github JavaScript analyzed a224377

itqanlab/agent-toolkit

Agent toolkit — portable Agent Skills, MCP servers, and Claude Code plugins. One repo, eight agents.

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools

transport — counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit a224377 · analyzer v33 · 2w ago

suspicious bundled script suspicious bundled script itqanlab-agent-toolkit-a224377/skills/cloudflare-ops/scripts/setup-deps.ps1 :80 Invoke-Expression $cmd
suspicious bundled script suspicious bundled script itqanlab-agent-toolkit-a224377/skills/dokploy-ops/scripts/setup-deps.ps1 :80 Invoke-Expression $cmd
suspicious bundled script suspicious bundled script itqanlab-agent-toolkit-a224377/skills/hetzner-ops/scripts/setup-deps.ps1 :80 Invoke-Expression $cmd
suspicious bundled script suspicious bundled script itqanlab-agent-toolkit-a224377/skills/toolkit-credentials/scripts/setup.ps1 :80 Invoke-Expression $cmd

code evidence vHEAD · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 31

fs itqanlab-agent-toolkit-a224377/site/build.mjs :12 import { readFileSync, writeFileSync, mkdirSync, readdirSync, existsSync, cpSync, rmSync } from 'node:fs';
fs itqanlab-agent-toolkit-a224377/skills/cloudflare-ops/lib/store.mjs :12 import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync, renameSync, statSync } from 'node:fs';
fs (weak) itqanlab-agent-toolkit-a224377/skills/cloudflare-ops/scripts/api.mjs :15 import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
fs itqanlab-agent-toolkit-a224377/skills/dokploy-ops/lib/store.mjs :12 import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync, renameSync, statSync } from 'node:fs';
fs (weak) itqanlab-agent-toolkit-a224377/skills/dokploy-ops/scripts/api.mjs :18 import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
fs itqanlab-agent-toolkit-a224377/skills/hetzner-ops/lib/store.mjs :12 import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync, renameSync, statSync } from 'node:fs';
fs (weak) itqanlab-agent-toolkit-a224377/skills/hetzner-ops/scripts/api.mjs :16 import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
fs (weak) itqanlab-agent-toolkit-a224377/skills/toolkit-credentials/scripts/store.mjs :12 import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync, renameSync, statSync } from 'node:fs';

shell (weak) itqanlab-agent-toolkit-a224377/skills/cloudflare-ops/scripts/cf.mjs :327 const { spawnSync } = await import('node:child_process');

net (weak) itqanlab-agent-toolkit-a224377/skills/cloudflare-ops/scripts/api.mjs :25 const response = await fetch(SPEC_URL, {
net (weak) itqanlab-agent-toolkit-a224377/skills/cloudflare-ops/scripts/cf.mjs :57 response = await fetch(url, init);
net (weak) itqanlab-agent-toolkit-a224377/skills/dokploy-ops/scripts/dk.mjs :86 response = await fetch(url, {
net (weak) itqanlab-agent-toolkit-a224377/skills/dokploy-ops/scripts/setup.mjs :39 response = await fetch(`${base}/api/project.all`, {
net (weak) itqanlab-agent-toolkit-a224377/skills/hetzner-ops/scripts/api.mjs :26 const response = await fetch(SPEC_URL, {
net (weak) itqanlab-agent-toolkit-a224377/skills/hetzner-ops/scripts/hz.mjs :82 response = await fetch(url, init);
net (weak) itqanlab-agent-toolkit-a224377/skills/hetzner-ops/scripts/setup.mjs :34 const response = await fetch('https://api.hetzner.cloud/v1/servers?per_page=1', {