github TypeScript re-analysis due

ikenokazuki/Sora

🌤️ 超高速・軽量なWebスクレイピング、ブラウザ操作＆日本の日常インフラ（天気・乗換・知恵袋）統合 MCP・REST サーバー

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 1 tools

transport stdio counts 1 tools · 0 res · 0 prompts permission surface via code analysis

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit b76ba85 · analyzer v33 · 3d ago

suspicious endpoint 169.254.169.254 (cloud metadata) ikenokazuki-Sora-b76ba85/src/index.test.ts :2692 'http://169.254.169.254/latest/meta-data',

code evidence vv2.21.0 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 62

fs ikenokazuki-Sora-b76ba85/src/browser_engine.ts :2 import { existsSync } from 'fs';
fs ikenokazuki-Sora-b76ba85/src/db.ts :2 import { existsSync, mkdirSync, chmodSync } from 'fs';
fs ikenokazuki-Sora-b76ba85/src/routes/system.ts :2 import { existsSync } from 'fs';
fs ikenokazuki-Sora-b76ba85/src/services/health.ts :1 import { existsSync } from 'fs';
fs ikenokazuki-Sora-b76ba85/src/services/yahoo.ts :2 import { existsSync } from 'fs';

shell ikenokazuki-Sora-b76ba85/src/browser_engine.ts :55 const { execSync } = require('child_process');
shell ikenokazuki-Sora-b76ba85/src/services/yahoo.ts :1 import { spawn } from 'child_process';

net ikenokazuki-Sora-b76ba85/src/browser_engine.ts :68 * 静的fetch(wreq)側のプロファイル選択を、ブラウザ経路が名乗るバージョンと一致させるために使う。
net ikenokazuki-Sora-b76ba85/src/enrichment.ts :386 const res = await fetch(webhookUrl, {
net ikenokazuki-Sora-b76ba85/src/http_fetcher.ts :30 fetch(url: string, init?: any): Promise<any>;
net (weak) ikenokazuki-Sora-b76ba85/src/index.test.ts :521 const resHealth = await testApp.fetch(new Request('http://localhost/health'));
net ikenokazuki-Sora-b76ba85/src/services/disaster.ts :117 const res = await fetch(jmaUrl, {
net ikenokazuki-Sora-b76ba85/src/services/gov.ts :72 const res = await fetch(url, {
net ikenokazuki-Sora-b76ba85/src/services/health.ts :38 const res = await fetch(url, {
net ikenokazuki-Sora-b76ba85/src/services/life.ts :175 const res = await fetch(url, {
net ikenokazuki-Sora-b76ba85/src/services/music.ts :61 const res = await fetch(itunesUrl, {
net ikenokazuki-Sora-b76ba85/src/services/tracking.ts :155 const res = await fetch('https://toi.kuronekoyamato.co.jp/cgi-bin/tneko', {
net ikenokazuki-Sora-b76ba85/src/services/trade.ts :562 const res = await fetch(url, {
net ikenokazuki-Sora-b76ba85/src/services/traffic.ts :133 const res = await fetch(url, {

secrets ikenokazuki-Sora-b76ba85/src/auth.ts :49 const apiKey = expectedApiKey ?? process.env.WEB_FETCHER_API_KEY ?? process.env.API_KEY;
secrets (weak) ikenokazuki-Sora-b76ba85/src/index.test.ts :2740 const prevKey = process.env.WEB_FETCHER_API_KEY;
secrets ikenokazuki-Sora-b76ba85/src/services/tracking.ts :698 const clientSecret = process.env.UPS_CLIENT_SECRET;

show 2 more