github TypeScript re-analysis due

ChronoAIProject/Ornn

Your all-in-one skills-as-a-service platform to manage your skills, auto-generate skills and use agent skills as simple as calling an API.

maintainer: ChronoAIProject
licence: Apache-2.0
first seen: 2026-06-04
last seen: 2026-08-07
releases · 30d: 0
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools

transport — counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 0041cfe · analyzer v33 · 1w ago

skills & prompt files 7

danger signals11

suspicious endpoint 169.254.169.254 (cloud metadata) ChronoAIProject-Ornn-0041cfe/ornn-api/src/domains/settings/sections/sections.test.ts :434 "http://169.254.169.254/latest/meta-data/",
suspicious endpoint eu.i.posthog.com (telemetry) ChronoAIProject-Ornn-0041cfe/ornn-api/src/infra/analytics/posthog.test.ts :25 const FAKE_HOST = "https://eu.i.posthog.com";
suspicious endpoint eu.i.posthog.com (telemetry) ChronoAIProject-Ornn-0041cfe/ornn-api/src/infra/config.ts :165 POSTHOG_HOST: z.string().url().default("https://eu.i.posthog.com"),
suspicious endpoint 93.184.216.34 ChronoAIProject-Ornn-0041cfe/ornn-api/src/infra/safeFetch.test.ts :107 const res = await safeFetch("http://93.184.216.34/x");
suspicious endpoint 169.254.169.254 (cloud metadata) ChronoAIProject-Ornn-0041cfe/ornn-api/src/infra/url.test.ts :99 expect(validatePublicUrl("http://169.254.169.254/latest/meta-data/").ok).toBe(false);
suspicious endpoint eu.i.posthog.com (telemetry) ChronoAIProject-Ornn-0041cfe/ornn-api/src/openapi/paths/admin.ts :1068 postHogHost: "https://eu.i.posthog.com",
suspicious endpoint eu.i.posthog.com (telemetry) ChronoAIProject-Ornn-0041cfe/ornn-api/src/openapi/paths/adminSettings.ts :266 postHogHost: "https://eu.i.posthog.com",
suspicious endpoint eu.i.posthog.com (telemetry) ChronoAIProject-Ornn-0041cfe/ornn-api/tests/integration/harness.ts :136 posthogHost: "https://eu.i.posthog.com",
suspicious endpoint eu.i.posthog.com (telemetry) ChronoAIProject-Ornn-0041cfe/ornn-web/src/lib/analytics.test.ts :48 posthogHost: "https://eu.i.posthog.com",
suspicious endpoint posthog.com (telemetry) ChronoAIProject-Ornn-0041cfe/ornn-web/src/lib/postHogLinks.ts :29 if (!host) return "https://posthog.com";
suspicious endpoint eu.i.posthog.com (telemetry) ChronoAIProject-Ornn-0041cfe/ornn-web/src/pages/admin/settings/sections/TelemetrySection.tsx :111 placeholder="https://eu.i.posthog.com"

code evidence vv0.16.1 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 828

filesystem 13

fs (weak) ChronoAIProject-Ornn-0041cfe/ornn-api/scripts/build-assistant-kb.ts :27 import { readFileSync, writeFileSync } from "node:fs";
fs (weak) ChronoAIProject-Ornn-0041cfe/ornn-api/scripts/drop-topics.ts :29 import { mkdir, writeFile } from "node:fs/promises";
fs ChronoAIProject-Ornn-0041cfe/ornn-api/src/bootstrap.ts :13 import { readFileSync } from "node:fs";
fs ChronoAIProject-Ornn-0041cfe/ornn-api/src/domains/assistant/kb/loader.ts :21 import { readFileSync } from "node:fs";
fs (weak) ChronoAIProject-Ornn-0041cfe/ornn-api/src/domains/playground/chatService.ts :166 - For file output: write files to the current directory using fs (require('fs')).
fs ChronoAIProject-Ornn-0041cfe/ornn-api/src/infra/agentseal/index.ts :32 import { existsSync, statSync } from "node:fs";
fs (weak) ChronoAIProject-Ornn-0041cfe/ornn-api/src/regression/hardcodeSweep.test.ts :29 import { readFileSync, readdirSync, statSync } from "node:fs";
fs (weak) ChronoAIProject-Ornn-0041cfe/ornn-api/src/regression/quotaOldFieldsGone.test.ts :18 import { readFileSync, readdirSync, statSync } from "node:fs";
fs ChronoAIProject-Ornn-0041cfe/ornn-api/src/shared/utils/archive.ts :1 import { mkdir } from "node:fs/promises";
fs (weak) ChronoAIProject-Ornn-0041cfe/ornn-web/src/__tests__/regression/hardcodeSweep.test.ts :19 import { readdirSync, readFileSync, statSync } from "node:fs";
fs (weak) ChronoAIProject-Ornn-0041cfe/ornn-web/src/components/skillset/SkillsetDependencyGraph.test.tsx :13 import { readFileSync } from "node:fs";
fs (weak) ChronoAIProject-Ornn-0041cfe/ornn-web/src/components/skillset/SkillsetDependencyGraphCanvas.test.tsx :16 import { readFileSync } from "node:fs";

