Drift inferred · capture-to-capture
- HIGH code analysis flagged dynamic code execution ×2 in CorgiCorner/tickward
transport http counts 0 tools · 0 res
· 0 prompts
permission surface via code analysis
No tools enumerated yet for this server.
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit a00df0a · analyzer v28 · 1d ago
skills & prompt files 2
danger signals3
- dynamic code execution indirect eval CorgiCorner-tickward-a00df0a/components/webmcp-inline-script.test.ts :16
;(0, eval)(webMcpInlineScript()) - dynamic code execution vm exec CorgiCorner-tickward-a00df0a/public/sw.test.ts :28
vm.runInNewContext(workerSource, { globalThis: workerGlobal, Set, URL }) - suspicious endpoint 8.8.8.8 CorgiCorner-tickward-a00df0a/lib/webhooks.server.test.ts :272
url: "https://8.8.8.8/tickward",
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 597
filesystem 2
- fs CorgiCorner-tickward-a00df0a/app/.well-known/agent-skills/index.json/route.ts :2
import { readFileSync } from "node:fs" - fs CorgiCorner-tickward-a00df0a/lib/og/fonts.ts :1
import { readFile } from "node:fs/promises"
shell / exec 1
- shell CorgiCorner-tickward-a00df0a/lib/i18n/messages.ts :37
return new RegExp(`^${pattern}$`)
network 26
- net CorgiCorner-tickward-a00df0a/app/api/internal/client-error/route.ts :87
await fetch(forwardUrl, { - net CorgiCorner-tickward-a00df0a/app/api/unsplash/download/route.ts :31
await fetch(`https://api.unsplash.com/photos/${photoId}/download`, { - net CorgiCorner-tickward-a00df0a/app/api/unsplash/search/route.ts :29
const res = await fetch(url.toString(), { - net CorgiCorner-tickward-a00df0a/components/account-preferences-provider.tsx :59
const res = await fetch("/api/account/preferences", { cache: "no-store" }) - net CorgiCorner-tickward-a00df0a/components/admin/admin-bootstrap-client.tsx :21
void fetch("/api/setup/claim-admin", { method: "POST" }) - net CorgiCorner-tickward-a00df0a/components/api-keys-settings.tsx :76
const res = await fetch("/api/account/api-keys", { cache: "no-store" }) - net CorgiCorner-tickward-a00df0a/components/footer-status-dot.tsx :17
fetch("/api/status-summary") - net CorgiCorner-tickward-a00df0a/components/mcp-settings.tsx :32
const res = await fetch("/api/account/mcp-connections", { cache: "no-store" }) - net CorgiCorner-tickward-a00df0a/components/timer-card.tsx :359
const res = await fetch("/api/share/status", { - net CorgiCorner-tickward-a00df0a/components/unsplash-picker.tsx :141
void fetch(`/api/unsplash/search?q=${encodeURIComponent(q)}`, { signal: controller.signal }) - net CorgiCorner-tickward-a00df0a/components/use-inbox.ts :68
const res = await fetch("/api/account/notifications", { - net CorgiCorner-tickward-a00df0a/components/webhooks-settings.tsx :77
const res = await fetch("/api/account/webhooks", { cache: "no-store" }) - net CorgiCorner-tickward-a00df0a/hooks/use-github-stars.ts :13
starsRequest ??= fetch(GITHUB_REPO_API_URL, { - net CorgiCorner-tickward-a00df0a/lib/adapters/resend-mail-provider.server.ts :103
const res = await fetch("https://api.resend.com/emails", { - net CorgiCorner-tickward-a00df0a/lib/desktop-release.ts :46
const response = await fetch(`${DESKTOP_FEED_BASE_URL}/latest-mac.yml`, { - net CorgiCorner-tickward-a00df0a/lib/error-reporting.ts :152
