Markdown that runs — one file, any agent.
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport stdio · streamable-http · http counts 0 tools · 0 res
· 0 prompts
permission surface via code analysis
No tools enumerated yet for this server.
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit 274a68a · analyzer v17 · 5d ago
skills & prompt files 4
evidence-backed
findings quoted directly from the published source artifact — not inferred
filesystem 18
- fs string-os-string-274a68a/packages/compiler/src/cli.ts :14
import fs from 'fs'; - fs string-os-string-274a68a/packages/compiler/src/compiler.ts :18
import fs from 'fs'; - fs string-os-string-274a68a/packages/string/src/agent.ts :1
import { readFileSync, writeFileSync, mkdirSync } from 'fs'; - fs string-os-string-274a68a/packages/string/src/commands/action.ts :5
import fs from 'fs'; - fs string-os-string-274a68a/packages/string/src/commands/edit.ts :5
import fsPromises from 'fs/promises'; - fs string-os-string-274a68a/packages/string/src/commands/helpers.ts :5
import fs from 'fs'; - fs string-os-string-274a68a/packages/string/src/commands/info.ts :5
import fsPromises from 'fs/promises'; - fs string-os-string-274a68a/packages/string/src/commands/open.ts :5
import fsPromises from 'fs/promises'; - fs string-os-string-274a68a/packages/string/src/commands/packages.ts :5
import fsPromises from 'fs/promises'; - fs string-os-string-274a68a/packages/string/src/commands/tool.ts :5
import fsPromises from 'fs/promises'; - fs string-os-string-274a68a/packages/string/src/config.ts :7
import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'fs'; - fs string-os-string-274a68a/packages/string/src/daemon.ts :37
import { mkdirSync, readdirSync, statSync } from 'fs'; - fs string-os-string-274a68a/packages/string/src/env-store.ts :25
import { readFileSync, writeFileSync, mkdirSync, statSync } from 'fs'; - fs string-os-string-274a68a/packages/string/src/events.ts :2
import fs from 'fs/promises'; - fs string-os-string-274a68a/packages/string/src/installer.ts :7
import fs from 'fs/promises'; - fs string-os-string-274a68a/packages/string/src/loader.ts :7
import fs from 'fs/promises'; - fs string-os-string-274a68a/packages/string/src/logger.ts :11
import fs from 'fs'; - fs string-os-string-274a68a/packages/string/validate_v05.ts :7
import fs from 'fs';
shell / exec 6
- shell string-os-string-274a68a/packages/client/src/index.ts :2
* stringd HTTP client — ping, ensureAgent, exec (SSE parsing) - shell string-os-string-274a68a/packages/string/src/bash-session.ts :69
async spawn(): Promise<void> { - shell string-os-string-274a68a/packages/string/src/cli.ts :13
import { spawn } from 'child_process'; - shell string-os-string-274a68a/packages/string/src/commands/exec.ts :2
* Shell commands: /exec (stateless), bash topic dispatch - shell string-os-string-274a68a/packages/string/src/index.ts :71
// and the next exec() lazily re-creates whatever session it needs. - shell string-os-string-274a68a/packages/string/src/loader.ts :6
import { spawn } from 'child_process';
network 5
- net string-os-string-274a68a/packages/client/src/index.ts :7
import http from 'http'; - net string-os-string-274a68a/packages/string/src/daemon.ts :36
import http from 'http'; - net string-os-string-274a68a/packages/string/src/github-installer.ts :109
return fetch(url, { headers }); - net string-os-string-274a68a/packages/string/src/installer.ts :327
const r = await fetch(f.url!, { headers: { Accept: 'text/markdown, text/plain' } }); - net string-os-string-274a68a/packages/string/src/loader.ts :240
res = await fetch(uri, init);
secrets 1
- secrets string-os-string-274a68a/packages/string/src/github-installer.ts :107
const token = process.env.GITHUB_TOKEN || process.env.GH_TOKEN;
declared dependencies 2
- tsx@^4.21.0
- typescript@^5.0.0