github JavaScript re-analysis due

moeilijk/ai-assisted-speedruns

An open standard and plugin framework for AI Assisted Speedruns: an LLM agent plays a game through three hardened tools, every decision lands on one timeline, the run is recorded and published as a bundle anyone can verify.

maintainer: moeilijk
licence: MIT
first seen: 2026-09-13
last seen: 2026-09-19
releases · 30d: 37
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools

transport stdio · http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit a346d06 · analyzer v33 · 6h ago

skills & prompt files 2

agent-rules moeilijk-ai-assisted-speedruns-a346d06/games/balatro/AGENTS.md
agent-rules moeilijk-ai-assisted-speedruns-a346d06/games/slay-the-spire/AGENTS.md

danger signals1

dynamic code execution new Function() moeilijk-ai-assisted-speedruns-a346d06/games/slay-the-spire/test/bot.test.mjs :112 try { result = await new Function("sts", `return (async () => { ${step.code} })()`)(api); } catch (e) { result = { error: e.message }; }

code evidence vv0.19.7 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 160

filesystem 97

fs moeilijk-ai-assisted-speedruns-a346d06/games/balatro/bridge.mjs :18 import { existsSync, readFileSync, rmSync, writeFileSync } from "node:fs";
fs moeilijk-ai-assisted-speedruns-a346d06/games/balatro/close-game.mjs :4 import fs from "node:fs";
fs moeilijk-ai-assisted-speedruns-a346d06/games/balatro/install-mod.mjs :10 import fs from "node:fs";
fs moeilijk-ai-assisted-speedruns-a346d06/games/balatro/launch-game.mjs :11 import fs from "node:fs";
fs moeilijk-ai-assisted-speedruns-a346d06/games/balatro/plugin.mjs :6 import { copyFileSync, existsSync, mkdirSync, readFileSync } from "node:fs";
fs (weak) moeilijk-ai-assisted-speedruns-a346d06/games/balatro/test/balatro.test.mjs :6 import { mkdtempSync, existsSync } from "node:fs";
fs (weak) moeilijk-ai-assisted-speedruns-a346d06/games/balatro/test/fake-balatrobot.mjs :5 import { readFileSync, writeFileSync } from "node:fs";
fs moeilijk-ai-assisted-speedruns-a346d06/games/portal/chambers.mjs :7 import fs from "node:fs";
fs moeilijk-ai-assisted-speedruns-a346d06/games/portal/demo-track.mjs :7 import fs from "node:fs";
fs moeilijk-ai-assisted-speedruns-a346d06/games/portal/extract-chambers.mjs :7 import fs from "node:fs";
fs moeilijk-ai-assisted-speedruns-a346d06/games/portal/fetch-portal-agent.mjs :6 import { existsSync, readFileSync } from "node:fs";
fs moeilijk-ai-assisted-speedruns-a346d06/games/portal/install-game-files.mjs :9 import fs from "node:fs";