void fetch(CLIENT_ERROR_ENDPOINT, { - net CorgiCorner-tickward-a00df0a/lib/mcp-authorization-handoff.server.ts :63
const res = await fetch(`${mcpOrigin}/oauth/handoff/${encodeURIComponent(handoff)}`, { cache: "no-store" }) - net CorgiCorner-tickward-a00df0a/lib/mcp-discovery-proxy.server.ts :36
upstream = await fetch(`${origin}${path}`, { - net CorgiCorner-tickward-a00df0a/lib/notification-audio.client.ts :100
const resp = await fetch(url) - net CorgiCorner-tickward-a00df0a/lib/over-limit-project-gc.server.ts :62
const res = await fetch("https://api.resend.com/emails", { - net CorgiCorner-tickward-a00df0a/lib/project-client.ts :51
const res = await fetch("/api/projects/save", { - net CorgiCorner-tickward-a00df0a/lib/status-summary.ts :27
const response = await fetch(url, { signal: controller.signal, next: { revalidate: 60 } }) - net CorgiCorner-tickward-a00df0a/lib/stores/count-up-store.ts :306
return occurrencesFromResponse(await fetch("/api/timer-attention", { credentials: "same-origin" })) - net CorgiCorner-tickward-a00df0a/lib/stores/timer-store-followed.ts :21
const res = await fetch(`/api/share/resolve?id=${encodeURIComponent(shareId)}`, { - net CorgiCorner-tickward-a00df0a/lib/web-push-client.ts :20
const response = await fetch("/api/push/public-key", { cache: "no-store" }) - net CorgiCorner-tickward-a00df0a/lib/webhooks.server.ts :5
import { isIP } from "node:net"
install hooks 2
- postinstall CorgiCorner-tickward-a00df0a/package.json :76
node scripts/prisma-generate-if-available.mjs - prepare CorgiCorner-tickward-a00df0a/package.json :77
husky || true
declared dependencies 62
- @dnd-kit/core@^6.3.1
- @dnd-kit/sortable@^10.0.0
- @dnd-kit/utilities@^3.2.2
- @hookform/resolvers@^5.4.0
- @phosphor-icons/react@^2.1.10
- @prisma/adapter-pg@^7.9.0
- @prisma/client@^7.9.0
- @upstash/ratelimit@^2.0.8
- @upstash/redis@^1.38.0
- better-auth@^1.6.23
- class-variance-authority@^0.7.1
- clsx@^2.1.1
- cmdk@^1.1.1
- date-fns@^4.4.0
- date-fns-tz@^3.2.0
- immer@^11.1.15
- lucide-react@^1.25.0
- nanoid@^6.0.0
- next@^16.2.11
- next-themes@^0.4.6
- pg@^8.22.0
- prisma@^7.9.0
- radix-ui@^1.6.4
- react@19.2.7
- react-day-picker@^9.14.0
- react-dom@19.2.7
- react-hook-form@^7.82.0
- react-swipeable-list@^1.10.0
- resend@^6.17.2
- sonner@^2.0.7
- tailwind-merge@^3.6.0
- web-push@^3.6.7
- zod@^4.4.3
- zustand@^5.0.14
- @biomejs/biome@^2.5.5
- @storybook/addon-docs@^10.5.3
- @storybook/addon-vitest@^10.5.3
- @storybook/nextjs-vite@^10.5.3
- @tailwindcss/postcss@^4
- @testing-library/jest-dom@^7.0.0
- @testing-library/react@^16.3.2
- @testing-library/user-event@^14.6.1
- @types/node@^22.20.1
- @types/react@^19
- @types/react-dom@^19
- @types/web-push@^3.6.4
- @vitest/browser-playwright@^4.1.10
- @vitest/coverage-v8@^4.1.7
- dotenv@^17.4.2
- eslint@^9
- eslint-config-next@^16.2.10
- husky@^9.1.7
- jsdom@^29.1.1
- lint-staged@^17.1.0
- napi-postinstall@^0.3.4
- playwright@^1.61.1
- shadcn@^4.13.1
- storybook@^10.4.2
- tailwindcss@^4
- tw-animate-css@^1.4.0
- typescript@^6
- vitest@^4.1.7
transport_posture 1
- network-listening, binds all interfaces, no auth detected CorgiCorner-tickward-a00df0a/scripts/smoke-webhook-receivers.mjs :107
HOST: "0.0.0.0",