github TypeScript analyzed · update queued 3f5d4ed

nimbus-agent/nimbus-sdk

Nimbus Agent — SDK (@nimbus-dev/sdk). MIT, dependency-free TypeScript contract for authoring Nimbus MCP connectors & extensions.

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 1 tools

transport — counts 1 tools · 0 res · 0 prompts permission surface via code analysis

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 3f5d4ed · analyzer v27 · 1w ago

over-broad OAuth scope https://www.googleapis.com/auth/cloud-platform nimbus-agent-nimbus-sdk-3f5d4ed/src/crypto/service-account-token.ts :15 const SCOPE_CLOUD_PLATFORM = "https://www.googleapis.com/auth/cloud-platform";

code evidence vsdk-v1.4.1 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 47

fs nimbus-agent-nimbus-sdk-3f5d4ed/src/distribution-channel.ts :1 import { realpathSync } from "node:fs";

prepublishOnly nimbus-agent-nimbus-sdk-3f5d4ed/package.json :43 bun run build && bun run typecheck