show 28 more

fs moeilijk-ai-assisted-speedruns-a346d06/games/portal/launch-game.mjs :13 import fs from "node:fs";
fs moeilijk-ai-assisted-speedruns-a346d06/games/portal/plugin.mjs :12 import { readFileSync, existsSync, statSync, mkdirSync, readdirSync, copyFileSync } from "node:fs";
fs (weak) moeilijk-ai-assisted-speedruns-a346d06/games/portal/test/fake-spt.mjs :5 import { mkdirSync, writeFileSync } from "node:fs";
fs (weak) moeilijk-ai-assisted-speedruns-a346d06/games/portal/test/portal.test.mjs :6 import { existsSync, mkdtempSync, readFileSync, readdirSync } from "node:fs";
fs moeilijk-ai-assisted-speedruns-a346d06/games/slay-the-spire/bot.mjs :29 import fs from "node:fs";
fs moeilijk-ai-assisted-speedruns-a346d06/games/slay-the-spire/check-plan.mjs :13 import fs from "node:fs";
fs moeilijk-ai-assisted-speedruns-a346d06/games/slay-the-spire/close-game.mjs :4 import fs from "node:fs";
fs moeilijk-ai-assisted-speedruns-a346d06/games/slay-the-spire/conformance.mjs :12 import fs from "node:fs";
fs moeilijk-ai-assisted-speedruns-a346d06/games/slay-the-spire/install-mod.mjs :9 import fs from "node:fs";
fs moeilijk-ai-assisted-speedruns-a346d06/games/slay-the-spire/launch-game.mjs :9 import fs from "node:fs";
fs moeilijk-ai-assisted-speedruns-a346d06/games/slay-the-spire/plugin.mjs :8 import { existsSync, readFileSync, mkdirSync, copyFileSync, readdirSync, statSync } from "node:fs";
fs moeilijk-ai-assisted-speedruns-a346d06/games/slay-the-spire/save-track.mjs :13 import fs from "node:fs";
fs moeilijk-ai-assisted-speedruns-a346d06/games/slay-the-spire/seed-pick.mjs :5 import fs from "node:fs";
fs moeilijk-ai-assisted-speedruns-a346d06/games/slay-the-spire/seed-winrate.mjs :28 import fs from "node:fs";
fs moeilijk-ai-assisted-speedruns-a346d06/games/slay-the-spire/tape.mjs :7 import fs from "node:fs";
fs (weak) moeilijk-ai-assisted-speedruns-a346d06/games/slay-the-spire/test/save-track.test.mjs :5 import fs from "node:fs";
fs (weak) moeilijk-ai-assisted-speedruns-a346d06/games/slay-the-spire/test/tape.test.mjs :4 import { mkdtempSync, writeFileSync } from "node:fs";
fs moeilijk-ai-assisted-speedruns-a346d06/packages/core/src/broker.mjs :36 import { appendFileSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
fs moeilijk-ai-assisted-speedruns-a346d06/packages/core/src/check-agent.mjs :6 import fs from "node:fs";
fs moeilijk-ai-assisted-speedruns-a346d06/packages/core/src/check-connection.mjs :7 import fs from "node:fs";
fs moeilijk-ai-assisted-speedruns-a346d06/packages/core/src/check-run.mjs :9 import fs from "node:fs";
fs moeilijk-ai-assisted-speedruns-a346d06/packages/core/src/cli.mjs :8 import fs from "node:fs";
fs moeilijk-ai-assisted-speedruns-a346d06/packages/core/src/close-all.mjs :10 import fs from "node:fs";
fs moeilijk-ai-assisted-speedruns-a346d06/packages/core/src/configure.mjs :5 import fs from "node:fs";
fs moeilijk-ai-assisted-speedruns-a346d06/packages/core/src/doctor.mjs :6 import fs from "node:fs";
fs moeilijk-ai-assisted-speedruns-a346d06/packages/core/src/events.mjs :3 import fs from "node:fs";
fs moeilijk-ai-assisted-speedruns-a346d06/packages/core/src/export-claude-session.mjs :10 import fs from "node:fs";
fs moeilijk-ai-assisted-speedruns-a346d06/packages/core/src/gui/checks.mjs :8 import fs from "node:fs";

57 more not shown — this panel samples each group; the count above is the real total.

