github JavaScript re-analysis due

humuhumu33/pin-the-protocol

Approve what an agent reads by content, not by name. A verifying MCP gateway that makes tool-description and Agent Skills rug-pulls unexpressible.

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools

transport stdio counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 79ce0d7 · analyzer v30 · 2w ago

code evidence vHEAD · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 13

fs humuhumu33-pin-the-protocol-79ce0d7/client/agent.mjs :13 import { readFileSync } from "node:fs";
fs humuhumu33-pin-the-protocol-79ce0d7/client/audit.mjs :9 import { mkdirSync, writeFileSync } from "node:fs";
fs humuhumu33-pin-the-protocol-79ce0d7/client/run-act1.mjs :10 import { mkdirSync, writeFileSync } from "node:fs";
fs humuhumu33-pin-the-protocol-79ce0d7/client/run-act2.mjs :14 import { readFileSync } from "node:fs";
fs humuhumu33-pin-the-protocol-79ce0d7/client/run-skills.mjs :9 import { cpSync, mkdirSync, rmSync, writeFileSync, readFileSync } from "node:fs";
fs humuhumu33-pin-the-protocol-79ce0d7/gateway/gateway.mjs :29 import { writeFileSync } from "node:fs";
fs humuhumu33-pin-the-protocol-79ce0d7/skill-lock/skill-lock.mjs :16 import { readFileSync } from "node:fs";

shell humuhumu33-pin-the-protocol-79ce0d7/client/approve.mjs :5 import { spawnSync } from "node:child_process";
shell humuhumu33-pin-the-protocol-79ce0d7/client/run-skills.mjs :11 import { spawnSync } from "node:child_process";

net humuhumu33-pin-the-protocol-79ce0d7/lib/store.mjs :28 const res = await fetch(`${STORE_URL}${path}`, { method, body, headers });