show 1 more

fs (weak) ChronoAIProject-Ornn-0041cfe/ornn-web/vite.config.ts :5 import { readFileSync, writeFileSync } from "fs";

shell / exec 3

shell ChronoAIProject-Ornn-0041cfe/ornn-api/src/infra/agentseal/index.ts :31 import { spawn } from "node:child_process";
shell ChronoAIProject-Ornn-0041cfe/ornn-api/src/shared/utils/archive.ts :21 const proc = Bun.spawn(["tar", "-xzf", filePath, "-C", destDir], {
shell (weak) ChronoAIProject-Ornn-0041cfe/ornn-web/vite.config.ts :6 import { execSync } from "child_process";

network 30

net (weak) ChronoAIProject-Ornn-0041cfe/examples/api-fetch-wrapper/src/index.ts :54 res = await fetch(url);
net (weak) ChronoAIProject-Ornn-0041cfe/ornn-api/scripts/migrate-skill-versions.ts :136 const res = await fetch(url, { method, headers, body });
net (weak) ChronoAIProject-Ornn-0041cfe/ornn-api/src/clients/llmModelListClient.ssrf.test.ts :6 * 1. The model-list URL fetch (`fetch({ modelListUrl, auth })`).
net (weak) ChronoAIProject-Ornn-0041cfe/ornn-api/src/clients/llmModelListClient.test.ts :110 await new LlmModelListClient().fetch({ modelListUrl: MODEL_LIST_URL, apiFormat, auth });
net ChronoAIProject-Ornn-0041cfe/ornn-api/src/clients/llmModelListClient.ts :87 async fetch(args: {
net (weak) ChronoAIProject-Ornn-0041cfe/ornn-api/src/clients/nyxid/llm.ssrf.test.ts :9 * refusal lands at the GATEWAY fetch (the site under test), not the SA
net (weak) ChronoAIProject-Ornn-0041cfe/ornn-api/src/clients/nyxid/ssrf.test.ts :171 // catalog `/models` fetch (the named site), not the token exchange.
net ChronoAIProject-Ornn-0041cfe/ornn-api/src/domains/me/routes.ts :192 const resp = await fetch(`${baseUrl}/api/v1/orgs/${encodeURIComponent(orgId)}`, {
net (weak) ChronoAIProject-Ornn-0041cfe/ornn-api/src/domains/playground/chatService.ts :164 - Replace Bun-specific APIs: use fs.writeFileSync() instead of Bun.write(), use fetch() for HTTP.
net (weak) ChronoAIProject-Ornn-0041cfe/ornn-api/src/domains/settings/llmProviders/routes.test.ts :76 async fetch() {
net (weak) ChronoAIProject-Ornn-0041cfe/ornn-api/src/domains/settings/llmProviders/service.test.ts :60 async fetch(): Promise<ReadonlyArray<{ id: string; displayName: string }>> {
net ChronoAIProject-Ornn-0041cfe/ornn-api/src/domains/settings/llmProviders/service.ts :185 fetch(args: {