shell / exec 45

shell moeilijk-ai-assisted-speedruns-a346d06/games/balatro/bridge.mjs :16 import { execFileSync } from "node:child_process";
shell moeilijk-ai-assisted-speedruns-a346d06/games/balatro/close-game.mjs :3 import { spawnSync } from "node:child_process";
shell moeilijk-ai-assisted-speedruns-a346d06/games/balatro/launch-game.mjs :10 import { spawn, spawnSync } from "node:child_process";
shell (weak) moeilijk-ai-assisted-speedruns-a346d06/games/balatro/test/balatro.test.mjs :168 assert.match(await exec("const s = await bal.select(); return s.state;"), /SELECTING_HAND/);
shell moeilijk-ai-assisted-speedruns-a346d06/games/portal/close-game.mjs :4 import { execFileSync, spawnSync } from "node:child_process";
shell moeilijk-ai-assisted-speedruns-a346d06/games/portal/fetch-portal-agent.mjs :5 import { execFileSync } from "node:child_process";
shell moeilijk-ai-assisted-speedruns-a346d06/games/portal/launch-game.mjs :12 import { spawn, spawnSync } from "node:child_process";
shell moeilijk-ai-assisted-speedruns-a346d06/games/portal/plugin.mjs :14 import { spawn } from "node:child_process";
shell moeilijk-ai-assisted-speedruns-a346d06/games/slay-the-spire/bot.mjs :28 import { spawnSync } from "node:child_process";
shell moeilijk-ai-assisted-speedruns-a346d06/games/slay-the-spire/bridge.mjs :12 import { spawnSync } from "node:child_process";
shell moeilijk-ai-assisted-speedruns-a346d06/games/slay-the-spire/conformance.mjs :11 import { execFileSync } from "node:child_process";
shell moeilijk-ai-assisted-speedruns-a346d06/games/slay-the-spire/install-mod.mjs :8 import { execFileSync } from "node:child_process";

show 28 more

shell moeilijk-ai-assisted-speedruns-a346d06/games/slay-the-spire/launch-game.mjs :8 import { execFileSync, spawn, spawnSync } from "node:child_process";
shell moeilijk-ai-assisted-speedruns-a346d06/games/slay-the-spire/plugin.mjs :501 const { spawnSync } = await import("node:child_process");
shell moeilijk-ai-assisted-speedruns-a346d06/games/slay-the-spire/seed-winrate.mjs :27 import { execFile } from "node:child_process";
shell moeilijk-ai-assisted-speedruns-a346d06/packages/core/src/close-all.mjs :9 import { execFileSync } from "node:child_process";
shell moeilijk-ai-assisted-speedruns-a346d06/packages/core/src/close-windows.mjs :5 import { execFileSync } from "node:child_process";
shell moeilijk-ai-assisted-speedruns-a346d06/packages/core/src/gui/checks.mjs :7 import { spawnSync } from "node:child_process";
shell moeilijk-ai-assisted-speedruns-a346d06/packages/core/src/gui/server.mjs :6 import { spawn } from "node:child_process";
shell moeilijk-ai-assisted-speedruns-a346d06/packages/core/src/gui/session.mjs :4 import { spawn } from "node:child_process";
shell moeilijk-ai-assisted-speedruns-a346d06/packages/core/src/gui/windows-paths.mjs :3 import { execFileSync, spawnSync } from "node:child_process";
shell moeilijk-ai-assisted-speedruns-a346d06/packages/core/src/mcp-client.mjs :4 import { spawn } from "node:child_process";
shell moeilijk-ai-assisted-speedruns-a346d06/packages/core/src/plugins.mjs :4 import { execFileSync } from "node:child_process";
shell moeilijk-ai-assisted-speedruns-a346d06/packages/core/src/render.mjs :7 import { execFileSync, spawnSync } from "node:child_process";
shell moeilijk-ai-assisted-speedruns-a346d06/packages/core/src/resume.mjs :7 import { spawnSync } from "node:child_process";
shell moeilijk-ai-assisted-speedruns-a346d06/packages/core/src/upload-sheet.mjs :8 import { execFileSync } from "node:child_process";
shell moeilijk-ai-assisted-speedruns-a346d06/packages/core/src/windows/audio-route.mjs :18 import { execFileSync, spawnSync } from "node:child_process";
shell moeilijk-ai-assisted-speedruns-a346d06/packages/core/src/windows/displays.mjs :8 import { execFileSync } from "node:child_process";
shell moeilijk-ai-assisted-speedruns-a346d06/packages/core/src/windows/keep-display-awake.mjs :10 import { execFileSync, spawn } from "node:child_process";
shell moeilijk-ai-assisted-speedruns-a346d06/packages/core/src/windows/quiet-start.mjs :10 import { spawnSync } from "node:child_process";
shell moeilijk-ai-assisted-speedruns-a346d06/packages/core/src/windows/steam.mjs :4 import { execFileSync } from "node:child_process";
shell (weak) moeilijk-ai-assisted-speedruns-a346d06/packages/core/test/audio-route.test.mjs :5 import { spawnSync } from "node:child_process";
shell (weak) moeilijk-ai-assisted-speedruns-a346d06/packages/core/test/broker.test.mjs :5 import { spawn } from "node:child_process";
shell (weak) moeilijk-ai-assisted-speedruns-a346d06/packages/core/test/render.test.mjs :3 import { execFileSync, spawnSync } from "node:child_process";
shell (weak) moeilijk-ai-assisted-speedruns-a346d06/packages/core/test/sign.test.mjs :5 import { execFileSync } from "node:child_process";
shell (weak) moeilijk-ai-assisted-speedruns-a346d06/packages/core/test/upload-sheet.test.mjs :5 import { spawnSync } from "node:child_process";
shell (weak) moeilijk-ai-assisted-speedruns-a346d06/packages/core/test/zip.test.mjs :4 import { execFileSync } from "node:child_process";
shell moeilijk-ai-assisted-speedruns-a346d06/packages/recorder-obs/index.mjs :15 import { execFileSync } from "node:child_process";
shell moeilijk-ai-assisted-speedruns-a346d06/packages/recorder-obs/launch-obs.mjs :8 import { execFileSync } from "node:child_process";
shell moeilijk-ai-assisted-speedruns-a346d06/packages/runtime-claude-code/index.mjs :4 import { spawn } from "node:child_process";

