Is affaan-m/ECC safe?

{ pattern: /\beval\s*\(/g, name: "eval() usage - potential code injection" },

"command": "npx",

"command": "nexus",

"command": "nexus",

"command": "nexus",

"command": "nexus",

"command": "nexus",

"command": "nexus",

"command": "nexus",

"command": "nexus",

"command": "nexus",

"command": "nexus",

"command": "nexus",

"command": "nexus",

"command": "nexus",

"command": "nexus",

"command": "nexus",

"command": "nexus",

"command": "nexus",

"command": "nexus",

"command": "nexus",

"command": "nexus",

"command": "nexus",

"command": "nexus",

"command": "nexus",

"command": "nexus",

const { execFileSync } = require('child_process');

import { execFileSync } from "child_process"

import { execFile } from "node:child_process"

const { spawnSync } = require('child_process');

const result = spawnSync(executable, argv, {

const { spawnSync } = require('child_process');

const result = spawnSync(process.execPath, [path.join(repoRoot, testFile)], {

const { spawnSync } = require('child_process');

const result = spawnSync(command, args, {

const { execFileSync } = require("node:child_process")

while ((match = indicatorPattern.exec(lowerText)) !== null) {

while ((match = pattern.exec(content)) !== null) {

const { spawnSync } = require('child_process');

// and Node's spawn() cannot resolve those wrappers via PATH without shell: true.

const result = spawnSync('claude', args, {

while ((match = regex.exec(safe)) !== null) {

const match = TOML_HEADER_RE.exec(raw);

const match = headerPattern.exec(raw);

const match = inlinePattern.exec(lines[index]);

const { execFileSync } = require('child_process');

const { spawn } = require('child_process');

const child = spawn('open', [url], {

try { const { spawn } = require('child_process'); const p = process.platform; const c = p === 'darwin' ? 'open' : p === 'win32' ? 'start' : 'xdg-open'; if (c === 'start') spawn('cmd', ['/c', 'start', dashboardUrl], { stdio: 'ignore' }); els …

const { spawnSync } = require('child_process');

const result = spawnSync(

subprocess.Popen(argv, **kwargs)  # noqa: S603 - list argv, no shell=True, path validated above

result = subprocess.run(args, capture_output=True, text=True, timeout=5)

result = subprocess.run(
            ["git", "-C", project_root, "worktree", "list", "--porcelain"],
            capture_output=True, text=True, timeout=5
        )

result = subprocess.run(
            ["git", "-C", project_root, "remote", "get-url", "origin"],
            capture_output=True, text=True, timeout=5
        )

result = subprocess.run(
        ["claude", "-p", prompt, "--model", model, "--output-format", "text"],
        capture_output=True,
        text=True,
        timeout=60,
    )

result = subprocess.run(
        [
            "claude", "-p", scenario.prompt,
            "--model", model,
            "--max-turns", str(max_turns),
            "--add-dir", str(sandbox_dir),
            "--allowedTools", "Read,Write,Ed …

subprocess.run(["git", "init"], cwd=sandbox_dir, capture_output=True)

subprocess.run(parts, cwd=sandbox_dir, capture_output=True)

result = subprocess.run(
        ["claude", "-p", prompt, "--model", model, "--output-format", "text"],
        capture_output=True,
        text=True,
        timeout=120,
    )

result = subprocess.run(
            ["claude", "-p", prompt, "--model", model, "--output-format", "text"],
            capture_output=True,
            text=True,
            timeout=120,
        )

const content = fs.readFileSync(filePath, 'utf8');

const content = fs.readFileSync(manifestPath, 'utf8');

const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, "utf-8"))

const content = JSON.parse(fs.readFileSync(fullPath, "utf-8"))

const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, "utf-8"))

const content = fs.readFileSync(pyprojectPath, "utf-8")

const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, "utf-8"))

const content = fs.readFileSync(filePath, "utf-8")

text = fs.readFileSync(path.join(ECC_ROOT, "rules", "common", file), "utf8").trim()

const parsed = JSON.parse(fs.readFileSync(file, "utf8")) as { packages?: unknown }

const manifest = JSON.parse(fs.readFileSync(path.join(ECC_ROOT, "package.json"), "utf8")) as {

const manifest = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));

const payload = JSON.parse(fs.readFileSync(0, 'utf8'));

pkgName = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8')).name;

return fs.readFileSync(filePath, 'utf8');

text = fs.readFileSync(filePath, 'utf8');

const content = fs.readFileSync(path.join(root, relativePath), 'utf8');

current = fs.readFileSync(outputPath, 'utf8');

return fs.readFileSync(filePath, 'utf8');

return crypto.createHash('sha256').update(fs.readFileSync(filePath)).digest('hex');

content = fs.readFileSync(filePath, 'utf-8');

content = fs.readFileSync(filePath, 'utf-8');

data = JSON.parse(fs.readFileSync(HOOKS_FILE, 'utf-8'));

const schema = JSON.parse(fs.readFileSync(HOOKS_SCHEMA_PATH, 'utf-8'));

return JSON.parse(fs.readFileSync(filePath, 'utf8'));

fs.writeFileSync(manifestPath, content, 'utf8');

fs.rmSync(codebuddyFullPath, { recursive: true, force: true });

fs.unlinkSync(fullPath);

fs.rmSync(distDir, { recursive: true, force: true })

fs.writeFileSync(filePath, content, 'utf8');

fs.writeFileSync(filePath, sanitized, 'utf8');

fs.writeFileSync(outputPath, formatRegistry(registry), 'utf8');

