github Shell re-analysis due

jfrog/opencode-jfrog-plugin

JFrog Plugin for seamless integration to Opencode

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools

transport — counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 56abf59 · analyzer v30 · 2w ago

code evidence vv0.1.0 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 7

fs (weak) jfrog-opencode-jfrog-plugin-56abf59/scripts/sync-skills.mjs :4 import { promises as fs, createWriteStream } from "node:fs";
fs (weak) jfrog-opencode-jfrog-plugin-56abf59/src/index.test.ts :12 } from 'node:fs';
fs jfrog-opencode-jfrog-plugin-56abf59/src/index.ts :11 } from 'fs';

shell (weak) jfrog-opencode-jfrog-plugin-56abf59/scripts/sync-skills.mjs :8 import { spawnSync } from "node:child_process";

net (weak) jfrog-opencode-jfrog-plugin-56abf59/scripts/sync-skills.mjs :17 const res = await fetch(url, { redirect: "follow" });

secrets (weak) jfrog-opencode-jfrog-plugin-56abf59/src/index.test.ts :169 process.env.JFROG_ACCESS_TOKEN = 'cmVmdGtuOnJlZmVyZW5jZQ';