github Python analyzed 90b47f4

technomaton/edpa

EDPA — Evidence-Driven Proportional Allocation. Derive hours from Git evidence. No timesheets.

Drift inferred · capture-to-capture

HIGH 2026-08-01 code analysis flagged dynamic code execution in technomaton/edpa
HIGH 2026-07-21 code analysis flagged dynamic code execution ×2 in technomaton/edpa
HIGH 2026-07-12 code analysis flagged dynamic code execution ×2 in technomaton/edpa
HIGH 2026-07-08 code analysis flagged dynamic code execution ×2 in technomaton/edpa
HIGH 2026-07-02 code analysis flagged dynamic code execution ×2 in technomaton/edpa

capabilities 0 tools

transport stdio counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 90b47f4 · analyzer v28 · 2h ago

dynamic code execution __import__() technomaton-edpa-90b47f4/.edpa/engine/scripts/preflight.py :128 __import__(mod)
dynamic code execution __import__() technomaton-edpa-90b47f4/plugin/edpa/scripts/preflight.py :128 __import__(mod)
dynamic code execution __import__ sink technomaton-edpa-90b47f4/tests/test_reconcile.py :39 "HOME": str(repo), "PATH": __import__("os").environ["PATH"]}
over-broad OAuth scope admin:org technomaton-edpa-90b47f4/.edpa/engine/scripts/preflight.py :34 EXPECTED_SCOPES = ["admin:org", "project", "repo", "workflow"]
over-broad OAuth scope admin:org technomaton-edpa-90b47f4/plugin/edpa/scripts/preflight.py :34 EXPECTED_SCOPES = ["admin:org", "project", "repo", "workflow"]

code evidence vv2.22.0 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 251

fs technomaton-edpa-90b47f4/tools/migrate_rr_to_rr_oe.py :24 from pathlib import Path
fs technomaton-edpa-90b47f4/tools/sensitivity_check.py :34 from pathlib import Path