github · nothumanallowedHEAD

Unsafe deserialization primitive detected. pickle.load(s), yaml.load (without SafeLoader), marshal.load(s), and shelve.open execute arbitrary code when the input is attacker-controlled.

// PHP/Ruby/Python unserialize equivalents

    { re: /\bunserialize\s*\(/g, type: 'unserialize() (insecure deserialization)', severity: SEVERITY.CRITICAL },

    { re: /\bpickle\.loads?\s*\(/g, type: 'Python pickle.load (insecure deserialization)', severity: SEVERITY.CRITICAL },

    { re: /\byaml\.(?:load|unsafe_load)\s*\(/g, type: 'YAML unsafe load (code execution risk)', severity: SEVERITY.CRITICAL },

    { re: /\bMarshal\.(?:load|restore)\s*\(/g, type: 'Ruby Marshal.load (insecure deserializat

TLS certificate verification is disabled on an outbound HTTP client. Any MITM in the network path can intercept and modify requests / responses — credentials, tokens, and tool output flow over a channel with no integrity guarantee. Python requests / httpx: drop `verify=False`. If the peer is using a private CA, set `verify="/path/to/ca-bundle.pem"` or configure the system trust store. Node TS axios / fetch: drop `rejectUnauthorized: false` from the agent / `httpsAgent` options. Same private-CA

}

          if (smtpPort === 465) {

            socket = tls.connect({ host: smtpHost, port: smtpPort, rejectUnauthorized: false }, () => {});

          } else {

            socket = net.createConnection({ host: smtpHost, port: smtpPort });

          }

TLS certificate verification is disabled on an outbound HTTP client. Any MITM in the network path can intercept and modify requests / responses — credentials, tokens, and tool output flow over a channel with no integrity guarantee. Python requests / httpx: drop `verify=False`. If the peer is using a private CA, set `verify="/path/to/ca-bundle.pem"` or configure the system trust store. Node TS axios / fetch: drop `rejectUnauthorized: false` from the agent / `httpsAgent` options. Same private-CA

case 'starttls':

            if (code === 220) {

              const tlsSocket = tls.connect(

                { socket, host: smtpHost, rejectUnauthorized: false },

                () => {

                  upgraded = true;

                  socket = tlsSocket;

TLS certificate verification is disabled on an outbound HTTP client. Any MITM in the network path can intercept and modify requests / responses — credentials, tokens, and tool output flow over a channel with no integrity guarantee. Python requests / httpx: drop `verify=False`. If the peer is using a private CA, set `verify="/path/to/ca-bundle.pem"` or configure the system trust store. Node TS axios / fetch: drop `rejectUnauthorized: false` from the agent / `httpsAgent` options. Same private-CA

case 'starttls':

            if (code === 220) {

              const tlsSocket = tls.connect(

                { socket, host: smtpHost, rejectUnauthorized: false },

                () => {

                  upgraded = true;

                  socket = tlsSocket;

TLS certificate verification is disabled on an outbound HTTP client. Any MITM in the network path can intercept and modify requests / responses — credentials, tokens, and tool output flow over a channel with no integrity guarantee. Python requests / httpx: drop `verify=False`. If the peer is using a private CA, set `verify="/path/to/ca-bundle.pem"` or configure the system trust store. Node TS axios / fetch: drop `rejectUnauthorized: false` from the agent / `httpsAgent` options. Same private-CA

}

          if (smtpPort === 465) {

            socket = tls.connect({ host: smtpHost, port: smtpPort, rejectUnauthorized: false }, () => {});

          } else {

            socket = net.createConnection({ host: smtpHost, port: smtpPort });

          }

User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.

handler: async (args) => {

      const client = await getAuthedClient();

      const id = args['--id'] || args._[0];

      if (!id) { console.error('Usage: workflow:run --id <shard-id> [--input <file.json>]'); return; }

      let input = {};

      if (args['--input']) {

        const fs = await import('fs');

User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.

if (command === 'optimize') {

    if (!args.input) {

      console.error('Error: --input is required (path to alerting rules YAML/JSON).');

      process.exit(1);

    }

    const rules = await fs.readFile(nodePath.resolve(args.input), 'utf-8');

User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.

const inputRaw = args.input || args._?.[1] || '';

  if (!inputRaw || (typeof inputRaw === 'string' && inputRaw.trim().length === 0)) {

    console.error('Error: --input is required. Provide raw text or a file path.');

    process.exit(1);

  }

User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.

