Turumba — a Jinfessa family tool. Watches secondhand marketplaces, filters the noise, and analyzes every listing with a deterministic (no-AI) engine, then mails a clean branded digest.
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport stdio · http counts 0 tools · 0 res
· 0 prompts
permission surface via code analysis
No tools enumerated yet for this server.
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit 6fd928d · analyzer v30 · 2w ago
skills & prompt files 1
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 22
filesystem 5
- fs (weak) n-jinfess-Turumba-Bikes-6fd928d/scripts/demo.js :5
import { writeFile, mkdir } from 'node:fs/promises'; - fs n-jinfess-Turumba-Bikes-6fd928d/src/email/send.js :6
import { writeFile, mkdir } from 'node:fs/promises'; - fs n-jinfess-Turumba-Bikes-6fd928d/src/index.js :11
import { writeFileSync, mkdirSync } from 'node:fs'; - fs n-jinfess-Turumba-Bikes-6fd928d/src/newsletter/render.js :5
import { readFileSync } from 'node:fs'; - fs n-jinfess-Turumba-Bikes-6fd928d/src/newsletter/subscribers.js :5
import { readFile, writeFile, mkdir } from 'node:fs/promises';
shell / exec 1
- shell n-jinfess-Turumba-Bikes-6fd928d/src/mcp/client.js :6
import { spawn } from 'node:child_process';
declared dependencies 4
- express@^4.19.2
- nodemailer@^6.9.14
- node-cron@^3.0.3
- secondhand-mcp@^0.4.0