github JavaScript analyzed 27b2cbf

mubit-ai/plugins

github

Official Mubit marketplace: persistent, typed, self-improving memory for Claude Code and the Codex CLI.

maintainer: mubit-ai
licence: Apache-2.0
first seen: 2026-09-10
last seen: 2026-09-10
releases · 30d: 0
short id

Drift inferred · capture-to-capture

HIGH 2026-09-10 code analysis flagged committed secret ×2 in mubit-ai/plugins

capabilities 0 tools

transport stdio · http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 27b2cbf · analyzer v33 · 1w ago

skills & prompt files 30

danger signals4

dynamic code execution new Function() mubit-ai-plugins-27b2cbf/integrations/claude-code/mcp/dist/server.js :2955 const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode);
dynamic code execution new Function() mubit-ai-plugins-27b2cbf/integrations/codex/mcp/dist/server.js :2955 const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode);
committed secret GitHub token mubit-ai-plugins-27b2cbf/.github/leakcheck/rules.mjs :100 ghp_16…(40 chars, redacted)
committed secret GitHub token mubit-ai-plugins-27b2cbf/.github/scripts/leakcheck.selftest.mjs :155 ghp_16…(40 chars, redacted)

code evidence vHEAD · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 74

filesystem 72

fs (weak) mubit-ai-plugins-27b2cbf/.github/scripts/leakcheck.mjs :37 import { existsSync, readFileSync, statSync, writeFileSync, appendFileSync } from 'node:fs';
fs (weak) mubit-ai-plugins-27b2cbf/.github/scripts/leakcheck.selftest.mjs :29 import { mkdtempSync, mkdirSync, writeFileSync, symlinkSync, cpSync, rmSync } from 'node:fs';
fs (weak) mubit-ai-plugins-27b2cbf/.github/scripts/llm-leak-review.mjs :38 import { existsSync, readFileSync, appendFileSync } from 'node:fs';
fs mubit-ai-plugins-27b2cbf/integrations/claude-code/bin/activity.mjs :5 import { realpathSync, existsSync as existsSync5, mkdirSync as mkdirSync3, writeFileSync as writeFileSync2 } from "node:fs";
fs mubit-ai-plugins-27b2cbf/integrations/claude-code/bin/admin.mjs :5 import { readFileSync as readFileSync5, realpathSync } from "node:fs";
fs mubit-ai-plugins-27b2cbf/integrations/claude-code/bin/auth.mjs :8 import { realpathSync } from "node:fs";
fs mubit-ai-plugins-27b2cbf/integrations/claude-code/bin/dashboard.mjs :6 import { readFileSync as readFileSync7, realpathSync, unlinkSync as unlinkSync4 } from "node:fs";
fs mubit-ai-plugins-27b2cbf/integrations/claude-code/bin/handoff.mjs :4 import { realpathSync } from "node:fs";
fs mubit-ai-plugins-27b2cbf/integrations/claude-code/bin/impl/statusline.mjs :4 import { realpathSync } from "node:fs";
fs mubit-ai-plugins-27b2cbf/integrations/claude-code/bin/import.mjs :8 import { existsSync as existsSync7, readdirSync as readdirSync4, statSync as statSync6 } from "node:fs";
fs mubit-ai-plugins-27b2cbf/integrations/claude-code/bin/pin.mjs :4 import { realpathSync } from "node:fs";
fs mubit-ai-plugins-27b2cbf/integrations/claude-code/bin/statusline.mjs :2 import { writeSync } from "fs";

