io.github.Mibayy/token-savior

What was checked

Plain notes from the hygiene checks.

• Permissions

  Concern

  requests shell access. No manifest field names shell or command execution. can delete files.

  PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES

  benchmarks/run_benchmarks.py, line 61

  subprocess.run(

  benchmarks/run_benchmarks.py, line 195

  os.remove(cache_path)

  scripts/export_markdown.py, line 127

  subprocess.run(["git", "init", str(root)], capture_output=True, text=True, check=False)

  Show more

  scripts/export_markdown.py, line 128

  subprocess.run(

  scripts/export_markdown.py, line 135

  subprocess.run(["git", "-C", str(root), "add", "-A"], capture_output=True, text=True, check=False)

  scripts/export_markdown.py, line 136

  diff = subprocess.run(

  scripts/export_markdown.py, line 142

  subprocess.run(

  src/token_savior/breaking_changes.py, line 216

  return subprocess.run(

• Install and update

  Pass

  No install-time script found, and dependencies are pinned or absent.

• Network

  Concern

  can reach api.telegram.org. The description does not name that host. can reach a host that is not written as a fixed address.

  NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST

  scripts/ts-trace-analysis.sh, line 128

  curl -s -X POST "https://api.telegram.org/bot${TG_TOKEN}/sendMessage" \

  src/token_savior/compactors/__init__.py, line 27

  from .curl import CurlCompactor

  src/token_savior/compactors/curl.py, line 1

  """curl output compactor - truncates large bodies, keeps status/content-type."""

  Show more

  src/token_savior/memory/auto_extract.py, line 105

  with urllib.request.urlopen(req, timeout=15) as r:

  src/token_savior/memory/notifications.py, line 59

  urllib.request.urlopen(req, timeout=5)

  src/token_savior/memory/viewer.py, line 157

  with urllib.request.urlopen(

  docs/index.html, line 1888

  const res = await fetch('./matrix.json', { cache: 'no-store' });

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_DOTENV

  hooks/read_guard_hook.py, line 64

  ".csv", ".tsv", ".log", ".xml", ".html", ".css", ".scss", ".sql", ".env",

  hooks/ts_discipline_guard.py, line 56

  # .yml, .sql, .env) stays on the native tools by design.

  scripts/ts_audit.py, line 32

  os.environ.get("TOKEN_SAVIOR_STATS_DIR", "~/.local/share/token-savior")

  Show more

  src/token_savior/annotator.py, line 59

  ".env": "env",

  src/token_savior/annotator.py, line 128

  elif _basename.startswith(".env") or _basename.endswith(".env"):

  src/token_savior/config_analyzer.py, line 433

  re.compile(r"process\.env\.([A-Z_][A-Z0-9_]*)"),

  src/token_savior/config_analyzer.py, line 434

  re.compile(r'process\.env\[(["\'])(.+?)\1\]'),

  src/token_savior/config_analyzer.py, line 435

  re.compile(r"import\.meta\.env\.([A-Z_][A-Z0-9_]*)"),

  src/token_savior/config_analyzer.py, line 791

  # os.getenv('KEY', 'default') / os.environ.get('KEY', 'default')

  src/token_savior/config_analyzer.py, line 802

  # process.env.KEY ?? 'default' or process.env.KEY || 'default'

  src/token_savior/config_analyzer.py, line 804

  r"process\.env\.([A-Z_][A-Z0-9_]*)"

  src/token_savior/config_analyzer.py, line 808

  # process.env.KEY - no default

  src/token_savior/config_analyzer.py, line 810

  # process.env['KEY']

  src/token_savior/config_analyzer.py, line 862

  # process.env['KEY'] pattern

  src/token_savior/dashboard.py, line 15

  HOST = os.environ.get("TOKEN_SAVIOR_DASHBOARD_HOST", "127.0.0.1")

  src/token_savior/dashboard.py, line 16

  PORT = int(os.environ.get("TOKEN_SAVIOR_DASHBOARD_PORT", "8921"))

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  a file was over the read cap and was not fully read. the file cap was reached before every file was read.

  OBFUSCATION_FILE_OVER_READ_CAP OBFUSCATION_FILE_CAP_REACHED

  uv.lock, line 1

  version = 1

  tests/test_resolve_symbol_info_homonymes_memo.py, line 1

  """Le comptage des classes homonymes passe par un cache, comme les fonctions.

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 770e055defd1. requests shell access. No manifest field names shell or command execution. can delete files. can reach api.telegram.org. The description does not name that host. can reach a host that is not written as a fixed address. reads a credential or environment file. a file was over the read cap and was not fully read. the file cap was reached before every file was read.

Date and source

Date checked: 19 Oct 2026

Read how this letter is chosen