@hyperscape/hyperscape

Why those were dismissed

Two keys had to turn. The model had to name a reason from a fixed list of six, and a deterministic check of ours — over which files this artifact actually installs — had to independently agree. Anything it could not corroborate is in “not reviewed” above, at full severity.

• 75 Test or fixture file — The match is in a test or fixture. Our own check confirmed the file is not part of what gets installed.

  Rules: YARA_script_injection_generic, COMMAND_INJECTION_EVAL, YARA_command_injection_generic and 4 more · Files: /repo/packages/client/tests/unit/utils/InputValidator.test.ts, /repo/packages/client/tests/e2e/utils/testWorld.ts, /repo/packages/client/tests/utils/errorLogger.ts and 14 more · reported by cisco-skill-scanner

• 18 CI or editor configuration — The match is in build, CI or editor configuration, confirmed by our own check to be outside the installed artifact.

  Rules: AAK-AGENT-TRUST-002, AAK-AGENT-TRUST-001, AAK-GHA-IMMUTABLE-001 · Files: .github/workflows/claude.yml, .github/workflows/claude-code-review.yml, .github/workflows/integration.yml and 4 more · reported by agent-audit-kit

• 17 Documentation or example — The match is in documentation or sample code, confirmed by our own check to be outside the installed artifact.

  Rules: SOCIAL_ENG_VAGUE_DESCRIPTION, MANIFEST_MISSING_LICENSE, MANIFEST_INVALID_NAME and 1 more · Files: /repo/docs/SKILL.md, /repo/packages/server/tests/e2e/branch-validation/SKILL.md, /repo/packages/physx-js-webidl/PhysX/.github/SKILL.md and 5 more · reported by cisco-skill-scanner, nerlo-install-instruction

• 4 Agent instruction file — The match is in a file that instructs an AI coding agent — a CLAUDE.md or similar. It is documentation of intent, and our own check confirmed it is not part of what gets installed.

  Rules: AAK-AGENT-002, TOOL_ABUSE_UNDECLARED_NETWORK, AAK-AGENT-001 · Files: CLAUDE.md, /repo/repo/CLAUDE.md · reported by agent-audit-kit, cisco-skill-scanner

In installed code — never dismissed

These findings are in files this artifact installs and are not placeholder values. No false-positive basis can be corroborated for such a finding, so this review never dismisses one; they were not sent to the model and stand at their scanner's severity.

• 224 DATA_EXFIL_JS_NETWORK

  Files: /repo/packages/asset-forge/server/routes/ai-vision.ts, /repo/packages/asset-forge/server/services/GenerationService.ts, /repo/packages/asset-forge/server/services/ImageHostingService.ts and 55 more · reported by cisco-skill-scanner

• 157 DATA_EXFIL_JS_FS_ACCESS

  Files: /repo/packages/asset-forge/scripts/audit-assets.ts, /repo/packages/asset-forge/scripts/count-lines.mjs, /repo/packages/asset-forge/scripts/normalize-all-assets.ts and 18 more · reported by cisco-skill-scanner

• 82 BINARY_FILE_DETECTED

  Files: /repo/packages/server/public/physx-js-webidl.wasm, /repo/packages/client/public/physx-js-webidl.wasm, /repo/packages/plugin-hyperscape/src/public/emotes/emote_sword_swing.glb and 32 more · reported by cisco-skill-scanner

• 82 UNANALYZABLE_BINARY

  Files: /repo/packages/server/public/physx-js-webidl.wasm, /repo/packages/client/public/physx-js-webidl.wasm, /repo/packages/plugin-hyperscape/src/public/emotes/emote-rude-gesture.glb and 32 more · reported by cisco-skill-scanner

• 79 COMMAND_INJECTION_JS_CHILD_PROCESS

  Files: /repo/packages/asset-forge/scripts/build-services.mjs, /repo/packages/client/scripts/deploy-cloudflare.mjs, /repo/packages/server/scripts/deploy-cloudflare.mjs and 13 more · reported by cisco-skill-scanner

