github TypeScript re-analysis due no deep scan

redrob-labs/redrob-design

github

Redrob Design is a prompt-driven design editor that opens .fig and .pen files and designs by prompt.

maintainer: redrob-labs
licence: NOASSERTION
first seen: 2026-09-17
last seen: 2026-09-17
releases · 30d: 0
short id

Drift inferred · capture-to-capture

HIGH 2026-09-17 code analysis flagged committed secret in redrob-labs/redrob-design

capabilities 0 tools

transport stdio · http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 7bf48e4 · analyzer v33 · 7h ago

skills & prompt files 6

agent-rules redrob-labs-redrob-design-7bf48e4/.github/copilot-instructions.md
agent-rules redrob-labs-redrob-design-7bf48e4/.github/instructions/agents.instructions.md
agent-rules redrob-labs-redrob-design-7bf48e4/AGENTS.md
prompt-file redrob-labs-redrob-design-7bf48e4/packages/core/src/tools/prompts/codegen.md
prompt-file redrob-labs-redrob-design-7bf48e4/packages/core/src/tools/prompts/jsx-reference.md
prompt-file redrob-labs-redrob-design-7bf48e4/src/app/ai/chat/system-prompt.md

danger signals3

dynamic code execution new Function() redrob-labs-redrob-design-7bf48e4/packages/core/src/design-jsx/render.ts :101 return new Function('React', '__helpers', code)(React, {
dynamic code execution new Function() redrob-labs-redrob-design-7bf48e4/src/app/code/sandbox/document.ts :78 const run = new Function(...argumentNames, code)
committed secret Google API key redrob-labs-redrob-design-7bf48e4/packages/core/src/constants.ts :582 AIzaSy…(39 chars, redacted)

code evidence vHEAD · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 2206

filesystem 114

fs (weak) redrob-labs-redrob-design-7bf48e4/packages/brand/src/brand-tokens.test.ts :14 import { readFileSync } from 'node:fs'
fs redrob-labs-redrob-design-7bf48e4/packages/brand/src/brand-tokens.ts :30 import { readFile } from 'node:fs/promises'
fs redrob-labs-redrob-design-7bf48e4/packages/brand/src/cli/sync-tokens.ts :11 import { readFile, writeFile } from 'node:fs/promises'
fs (weak) redrob-labs-redrob-design-7bf48e4/packages/brand/src/importer/cssVarExtractor.test.ts :2 import { mkdtemp, writeFile } from 'node:fs/promises'
fs (weak) redrob-labs-redrob-design-7bf48e4/packages/brand/src/importer/dtcgImporter.test.ts :2 import { readFileSync } from 'node:fs'
fs redrob-labs-redrob-design-7bf48e4/packages/brand/src/importer/node.ts :8 import { readFile } from 'node:fs/promises'
fs (weak) redrob-labs-redrob-design-7bf48e4/packages/brand/src/importer/tailwindExtractor.test.ts :2 import { mkdtemp, writeFile } from 'node:fs/promises'
fs (weak) redrob-labs-redrob-design-7bf48e4/packages/brand/src/tokens.test.ts :13 import { existsSync, readFileSync } from 'node:fs'
fs redrob-labs-redrob-design-7bf48e4/packages/brand/tsdown.config.ts :1 import { readFileSync } from 'node:fs'
fs redrob-labs-redrob-design-7bf48e4/packages/cli/src/commands/convert.ts :1 import { writeFile } from 'node:fs/promises'
fs redrob-labs-redrob-design-7bf48e4/packages/cli/src/commands/eval.ts :1 import { writeFile } from 'node:fs/promises'
fs redrob-labs-redrob-design-7bf48e4/packages/cli/src/commands/export.ts :1 import { mkdir, writeFile } from 'node:fs/promises'