show 28 more

fs mubit-ai-plugins-27b2cbf/integrations/claude-code/hooks/dist/capture.mjs :2 import { writeSync } from "fs";
fs mubit-ai-plugins-27b2cbf/integrations/claude-code/hooks/dist/checkpoint.mjs :2 import { writeSync } from "fs";
fs mubit-ai-plugins-27b2cbf/integrations/claude-code/hooks/dist/cwd-changed.mjs :2 import { writeSync } from "fs";
fs mubit-ai-plugins-27b2cbf/integrations/claude-code/hooks/dist/drain.mjs :2 import { writeSync } from "fs";
fs mubit-ai-plugins-27b2cbf/integrations/claude-code/hooks/dist/impl/capture.mjs :24 } from "node:fs";
fs mubit-ai-plugins-27b2cbf/integrations/claude-code/hooks/dist/impl/checkpoint.mjs :5 import { closeSync as closeSync3, openSync as openSync3, readSync, statSync as statSync6 } from "node:fs";
fs mubit-ai-plugins-27b2cbf/integrations/claude-code/hooks/dist/impl/cwd-changed.mjs :6 import { existsSync as existsSync3, readFileSync as readFileSync3, statSync as statSync2 } from "node:fs";
fs mubit-ai-plugins-27b2cbf/integrations/claude-code/hooks/dist/impl/drain.mjs :5 import { renameSync as renameSync5, unlinkSync as unlinkSync4, writeFileSync as writeFileSync4 } from "node:fs";
fs mubit-ai-plugins-27b2cbf/integrations/claude-code/hooks/dist/impl/pre-tool.mjs :6 import { existsSync as existsSync3, readFileSync as readFileSync3, statSync as statSync2 } from "node:fs";
fs mubit-ai-plugins-27b2cbf/integrations/claude-code/hooks/dist/impl/prompt-recall.mjs :245 } from "node:fs";
fs mubit-ai-plugins-27b2cbf/integrations/claude-code/hooks/dist/impl/recall-refresh.mjs :7 import { existsSync as existsSync3, readFileSync as readFileSync3, statSync as statSync2 } from "node:fs";
fs mubit-ai-plugins-27b2cbf/integrations/claude-code/hooks/dist/impl/session-end.mjs :5 import { readdirSync as readdirSync4, unlinkSync as unlinkSync5 } from "node:fs";
fs mubit-ai-plugins-27b2cbf/integrations/claude-code/hooks/dist/impl/session-resume.mjs :6 import { existsSync as existsSync3, readFileSync as readFileSync3, statSync as statSync2 } from "node:fs";
fs mubit-ai-plugins-27b2cbf/integrations/claude-code/hooks/dist/impl/session-start.mjs :24 } from "node:fs";
fs mubit-ai-plugins-27b2cbf/integrations/claude-code/hooks/dist/impl/stage-prompt.mjs :5 import { readdirSync as readdirSync4 } from "node:fs";
fs mubit-ai-plugins-27b2cbf/integrations/claude-code/hooks/dist/impl/subagent-start.mjs :10 import { existsSync as existsSync3, readFileSync as readFileSync3, statSync as statSync2 } from "node:fs";
fs mubit-ai-plugins-27b2cbf/integrations/claude-code/hooks/dist/pre-tool.mjs :2 import { writeSync } from "fs";
fs mubit-ai-plugins-27b2cbf/integrations/claude-code/hooks/dist/prompt-recall.mjs :2 import { writeSync } from "fs";
fs mubit-ai-plugins-27b2cbf/integrations/claude-code/hooks/dist/recall-refresh.mjs :2 import { writeSync } from "fs";
fs mubit-ai-plugins-27b2cbf/integrations/claude-code/hooks/dist/session-end.mjs :2 import { writeSync } from "fs";
fs mubit-ai-plugins-27b2cbf/integrations/claude-code/hooks/dist/session-resume.mjs :2 import { writeSync } from "fs";
fs mubit-ai-plugins-27b2cbf/integrations/claude-code/hooks/dist/session-start.mjs :2 import { writeSync } from "fs";
fs mubit-ai-plugins-27b2cbf/integrations/claude-code/hooks/dist/stage-prompt.mjs :2 import { writeSync } from "fs";
fs mubit-ai-plugins-27b2cbf/integrations/claude-code/hooks/dist/subagent-start.mjs :2 import { writeSync } from "fs";
fs mubit-ai-plugins-27b2cbf/integrations/claude-code/mcp/dist/index.js :5 import { existsSync as existsSync3, readFileSync as readFileSync3, statSync as statSync2 } from "node:fs";
fs mubit-ai-plugins-27b2cbf/integrations/claude-code/mcp/dist/server.js :14099 if (!fs || !fs.readFile || !fs.readFileSync)
fs mubit-ai-plugins-27b2cbf/integrations/codex/bin/activity.mjs :32 } from "node:fs";
fs mubit-ai-plugins-27b2cbf/integrations/codex/bin/admin.mjs :32 } from "node:fs";

