Privacy-first, self-hosted multi-user information hub for RSS, GitHub, Reddit, Telegram, Hacker News, and MCP.
- capability exposure inferred + 32
- tool safety inferred + 17
- trust mitigators mixed − 3
inferred mixed
The A–E grade is our heuristic synthesis — a "review this" prompt, not a verdict. Each factor is tagged by what backs it: attested (a verifiable record), reported (a third party's claim), or inferred (our own heuristic, e.g. permissions). See methodology.
grade last moved 1w ago · see ecosystem CVEs →
No known CVEs for this server.
- high dangerous code
dynamic exec: eval()/exec() · credential logged in 1 file(s)
- medium toxic flow (lethal trifecta)
lethal trifecta reachable across this server's tool + source surface: private-data access + untrusted-content ingestion + network exfil (a leg is proven only in the analyzed source)
analyzed commit 360ece2 · analyzer v33 · 1d ago
skills & prompt files 3
danger signals20
- dynamic code execution eval()/exec() StealHD-infohub-light-360ece2/tests/test_logging_completeness.py :147
exec(compile("raise RuntimeError('private-upstream-payload')", filename, "exec"), {}) - suspicious endpoint t.me StealHD-infohub-light-360ece2/src/scrapers/apify_social.py :1071
msg_url = str(row.get("Url") or row.get("url") or f"https://t.me/{channel}/{message_id}") - suspicious endpoint t.me StealHD-infohub-light-360ece2/src/scrapers/source_registry.py :67
endpoint="https://t.me/s/{channel}", - suspicious endpoint t.me StealHD-infohub-light-360ece2/src/scrapers/telegram.py :18
TELEGRAM_WEB_BASE = "https://t.me/s" - suspicious endpoint t.me StealHD-infohub-light-360ece2/src/services/config_runtime.py :341
raise ValueError("Telegram 频道格式不正确，请填写 zaihuapd、@zaihuapd 或 https://t.me/zaihuapd") - suspicious endpoint discord.com StealHD-infohub-light-360ece2/src/services/notification_webhook_transport.py :125
"url_hint": "https://discord.com/api/webhooks/…/…", - suspicious endpoint t.me StealHD-infohub-light-360ece2/src/services/source_probe.py :369
html = _fetch_text(f"https://t.me/s/{channel}") - suspicious endpoint t.me StealHD-infohub-light-360ece2/src/services/source_type_registry.py :837
("name", "@name", "https://t.me/name"), ("名称", "@名称", "公开频道网址"), - suspicious endpoint t.me StealHD-infohub-light-360ece2/tests/test_apify_social.py :1891
"Url": "https://t.me/zaihuapd/99", - suspicious endpoint 93.184.216.34 StealHD-infohub-light-360ece2/tests/test_config_server.py :1087
assert calls[0][0] == "https://93.184.216.34/feed.xml" - suspicious endpoint t.me StealHD-infohub-light-360ece2/tests/test_notification_telegram_transport.py :130
"https://t.me/example_channel", - suspicious endpoint api.telegram.org StealHD-infohub-light-360ece2/tests/test_notification_telegram_transport.py :153
f"https://api.telegram.org/bot{BOT_TOKEN}/sendMessage" - suspicious endpoint discord.com StealHD-infohub-light-360ece2/tests/test_notification_webhook_transport.py :48
"https://discord.com/api/webhooks/" - suspicious endpoint 93.184.216.34 StealHD-infohub-light-360ece2/tests/test_rss.py :568
url="https://93.184.216.34/feed.xml", - suspicious endpoint 1.1.1.1 StealHD-infohub-light-360ece2/tests/test_rss.py :692
assert str(second.url) == "https://1.1.1.1/next.xml" - suspicious endpoint t.me StealHD-infohub-light-360ece2/tests/test_source_presentation_adapters.py :152
apify_telegram_item = social._parse_telegram({"Id": 2, "Date": NOW.isoformat(), "Url": "https://t.me/durov/2", "Body": "Apify TG message", "Channel_Handle": "durov"}, apify_telegram_sub, SINCE) - suspicious endpoint t.me StealHD-infohub-light-360ece2/tests/test_source_setup_guidance.py :195
"telegram", {"channel": "https://t.me/durov"} - suspicious endpoint 169.254.169.254 (cloud metadata) StealHD-infohub-light-360ece2/tests/test_source_setup_guidance.py :802
"http://169.254.169.254/feed", - suspicious endpoint 93.184.216.34 StealHD-infohub-light-360ece2/tests/test_source_setup_guidance.py :892
source_type, {"url": "http://93.184.216.34/feed.xml"} - credential in logs credential in log StealHD-infohub-light-360ece2/src/auth.py :86
print(hash_password(password))
[](https://mcpobservatory.com/servers/github:StealHD/infohub-light/security) Heuristic, inferred signals — false positives (legitimately powerful tools, forks, language ports) are expected. Treat each as "review this", not a verdict. See the ecosystem-wide picture on the security hub, or the fleet security of StealHD.