show 18 more

net ChronoAIProject-Ornn-0041cfe/ornn-api/src/domains/skills/mirror/githubAppAuth.ts :61 const resp = await fetch(url, {
net ChronoAIProject-Ornn-0041cfe/ornn-api/src/domains/skills/mirror/githubMirrorClient.ts :248 const resp = await fetch(url, init);
net ChronoAIProject-Ornn-0041cfe/ornn-api/src/infra/safeFetch.ts :144 const res = await fetch(currentUrl, currentInit);
net ChronoAIProject-Ornn-0041cfe/ornn-api/src/infra/url.ts :241 * Returns `void` on success. Caller is expected to call `fetch()`
net (weak) ChronoAIProject-Ornn-0041cfe/ornn-api/tests/integration/llmProviders_sync.test.ts :40 async fetch(args: {
net (weak) ChronoAIProject-Ornn-0041cfe/ornn-api/tests/mocks/modelListServer.ts :37 fetch() {
net (weak) ChronoAIProject-Ornn-0041cfe/ornn-web/src/components/notifications/NotificationBell.test.tsx :149 // First fetch (mount): only the old item. The refetch fired by opening
net ChronoAIProject-Ornn-0041cfe/ornn-web/src/components/skill/GenerateSkillModal.tsx :158 const specResp = await fetch(openapiRef.value, {
net (weak) ChronoAIProject-Ornn-0041cfe/ornn-web/src/lib/versionCheck.test.ts :119 it("does not fire on null fetch (network down)", async () => {
net ChronoAIProject-Ornn-0041cfe/ornn-web/src/lib/versionCheck.ts :41 const res = await fetch(VERSION_JSON_PATH, {
net ChronoAIProject-Ornn-0041cfe/ornn-web/src/pages/ServiceDetailPage.tsx :52 fetch(`${NYXID_API_BASE}/api/v1/services/${id}`, {
net ChronoAIProject-Ornn-0041cfe/ornn-web/src/services/activityApi.ts :48 const res = await fetch(`${API_BASE}/api/v1/activity/${action}`, {
net ChronoAIProject-Ornn-0041cfe/ornn-web/src/services/apiClient.ts :187 const response = await fetch(url, options);
net ChronoAIProject-Ornn-0041cfe/ornn-web/src/services/assistantStreamApi.ts :68 const response = await fetch(url.toString(), {
net ChronoAIProject-Ornn-0041cfe/ornn-web/src/services/generateStreamApi.ts :95 const response = await fetch(url, {
net ChronoAIProject-Ornn-0041cfe/ornn-web/src/services/playgroundStreamApi.ts :58 const response = await fetch(url.toString(), {
net ChronoAIProject-Ornn-0041cfe/ornn-web/src/services/skillApi.ts :71 const response = await fetch(
net ChronoAIProject-Ornn-0041cfe/ornn-web/src/stores/authStore.ts :236 const response = await fetch(NYXID_CONFIG.tokenUrl, {

secrets 3

secrets (weak) ChronoAIProject-Ornn-0041cfe/ornn-api/scripts/migrate-skill-versions.ts :55 const adminToken = process.env.ORNN_ADMIN_TOKEN;
secrets (weak) ChronoAIProject-Ornn-0041cfe/ornn-api/src/infra/config.test.ts :22 const ORIGINAL_ENCRYPTION_KEY = process.env.ENCRYPTION_KEY;
secrets ChronoAIProject-Ornn-0041cfe/sdk/typescript/src/index.ts :11 * token: process.env.NYXID_ACCESS_TOKEN!,

database 81

db (weak) ChronoAIProject-Ornn-0041cfe/ornn-api/scripts/audit-reserved-verbs.ts :18 import { MongoClient } from "mongodb";
db (weak) ChronoAIProject-Ornn-0041cfe/ornn-api/scripts/drop-topics.ts :28 import { MongoClient } from "mongodb";
db (weak) ChronoAIProject-Ornn-0041cfe/ornn-api/scripts/migrate-quota-to-buckets.test.ts :10 import { MongoClient, type Db } from "mongodb";
db (weak) ChronoAIProject-Ornn-0041cfe/ornn-api/scripts/migrate-quota-to-buckets.ts :30 import type { Collection, Db } from "mongodb";
db (weak) ChronoAIProject-Ornn-0041cfe/ornn-api/scripts/migrate-skill-ownership.ts :26 import { MongoClient } from "mongodb";
db (weak) ChronoAIProject-Ornn-0041cfe/ornn-api/scripts/migrate-skill-versions.ts :39 import { MongoClient } from "mongodb";
db (weak) ChronoAIProject-Ornn-0041cfe/ornn-api/src/domains/admin-users/service.test.ts :16 import { MongoClient, type Db } from "mongodb";
db ChronoAIProject-Ornn-0041cfe/ornn-api/src/domains/admin-users/service.ts :26 import type { Collection, Db } from "mongodb";
db ChronoAIProject-Ornn-0041cfe/ornn-api/src/domains/admin/bootstrap.ts :19 import type { Db } from "mongodb";
db (weak) ChronoAIProject-Ornn-0041cfe/ornn-api/src/domains/admin/dashboard/service.test.ts :18 import { MongoClient, type Db } from "mongodb";
db ChronoAIProject-Ornn-0041cfe/ornn-api/src/domains/admin/dashboard/service.ts :18 import type { Collection, Db } from "mongodb";
db (weak) ChronoAIProject-Ornn-0041cfe/ornn-api/src/domains/admin/quota/routes.test.ts :15 import { MongoClient, type Db } from "mongodb";