5 more not shown — this panel samples each group; the count above is the real total.

network 25

net moeilijk-ai-assisted-speedruns-a346d06/games/balatro/bridge.mjs :15 import http from "node:http";
net moeilijk-ai-assisted-speedruns-a346d06/games/balatro/install-mod.mjs :30 const res = await fetch(pin.url);
net (weak) moeilijk-ai-assisted-speedruns-a346d06/games/balatro/test/fake-balatrobot.mjs :4 import http from "node:http";
net moeilijk-ai-assisted-speedruns-a346d06/games/portal/launch-game.mjs :14 import net from "node:net";
net moeilijk-ai-assisted-speedruns-a346d06/games/portal/spt-session.mjs :4 import net from "node:net";
net (weak) moeilijk-ai-assisted-speedruns-a346d06/games/portal/test/fake-spt.mjs :4 import net from "node:net";
net moeilijk-ai-assisted-speedruns-a346d06/games/slay-the-spire/bridge.mjs :10 import net from "node:net";
net moeilijk-ai-assisted-speedruns-a346d06/games/slay-the-spire/install-mod.mjs :27 const res = await fetch(upstream.jar);
net moeilijk-ai-assisted-speedruns-a346d06/games/slay-the-spire/launch-game.mjs :10 import net from "node:net";
net moeilijk-ai-assisted-speedruns-a346d06/games/slay-the-spire/plugin.mjs :11 import net from "node:net";
net (weak) moeilijk-ai-assisted-speedruns-a346d06/games/slay-the-spire/test/fake-sts.mjs :5 import net from "node:net";
net moeilijk-ai-assisted-speedruns-a346d06/packages/core/src/doctor.mjs :5 import net from "node:net";

