTHROPIC_API_KEY

  src/commands/work/start.ts, line 3266

  const hasApiKey = !!process.env.ANTHROPIC_API_KEY

  src/lib/asana/config.ts, line 75

  const envToken = process.env.PRLT_ASANA_ACCESS_TOKEN || process.env.ASANA_ACCESS_TOKEN

  src/lib/clickup/config.ts, line 108

  const envKey = process.env.PRLT_CLICKUP_API_KEY || process.env.CLICKUP_API_KEY

  src/lib/execution/preflight.ts, line 148

  if (process.env.ANTHROPIC_API_KEY) {

  src/lib/execution/runners/docker-credentials.ts, line 53

  `docker run --rm --pull never -v ${CLAUDE_CREDENTIALS_VOLUME}:/data alpine cat /data/.credentials.json 2>/dev/null`,

  src/lib/execution/runners/docker-credentials.ts, line 79

  `docker run --rm --pull never -v ${CLAUDE_CREDENTIALS_VOLUME}:/data alpine cat /data/.credentials.json 2>/dev/null`,

  src/lib/execution/runners/docker-credentials.ts, line 101

  '.credentials.json',

  src/lib/execution/runners/docker-credentials.ts, line 184

  * 2. OAuth credentials exist in ~/.claude/.credentials.json (Claude Code 1.x)

  src/lib/execution/runners/docker-credentials.ts, line 194

  const credPath = path.join(homeDir, '.claude', '.credentials.json')

  src/lib/gc/index.ts, line 449

  * Files to preserve: .credentials.json, credentials.json, .oauthtoken, settings.json

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  the file cap was reached before every file was read.

  OBFUSCATION_FILE_CAP_REACHED

  src/lib/execution/spawner.ts, line 1

  /**

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 0f0f9fa605c3. can delete files. requests shell access. No manifest field names shell or command execution. runs a script at install time. dependencies are not pinned. The docs document an installer that pipes a download into a shell. can reach a host that is not written as a fixed address. can reach github.com. The description does not name that host. can reach example.com. The description does not name that host. can reach api.anthropic.com. The description does not name that host. can reach api.sendgrid.com. The description does not name that host. reads a credential or environment file. the file cap was reached before every file was read. Grades are a

Date and source

Date checked: 22 Oct 2026

Read how this letter is chosen