github Rust re-analysis due unconfirmed MCP

dilpreet92/coldtrail

github

Discovery-first cold outreach for solo founders — find the companies other tools miss, draft each email in your voice, send from your own Gmail. Local, single Rust binary. Built on Canonical.

maintainer
dilpreet92
license
MIT
first seen
2026-08-11
last seen
2026-08-25
releases · 30d
50
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools
transport counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 23308fd · analyzer v30 · 2w ago

skills & prompt files 1

danger signals1

  • over-broad OAuth scope https://mail.google.com/ dilpreet92-coldtrail-23308fd/ui/app.js :598 ${inGmail ? `<a class="btn" href="https://mail.google.com/mail/u/0/#drafts" target="_blank" rel="noreferrer">Open Gmail</a><button class="btn marksent">Mark sent</button>` : ""}
code evidence vv0.9.1 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 44

network 1

  • net dilpreet92-coldtrail-23308fd/ui/app.js :28 const r = await fetch(path, { credentials: "same-origin" });

declared dependencies 25

  • clap@4
  • rusqlite@0.31
  • serde@1
  • serde_json@1
  • toml@0.8
  • reqwest@0.12
  • scraper@0.19
  • hickory-resolver@0.24
  • regex@1
  • anyhow@1
  • dirs@5
  • rpassword@7
  • urlencoding@2
  • tokio@1
  • axum@0.7
  • tower@0.5
  • rust-embed@8
  • open@5
  • uuid@1
  • futures@0.3
  • tokio-stream@0.1
  • base64@0.22
  • sha2@0.10
  • tokio-rustls@0.26
  • webpki-roots@0.26