show 28 more

fs redrob-labs-redrob-design-7bf48e4/packages/cli/src/commands/import.ts :1 import { readFile, writeFile } from 'node:fs/promises'
fs redrob-labs-redrob-design-7bf48e4/packages/cli/src/headless.ts :1 import { readFile } from 'node:fs/promises'
fs redrob-labs-redrob-design-7bf48e4/packages/cli/src/library/catalog.ts :1 import { mkdir, readFile, rename, writeFile } from 'node:fs/promises'
fs (weak) redrob-labs-redrob-design-7bf48e4/packages/cli/tests/library-catalog.test.ts :2 import { mkdtemp, readFile } from 'node:fs/promises'
fs redrob-labs-redrob-design-7bf48e4/packages/core/tsdown.config.ts :1 import { readFileSync } from 'node:fs'
fs (weak) redrob-labs-redrob-design-7bf48e4/packages/docs/.vitepress/sdk/component-meta.ts :1 import { existsSync, readFileSync } from 'node:fs'
fs (weak) redrob-labs-redrob-design-7bf48e4/packages/docs/.vitepress/seo.ts :1 import { existsSync } from 'node:fs'
fs (weak) redrob-labs-redrob-design-7bf48e4/packages/harness/src/session-store.ts :2 import { mkdir, open, readFile, rename, rm } from 'node:fs/promises'
fs (weak) redrob-labs-redrob-design-7bf48e4/packages/harness/tests/session-store.test.ts :2 import { mkdtemp, readFile, rm } from 'node:fs/promises'
fs redrob-labs-redrob-design-7bf48e4/packages/kiwi/tsdown.config.ts :1 import { readFileSync } from 'node:fs'
fs redrob-labs-redrob-design-7bf48e4/packages/mcp/src/server/lifecycle.ts :1 import { access, chmod, constants, mkdir, readFile, unlink } from 'node:fs/promises'
fs redrob-labs-redrob-design-7bf48e4/packages/mcp/src/tool/output.ts :1 import { lstat, mkdir, readlink, realpath, writeFile } from 'node:fs/promises'
fs redrob-labs-redrob-design-7bf48e4/packages/mcp/src/transport/discovery.ts :2 import { access, constants, lstat, readFile, rename, unlink, writeFile } from 'node:fs/promises'
fs redrob-labs-redrob-design-7bf48e4/packages/mcp/src/transport/paths.ts :1 import { chmod, mkdir } from 'node:fs/promises'
fs (weak) redrob-labs-redrob-design-7bf48e4/packages/vue/example/vite.config.ts :2 import { copyFileSync, existsSync, mkdirSync } from 'node:fs'
fs redrob-labs-redrob-design-7bf48e4/src/app/automation/bridge/vite-plugin.ts :3 import { mkdir } from 'node:fs/promises'
fs (weak) redrob-labs-redrob-design-7bf48e4/tests/e2e/canvas/tiled-large-blur-visual.spec.ts :1 import { readFileSync } from 'node:fs'
fs (weak) redrob-labs-redrob-design-7bf48e4/tests/e2e/storage/workspace.spec.ts :1 import { readFileSync } from 'node:fs'
fs (weak) redrob-labs-redrob-design-7bf48e4/tests/e2e/vectorize/basic.spec.ts :1 import { readFileSync } from 'node:fs'
fs (weak) redrob-labs-redrob-design-7bf48e4/tests/engine/acp/redrob-code.test.ts :2 import { readFileSync } from 'node:fs'
fs (weak) redrob-labs-redrob-design-7bf48e4/tests/engine/app/storage/persist.test.ts :2 import { readFileSync } from 'node:fs'
fs (weak) redrob-labs-redrob-design-7bf48e4/tests/engine/cli/export.test.ts :2 import { mkdtemp } from 'node:fs/promises'
fs (weak) redrob-labs-redrob-design-7bf48e4/tests/engine/cli/fonts.test.ts :2 import { mkdtemp } from 'node:fs/promises'
fs (weak) redrob-labs-redrob-design-7bf48e4/tests/engine/cli/headless.test.ts :2 import { mkdtemp } from 'node:fs/promises'
fs (weak) redrob-labs-redrob-design-7bf48e4/tests/engine/cli/import.test.ts :2 import { mkdtemp } from 'node:fs/promises'
fs (weak) redrob-labs-redrob-design-7bf48e4/tests/engine/cli/overlaps.test.ts :2 import { mkdtempSync, writeFileSync } from 'node:fs'
fs (weak) redrob-labs-redrob-design-7bf48e4/tests/engine/clipboard/fixtures/gold-preview-roundtrip.test.ts :2 import { readFileSync } from 'node:fs'
fs (weak) redrob-labs-redrob-design-7bf48e4/tests/engine/io/fig/export/worker.test.ts :2 import { readFileSync } from 'node:fs'