show 28 more

db (weak) ChronoAIProject-Ornn-0041cfe/ornn-api/src/domains/admin/redemption-codes/routes.test.ts :14 import { MongoClient, type Db } from "mongodb";
db (weak) ChronoAIProject-Ornn-0041cfe/ornn-api/src/domains/admin/routes.test.ts :22 import { MongoClient, type Collection, type Db } from "mongodb";
db ChronoAIProject-Ornn-0041cfe/ornn-api/src/domains/analytics/bootstrap.ts :12 import type { Db } from "mongodb";
db (weak) ChronoAIProject-Ornn-0041cfe/ornn-api/src/domains/analytics/repository.test.ts :22 import { MongoClient, type Db } from "mongodb";
db ChronoAIProject-Ornn-0041cfe/ornn-api/src/domains/analytics/repository.ts :11 import type { Collection, Db, Document } from "mongodb";
db (weak) ChronoAIProject-Ornn-0041cfe/ornn-api/src/domains/announcements/bootstrap.test.ts :20 import { MongoClient, type Db, type Document } from "mongodb";
db ChronoAIProject-Ornn-0041cfe/ornn-api/src/domains/announcements/bootstrap.ts :12 import type { Db } from "mongodb";
db (weak) ChronoAIProject-Ornn-0041cfe/ornn-api/src/domains/announcements/migration.test.ts :21 import { MongoClient, type Db, type Document } from "mongodb";
db ChronoAIProject-Ornn-0041cfe/ornn-api/src/domains/announcements/migration.ts :31 import type { Db, Document } from "mongodb";
db (weak) ChronoAIProject-Ornn-0041cfe/ornn-api/src/domains/announcements/repository.test.ts :25 import { MongoClient, type Db, type Document } from "mongodb";
db ChronoAIProject-Ornn-0041cfe/ornn-api/src/domains/announcements/repository.ts :30 import type { Collection, Db, Document } from "mongodb";
db (weak) ChronoAIProject-Ornn-0041cfe/ornn-api/src/domains/broadcasts/bootstrap.test.ts :19 import { MongoClient, type Db, type Document } from "mongodb";
db ChronoAIProject-Ornn-0041cfe/ornn-api/src/domains/broadcasts/bootstrap.ts :17 import type { Db } from "mongodb";
db (weak) ChronoAIProject-Ornn-0041cfe/ornn-api/src/domains/broadcasts/migration.test.ts :19 import { MongoClient, type Db, type Document } from "mongodb";
db ChronoAIProject-Ornn-0041cfe/ornn-api/src/domains/broadcasts/migration.ts :23 import type { Db } from "mongodb";
db (weak) ChronoAIProject-Ornn-0041cfe/ornn-api/src/domains/broadcasts/repository.test.ts :16 import { MongoClient, type Db } from "mongodb";
db ChronoAIProject-Ornn-0041cfe/ornn-api/src/domains/broadcasts/repository.ts :24 import type { Collection, Db, Document } from "mongodb";
db ChronoAIProject-Ornn-0041cfe/ornn-api/src/domains/launchPromo/bootstrap.ts :13 import type { Db } from "mongodb";
db ChronoAIProject-Ornn-0041cfe/ornn-api/src/domains/launchPromo/repository.ts :12 import type { Collection, Db } from "mongodb";
db (weak) ChronoAIProject-Ornn-0041cfe/ornn-api/src/domains/notifications/bootstrap.test.ts :22 import { MongoClient, type Db, type Document } from "mongodb";
db ChronoAIProject-Ornn-0041cfe/ornn-api/src/domains/notifications/bootstrap.ts :16 import type { Db } from "mongodb";
db (weak) ChronoAIProject-Ornn-0041cfe/ornn-api/src/domains/notifications/migration.test.ts :22 import { MongoClient, type Db, type Document } from "mongodb";
db ChronoAIProject-Ornn-0041cfe/ornn-api/src/domains/notifications/migration.ts :22 import type { Db } from "mongodb";
db (weak) ChronoAIProject-Ornn-0041cfe/ornn-api/src/domains/notifications/repository.test.ts :22 import { MongoClient, type Db } from "mongodb";
db ChronoAIProject-Ornn-0041cfe/ornn-api/src/domains/notifications/repository.ts :11 import type { Collection, Db, Document, Filter } from "mongodb";
db ChronoAIProject-Ornn-0041cfe/ornn-api/src/domains/platform/bootstrap.ts :14 import type { Db } from "mongodb";
db (weak) ChronoAIProject-Ornn-0041cfe/ornn-api/src/domains/platform/repository.test.ts :20 import { MongoClient, type Db } from "mongodb";
db ChronoAIProject-Ornn-0041cfe/ornn-api/src/domains/platform/repository.ts :10 import type { Collection, Db, Document } from "mongodb";

41 more not shown — this panel samples each group; the count above is the real total.

declared dependencies 7

@changesets/changelog-github@^0.7.0
@changesets/cli@^2.30.0
@eslint/js@^10.0.1
eslint@^10.6.0
eslint-plugin-react-hooks@^7.1.1
eslint-plugin-react-refresh@^0.5.3
typescript-eslint@^8.62.0