io.github.Sandeeprdy1729/timps-swarm

What was checked

Plain notes from the hygiene checks.

• Permissions

  Concern

  can delete files.

  PERMISSION_DELETE_FILES

  timps_doctor.py, line 120

  result = subprocess.run(

  timps_doctor.py, line 413

  subprocess.run(r.fix_cmd, shell=True, check=True)

  mcp_server/test_server.py, line 27

  proc = subprocess.Popen(

  Show more

  src/_helpers.py, line 58

  r = subprocess.run(

  src/cloud_tools.py, line 29

  r = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout, cwd=cwd)

  src/computer_use.py, line 303

  result = subprocess.run(

  src/computer_use.py, line 416

  shutil.rmtree(p)

  src/context_keeper.py, line 52

  out = subprocess.check_output(cmd, stderr=subprocess.DEVNULL, cwd=cwd, timeout=timeout)

  src/context_sharing.py, line 13

  git_status = subprocess.run(

  src/layer1_computer_manager.py, line 108

  shutil.rmtree(computer.working_dir)

• Install and update

  Serious

  install fetches a script from the network. The docs document an installer that pipes a download into a shell.

  INSTALL_REMOTE_SCRIPT INSTALL_DOCUMENTED_INSTALLER

  SETUP.md, line 90

  # Linux: curl -fsSL https://ollama.ai/install.sh | sh

  install.sh, line 4

  # Usage: curl -fsSL https://raw.githubusercontent.com/Sandeeprdy1729/timps-swarm/main/install.sh | sh

  install.sh, line 70

  curl -LsSf https://astral.sh/uv/install.sh | sh

  Show more

  install.sh, line 155

  curl -fsSL https://ollama.ai/install.sh | sh

  .github/workflows/timps-swarm.yml, line 111

  # curl -fsSL https://ollama.ai/install.sh | sh

• Network

  Serious

  accepts a host from input, with no fixed list in this file.

  NETWORK_HOST_FROM_INPUT

  install.sh, line 149

  curl -fsSL "https://ollama.ai/download/Ollama-darwin.zip" -o /tmp/ollama.zip

  install.sh, line 176

  if ! curl -sf http://localhost:11434/api/tags &>/dev/null; then

  test_all_adapters.py, line 32

  "prompt": "Fix async bug:\nconst data = fetch('/api/users').json();\nconsole.log(data.name);",

  Show more

  timps_cli.py, line 365

  r = requests.get("http://localhost:11434/api/tags", timeout=2)

  timps_doctor.py, line 149

  resp = requests.get("http://localhost:11434/api/tags", timeout=3)

  timps_doctor.py, line 173

  resp = requests.get("http://localhost:11434/api/tags", timeout=3)

  cli/bin/timps-swarm.js, line 46

  const resp = await fetch(`${API_BASE}${path}`, {

  cli/bin/timps-swarm.js, line 58

  const resp = await fetch(`${API_BASE}/health`, { signal: AbortSignal.timeout(3000) });

  cli/lib/aider-bridge.sh, line 83

  curl -sf -X POST "${TIMPS_API}/mcp/tools/call" \

  cli/lib/local-audit.js, line 94

  const resp = await fetch("https://api.osv.dev/v1/querybatch", {

  cli/lib/local-audit.js, line 117

  const resp = await fetch(`https://api.osv.dev/v1/vulns/${id}`, {

  cli/lib/mcp-proxy.js, line 74

  r = await fetch(`${API_BASE}/mcp/tools`, { signal: AbortSignal.timeout(10000) });

  src/nextgen/accessibility_tester.py, line 35

  f"curl -sL --max-time 10 -A 'Mozilla/5.0 TIMPS-A11y' {url} 2>/dev/null | head -c 12000",

  src/phase7/red_team_agent.py, line 148

  ' r = httpx.post(ENDPOINT, json={"prompt": prompt}, headers=headers, timeout=TIMEOUT)\n'

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV

  timps_cli.py, line 357

  if os.getenv("GEMINI_API_KEY"):

  timps_cli.py, line 359

  if os.getenv("ANTHROPIC_API_KEY"):

  src/git_tools.py, line 501

  "~/.npmrc", "~/.pip/pip.conf",

  Show more

  timps_cli.py, line 361

  if os.getenv("OPENAI_API_KEY"):

  timps_cli.py, line 508

  ("Gemini API", bool(os.getenv("GEMINI_API_KEY")), "GEMINI_API_KEY"),

  timps_cli.py, line 509

  ("Anthropic API", bool(os.getenv("ANTHROPIC_API_KEY")), "ANTHROPIC_API_KEY"),

  timps_cli.py, line 510

  ("OpenAI API", bool(os.getenv("OPENAI_API_KEY")), "OPENAI_API_KEY"),

  cli/lib/local-audit.js, line 219

  ".php", ".sh", ".bash", ".zsh", ".env", ".yml", ".yaml", ".json",

  cli/lib/local-audit.js, line 231

  else if (SOURCE_EXTS.has(extname(entry).toLowerCase()) || entry.toLowerCase().startsWith(".env")) {

  src/auth.py, line 33

  os.environ.get("TIMPS_SECRETS_FILE", str(Path.home() / ".timps" / ".secrets"))

  src/auth.py, line 150

  env_key = os.environ.get("TIMPS_API_KEY", "")

  src/cloud_tools.py, line 75

  """Extract hostnames from common config files (nginx, k8s, terraform, .env)."""

  src/cloud_tools.py, line 87

  if f.suffix not in {".conf", ".yaml", ".yml", ".tf", ".env", ".ini", ".toml"}:

  src/git_tools.py, line 502

  "~/.ssh/config",

  src/infra/secrets_management.py, line 33

  f"grep -r --include='*.py' --include='*.env' --include='*.js' -l "

  src/infra/secrets_management.py, line 37

  # Read .env files if present

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  a file was over the read cap and was not fully read.

  OBFUSCATION_FILE_OVER_READ_CAP

  dashboard/package-lock.json, line 1

  {

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit c895066b67a1. can delete files. install fetches a script from the network. The docs document an installer that pipes a download into a shell. accepts a host from input, with no fixed list in this file. reads a credential or environment file. a file was over the read cap and was not fully read.

Date and source

Date checked: 20 Oct 2026

Read how this letter is chosen