io.github.Wangggym/quarry

What was checked

Plain notes from the hygiene checks.

• Permissions

  Note

  requests shell access. The manifest names this permission.

  PERMISSION_SHELL_DECLARED

  scripts/gui_screenshots.py, line 98

  proc = subprocess.Popen(

  src/quarry/assistant_config.py, line 122

  result = subprocess.run(["/usr/bin/defaults", "read", "-g", "AppleLanguages"],

  src/quarry/assistant_config.py, line 124

  xml = subprocess.run(["/usr/bin/plutil", "-convert", "xml1", "-o", "-", "--", "-"],

  Show more

  src/quarry/assistant_config.py, line 134

  result = subprocess.run(["/usr/bin/defaults", "read", "-g", "AppleLocale"],

  src/quarry/cli.py, line 445

  proc = subprocess.run(cmd, capture_output=True, text=True, timeout=15)

  src/quarry/cli.py, line 867

  return subprocess.call([editor, str(path)])

  src/quarry/core.py, line 1134

  proc = subprocess.run(cmd, input=sql, capture_output=True, text=True, timeout=timeout, env=env)

  src/quarry/gui.py, line 967

  r = subprocess.run(["lsof", "-nP", f"-iTCP:{port}", "-sTCP:LISTEN", "-t"],

• Install and update

  Pass

  No install-time script found, and dependencies are pinned or absent.

• Network

  Concern

  can reach a host that is not written as a fixed address.

  NETWORK_NO_FIXED_HOST

  src/quarry/local.py, line 515

  with urllib.request.urlopen(

  src/quarry/local.py, line 620

  with urllib.request.urlopen(

  src/quarry/proxy.py, line 185

  with socket.create_connection((host, port), timeout=timeout):

  Show more

  src/quarry/proxycommand.py, line 47

  sock = socket.create_connection((proxy_host, proxy_port), timeout=connect_timeout)

  src/quarry/tunnel.py, line 99

  with socket.create_connection((host, port), timeout=1):

  src/quarry/tunnel.py, line 121

  with socket.create_connection((host, port), timeout=0.3):

  web/src/api.ts, line 161

  const res = await fetch(path, { signal });

  web/src/api.ts, line 170

  const res = await fetch(path, {

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV

  src/quarry/assistant_config.py, line 36

  return workspace._config_path().with_name("assistant-credentials.json")

  src/quarry/keepalive.py, line 268

  files.extend(ssh_home / name for name in ("id_rsa", "id_ecdsa", "id_ed25519"))

  src/quarry/tunnel.py, line 402

  # Direct means direct even when ~/.ssh/config supplies a proxy/jump.

  Show more

  src/quarry/core.py, line 535

  # A local dev .env (loopback host, throwaway credentials) getting registered

  src/quarry/core.py, line 625

  "service's deployment docs (README / docker-compose / .env.example) rather "

  src/quarry/core.py, line 626

  "than a local dev .env — add --ssh-host/--ssh-user/--ssh-key to tunnel to the "

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  a file was over the read cap and was not fully read.

  OBFUSCATION_FILE_OVER_READ_CAP

  src/quarry/web_dist/assets/index-DGUZlea4.css, line 1

  @font-face{font-family:tabler-icons;font-style:normal;font-weight:400;src:url(/quarry/assets/tabler-icons-beWnEeRv.woff2?v3.0.0) format("woff2"),url(/quarry/assets/tabler-icons-60F

  src/quarry/web_dist/assets/index-u5yVa3JS.js, line 1

  (function(){const l=document.createElement("link").relList;if(l&&l.supports&&l.supports("modulepreload"))return;for(const u of document.querySelectorAll('link[rel="modulepreload"]'

  tests/test_gui_browser_features.py, line 1

  """Browser e2e for the GUI feature matrix (TESTING.md "GUI feature matrix").

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit a08ee492e510. requests shell access. The manifest names this permission. can reach a host that is not written as a fixed address. reads a credential or environment file. a file was over the read cap and was not fully read.

Date and source

Date checked: 20 Oct 2026

Read how this letter is chosen