32 more not shown — this panel samples each group; the count above is the real total.

shell / exec 36

shell (weak) mubit-ai-plugins-27b2cbf/.github/scripts/leakcheck.mjs :35 import { execFileSync } from 'node:child_process';
shell (weak) mubit-ai-plugins-27b2cbf/.github/scripts/leakcheck.selftest.mjs :28 import { execFileSync } from 'node:child_process';
shell (weak) mubit-ai-plugins-27b2cbf/.github/scripts/llm-leak-review.mjs :37 import { execFileSync } from 'node:child_process';
shell mubit-ai-plugins-27b2cbf/integrations/claude-code/bin/activity.mjs :4 import { spawnSync } from "node:child_process";
shell mubit-ai-plugins-27b2cbf/integrations/claude-code/bin/auth.mjs :4 import { spawn, spawnSync } from "node:child_process";
shell mubit-ai-plugins-27b2cbf/integrations/claude-code/bin/dashboard.mjs :4 import { spawn } from "node:child_process";
shell mubit-ai-plugins-27b2cbf/integrations/claude-code/bin/impl/statusline.mjs :658 import { spawnSync } from "node:child_process";
shell mubit-ai-plugins-27b2cbf/integrations/claude-code/bin/import.mjs :199 import { spawnSync as spawnSync4 } from "node:child_process";
shell mubit-ai-plugins-27b2cbf/integrations/claude-code/hooks/dist/impl/capture.mjs :199 import { spawnSync } from "node:child_process";
shell mubit-ai-plugins-27b2cbf/integrations/claude-code/hooks/dist/impl/checkpoint.mjs :239 import { spawnSync } from "node:child_process";
shell mubit-ai-plugins-27b2cbf/integrations/claude-code/hooks/dist/impl/cwd-changed.mjs :496 import { spawn } from "node:child_process";
shell mubit-ai-plugins-27b2cbf/integrations/claude-code/hooks/dist/impl/drain.mjs :9 import { spawnSync } from "node:child_process";

