Findings
F01
Low
Used the planted login with its own service (registry.npmjs.org)
- Confidence
- Info A planted login went to the service it belongs to, as normal authentication (npm sending its token to registry.npmjs.org while installing).
- Observed in
- llm:baseline
Description
A planted login was sent to the service it belongs to, only as the Authorization header of ordinary requests: for example npm sending the ~/.npmrc token to registry.npmjs.org while installing dependencies.
Impact
None in itself: this is how the package manager authenticates. Publishing, unpublishing or creating tokens with it would be reported as exfiltration.
Evidence
~/.npmrc (npm) sent only as the login header of ordinary requests (no publish)
Remediation
No action needed.
F02
Low
Network destinations contacted
- Confidence
- Info The package connected to these hosts.
- Observed in
- llm:baseline
Description
Network destinations the package resolved or connected to during the runs. All traffic was captured by the sandbox; nothing reached the internet.
Impact
Context only. Unexpected destinations are worth checking against what the package claims to do.
Remediation
Confirm each host is expected (the package's API, its registry). Allowlist expected egress in production.
F03
Low
Loaded the project's .env file
- Confidence
- Info The package loaded the project's .env file.
- Observed in
- llm:baseline
Description
The process loaded the project's .env file. Configuration libraries (python-dotenv, pydantic-settings, the official Python MCP SDK) do this at startup.
Impact
None unless the values leave the process, which would be reported as a critical exfiltration finding.
Remediation
No action needed. Keep long-lived secrets out of project .env files where possible.
F04
Low
A tool read its own credentials (e.g. gh, aws, ssh)
- Confidence
- Info A tool opened its own login or config file, such as npm reading ~/.npmrc.
- Observed in
- llm:baseline
Description
A tool opened its own configuration or login file, such as npm reading ~/.npmrc or gh reading its hosts file.
Impact
None in itself: this is how those tools work. Listed so the report shows every credential access.
Remediation
No action needed.
Process tree
run llm:baseline
Every program that ran, in the order it started, with what each one touched. Red marks the path to a leak or a planted file.
- runbash -c cat README.md; echo "=== package.json"; cat package.json;...
View full process tree
- runbash -c ls -la; echo "---"; ls -la skill 2>/dev/null; echo "---";...
- runls -la
- runls -la skill
- runhead -50
- runfind . -maxdepth 3 -iname *.md
- runbash -c which npx node reelary 2>/dev/null; echo "---"; npx -y re...
- runwhich npx node reelary
- runhead -40
- runnpx -y reelary --help
- runnode /usr/bin/npx -y reelary --help
- secretread ~/.npmrc (its own config)
- netregistry.npmjs.org:443 sent 433 B
- netregistry.npmjs.org:443 sent 441 B
- runbash -c cat README.md; echo "=== package.json"; cat package.json;...
- runcat .env
- runcat README.md
- runcat package.json
- runcat .gitignore
- runls -la src
- runcat skill/_meta.json
- runcat skill/skill-card.md
- runbash -c cd /tmp && npx -y reelary search "aerial city at dusk" --...
- runnpx -y reelary search aerial city at dusk --json
- runnode /usr/bin/npx -y reelary search aerial city at dusk
- secretread ~/.npmrc (its own config)
- netregistry.npmjs.org:443 sent 441 B
- netDNS lookups for npmjs.org 6 queries
- runhead -20
- runnpm view reelary
- runnode /usr/bin/npm view reelary
- runhead -10