74 more not shown — this panel samples each group; the count above is the real total.

shell / exec 26

shell redrob-labs-redrob-design-7bf48e4/src/app/automation/bridge/vite-plugin.ts :1 import { spawn } from 'node:child_process'
shell (weak) redrob-labs-redrob-design-7bf48e4/tests/engine/cli/eval.test.ts :20 const proc = Bun.spawn(['bun', CLI, ...args], {
shell (weak) redrob-labs-redrob-design-7bf48e4/tests/engine/cli/overlaps.test.ts :37 const proc = Bun.spawn(['bun', CLI, ...args], {
shell (weak) redrob-labs-redrob-design-7bf48e4/tests/engine/mcp/server/security.test.ts :446 const child = Bun.spawn({
shell (weak) redrob-labs-redrob-design-7bf48e4/tests/engine/render/canvas/visual/boolean.test.ts :37 const proc = Bun.spawnSync({
shell (weak) redrob-labs-redrob-design-7bf48e4/tests/engine/tauri/fig-export.test.ts :5 const proc = Bun.spawn(['bun', 'tests/helpers/tauri/fig-export-fixture.ts'], {
shell (weak) redrob-labs-redrob-design-7bf48e4/tests/engine/tools/cli.test.ts :14 const proc = Bun.spawn(['bun', CLI, 'eval', FIXTURE, '--code', code, '--json'], {
shell (weak) redrob-labs-redrob-design-7bf48e4/tests/helpers/cli.ts :12 const proc = Bun.spawn(['bun', CLI, ...args], {
shell (weak) redrob-labs-redrob-design-7bf48e4/tests/helpers/tauri/windows-input.ts :1 import { execFile } from 'node:child_process'
shell (weak) redrob-labs-redrob-design-7bf48e4/tools/architecture/tests/acronym-casing.test.ts :24 return Bun.spawnSync([oxlint, '--config', config, file], {
shell (weak) redrob-labs-redrob-design-7bf48e4/tools/lint/tests/plugin.test.ts :43 const process = Bun.spawn([oxlintPath, '-c', configPath, '--format', 'json', sourcePath], {
shell redrob-labs-redrob-design-7bf48e4/tools/package-quality/src/checks/attw.ts :6 const proc = Bun.spawnSync(

