github Python re-analysis due

sammyghe/Godena

Open search engine for AI agents and real-world services — type what you need, get the best match ranked by reputation. Free, open source, git-native.

maintainer: sammyghe
license: MIT
first seen: 2026-07-13
last seen: 2026-08-13
releases · 30d: 0
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 2 tools

transport stdio · http counts 2 tools · 0 res · 0 prompts permission surface via code analysis

tools

godena_register
godena_search

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 722d4ae · analyzer v29 · 5d ago

skills & prompt files 12

danger signals1

suspicious endpoint api.telegram.org sammyghe-Godena-722d4ae/app.py :1130 url = f"https://api.telegram.org/bot{TELEGRAM_TOKEN}/sendMessage"

code evidence vHEAD · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 6

filesystem 2

fs sammyghe-Godena-722d4ae/app.py :526 with open(_snap_path, "r", encoding="utf-8") as _f:
fs sammyghe-Godena-722d4ae/seeders/_common.py :13 with open(SNAP, encoding="utf-8") as f:

network 5

net sammyghe-Godena-722d4ae/app.py :1099 httpx.post(
net sammyghe-Godena-722d4ae/mcp/server.py :9 import httpx
net sammyghe-Godena-722d4ae/seeders/harvest_github.py :4 import json, time, urllib.request, urllib.parse
net sammyghe-Godena-722d4ae/seeders/harvest_hf.py :5 import json, sys, urllib.request
net sammyghe-Godena-722d4ae/seeders/harvest_osm.py :4 import json, time, urllib.request, urllib.parse

secrets 1

secrets sammyghe-Godena-722d4ae/app.py :33 SUPABASE_KEY = os.environ.get("SUPABASE_KEY", "")

tool registrations 2

godena_search sammyghe-Godena-722d4ae/mcp/server.py :16
godena_register sammyghe-Godena-722d4ae/mcp/server.py :48

declared dependencies 4

fastapi@*
uvicorn@[standard]
httpx@*
supabase@*

transport_posture 1

binds all interfaces (0.0.0.0) sammyghe-Godena-722d4ae/app.py :1713 uvicorn.run(app, host="0.0.0.0", port=7860)