show 13 more

net moeilijk-ai-assisted-speedruns-a346d06/packages/core/src/gui/server.mjs :3 import http from "node:http";
net moeilijk-ai-assisted-speedruns-a346d06/packages/core/src/hardening.mjs :27 import net from "node:net";
net moeilijk-ai-assisted-speedruns-a346d06/packages/core/src/json-rpc-http.mjs :5 import http from "node:http";
net moeilijk-ai-assisted-speedruns-a346d06/packages/core/src/overlay-server.mjs :5 import http from "node:http";
net moeilijk-ai-assisted-speedruns-a346d06/packages/core/src/windows/install-soundvolumeview.mjs :20 const res = await fetch(pin.url);
net (weak) moeilijk-ai-assisted-speedruns-a346d06/packages/core/test/fake-witness.mjs :3 import http from "node:http";
net (weak) moeilijk-ai-assisted-speedruns-a346d06/packages/core/test/overlay.test.mjs :15 const page = await (await fetch(overlay.url)).text();
net (weak) moeilijk-ai-assisted-speedruns-a346d06/packages/core/test/run-publish.test.mjs :7 import net from "node:net";
net moeilijk-ai-assisted-speedruns-a346d06/packages/recorder-obs/index.mjs :18 import net from "node:net";
net moeilijk-ai-assisted-speedruns-a346d06/packages/recorder-obs/launch-obs.mjs :9 import net from "node:net";
net (weak) moeilijk-ai-assisted-speedruns-a346d06/packages/recorder-obs/test/fake-obs.mjs :6 import http from "node:http";
net moeilijk-ai-assisted-speedruns-a346d06/packages/timer-livesplit/index.mjs :19 import net from "node:net";
net moeilijk-ai-assisted-speedruns-a346d06/packages/timer-livesplit/install-livesplit.mjs :39 const res = await fetch(pin.url);

secrets 5

secrets moeilijk-ai-assisted-speedruns-a346d06/packages/core/src/publish.mjs :398 if (process.env.AAS_SIGN_KEY) return process.env.AAS_SIGN_KEY;
secrets (weak) moeilijk-ai-assisted-speedruns-a346d06/packages/core/test/configure.test.mjs :17 process.env.AAS_OBS_PASSWORD = "not-for-the-bundle";
secrets (weak) moeilijk-ai-assisted-speedruns-a346d06/packages/core/test/run-publish.test.mjs :62 const savedEnv = { AAS_WITNESS_URL: process.env.AAS_WITNESS_URL, AAS_WITNESS_KEYS: process.env.AAS_WITNESS_KEYS, AAS_SIGN_KEY: process.env.AAS_SIGN_KEY };
secrets (weak) moeilijk-ai-assisted-speedruns-a346d06/packages/core/test/sign.test.mjs :82 const env = { HOME: process.env.HOME, XDG_CONFIG_HOME: process.env.XDG_CONFIG_HOME, AAS_SIGN_KEY: process.env.AAS_SIGN_KEY };
secrets moeilijk-ai-assisted-speedruns-a346d06/packages/recorder-obs/index.mjs :45 const password = options.password ?? process.env.AAS_OBS_PASSWORD ?? "";

obfuscation 4

dynamic require()/import() moeilijk-ai-assisted-speedruns-a346d06/games/balatro/test/balatro.test.mjs :24 const { default: plugin } = await import(`../plugin.mjs?port=${bridge.port}`);
dynamic require()/import() moeilijk-ai-assisted-speedruns-a346d06/games/slay-the-spire/test/bot.test.mjs :99 const { default: plugin } = await import(`../plugin.mjs?port=${fake.port}&bot=1`);
dynamic require()/import() moeilijk-ai-assisted-speedruns-a346d06/games/slay-the-spire/test/sts.test.mjs :21 const { default: plugin } = await import(`../plugin.mjs?port=${fake.port}`);
dynamic require()/import() moeilijk-ai-assisted-speedruns-a346d06/packages/core/src/gui/game-doctor.mjs :6 const { default: plugin } = await import(new URL(`file://${file}`).href);

perm:untrusted 1

untrusted (weak) moeilijk-ai-assisted-speedruns-a346d06/packages/core/test/overlay.test.mjs :15 const page = await (await fetch(overlay.url)).text();