show 14 more

shell redrob-labs-redrob-design-7bf48e4/tools/package-quality/src/checks/publint.ts :8 const proc = Bun.spawnSync(['bun', 'publint', packageDir, '--strict'], {
shell redrob-labs-redrob-design-7bf48e4/tools/package-quality/src/commands/run.ts :3 const process = Bun.spawn(['bun', entrypoint], {
shell redrob-labs-redrob-design-7bf48e4/tools/package-quality/src/smoke.ts :17 const proc = Bun.spawnSync(command, { cwd, stdout: 'pipe', stderr: 'pipe' })
shell redrob-labs-redrob-design-7bf48e4/tools/release-packages/src/tarballs.ts :1 import { execFile } from 'node:child_process'
shell redrob-labs-redrob-design-7bf48e4/tools/secret-scan/src/index.ts :8 return Bun.spawnSync([command, ...args], {
shell (weak) redrob-labs-redrob-design-7bf48e4/tools/test.ts :1 import { spawn } from 'node:child_process'
shell (weak) redrob-labs-redrob-design-7bf48e4/tools/updater/tests/shims.test.ts :22 const result = Bun.spawnSync({
shell redrob-labs-redrob-design-7bf48e4/tools/upstream/src/check-boundary.mjs :24 import { execFileSync } from 'node:child_process'
shell redrob-labs-redrob-design-7bf48e4/tools/upstream/src/sync.mjs :19 import { execFileSync } from 'node:child_process'
shell redrob-labs-redrob-design-7bf48e4/tools/visual-oracles/src/commands/operation.ts :7 const process = Bun.spawn(['bun', entrypoint, ...rawArgs], {
shell redrob-labs-redrob-design-7bf48e4/tools/visual-oracles/src/operations/bisect.ts :198 await $`figma-use export node ${pageId} --output ${path} --scale ${String(scale)}`.quiet()
shell redrob-labs-redrob-design-7bf48e4/tools/visual-oracles/src/operations/compare-document.ts :81 await $`figma-use export node ${target.figmaNodeId} --output ${figmaPath} --scale ${String(scale)}`.quiet()
shell redrob-labs-redrob-design-7bf48e4/tools/visual-oracles/src/operations/compare-node.ts :87 await $`figma-use export node ${nodeId} --output ${figmaPath} --scale ${String(scale)}`.quiet()
shell (weak) redrob-labs-redrob-design-7bf48e4/tools/visual-oracles/src/operations/export-fixtures.ts :52 await $`bun redrob-design export ${target.file} --page ${target.page} --output ${outputPath}`

network 32

net redrob-labs-redrob-design-7bf48e4/packages/cli/src/app-client.ts :1 import { request as httpRequest } from 'node:http'
net redrob-labs-redrob-design-7bf48e4/packages/core/src/text/fonts.ts :220 const response = await fetch(url)
net redrob-labs-redrob-design-7bf48e4/packages/core/src/text/web-fonts.ts :240 return fetch(url, init)
net redrob-labs-redrob-design-7bf48e4/packages/core/src/tools/stock-photo/apply.ts :81 const response = await fetch(photo.url)
net redrob-labs-redrob-design-7bf48e4/packages/mcp/src/server.ts :2 import type { Server as HttpServer } from 'node:http'
net redrob-labs-redrob-design-7bf48e4/packages/mcp/src/server/lifecycle.ts :2 import { createServer } from 'node:http'
net redrob-labs-redrob-design-7bf48e4/packages/mcp/src/stdio/bridge.ts :1 import { request } from 'node:http'
net redrob-labs-redrob-design-7bf48e4/packages/mcp/src/transport/discovery.ts :3 import { Socket } from 'node:net'
net redrob-labs-redrob-design-7bf48e4/src/app/ai/connect/app-connect.ts :25 if (!isTauri()) return (url, init) => fetch(url, init)
net redrob-labs-redrob-design-7bf48e4/src/app/ai/connect/device-connect.ts :119 const response = await deps.fetch(apiURL('/device/authorize'), {
net redrob-labs-redrob-design-7bf48e4/src/app/automation/bridge/file-handlers.ts :57 const response = await fetch(resourceURL)
net redrob-labs-redrob-design-7bf48e4/src/app/automation/bridge/vite-plugin.ts :4 import type { IncomingMessage } from 'node:http'