• 65 FILE_MAGIC_MISMATCH

  Files: /repo/packages/physx-js-webidl/PhysX/physx/compiler/public/CMakeLists.txt, /repo/packages/physx-js-webidl/PhysX/physx/pvdruntime/compiler/cmake/CMakeLists.txt, /repo/packages/physx-js-webidl/PhysX/physx/pvdruntime/compiler/cmake/linux/CMakeLists.txt and 19 more · reported by cisco-skill-scanner

• 49 COMMAND_INJECTION_EVAL

  Files: /repo/packages/shared/src/systems/shared/interaction/Physics.ts, /repo/scripts/deploy-aws.mjs, /repo/scripts/deploy-cloudflare.mjs and 2 more · reported by cisco-skill-scanner

• 39 MANIFEST_MISSING_LICENSE

  Files: /repo/SKILL.md, /repo/.claude/commands/SKILL.md, /repo/packages/server/SKILL.md and 36 more · reported by cisco-skill-scanner

• 39 SOCIAL_ENG_VAGUE_DESCRIPTION

  Files: /repo/SKILL.md, /repo/.claude/commands/SKILL.md, /repo/packages/server/SKILL.md and 36 more · reported by cisco-skill-scanner

• 31 opt.nerlo-rules.nerlo-js-secret-to-network-egress

  Files: /repo/packages/asset-forge/server/routes/ai-vision.ts, /repo/packages/asset-forge/server/services/GenerationService.ts, /repo/packages/asset-forge/server/services/ImageHostingService.ts and 15 more · reported by nerlo-behavioral

• 24 PIPELINE_TAINT_FLOW

  Files: /repo/packages/asset-forge/dev-book/02-getting-started/installation.md, /repo/packages/asset-forge/dev-book/02-getting-started/troubleshooting.md, /repo/packages/asset-forge/dev-book/11-development/setup-guide.md and 4 more · reported by cisco-skill-scanner

• 24 TOOL_ABUSE_SYSTEM_PACKAGE_INSTALL

  Files: /repo/packages/physx-js-webidl/PhysX/blast/setup.sh · reported by cisco-skill-scanner

• 20 COMMAND_INJECTION_SHELL_TRUE

  Files: /repo/packages/physx-js-webidl/PhysX/physx/buildtools/cmake_generate_projects.py, /repo/packages/physx-js-webidl/PhysX/physx/tools/physxmetadatagenerator/lib/utils.py · reported by cisco-skill-scanner

• 19 opt.nerlo-rules.nerlo-dynamic-exec

  Files: /repo/packages/asset-forge/scripts/build-services.mjs, /repo/packages/client/scripts/deploy-cloudflare.mjs, /repo/packages/server/scripts/dev-final.mjs and 7 more · reported by nerlo-behavioral

• 16 HIDDEN_DATA_FILE

  Files: /repo/packages/asset-forge/.depcheckrc, /repo/packages/client/public/.well-known/assetlinks.json, /repo/packages/server/.eliza/data/character-templates/pvmer.json and 6 more · reported by cisco-skill-scanner

• 16 YARA_prompt_injection_unicode_steganography

  Files: /repo/packages/asset-forge/public/rigs/animations/human-base-animations.glb, /repo/packages/client/public/images/app_background.png, /repo/packages/client/public/images/preview.jpg and 2 more · reported by cisco-skill-scanner

• 12 RESOURCE_ABUSE_INFINITE_LOOP

  Files: /repo/packages/physx-js-webidl/PhysX/blast/tools/packman/bootstrap/install_package.py, /repo/packages/physx-js-webidl/PhysX/flow/buildtools/packman/bootstrap/install_package.py, /repo/packages/physx-js-webidl/PhysX/physx/buildtools/packman/bootstrap/install_package.py · reported by cisco-skill-scanner

• 12 TOOL_ABUSE_SYSTEM_MODIFICATION

  Files: /repo/packages/physx-js-webidl/PhysX/blast/setup.sh · reported by cisco-skill-scanner

• 12 YARA_embedded_pe_executable

  Files: /repo/packages/physx-js-webidl/PhysX/flow/external/glfw/win64/glfw3.dll · reported by cisco-skill-scanner

