github Python analyzed eeea683

testery/claude-plugin

The Testery plugin for Claude Code: run tests fast and flake-free, gate deploys, and independently verify AI-written code.

Drift inferred · capture-to-capture

HIGH 2026-07-12 code analysis flagged hidden prompt content ×2 in testery/claude-plugin
HIGH 2026-07-08 code analysis flagged hidden prompt content in testery/claude-plugin
HIGH 2026-06-30 code analysis flagged hidden prompt content ×2 in testery/claude-plugin
HIGH 2026-06-24 code analysis flagged hidden prompt content ×2 in testery/claude-plugin

capabilities 0 tools

transport — counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit eeea683 · analyzer v33 · 2w ago

hidden: skill: skill-exfil testery-claude-plugin-eeea683/skills/testery-create-alert/SKILL.md :11 secret→sink: 2. **REST API**: POST to the alerts endpoint on `https://api.testery.io` (see Testery API docs). Construct the call with `curl` using `Authorization: Bearer $TESTERY_TOKEN`.
hidden: skill: skill-exfil (low) testery-claude-plugin-eeea683/skills/testery-monitor-test-run/SKILL.md :49 secret→sink: 3. After the dashboard exits, render the final per-test summary using the format from `testery-report-test-run`. Include the run URL on the header line (see "Testery URLs" below):

suspicious endpoint us.i.posthog.com (telemetry) testery-claude-plugin-eeea683/scripts/testery_telemetry.py :25 DEFAULT_POSTHOG_HOST = 'https://us.i.posthog.com'

code evidence vv0.1.6 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 9

fs (weak) testery-claude-plugin-eeea683/scripts/testery_guard_hook.py :14 import shutil
fs (weak) testery-claude-plugin-eeea683/scripts/testery_telemetry.py :21 from pathlib import Path
fs (weak) testery-claude-plugin-eeea683/skills/autofix-failed-test-run/bin/fetch_failures.py :27 from pathlib import Path

net (weak) testery-claude-plugin-eeea683/scripts/testery_telemetry.py :19 import urllib.request
net (weak) testery-claude-plugin-eeea683/skills/autofix-failed-test-run/bin/fetch_failures.py :25 import urllib.error

secrets (weak) testery-claude-plugin-eeea683/scripts/testery_guard_hook.py :61 if os.environ.get("TESTERY_API_TOKEN"):
secrets (weak) testery-claude-plugin-eeea683/scripts/testery_telemetry.py :90 'api_key': os.environ.get('TESTERY_POSTHOG_KEY') or DEFAULT_POSTHOG_KEY,
secrets (weak) testery-claude-plugin-eeea683/skills/autofix-failed-test-run/bin/fetch_failures.py :53 return os.environ.get("TESTERY_API_TOKEN")