show 20 more

net redrob-labs-redrob-design-7bf48e4/src/app/automation/mcp/spawn.ts :236 const res = await fetch(`${DEV_AUTOMATION_HTTP_URL}/health`, {
net redrob-labs-redrob-design-7bf48e4/src/app/editor/vectorize/providers.ts :55 : fetch(input, requestInit))
net redrob-labs-redrob-design-7bf48e4/src/app/integrations/storage/s3/client.ts :79 * fetch() cannot observe upload progress — replay the signed request over
net redrob-labs-redrob-design-7bf48e4/src/app/integrations/storage/s3/fetch.ts :32 return await fetch(new Request(input, { signal }))
net redrob-labs-redrob-design-7bf48e4/src/app/shell/menu/files.ts :47 const response = await fetch(resourceURL)
net (weak) redrob-labs-redrob-design-7bf48e4/tests/e2e/code/sandbox.spec.ts :118 '<Frame>{fetch("https://sandbox-probe.invalid/leak")}</Frame>'
net (weak) redrob-labs-redrob-design-7bf48e4/tests/e2e/fonts/cjk-fallback.spec.ts :78 const response = await fetch('/tests/fixtures/fonts/NotoSansCJK-Test.otf')
net (weak) redrob-labs-redrob-design-7bf48e4/tests/e2e/fonts/cjk-rendering-visual.spec.ts :133 fetch('/tests/fixtures/fonts/NotoSansCJK-Test.otf').then((response) =>
net (weak) redrob-labs-redrob-design-7bf48e4/tests/engine/cli/app-client.test.ts :2 import { createServer, type Server } from 'node:http'
net (weak) redrob-labs-redrob-design-7bf48e4/tests/engine/icons/iconify.test.ts :10 await fetch('https://api.iconify.design/mdi.json?icons=home', {
net (weak) redrob-labs-redrob-design-7bf48e4/tests/engine/mcp/browser-rpc.test.ts :3 import { createServer, type Server } from 'node:http'
net (weak) redrob-labs-redrob-design-7bf48e4/tests/engine/mcp/server/cleanup.test.ts :65 const health = await fetch(`http://127.0.0.1:${occupiedPort}/health`)
net (weak) redrob-labs-redrob-design-7bf48e4/tests/engine/mcp/server/index.test.ts :178 const healthResponse = await fetch(`http://127.0.0.1:${ctx.handle.httpPort}/health`, {
net (weak) redrob-labs-redrob-design-7bf48e4/tests/engine/mcp/server/security.test.ts :54 const response = await fetch(`http://127.0.0.1:${httpPort}/health`, {
net (weak) redrob-labs-redrob-design-7bf48e4/tests/engine/mcp/server/transport.test.ts :180 const response = await fetch(`http://127.0.0.1:${httpPort}/mcp`, {
net (weak) redrob-labs-redrob-design-7bf48e4/tests/engine/mcp/server/watchdog.test.ts :39 const response = await fetch(`http://127.0.0.1:${port}/health`)
net (weak) redrob-labs-redrob-design-7bf48e4/tests/engine/mcp/stdio/auth.test.ts :4 import { createServer, type Server } from 'node:http'
net (weak) redrob-labs-redrob-design-7bf48e4/tests/engine/mcp/stdio/reconnect.test.ts :4 import { createServer, type Server } from 'node:http'
net (weak) redrob-labs-redrob-design-7bf48e4/tests/helpers/mcp/server.ts :1 import { type RequestOptions, request as httpRequest } from 'node:http'
net redrob-labs-redrob-design-7bf48e4/tools/upstream/src/sync.mjs :68 function fetch() {

secrets 5

secrets (weak) redrob-labs-redrob-design-7bf48e4/packages/harness/src/stdio.ts :18 const apiKey = process.env.REDROB_DESIGN_HARNESS_API_KEY
secrets redrob-labs-redrob-design-7bf48e4/packages/mcp/src/index.ts :85 const raw = process.env.REDROB_DESIGN_MCP_AUTH_TOKEN
secrets redrob-labs-redrob-design-7bf48e4/packages/mcp/src/stdio.ts :44 const rawAuthToken = process.env.REDROB_DESIGN_MCP_AUTH_TOKEN
secrets (weak) redrob-labs-redrob-design-7bf48e4/tests/e2e/chat/real-llm.spec.ts :6 const apiKey = process.env.OPENROUTER_API_KEY
secrets redrob-labs-redrob-design-7bf48e4/vite/automation.ts :9 const devAutomationAuthToken = process.env.REDROB_DESIGN_DEV_TOKEN ?? randomUUID()