• 11 EXCESSIVE_FILE_COUNT

  Files: /repo/packages/server/., /repo/packages/physx-js-webidl/PhysX/flow/., /repo/packages/physx-js-webidl/. and 8 more · reported by cisco-skill-scanner

• 9 opt.nerlo-rules.nerlo-install-run-bundled-artifact

  Files: /repo/packages/asset-forge/dev-book/15-appendix/resources.md, /repo/packages/physx-js-webidl/PhysX/blast/README.md, /repo/packages/physx-js-webidl/PhysX/flow/README.md and 1 more · reported by nerlo-install-instruction

• 8 AAK-SECRET-004

  Files: packages/plugin-hyperscape/src/providers/walletProvider.ts, packages/plugin-hyperscape/src/actions/payments.ts, packages/plugin-hyperscape/src/systems/PlayerMovementSystem.ts and 4 more · reported by agent-audit-kit

• 8 COMPOUND_FETCH_EXECUTE

  Files: /repo/packages/asset-forge/dev-book/14-deployment/environment-setup.md · reported by cisco-skill-scanner

• 8 YARA_embedded_elf_binary

  Files: /repo/packages/physx-js-webidl/PhysX/flow/external/glfw/linux/libglfw.so.3.3, /repo/packages/physx-js-webidl/PhysX/flow/external/glfw/linux/libglfw_aarch64.so.3.3 · reported by cisco-skill-scanner

• 7 LOW_ANALYZABILITY

  Files: /repo/packages/shared/src/systems/shared/combat, /repo/packages/plugin-hyperscape, /repo and 4 more · reported by cisco-skill-scanner

• 6 FIND_EXEC_PATTERN

  Files: /repo/packages/asset-forge/dev-book/14-deployment/build-process.md, /repo/packages/asset-forge/dev-book/14-deployment/SKILL.md, /repo/packages/asset-forge/dev-book/14-deployment/monitoring.md · reported by cisco-skill-scanner

• 6 opt.nerlo-rules.nerlo-py-dynamic-exec

  Files: /repo/packages/physx-js-webidl/PhysX/physx/buildtools/cmake_generate_projects.py, /repo/packages/physx-js-webidl/PhysX/physx/tools/physxmetadatagenerator/lib/utils.py · reported by nerlo-behavioral

• 5 opt.nerlo-rules.nerlo-install-pipe-to-shell

  Files: /repo/packages/asset-forge/dev-book/02-getting-started/installation.md, /repo/packages/asset-forge/dev-book/02-getting-started/troubleshooting.md, /repo/packages/asset-forge/dev-book/11-development/setup-guide.md and 1 more · reported by nerlo-install-instruction

• 4 AAK-LEGAL-001

  Files: packages/server/package.json, packages/app/package.json, packages/shared/package.json and 1 more · reported by agent-audit-kit

• 4 AAK-SPLUNK-TOKLOG-001

  Files: packages/server/src/systems/ServerNetwork/connection-handler.ts, packages/server/src/systems/ServerNetwork/authentication.ts, packages/plugin-hyperscape/src/services/HyperscapeService.ts and 1 more · reported by agent-audit-kit

• 4 YARA_capability_inflation_generic

  Files: /repo/packages/client/src/ui/components/PopoutPanel.tsx · reported by cisco-skill-scanner

• 4 YARA_command_injection_generic

  Files: /repo/packages/asset-forge/dev-book/02-getting-started/configuration.md · reported by cisco-skill-scanner

• 3 AAK-OAUTH-008

  Files: packages/server/src/systems/payments/X402PaymentService.ts, packages/shared/src/web3/x402/constants.ts, packages/shared/src/web3/x402/types.ts · reported by agent-audit-kit

• 3 opt.nerlo-rules.nerlo-hardcoded-external-egress

  Files: /repo/packages/asset-forge/server/routes/ai-vision.ts, /repo/packages/asset-forge/server/services/ImageHostingService.ts · reported by nerlo-behavioral

• 3 TOOL_ABUSE_UNDECLARED_NETWORK

  Files: /repo/packages/physx-js-webidl/repo/packages/physx-js-webidl/README.md, /repo/packages/physx-js-webidl/PhysX/repo/packages/physx-js-webidl/PhysX/CONTRIBUTING.md, /repo/packages/physx-js-webidl/PhysX/blast/repo/packages/physx-js-webidl/PhysX/blast/README.md · reported by cisco-skill-scanner

