ripple

What was checked

Plain notes from the hygiene checks.

• Permissions

  Note

  requests shell access. The manifest names this permission.

  PERMISSION_SHELL_DECLARED

  crates/engine/src/lib.rs, line 13

  //! if engine::is_reachable(&graph, "handleRequest", "child_process.exec") {

  crates/engine/src/lib.rs, line 65

  /// (exact, then qualified-name suffix, then substring), so `"child_process.exec"`

  crates/engine/src/lib.rs, line 388

  "launch uses subprocess.run: {:?}",

  Show more

  crates/engine/src/lib.rs, line 393

  "launch reaches subprocess.run"

  crates/engine/src/lib.rs, line 494

  // plain `import os` + os.system(...)

  crates/engine/src/lib.rs, line 498

  def wipe():\n return os.system('rm -rf /tmp/x')\n",

  crates/resolve/src/lib.rs, line 969

  // `React.useState()` / `os.system()` - the receiver names an

• Install and update

  Pass

  No install-time script found, and dependencies are pinned or absent.

• Network

  Serious

  accepts a host from input, with no fixed list in this file.

  NETWORK_HOST_FROM_INPUT

  install.sh, line 54

  curl -fsSL "https://github.com/$REPO/releases/latest/download/ripple-$triple.tar.gz" | tar -xz -C "$tmp"

  install.sh, line 67

  curl -fsSL "https://raw.githubusercontent.com/$REPO/main/.claude/skills/ripple-orient/SKILL.md" \

  crates/lang/src/cross.rs, line 105

  /// How much of the key was literal. A `fetch(`/api/${id}`)` pins less than a

  Show more

  crates/lang/src/cross.rs, line 392

  /// `fetch("/api/users")`, `axios.get(`/api/users/${id}`)` - the consumer side of an

  crates/lang/src/cross.rs, line 1035

  ts_consumes("fetch(\"/api/users\");"),

  crates/lang/src/cross.rs, line 1039

  ts_consumes("fetch(\"/api/users\", { method: \"POST\" });"),

  crates/lang/src/cross.rs, line 1043

  ts_consumes("axios.get(`/api/users/${id}`);"),

  crates/lang/src/cross.rs, line 1061

  // MSW spells a mock handler `http.get("*/health", …)`; reading those would

  crates/lang/src/cross.rs, line 1063

  assert!(ts_consumes("http.get(\"*/health\", handler);").is_empty());

  crates/lang/src/cross.rs, line 1066

  assert!(ts_consumes("fetch(url, { method: verb });").is_empty());

  crates/lang/src/cross.rs, line 1070

  assert!(ts_consumes("fetch(\"users\");").is_empty());

  crates/lang/src/typescript/mod.rs, line 403

  let caps = captured("declare class Api { fetch(): void; static make(): Api; }\n");

  docs/src/content/docs/design/10-cross-service-resolution.md, line 17

  @app.get("/users/:id") fetch(`/api/users/${id}`)

  docs/src/content/docs/design/10-cross-service-resolution.md, line 81

  2. **Base URL (consumer).** `fetch(API_BASE + "/users")` where `API_BASE` comes from env/config. Resolve via the existing `CONFIGURES` edge (codebase-memory has `CONFIGURES {config

• Secrets

  Pass

  No read of a credential file or secret environment variable found.

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  a file was over the read cap and was not fully read.

  OBFUSCATION_FILE_OVER_READ_CAP

  docs/bun.lock, line 1

  {

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 7375bbbdf09a. requests shell access. The manifest names this permission. accepts a host from input, with no fixed list in this file. a file was over the read cap and was not fully read.

Date and source

Date checked: 25 Oct 2026

Read how this letter is chosen