show 24 more

shell mubit-ai-plugins-27b2cbf/integrations/claude-code/hooks/dist/impl/pre-tool.mjs :1087 import { spawnSync } from "node:child_process";
shell mubit-ai-plugins-27b2cbf/integrations/claude-code/hooks/dist/impl/prompt-recall.mjs :674 import { spawnSync } from "node:child_process";
shell mubit-ai-plugins-27b2cbf/integrations/claude-code/hooks/dist/impl/recall-refresh.mjs :5 import { spawnSync } from "node:child_process";
shell mubit-ai-plugins-27b2cbf/integrations/claude-code/hooks/dist/impl/session-end.mjs :1640 import { spawn } from "node:child_process";
shell mubit-ai-plugins-27b2cbf/integrations/claude-code/hooks/dist/impl/session-start.mjs :766 import { spawn } from "node:child_process";
shell mubit-ai-plugins-27b2cbf/integrations/claude-code/hooks/dist/impl/stage-prompt.mjs :508 import { spawn } from "node:child_process";
shell mubit-ai-plugins-27b2cbf/integrations/claude-code/hooks/dist/impl/subagent-start.mjs :8 import { spawnSync } from "node:child_process";
shell mubit-ai-plugins-27b2cbf/integrations/claude-code/mcp/dist/index.js :753 import { spawnSync } from "node:child_process";
shell mubit-ai-plugins-27b2cbf/integrations/codex/bin/activity.mjs :1743 import { spawnSync } from "node:child_process";
shell mubit-ai-plugins-27b2cbf/integrations/codex/bin/auth.mjs :215 import { spawn, spawnSync } from "node:child_process";
shell mubit-ai-plugins-27b2cbf/integrations/codex/bin/dashboard.mjs :3300 import { spawn } from "node:child_process";
shell mubit-ai-plugins-27b2cbf/integrations/codex/bin/import.mjs :496 import { spawnSync } from "node:child_process";
shell mubit-ai-plugins-27b2cbf/integrations/codex/hooks/dist/impl/capture.mjs :246 import { spawnSync } from "node:child_process";
shell mubit-ai-plugins-27b2cbf/integrations/codex/hooks/dist/impl/checkpoint.mjs :296 import { spawnSync } from "node:child_process";
shell mubit-ai-plugins-27b2cbf/integrations/codex/hooks/dist/impl/drain.mjs :260 import { spawnSync } from "node:child_process";
shell mubit-ai-plugins-27b2cbf/integrations/codex/hooks/dist/impl/pre-tool.mjs :1132 import { spawnSync } from "node:child_process";
shell mubit-ai-plugins-27b2cbf/integrations/codex/hooks/dist/impl/prompt-recall.mjs :730 import { spawnSync } from "node:child_process";
shell mubit-ai-plugins-27b2cbf/integrations/codex/hooks/dist/impl/recall-refresh.mjs :196 import { spawnSync } from "node:child_process";
shell mubit-ai-plugins-27b2cbf/integrations/codex/hooks/dist/impl/session-end.mjs :1695 import { spawn } from "node:child_process";
shell mubit-ai-plugins-27b2cbf/integrations/codex/hooks/dist/impl/session-start.mjs :1045 import { spawn } from "node:child_process";
shell mubit-ai-plugins-27b2cbf/integrations/codex/hooks/dist/impl/stage-prompt.mjs :781 import { spawn } from "node:child_process";
shell mubit-ai-plugins-27b2cbf/integrations/codex/hooks/dist/impl/subagent-start.mjs :196 import { spawnSync } from "node:child_process";
shell mubit-ai-plugins-27b2cbf/integrations/codex/mcp/dist/index.js :753 import { spawnSync } from "node:child_process";
shell (weak) mubit-ai-plugins-27b2cbf/integrations/codex/scripts/setup.mjs :39 import { spawn, spawnSync } from 'node:child_process';

network 35

net (weak) mubit-ai-plugins-27b2cbf/.github/scripts/llm-leak-review.mjs :197 const res = await fetch(attempt.url, {
net mubit-ai-plugins-27b2cbf/integrations/claude-code/bin/activity.mjs :1101 const res = await fetch(o.url, {
net mubit-ai-plugins-27b2cbf/integrations/claude-code/bin/admin.mjs :1112 const res = await fetch(o.url, {
net mubit-ai-plugins-27b2cbf/integrations/claude-code/bin/auth.mjs :6 import { createServer } from "node:http";
net mubit-ai-plugins-27b2cbf/integrations/claude-code/bin/dashboard.mjs :7 import { createServer } from "node:http";
net mubit-ai-plugins-27b2cbf/integrations/claude-code/bin/handoff.mjs :1144 const res = await fetch(o.url, {
net mubit-ai-plugins-27b2cbf/integrations/claude-code/bin/import.mjs :1846 const res = await fetch(o.url, {
net mubit-ai-plugins-27b2cbf/integrations/claude-code/bin/pin.mjs :1184 const res = await fetch(o.url, {
net mubit-ai-plugins-27b2cbf/integrations/claude-code/hooks/dist/impl/checkpoint.mjs :1566 const res = await fetch(o.url, {
net mubit-ai-plugins-27b2cbf/integrations/claude-code/hooks/dist/impl/drain.mjs :1527 const res = await fetch(o.url, {
net mubit-ai-plugins-27b2cbf/integrations/claude-code/hooks/dist/impl/prompt-recall.mjs :1929 const res = await fetch(o.url, {
net mubit-ai-plugins-27b2cbf/integrations/claude-code/hooks/dist/impl/recall-refresh.mjs :1873 const res = await fetch(o.url, {

