https://github.com/AbstractGlitch/glitch-toolkit

glitch-toolkit

Caution

Score 77 / 100 · 35 files read · 0 critical, 0 high, 7 medium, 1 low findings

Report cb1764b996910d0f · first scanned 2026-10-28 · scanned 3× · keyed to the exact package contents, so this link always shows this version

Listed in the Agent Census directory data

Subscores

credentials100

exfiltration92

execution52

injection100

obfuscation98

files100

100 is clean. Deductions come only from the cited findings below.

Findings

mediumCode contacts static.modelcontextprotocol.io, which the documentation never mentions

(package) · line 1 · rule M3

static.modelcontextprotocol.io

mediumCan run shell commands from code

release_preflight.py · line 80 · rule M1

try: out = subprocess.run( ["git", "rev-parse", "--show-toplevel"], cwd=str(start), capture_outpu

mediumCan run shell commands from code

src/glitch/_assets/scripts/gate_check.py · line 131 · rule M1

e.time() proc = subprocess.run(args.command, capture_output=True, text=True, shell=False) elapsed = time.time() - t0 a

mediumCan run shell commands from code

src/glitch/cli.py · line 163 · rule M1

try: p = subprocess.run( args, cwd=str(cwd), capture_output=True, text=True, timeout=TIMEOUT )

mediumCan run shell commands from code

tests/run_all.py · line 23 · rule M1

t("=" * 62) p = subprocess.run([sys.executable, str(HERE / name)], text=True, capture_output=True) sys.stdout.write(p.stdo

mediumCan run shell commands from code

tests/test_cli.py · line 17 · rule M1

s the real CLI as a subprocess. Nothing here reimplements the checker's logic, because a second copy of the logic would agree with

mediumCan run shell commands from code

tests/test_mcp_server.py · line 76 · rule M1

ort subprocess subprocess.run( [sys.executable, str(pathlib.Path(cli.__file__)), "--repo", str(repo), "install"],

low4 binary file(s) were not parsed (static text analysis only)

(package) · line 1 · rule L3

4 binary files

Permission surface

Network endpoints: github.comglama.aimcpservers.orgpypi.orgstatic.modelcontextprotocol.iowww.apache.org
Environment read: WANTED
Shell execution: yes — code or scripts can run shell commands
Install hooks: none
Credential material: none referenced

Provenance

Source: GitHub
Repository: AbstractGlitch/glitch-toolkit
Owner: AbstractGlitch
Stars: 0
Forks: 0
Repo created: 2026-09-08
Last push: 2026-09-11
License: Apache-2.0

Badge for the author

[![Preflight: Caution](https://preflight.orbitaldeskllc.com/badge/cb1764b996910d0f.svg)](https://preflight.orbitaldeskllc.com/b/cb1764b996910d0f)

The badge links back to this report and updates if the package is re-scanned at a new version.

Watch this package

Interest list only. We store the address and this report link, nothing else. No mail is sent in v1.

Share this report: https://preflight.orbitaldeskllc.com/r/cb1764b996910d0f