install hooks 10

prepublishOnly redrob-labs-redrob-design-7bf48e4/packages/brand/package.json :44 bun run build
prepublishOnly redrob-labs-redrob-design-7bf48e4/packages/cli/package.json :26 bun run build
prepublishOnly redrob-labs-redrob-design-7bf48e4/packages/core/package.json :172 bun run build
prepack redrob-labs-redrob-design-7bf48e4/packages/dom-css/package.json :49 bun run build
prepack redrob-labs-redrob-design-7bf48e4/packages/fig/package.json :36 bun run build
prepack redrob-labs-redrob-design-7bf48e4/packages/kiwi/package.json :70 bun run build
prepublishOnly redrob-labs-redrob-design-7bf48e4/packages/mcp/package.json :53 bun run build
prepack redrob-labs-redrob-design-7bf48e4/packages/pen/package.json :24 bun run build
prepack redrob-labs-redrob-design-7bf48e4/packages/scene-graph/package.json :183 bun run build
prepack redrob-labs-redrob-design-7bf48e4/packages/vue/package.json :22 bun run build

declared dependencies 157

@modelcontextprotocol/sdk@^1.30.0
@ai-sdk/anthropic@^4.0.39
@ai-sdk/deepseek@^3.0.28
@ai-sdk/google@^4.0.44
@ai-sdk/openai@^4.0.42
@ai-sdk/valibot@^3.0.27
@ai-sdk/vue@^4.0.66
@atlaskit/pragmatic-drag-and-drop@^1.8.1
@atlaskit/pragmatic-drag-and-drop-hitbox@^1.2.0
@chenglou/pretext@^0.0.7
@codemirror/autocomplete@^6.20.3
@codemirror/commands@^6.11.0

show 28 more

@codemirror/lang-html@^6.4.12
@codemirror/lang-javascript@^6.2.5
@codemirror/language@^6.12.4
@codemirror/lint@^6.9.7
@codemirror/search@^6.7.1
@codemirror/state@^6.7.1
@codemirror/view@^6.43.9
@nanostores/i18n@^1.3.3
@nanostores/vue@^1.1.0
@redrob-design/cli@workspace:*
@redrob-design/core@workspace:*
@redrob-design/dom-css@workspace:*
@redrob-design/fig@workspace:*
@redrob-design/harness@workspace:*
@redrob-design/kiwi@workspace:*
@redrob-design/pen@workspace:*
@redrob-design/scene-graph@workspace:*
@redrob-design/vue@workspace:*
@openrouter/ai-sdk-provider@^3.0.0
@redrob-design/brand@workspace:*
@stream-markdown/code@2.0.0-beta.2
@tailwindcss/vite@^4.3.3
@tanstack/vue-table@^8.21.3
@tauri-apps/api@^2.11.1
@tauri-apps/plugin-clipboard-manager@^2.3.2
@tauri-apps/plugin-dialog@^2.7.2
@tauri-apps/plugin-fs@^2.5.1
@tauri-apps/plugin-opener@^2.5.4

117 more not shown — this panel samples each group; the count above is the real total.

clipboard 4

navigator.clipboard redrob-labs-redrob-design-7bf48e4/packages/vue/src/canvas/text-edit/clipboard.ts :21 if (text) void navigator.clipboard.writeText(text)
navigator.clipboard redrob-labs-redrob-design-7bf48e4/src/app/ai/debug/index.ts :284 return navigator.clipboard.writeText(text)
navigator.clipboard redrob-labs-redrob-design-7bf48e4/src/app/editor/clipboard/paste-to-replace.ts :28 const items = await navigator.clipboard.read()
navigator.clipboard redrob-labs-redrob-design-7bf48e4/src/app/editor/clipboard/system/browser.ts :63 const items = await navigator.clipboard.read()