io.github.GoPlasmatic/orion

What was checked

Plain notes from the hygiene checks.

• Permissions

  Pass

  No shell or command execution found, and no extra permission was declared.

• Install and update

  Serious

  install fetches a script from the network. The docs document an installer that pipes a download into a shell.

  INSTALL_REMOTE_SCRIPT INSTALL_DOCUMENTED_INSTALLER

  .github/workflows/release.yml, line 87

  run: "curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.31.0/cargo-dist-installer.sh | sh"

  .github/workflows/release.yml, line 155

  curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y

  examples/quickstart.sh, line 5

  # curl -fsSL https://raw.githubusercontent.com/GoPlasmatic/Orion/main/examples/quickstart.sh | bash

• Network

  Concern

  can reach a host that is not written as a fixed address.

  NETWORK_NO_FIXED_HOST

  crates/orion-cli/src/commands/models.rs, line 685

  let model = fetch().await?;

  crates/orion-client/src/client.rs, line 215

  let mut req = self.http.request(method, &url);

  crates/orion-server/src/channel/oidc_discovery.rs, line 44

  /// normalised-identity fetch (#355) for a provider whose identity is not in

  Show more

  crates/orion-server/src/channel/oidc_discovery.rs, line 128

  match self.fetch(issuer).await {

  crates/orion-server/src/channel/oidc_discovery.rs, line 156

  async fn fetch(&self, issuer: &str) -> Result<(Discovered, Duration), String> {

  crates/orion-server/src/engine/functions/data_write.rs, line 414

  .fetch(executor);

  crates/orion-server/src/engine/functions/db_read.rs, line 205

  let mut stream = sqlx_query.fetch(&mut *conn);

  crates/orion-server/src/jwt/jwks.rs, line 167

  match self.fetch(url).await {

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_PATH_DOTENV

  .gitignore, line 39

  # Environment & local config

  .gitignore, line 40

  .env

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Serious

  runs an encoded payload.

  OBFUSCATION_RUNS_ENCODED_PAYLOAD

  crates/orion-server/CHANGELOG.md, line 1

  # Changelog

  crates/orion-server/src/engine/operators.rs, line 738

  eval(json!({"url_decode": [encoded]})).expect("test"),

  crates/orion-server/src/engine/operators.rs, line 745

  eval(json!({"url_decode": ["a+b"]})).expect("test"),

  Show more

  crates/orion-server/src/engine/operators.rs, line 750

  let err = eval(json!({"url_decode": [bad]})).expect_err(bad);

  crates/orion-server/src/engine/operators.rs, line 846

  eval(json!({"base64_decode": [input]})).expect("test"),

  crates/orion-server/src/engine/operators.rs, line 850

  eval(json!({"base64url_decode": [input]})).expect("test"),

  crates/orion-server/src/engine/operators.rs, line 875

  assert!(eval(json!({"hex_decode": ["zz"]})).is_err());

  crates/orion-server/src/engine/operators.rs, line 876

  assert!(eval(json!({"base64_decode": ["!!!"]})).is_err());

  crates/orion-server/src/engine/operators.rs, line 878

  let err = eval(json!({"base64_decode": ["//4="]})).expect_err("test");

  crates/orion-server/src/engine/operators.rs, line 881

  assert!(eval(json!({"base64_decode": [42]})).is_err());

  crates/orion-server/src/runtime/limiter_prune.rs, line 1

  //! The rate-limiter prune task: the sweep that keeps governor's in-process

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 9ff9b956ea74. install fetches a script from the network. The docs document an installer that pipes a download into a shell. can reach a host that is not written as a fixed address. reads a credential or environment file. runs an encoded payload.

Date and source

Date checked: 18 Oct 2026

Read how this letter is chosen