SkillHub's Security Scanner Blocks on Crash, Not on Verdict
A commit-pinned audit of iflytek/skillhub: the scan verdict — even BLOCKED — gates no publish path in shipped code, while an unrecovered scanner outage hard-blocks the version.
Fodev JEO
LATEST INVESTIGATIONS
Source audits & field notes
CAO's Honest Trust Boundary and Its Phantom Auth Switch
A commit-pinned audit of awslabs/cli-agent-orchestrator 2.5.0: the docs name the real trust boundary in plain text, and four references cite an auth switch no code reads.
Ouroboros Preaches Agency and Ships Owner-First Custody
A commit-pinned audit of razzant/ouroboros 6.114.0: the constitution says agency wins, and every custody switch this audit read belongs to the owner.
Open Science's Provenance Engine Would Reject Its Own #1 Badge
A commit-pinned audit of aipoch/open-science: checksum-bound artifact provenance in the code, and a README #1 badge that sheds every hedge the org’s blog recorded a day earlier.
Apache Maka Tracks Its Agents' Screenshots and Ships None of Them
A commit-pinned audit of Apache Maka’s working-record boundary: agent PR evidence tracked in git, export-ignored from the ASF source archive, bound by tests in two languages.
OpenHarness Lets Its Allow List Outrank Your Deny Rules
A commit-pinned audit of the OpenHarness permission checker: its tool allow list returns before the command and path deny globs an operator configured.
diagram-design Hash-Locks Its Screenshots, Not Its Storefront
The 30.7k-star diagram skill CI-verifies eleven drift classes and pins screenshot digests. Its GitHub description still says 38 types while the tree says 39.
ECC Retired Six MCP Servers Over a Tax Its Catalog Still Pays
ECC’s connector policy says tool schemas tax every session, and it retired six defaults. Measured at commit 22e8cf01, its 286-skill catalog carries roughly 86 KB of metadata.
SIE's Public Repo Is an Export Surface, Not a Workshop
SIE’s changelog cites PR #478 while the public repo’s sequence stops at #248. Engine releases arrive as bot-authored squash syncs, and no .github directory exists at v0.7.2.
mjlab Source Audit: The Green Badge Proves the CPU Path
mjlab markets Isaac Lab ergonomics on MuJoCo Warp. The pinned tree shows CPU-only CI, benchmarks that record no hardware, and a second licence inside the package.
Search article titles, categories, and tags. Full text is searched when needed.
Type to search articles.