Quita los metadatos (autor, GPS, comentarios, macros...) de Word, Excel, PowerPoint, PDF e imágenes. En el navegador, sin subir nada; y como servicio de pago para agentes de IA con cobro x402.
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport stdio counts 1 tools · 0 res
· 0 prompts
permission surface via code analysis
tools
-
limpiar_metadatos
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit d3215c2 · analyzer v33 · 3h ago
danger signals1
- credential in logs credential in log jostoz-quitametadatos-d3215c2/service/test/live-testnet.js :151
console.log(` set EVM_PRIVATE_KEY=${claveNueva || process.env.EVM_PRIVATE_KEY}`);
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 49
filesystem 13
- fs jostoz-quitametadatos-d3215c2/service/src/ledger.js :10
import { appendFile, access, constants, mkdir } from 'node:fs/promises'; - fs jostoz-quitametadatos-d3215c2/service/src/mcp-service.js :17
import { writeFile } from 'node:fs/promises'; - fs jostoz-quitametadatos-d3215c2/service/src/mcp.js :16
import { readFile, writeFile } from 'node:fs/promises'; - fs jostoz-quitametadatos-d3215c2/service/src/pagar.js :10
import { mkdir, readFile, writeFile } from 'node:fs/promises'; - fs (weak) jostoz-quitametadatos-d3215c2/service/test/e2e-asset.js :10
import { readFile } from 'node:fs/promises'; - fs (weak) jostoz-quitametadatos-d3215c2/service/test/e2e-productos.js :19
import { readFile } from 'node:fs/promises'; - fs (weak) jostoz-quitametadatos-d3215c2/service/test/e2e-scan.js :14
import { readFile } from 'node:fs/promises'; - fs (weak) jostoz-quitametadatos-d3215c2/service/test/e2e-secrets.js :13
import { readFile } from 'node:fs/promises'; - fs (weak) jostoz-quitametadatos-d3215c2/service/test/e2e-svm.js :10
import { readFile } from 'node:fs/promises'; - fs (weak) jostoz-quitametadatos-d3215c2/service/test/e2e.js :15
import { readFile } from 'node:fs/promises'; - fs (weak) jostoz-quitametadatos-d3215c2/service/test/live-testnet.js :23
import { readFile } from 'node:fs/promises'; - fs (weak) jostoz-quitametadatos-d3215c2/service/test/mcp.js :11
import { mkdtemp, readFile, rm, stat } from 'node:fs/promises';
show 1 more
- fs (weak) jostoz-quitametadatos-d3215c2/service/test/verify-fixtures.js :11
import { mkdir, readFile, writeFile, rm } from 'node:fs/promises';
shell / exec 3
- shell jostoz-quitametadatos-d3215c2/service/src/distribuir.js :161
const { execFileSync } = await import('node:child_process'); - shell (weak) jostoz-quitametadatos-d3215c2/service/test/preflight.js :8
import { spawn } from 'node:child_process'; - shell (weak) jostoz-quitametadatos-d3215c2/service/test/verify-fixtures.js :10
import { execFileSync } from 'node:child_process';
network 13
- net jostoz-quitametadatos-d3215c2/service/src/catalogado.js :36
const r = await fetch(`${facilitador}${ruta}`, { headers: { Accept: 'application/json' } }); - net jostoz-quitametadatos-d3215c2/service/src/pagar.js :61
const reto = await fetch(url, { method: 'POST', body: formulario() }); - net jostoz-quitametadatos-d3215c2/service/src/server.js :517
const manejar = reescribir ? (req) => app.fetch(reescribir(req)) : app.fetch; - net (weak) jostoz-quitametadatos-d3215c2/service/test/e2e-asset.js :57
(await fetch(`${url}/v1/clean`, { method: 'POST', body: formulario() })).headers.get('payment-required'), - net (weak) jostoz-quitametadatos-d3215c2/service/test/e2e-productos.js :83
const sinPagar = (url, ruta) => fetch(`${url}${ruta}`, { - net (weak) jostoz-quitametadatos-d3215c2/service/test/e2e-scan.js :82
const retoScan = await fetch(`${url}/v1/scan`, { method: 'POST', body: upload('x.xlsx', xlsxRiesgoso) }); - net (weak) jostoz-quitametadatos-d3215c2/service/test/e2e-secrets.js :92
const reto = await fetch(`${url}/v1/secrets`, { - net (weak) jostoz-quitametadatos-d3215c2/service/test/e2e-svm.js :74
const reto = await fetch(`${url}/v1/clean`, { method: 'POST', body: form(foto) }); - net (weak) jostoz-quitametadatos-d3215c2/service/test/e2e.js :101
const reto = await fetch(`${url}/v1/clean`, { method: 'POST', body: upload() }); - net (weak) jostoz-quitametadatos-d3215c2/service/test/live-testnet.js :104
const reto = await fetch(`${url}/v1/clean`, { method: 'POST', body: formulario() }); - net (weak) jostoz-quitametadatos-d3215c2/service/test/stub-facilitator.js :15
import { createServer } from 'node:http'; - net (weak) jostoz-quitametadatos-d3215c2/service/test/stub-rpc.js :11
import { createServer } from 'node:http';
show 1 more
- net jostoz-quitametadatos-d3215c2/web/sw.js :56
fetch(request)
secrets 4
- secrets jostoz-quitametadatos-d3215c2/service/src/distribuir.js :144
if (!process.env.EVM_PRIVATE_KEY) { - secrets jostoz-quitametadatos-d3215c2/service/src/pagar.js :29
if (!process.env.EVM_PRIVATE_KEY) { - secrets (weak) jostoz-quitametadatos-d3215c2/service/test/e2e-secrets.js :56
'const token = process.env.MY_TOKEN; // viene de env, no está en el código', - secrets (weak) jostoz-quitametadatos-d3215c2/service/test/live-testnet.js :64
const claveDelEntorno = process.env.EVM_PRIVATE_KEY;
tool registrations 1
- limpiar_metadatos jostoz-quitametadatos-d3215c2/service/src/mcp.js :44
declared dependencies 16
- @modelcontextprotocol/sdk@^1.20.2
- @hono/node-server@^1.19.5
- @privy-io/node@^0.34.0
- @solana-program/token-2022@0.6.1
- @solana/kit@5.5.1
- @x402/core@^2.26.0
- @x402/evm@^2.26.0
- @x402/extensions@^2.26.0
- @x402/fetch@^2.26.0
- @x402/hono@^2.26.0
- @x402/mcp@^2.26.0
- @x402/svm@^2.26.0
show 4 more
- @xmldom/xmldom@^0.9.12
- hono@^4.10.2
- viem@^2.56.7
- zod@^3.25.76
perm:untrusted 4
- untrusted (weak) jostoz-quitametadatos-d3215c2/service/test/e2e-productos.js :89
const jsonDe = async (url, ruta = '/') => (await fetch(`${url}${ruta}`)).json(); - untrusted (weak) jostoz-quitametadatos-d3215c2/service/test/e2e-scan.js :143
const descriptor = await (await fetch(`${url}/`, { headers: { Accept: 'application/json' } })).json(); - untrusted (weak) jostoz-quitametadatos-d3215c2/service/test/e2e-secrets.js :154
const descriptor = await (await fetch(`${url}/`, { headers: { Accept: 'application/json' } })).json(); - untrusted (weak) jostoz-quitametadatos-d3215c2/service/test/e2e.js :422
const precios = await (await fetch(`${url}/v1/pricing`)).json();