fs.writeFileSync(absolutePath, `${JSON.stringify(report, null, 2)}\n`);

fs.appendFileSync(filePath, entry, 'utf8');

fs.writeFileSync(filePath, compactedHeader + compactedTurns, 'utf8');

fs.writeFileSync(out, history, 'utf8');

fs.writeFileSync(out, JSON.stringify({ session: sessionName, turns }, null, 2), 'utf8');

fs.writeFileSync(out, txt, 'utf8');

fs.writeFileSync(target, content, 'utf8');

fs.writeFileSync(sessionPath, '', 'utf8');

fs.writeFileSync(indexPath, indexContent, 'utf8');

fs.writeFileSync(outPath, content, 'utf8');

fs.writeFileSync(configPath, nextRaw, 'utf8');

fs.writeFileSync(configPath, cleaned + (toAppend.length > 0 ? appendText : ''), 'utf8');

fs.appendFileSync(configPath, appendText, 'utf8');

fs.writeFileSync(writePath, output, 'utf8');

fs.writeFileSync(filePath, adapted.text);

fs.writeFileSync(tty, `\x1b]9;${message}\x07`);

fs.writeFileSync(tmp, JSON.stringify(state), 'utf8');

try { fs.unlinkSync(tmp); } catch { /* ignore */ }

with open(agent_path, 'r', encoding='utf-8') as f:

with open(skill_file, 'r', encoding='utf-8') as f:

with open(os.path.join(commands_dir, item), 'r', encoding='utf-8') as f:

with open(path) as f:

with open(REGISTRY_FILE, encoding="utf-8") as f:

with open(REGISTRY_FILE, encoding="utf-8") as f:

content = file.read_text(encoding="utf-8")

with open(observations_file, encoding="utf-8") as f:

instincts = parse_instinct_file(file_path.read_text(encoding="utf-8"))

lines = from_file.read_text(encoding="utf-8").splitlines()

with open(obs_file, encoding="utf-8") as f:

content = path.read_text(encoding="utf-8")

content = source_file.read_text(encoding="utf-8")

with open(obs_file, encoding="utf-8") as f:

content = file_path.read_text(encoding="utf-8")

with open(AUDIT_FILE, "a", encoding="utf-8") as f:

lock_fd = open(lock_path, "w")

with open(tmp_file, "w", encoding="utf-8") as f:

with open(tmp_file, "w", encoding="utf-8") as f:

shutil.rmtree(project_dir)

shutil.copy2(file_path, target_path)

with open(into_file, "a", encoding="utf-8") as f:

output_file.write_text(output_content, encoding="utf-8")

out_path.write_text(output, encoding="utf-8")

output_file.write_text(output_content, encoding="utf-8")

output_file.write_text(output_content, encoding="utf-8")

(skill_dir / "SKILL.md").write_text(content, encoding="utf-8")

cmd_file.write_text(content, encoding="utf-8")

agent_file.write_text(content, encoding="utf-8")

const res = await fetch('https://api.github.com/repos/affaan-m/ECC/releases/latest', {

await fetch(url, {

await fetch(url, {

await fetch(url, {

const gw = await fetch(`${API}/gateway/bot`, { headers: { Authorization: `Bot ${TOKEN}` } }).then(r => r.json());

const res = await fetch(`https://discord.com/api/v10/applications/${APP_ID}/guilds/${GUILD}/commands`, {

const response = await fetch(url, options);

const req = http.request(

fetch('/api/proximity').then(function (r) { return r.json(); }).then(function (data) {

const response = await fetch('/api/actions/' + encodeURIComponent(actionId), {

const response = await fetch(url);

const response = await fetch('/api/work-items/' + pathSuffix, {

const request = https.get(parsed, { headers: options.accept ? { Accept: options.accept } : {} }, response => {

const res = await fetch('/api/session/' + key + '/feedback', {

try { await fetch('/api/session/' + key + '/end', { method: 'POST' }); } catch { /* server gone */ }

const req = http.request(

const req = http.request(

/\b(auth|login|password|passwd|token|secret|credential|api[_-]?key|session|jwt|oauth|cookie|sql|query|exec|eval|crypto|cipher|hash|hmac|sign|fs\.|readFile|writeFile|fetch|axios|request|subprocess|os\.system)\b/i;

import urllib.error

import urllib.parse

import urllib.request

req = urllib.request.Request(url, headers={"User-Agent": "aura-adapter/1.0"})

with urllib.request.urlopen(req, timeout=timeout) as resp:  # noqa: S310 (https only)

url = f"{base_url.rstrip('/')}/check?" + urllib.parse.urlencode({"did": did})

import urllib.parse

import urllib.request

parsed = urllib.parse.urlparse(source)

return urllib.parse.urlunparse(parsed)

req = urllib.request.Request(url, headers={"User-Agent": "ECC-instinct-import/2"})

with urllib.request.urlopen(req, timeout=15) as response:

import urllib.request

req = urllib.request.Request(url, data=data, headers={"Content-Type": "application/json"})

with urllib.request.urlopen(req, timeout=60) as response:

"mcpServers": {},

"mcpServers": {},

"tools": [

"mcpServers": {},

"tools": [

"mcpServers": {},

"tools": [

"mcpServers": {},

"tools": [

"mcpServers": {},

"tools": [

"mcpServers": {},

"tools": [

"mcpServers": {},

"tools": [

"mcpServers": {},

"tools": [

"mcpServers": {},

"tools": [

"mcpServers": {},

"tools": [

"mcpServers": {},

"tools": [

"mcpServers": {},

"tools": [