pixasso

What was checked

Plain notes from the hygiene checks.

• Permissions

  Concern

  can delete files.

  PERMISSION_DELETE_FILES

  scripts/sync-skill.js, line 88

  fs.unlinkSync(path.join(targetDir, file));

• Install and update

  Pass

  No install-time script found, and dependencies are pinned or absent.

• Network

  Concern

  can reach a host that is not written as a fixed address. can reach integrate.api.nvidia.com. The description does not name that host. can reach openrouter.ai. The description does not name that host.

  NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST

  .agents/skills/pixasso/references/sound-and-sensory-design.md, line 71

  const response = await fetch(url);

  .cursor/skills/pixasso/references/sound-and-sensory-design.md, line 71

  const response = await fetch(url);

  apps/taste-canvas/src/App.tsx, line 261

  const res = await fetch('https://mcp.pixasso.erebuzzz.tech/taste/brain', {

  Show more

  mcp-server/src/utils.ts, line 40

  const resp = await fetch(upstream_url, {

  mcp-server/src/worker.ts, line 253

  async fetch(request: Request, env: WorkerEnv, ctx: ExecutionContext): Promise<Response> {

  mcp-server/src/worker.ts, line 346

  return oauthProvider.fetch(request, env, ctx);

  mcp-server/src/worker.ts, line 362

  await fetch(url, {

  mcp-server/src/taste/inference.ts, line 47

  const res = await fetch('https://integrate.api.nvidia.com/v1/chat/completions', {

  mcp-server/src/taste/inference.ts, line 84

  const res = await fetch('https://openrouter.ai/api/v1/chat/completions', {

  site/index.html, line 3226

  const res = await fetch('https://mcp.pixasso.erebuzzz.tech/taste/brain', {

  site/index.html, line 4513

  fetch('https://mcp.pixasso.erebuzzz.tech/ping').catch(() => {});

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV

  .gitignore, line 8

  # Environment and secrets

  .gitignore, line 9

  .env

  .gitignore, line 16

  credentials.json

  Show more

  .gitignore, line 11

  !.env.example

  CONTRIBUTING.md, line 51

  Also do not commit secrets, `.env` files, or personal credentials.

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  a file was over the read cap and was not fully read. the file cap was reached before every file was read.

  OBFUSCATION_FILE_OVER_READ_CAP OBFUSCATION_FILE_CAP_REACHED

  examples/assets/index-CAkFZg37.js, line 1

  var e=Object.create,t=Object.defineProperty,n=Object.getOwnPropertyDescriptor,r=Object.getOwnPropertyNames,i=Object.getPrototypeOf,a=Object.prototype.hasOwnProperty,o=(e,t)=>()=>(t

  examples/assets/index-DcUV1vvO.js, line 1

  var e=Object.create,t=Object.defineProperty,n=Object.getOwnPropertyDescriptor,r=Object.getOwnPropertyNames,i=Object.getPrototypeOf,a=Object.prototype.hasOwnProperty,o=(e,t)=>()=>(t

  examples/assets/index-IaopMVMp.js, line 1

  var e=Object.create,t=Object.defineProperty,n=Object.getOwnPropertyDescriptor,r=Object.getOwnPropertyNames,i=Object.getPrototypeOf,a=Object.prototype.hasOwnProperty,o=(e,t)=>()=>(t

  Show more

  examples/assets/index-Nzi823Gu.js, line 1

  var e=Object.create,t=Object.defineProperty,n=Object.getOwnPropertyDescriptor,r=Object.getOwnPropertyNames,i=Object.getPrototypeOf,a=Object.prototype.hasOwnProperty,o=(e,t)=>()=>(t

  examples/taste-canvas/assets/index-CAkFZg37.js, line 1

  var e=Object.create,t=Object.defineProperty,n=Object.getOwnPropertyDescriptor,r=Object.getOwnPropertyNames,i=Object.getPrototypeOf,a=Object.prototype.hasOwnProperty,o=(e,t)=>()=>(t

  examples/taste-canvas/assets/index-DcUV1vvO.js, line 1

  var e=Object.create,t=Object.defineProperty,n=Object.getOwnPropertyDescriptor,r=Object.getOwnPropertyNames,i=Object.getPrototypeOf,a=Object.prototype.hasOwnProperty,o=(e,t)=>()=>(t

  examples/taste-canvas/assets/index-IaopMVMp.js, line 1

  var e=Object.create,t=Object.defineProperty,n=Object.getOwnPropertyDescriptor,r=Object.getOwnPropertyNames,i=Object.getPrototypeOf,a=Object.prototype.hasOwnProperty,o=(e,t)=>()=>(t

  examples/taste-canvas/assets/index-Nzi823Gu.js, line 1

  var e=Object.create,t=Object.defineProperty,n=Object.getOwnPropertyDescriptor,r=Object.getOwnPropertyNames,i=Object.getPrototypeOf,a=Object.prototype.hasOwnProperty,o=(e,t)=>()=>(t

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit e6ea3d386b2f. can delete files. can reach a host that is not written as a fixed address. can reach integrate.api.nvidia.com. The description does not name that host. can reach openrouter.ai. The description does not name that host. reads a credential or environment file. a file was over the read cap and was not fully read. the file cap was reached before every file was read.

Date and source

Date checked: 25 Oct 2026

Read how this letter is chosen