show 23 more

net mubit-ai-plugins-27b2cbf/integrations/claude-code/hooks/dist/impl/session-end.mjs :1434 const res = await fetch(o.url, {
net mubit-ai-plugins-27b2cbf/integrations/claude-code/hooks/dist/impl/session-resume.mjs :1477 const res = await fetch(o.url, {
net mubit-ai-plugins-27b2cbf/integrations/claude-code/hooks/dist/impl/session-start.mjs :1554 const res = await fetch(o.url, {
net mubit-ai-plugins-27b2cbf/integrations/claude-code/hooks/dist/impl/subagent-start.mjs :1711 const res = await fetch(o.url, {
net mubit-ai-plugins-27b2cbf/integrations/claude-code/mcp/dist/index.js :1404 const res = await fetch(o.url, {
net mubit-ai-plugins-27b2cbf/integrations/claude-code/mcp/dist/server.js :15704 self2.fetch(filename2, function(err, source2) {
net mubit-ai-plugins-27b2cbf/integrations/codex/bin/activity.mjs :1114 const res = await fetch(o.url, {
net mubit-ai-plugins-27b2cbf/integrations/codex/bin/admin.mjs :1125 const res = await fetch(o.url, {
net mubit-ai-plugins-27b2cbf/integrations/codex/bin/auth.mjs :217 import { createServer } from "node:http";
net mubit-ai-plugins-27b2cbf/integrations/codex/bin/dashboard.mjs :1158 const res = await fetch(o.url, {
net mubit-ai-plugins-27b2cbf/integrations/codex/bin/handoff.mjs :1158 const res = await fetch(o.url, {
net mubit-ai-plugins-27b2cbf/integrations/codex/bin/import.mjs :1865 const res = await fetch(o.url, {
net mubit-ai-plugins-27b2cbf/integrations/codex/bin/pin.mjs :1200 const res = await fetch(o.url, {
net mubit-ai-plugins-27b2cbf/integrations/codex/hooks/dist/impl/checkpoint.mjs :1598 const res = await fetch(o.url, {
net mubit-ai-plugins-27b2cbf/integrations/codex/hooks/dist/impl/drain.mjs :1555 const res = await fetch(o.url, {
net mubit-ai-plugins-27b2cbf/integrations/codex/hooks/dist/impl/prompt-recall.mjs :1959 const res = await fetch(o.url, {
net mubit-ai-plugins-27b2cbf/integrations/codex/hooks/dist/impl/recall-refresh.mjs :1909 const res = await fetch(o.url, {
net mubit-ai-plugins-27b2cbf/integrations/codex/hooks/dist/impl/session-end.mjs :1456 const res = await fetch(o.url, {
net mubit-ai-plugins-27b2cbf/integrations/codex/hooks/dist/impl/session-resume.mjs :1501 const res = await fetch(o.url, {
net mubit-ai-plugins-27b2cbf/integrations/codex/hooks/dist/impl/session-start.mjs :1570 const res = await fetch(o.url, {
net mubit-ai-plugins-27b2cbf/integrations/codex/hooks/dist/impl/subagent-start.mjs :1729 const res = await fetch(o.url, {
net mubit-ai-plugins-27b2cbf/integrations/codex/mcp/dist/index.js :1404 const res = await fetch(o.url, {
net mubit-ai-plugins-27b2cbf/integrations/codex/mcp/dist/server.js :15704 self2.fetch(filename2, function(err, source2) {

secrets 2

secrets (weak) mubit-ai-plugins-27b2cbf/.github/scripts/llm-leak-review.mjs :48 const API_KEY = process.env.LEAKCHECK_API_KEY || process.env.OPENAI_API_KEY || process.env.CODEX_API_KEY || '';
secrets (weak) mubit-ai-plugins-27b2cbf/integrations/codex/scripts/login.mjs :123 const given = flag('key') || process.env.MUBIT_AUTH_KEY || process.env.MUBIT_API_KEY || '';

install hooks 2

prepack mubit-ai-plugins-27b2cbf/integrations/claude-code/package.json :18 npm run build
prepack mubit-ai-plugins-27b2cbf/integrations/codex/package.json :17 npm run build

declared dependencies 2

esbuild@^0.28.0
@mubit-ai/mcp@file:../mcp