io.github.MUSE-CODE-SPACE/test-genie

What was checked

Plain notes from the hygiene checks.

• Permissions

  Concern

  can delete files.

  PERMISSION_DELETE_FILES

  src/security.ts, line 9

  * User-controlled values must be passed as argv arrays via child_process.spawn,

  src/analyzers/securityAnalyzer.ts, line 273

  // child_process.exec with template literal containing user input.

  src/analyzers/securityAnalyzer.ts, line 284

  title: 'child_process.exec with user input in template literal',

  Show more

  src/core/subprocess.ts, line 80

  * Promise wrapper around `child_process.spawn` with argv arrays, allowlist

  src/core/syntaxValidator.ts, line 230

  fs.unlinkSync(tmpPath);

  src/platforms/web/index.ts, line 728

  fs.unlinkSync(scriptPath);

  src/platforms/web/index.ts, line 904

  fs.unlinkSync(scriptPath);

  src/storage/index.ts, line 389

  if (fs.existsSync(SCENARIOS_FILE)) fs.unlinkSync(SCENARIOS_FILE);

  src/storage/index.ts, line 390

  if (fs.existsSync(RESULTS_FILE)) fs.unlinkSync(RESULTS_FILE);

  src/storage/index.ts, line 391

  if (fs.existsSync(FIXES_FILE)) fs.unlinkSync(FIXES_FILE);

  src/storage/index.ts, line 392

  if (fs.existsSync(PLANS_FILE)) fs.unlinkSync(PLANS_FILE);

  src/storage/index.ts, line 393

  if (fs.existsSync(ISSUES_FILE)) fs.unlinkSync(ISSUES_FILE);

  src/tools/automation/diagnoseAutoFix.ts, line 21

  * Everything else (eval, child_process.exec injection, useEffect-no-abort,

  README.md, line 262

  | `child_process.exec` with user-input template literal | critical | CWE-78 | no |

  SAFETY.md, line 185

  - **`child_process.exec` template-literal injection.** Flagged but

  SECURITY.md, line 73

  use with `child_process.spawn(command, args, opts)`.

• Install and update

  Pass

  No install-time script found, and dependencies are pinned or absent.

• Network

  Concern

  can reach a host that is not written as a fixed address.

  NETWORK_NO_FIXED_HOST

  src/analyzers/raceConditionAnalyzer.ts, line 171

  // Heuristic: two `fetch(` calls within a short window, neither inside Promise.all.

  src/platforms/web/index.ts, line 779

  const response = await fetch(url, {

  src/platforms/web/index.ts, line 857

  const res = http.get('${url}');

  Show more

  README.md, line 263

  | `fetch(req.query.url)` (SSRF) | high | CWE-918 | no |

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_DOTENV

  src/analyzers/securityAnalyzer.ts, line 389

  // .env hygiene

  src/analyzers/securityAnalyzer.ts, line 394

  const envPath = path.join(projectPath, '.env');

  src/llm/index.ts, line 61

  if (process.env.ANTHROPIC_API_KEY) return 'anthropic';

  Show more

  src/analyzers/securityAnalyzer.ts, line 406

  if (!/^\.env\b|\n\.env\b|^\*\.env|\n\*\.env/.test(gitignoreContent)) {

  src/analyzers/securityAnalyzer.ts, line 415

  title: '.env file exists but is not in .gitignore',

  src/analyzers/securityAnalyzer.ts, line 416

  description: '`.env` typically holds credentials. If it\'s not gitignored, the next commit will leak the secrets - irreversibly, into git history.',

  src/analyzers/securityAnalyzer.ts, line 417

  snippet: '(file: .env present, .gitignore missing entry)',

  src/analyzers/securityAnalyzer.ts, line 418

  recommendation: 'Add `.env` (and `.env.*` except `.env.example`) to `.gitignore`, then rotate any credentials that may already have been committed.',

  src/analyzers/securityAnalyzer.ts, line 446

  return ['.tsx', '.ts', '.jsx', '.js', '.env', '.yml', '.yaml'];

  src/llm/index.ts, line 62

  if (process.env.OPENAI_API_KEY) return 'openai';

  src/llm/index.ts, line 188

  const client = new Anthropic({ apiKey: process.env.ANTHROPIC_API_KEY });

  src/llm/index.ts, line 218

  const client = new OpenAI({ apiKey: process.env.OPENAI_API_KEY });

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  a file was over the read cap and was not fully read.

  OBFUSCATION_FILE_OVER_READ_CAP

  package-lock.json, line 1

  {

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 6f17d848410f. can delete files. can reach a host that is not written as a fixed address. reads a credential or environment file. a file was over the read cap and was not fully read.

Date and source

Date checked: 19 Oct 2026

Read how this letter is chosen