https://github.com/AgentSafe-AI/tooltrust-scanner
verify-tooltrust-scanner
Caution
Score 93 / 100 · 15 files read · 0 critical, 0 high, 1 medium, 0 low findings
Report 4f8bd9a1d68f70ec · first scanned 2026-10-28 · scanned 3× · keyed to the exact package contents, so this link always shows this version
Subscores
100 is clean. Deductions come only from the cited findings below.
Findings
mediumCan run shell commands from code
scripts/verify.py · line 33 · rule M1
gest(): names = subprocess.check_output( ["git", "ls-files", "--cached", "--others", "--exclude-standard", "-z"], cwd=
Permission surface
- Network endpoints
- none found in the text
- Environment read
- no named variables
- Shell execution
- yes — code or scripts can run shell commands
- Install hooks
- none
- Credential material
- none referenced
Provenance
- Source
- GitHub
- Repository
- AgentSafe-AI/tooltrust-scanner
- Owner
- AgentSafe-AI
- Stars
- 19
- Forks
- 6
- Repo created
- 2026-03-01
- Last push
- 2026-10-27
- License
- MIT
Badge for the author
The badge links back to this report and updates if the package is re-scanned at a new version.
Watch this package
Interest list only. We store the address and this report link, nothing else. No mail is sent in v1.
Share this report: https://preflight.orbitaldeskllc.com/r/4f8bd9a1d68f70ec