{
  "verdict": "warnings",
  "target": {
    "cacheKey": "github:kunchenguid/firstmate@51d2e8c902bb8785093969f8ba738c7355a283e0",
    "host": "github",
    "owner": "kunchenguid",
    "name": "firstmate",
    "requestedRef": "",
    "sha": "51d2e8c902bb8785093969f8ba738c7355a283e0",
    "defaultBranch": "main"
  },
  "summary": "Installing this repository would give an AI coding agent three hook manifests, 21 skill definitions, and 20 harness extensions that activate automatically when the agent indexes a cloned working tree. The hooks run on PreToolUse, SessionStart, and Stop events, and the manifest executes commands without user invocation. One command is quoted verbatim from the settings file, checking whether the repository exists in the working directory. The repository was pushed one day before the analysed commit, and it contains files that cannot be reviewed by reading alone. One of those files is binary or generated, comprising 1 of 506 files at 19% of the repository by size.",
  "summary_model": "deepseek-ai/DeepSeek-V4-Flash-0731-TEE",
  "findings": [
    {
      "check": "agent-config",
      "severity": "warning",
      "concern": "agent-config:Claude Code hook manifest",
      "statement": "The repository ships 3 Claude Code hook manifests. A harness that indexes a cloned working tree can pick these up without any install step being run.",
      "evidence": ".claude/settings.json, .codex/hooks.json, .cursor/hooks.json",
      "method": "tree"
    },
    {
      "check": "agent-config",
      "severity": "warning",
      "concern": "agent-config:agent skill definition",
      "statement": "The repository ships 21 agent skill definitions. A harness that indexes a cloned working tree can pick these up without any install step being run.",
      "evidence": ".agents/skills/afk/SKILL.md, .agents/skills/ahoy/SKILL.md, .agents/skills/ask-user-authority/SKILL.md, and 18 more",
      "method": "tree"
    },
    {
      "check": "agent-config",
      "severity": "warning",
      "concern": "agent-config:harness extension",
      "statement": "The repository ships 20 harness extensions. A harness that indexes a cloned working tree can pick these up without any install step being run.",
      "evidence": ".opencode/plugins/fm-primary-cd-check.js, .opencode/plugins/fm-primary-pretool-check.js, .opencode/plugins/fm-primary-sessionstart-nudge.js, and 17 more",
      "method": "tree"
    },
    {
      "check": "agent-config",
      "severity": "warning",
      "concern": "agent-config:hooks",
      "statement": "The hook manifest registers 3 lifecycle hooks: PreToolUse, SessionStart, Stop. Hooks run when their event fires, without the user invoking anything by name.",
      "evidence": ".claude/settings.json, .codex/hooks.json",
      "method": "file"
    },
    {
      "check": "agent-config",
      "severity": "note",
      "concern": "agent-config:agent instruction file",
      "statement": "The repository ships 2 agent instruction files. A harness that indexes a cloned working tree can pick these up without any install step being run.",
      "evidence": "AGENTS.md, CLAUDE.md",
      "method": "tree"
    },
    {
      "check": "agent-config",
      "severity": "note",
      "concern": "agent-config:hook-commands",
      "statement": "The hook manifest runs 6 commands. The first is quoted verbatim.",
      "evidence": ".claude/settings.json",
      "method": "file",
      "quote": "[ -z \\"
    },
    {
      "check": "agent-config",
      "severity": "note",
      "concern": "agent-config:hook-commands",
      "statement": "The hook manifest runs 4 commands. The first is quoted verbatim.",
      "evidence": ".codex/hooks.json",
      "method": "file",
      "quote": "bash -lc 'payload=$(cat 2>/dev/null || true); [ -n \\"
    },
    {
      "check": "unauditable-surface",
      "severity": "clean",
      "concern": "unauditable-surface:census",
      "statement": "19% of the repository by size (1 of 506 files) is binary or generated and cannot be reviewed by reading.",
      "evidence": "file listing at the analysed commit",
      "method": "tree"
    },
    {
      "check": "trust-root",
      "severity": "clean",
      "concern": "trust-root:activity",
      "statement": "The last push was 0 days ago (2026-09-06).",
      "evidence": "GitHub repository pushed_at field",
      "method": "api"
    },
    {
      "check": "trust-root",
      "severity": "clean",
      "concern": "trust-root:concentration",
      "statement": "Among the 44 most active contributors, the busiest (kunchenguid) accounts for about 85% of commits.",
      "evidence": "GitHub contributors API, first page",
      "method": "api"
    }
  ],
  "not_checked": [
    "OpenSSF Scorecard has no published result for this repository, so its maintenance-hygiene score is not shown.",
    "Nothing was executed. The installer was not run, the package was not installed, and no binary was launched, so every statement here is about what the code says it does rather than what it did.",
    "The contents of compiled and generated files were not reviewed. They can only be read by running the project's own build or by disassembly.",
    "Install scripts hosted outside this repository were not fetched. Only scripts committed to the repository itself are read."
  ],
  "prose_excerpts": [],
  "scorecard": null,
  "stats": {
    "filesInTree": 506,
    "totalBytes": 16057112,
    "opaqueBytes": 3011594,
    "filesFetched": 7,
    "fetchBudgetExhausted": false
  },
  "generated_at": "2026-09-06T12:07:04.985Z"
}