• 2 AAK-HEALTHCARE-AI-004

  Files: packages/server/.eliza/data/character-templates/skiller.json, packages/server/.eliza/data/character-templates/ironman.json · reported by agent-audit-kit

• 2 AAK-TASKS-003

  Files: packages/physx-js-webidl/types/input.d.ts, packages/physx-js-webidl/types/physx-js-webidl.d.ts · reported by agent-audit-kit

• 2 hooks-no-pretooluse

  Files: settings.json, .claude/settings.json · reported by agentshield

• 2 LAZY_LOAD_DEEP_NESTING

  Files: /repo/packages/asset-forge/dev-book/03-user-guides/SKILL.md, /repo/packages/asset-forge/dev-book/08-features/07-ai-pipeline/SKILL.md · reported by cisco-skill-scanner

• 2 MANIFEST_INVALID_NAME

  Files: /repo/packages/physx-js-webidl/PhysX/SKILL.md, /repo/packages/physx-js-webidl/PhysX/blast/PACKAGE-LICENSES/SKILL.md · reported by cisco-skill-scanner

• 2 OVERSIZED_FILE

  Files: /repo/packages/server/public/physx-js-webidl.wasm, /repo/packages/client/public/physx-js-webidl.wasm · reported by cisco-skill-scanner

• 2 permissions-no-block

  Files: settings.json, .claude/settings.json · reported by agentshield

• 2 SECRET_PASSWORD_VAR

  Files: /repo/packages/server/src/systems/payments/X402PaymentService.ts · reported by cisco-skill-scanner

• 1 AAK-IPI-WILD-CORPUS-001

  Files: packages/server/.eliza/data/character-templates/ironman.json · reported by agent-audit-kit

• 1 AAK-LEGAL-002

  Files: packages/physx-js-webidl/types/package.json · reported by agent-audit-kit

• 1 AAK-OAUTH-006

  Files: packages/client/src/lib/tauri-integration.ts · reported by agent-audit-kit

• 1 AAK-SUPPLY-003

  Files: package.json · reported by agent-audit-kit

• 1 AAK-SUPPLY-004

  Files: package.json · reported by agent-audit-kit

• 1 opt.nerlo-rules.nerlo-install-fetch-raw-then-run

  Files: /repo/packages/asset-forge/dev-book/02-getting-started/troubleshooting.md · reported by nerlo-install-instruction

Upheld — the review declined to dismiss these

The model could have called any of these a false positive and did not.

• 8 YARA_prompt_injection_unicode_steganography

  Files: /repo/packages/website/public/images/app_background.png, /repo/packages/website/public/images/gold-banner.png, /repo/packages/website/public/images/og-image.jpg and 2 more · reported by cisco-skill-scanner

• 2 DATA_EXFIL_JS_FS_ACCESS

  Files: /repo/packages/plugin-hyperscape/src/testing/RealWorldPlaywrightManager.ts · reported by cisco-skill-scanner

• 1 AAK-LEGAL-002

  Files: packages/website/package.json · reported by agent-audit-kit

• 1 AAK-MCP-ENV-PLACEHOLDER-EXFIL-001

  Files: packages/server/scripts/dev-final.mjs · reported by agent-audit-kit

• 1 FILE_MAGIC_MISMATCH

  Files: /repo/packages/website/src/lib/theme.ts · reported by cisco-skill-scanner

• 1 OVERSIZED_FILE

  Files: /repo/packages/website/public/images/hero-image.png · reported by cisco-skill-scanner

• 1 skills-missing-governance-commands/audit.md

  Files: commands/audit.md · reported by agentshield

Not reviewed

• 7 The model called these false positives and our own check did not agree, so the dismissal was refused.

  Rules: skills-missing-telemetry-commands/audit.md, skills-missing-governance-.claude/commands/audit.md, skills-missing-governance-commands/super-audit.md and 4 more · Files: commands/audit.md, .claude/commands/audit.md, commands/super-audit.md and 1 more · reported by agentshield