: parseJSON(desiredContent).data;

    const desiredData = Array.isArray(desiredParsed) ? desiredParsed : [desiredParsed];

    console.log(`\nSuggesting pipeline via FLUX (${data.length} input rows -> ${desiredData.length} output rows)...\n`);

    const result = await suggestPipeline(data, desiredData);

    if (!result.ok) {

      console.error(`Error: ${result.error}`);

User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.

if (command === 'incident') {

    if (!args.input) {

      console.error('Error: --input is required (path to log file).');

      process.exit(1);

    }

    const logs = await fs.readFile(nodePath.resolve(args.input), 'utf-8');

User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.

try {

    inputContent = await fs.readFile(inputPath, 'utf-8');

  } catch (err) {

    console.error(`Error: Could not read input file: ${err.message}`);

    process.exit(1);

  }

User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.

if (!filePath) {

      console.log('Usage: pif file:write --path <file> --content "content"');

      console.log('       pif file:write --path <file> --stdin < input.txt');

      return;

    }

User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.

handler: async (args) => {

      const client = await getAuthedClient();

      const idsArg = args['--ids'] || args._[0];

      if (!idsArg) { console.error('Usage: skill:chain --ids <id1,id2,...> [--input <file.json>]'); return; }

      const skillIds = idsArg.split(',').map(s => s.trim());

      let initialInput = {};

      if (args['--input']) {

User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.

if (format === 'github-json') {

      // Output exact GitHub Pull Request Review API format

      console.log(JSON.stringify({

        body: result.body ?? result.summary ?? '',

        event: result.event ?? 'COMMENT',

        comments: result.comments ?? [],

      }, null, 2));

    } else {

      console.log(`Summary: ${result.summary ?? result.body ?? ''}\n`);

      const displayComments = result.comments ?? [];

User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.

var s = result.data || result;

        console.log('\n  \x1b[36m[ MESH CAPABILITIES: ' + query + ' ]\x1b[0m\n');

        console.log('  Network has ' + s.network.uniqueReceivers + ' active receivers');

        console.log('  Use mesh:delegate --task "..." --capability "' + query + '" to find matches');

        console.log('');

      } catch (error) {

        console.error('Error: ' + error.message);

User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.

if (command === 'analyze') {

    if (!args.input || (typeof args.input === 'string' && args.input.trim().length === 0)) {

      console.error('Error: --input is required for analysis (path to test results JSON).');

      process.exit(1);

    }

    const content = await fs.readFile(path.resolve(args.input), 'utf-8');

User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.

handler: async (args) => {

      var query = args['--query'] || args._?.[0];

      if (!query) {

        console.log('Usage: pif mesh:capabilities --query "security"');

        return;

      }

      var client = new NHAClient();

User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.

if (!filePath) {

      console.log('Usage: pif file:write --path <file> --content "content"');

      console.log('       pif file:write --path <file> --stdin < input.txt');

      return;

    }

User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.

fs.writeFileSync(notifyConfigPath, JSON.stringify(notifyConfig, null, 2));

      const status = val ? '\x1b[32menabled\x1b[0m' : '\x1b[31mdisabled\x1b[0m';

      console.log(`Notification "${event}" is now ${status}.`);

      console.log(`Saved to ${notifyConfigPath}`);

    },

  },

User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.

}

        console.log('');

        console.log('Toggle: pif telegram:notify --event feed:hot --enabled false');

        return;

      }

Silent error swallowing detected. An except clause that does pass or ... discards the exception with no log, no metric, and no trace. This blinds incident response and hides real failures.

apiPost('/api/config',{key:configKey,value:''}).then(function(){

    var el=document.getElementById('content');

    if(el&&renderFn)renderFn(el);

  }).catch(function(){});

}

function setupBanner(service,cmd){return '<div style="display:flex;align-items:center;gap:12px;padding:12px 16px;background:var(--bg2);border:1px solid var(--border);border-left:3px solid var(--amber);border-radius:var(--r);margin-bottom:14px;font-size:12px"><span style="font-size:20px">&#128274;</span><div><div style="color

Silent error swallowing detected. An except clause that does pass or ... discards the exception with no log, no metric, and no trace. This blinds incident response and hides real failures.

// Track download (fire-and-forget, auth may not be available)

        try {

          if (client.isAuthenticated) {

            client.trackExtensionDownload(id).catch(function() {});

          }

        } catch (_e) { /* ignore */ }

Silent error swallowing detected. An except clause that does pass or ... discards the exception with no log, no metric, and no trace. This blinds incident response and hides real failures.

try {

        const json = JSON.parse(keysMatch[1]);

        return String(Object.keys(json).length);

      } catch {}

    }

  }

Silent error swallowing detected. An except clause that does pass or ... discards the exception with no log, no metric, and no trace. This blinds incident response and hides real failures.

process.stdout.write(chunk);

          fullText += chunk;

        }

      } catch {}

    }

  }

Silent error swallowing detected. An except clause that does pass or ... discards the exception with no log, no metric, and no trace. This blinds incident response and hides real failures.

} catch {}

      browserWs.on('close', () => { wsClients.delete(browserWs); if (daemonWs) try { daemonWs.close(); } catch {} });

      browserWs.on('error', () => { wsClients.delete(browserWs); if (daemonWs) try { daemonWs.close(); } catch {} });

    });

    // ── Alexandria real-time — connect to server WS for each channel ──────