registry / @mertsoylu/aislopfixer / 0.3.0

@mertsoylu/aislopfixer@0.3.0

Terminal TUI that finds and fixes AI-generated slop in local web projects (offline, rule-based).

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 7 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireFilesystem

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 3.94 KB of source, external domains: www.python.org

Source & flagged code

4 flagged

src/aislopfixer/engine/rules/secrets.pyView file

Lines 1-27python

1"""Detect placeholder / hardcoded secrets — a runtime-breaking AI mistake.

3Generated code routinely leaves credentials as obvious placeholders::

5 const apiKey = "YOUR_API_KEY_HERE";

6 OPENAI_KEY = "sk-xxxxxxxxxxxxxxxxxxxx"

7 password: "changeme"

Medium

Secret Pattern

Package contains a possible secret pattern.

src/aislopfixer/engine/rules/secrets.pyView on unpkg · L7

8 token = "<your-token>"

10This is two mistakes at once: the app fails at runtime because the value is fake,

11and it normalizes hardcoding secrets in source. We flag the placeholder, never a

12value that looks like a *real* secret (those are caught by a different class of

13tool), and never the correct pattern — reading from the environment

14(``process.env.API_KEY``) carries no literal placeholder and is left alone.

16Three shapes:

18* **placeholder tokens** — ``YOUR_API_KEY``, ``your-token``, ``api_key_here``,

19 ``<your-secret>``. Word parts joined by ``_``/``-`` (or angle-bracketed), so

20 prose like "Change Password" is not matched.

21* **provider stub keys** — an ``sk-`` / ``pk_`` prefix followed by ``xxxx`` /

22 ``...`` / ``your`` rather than a real body.

23* **credential assignments** — a ``key|secret|token|password|…`` identifier

24 assigned a quoted placeholder value (``"changeme"``, ``"<...>"``, ``"xxxx…"``).

25"""

27from __future__ import annotations

bin/cli.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

2"use strict";

4/**

5 * npm launcher for aislopfixer (a Python / Textual TUI).

6 *

7 * Strategy: find a Python >= 3.11 on the host, create a private virtualenv in

8 * the user's home dir on first run, pip-install the bundled Python package

9 * (which pulls in `textual`), then exec the TUI with the user's args.

10 *

11 * The venv is keyed by package version so upgrades rebuild cleanly. After the

12 * first run everything is cached and startup is instant.

src/aislopfixer/headless.pyView file

•path = src/aislopfixer/headless.py kind = build_helper sizeBytes = 8654 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/aislopfixer/headless.pyView on unpkg

README.mdView file

Lines 30-70markdown

31Requires **Python ≥ 3.11** on your machine. On first run the npm launcher builds a small isolated Python environment under `~/.aislopfixer/` (needs internet once), then starts instantly thereafter.

33Or straight from PyPI / source:

35```bash

36pip install aislopfixer # or: pip install -e . from a checkout

37aislopfixer ./path/to/project

38```

Source & flagged code

4 flagged · loading source

src/aislopfixer/engine/rules/secrets.pyView file

7patternName = generic_password severity = medium line = 7 matchedText = passwo...

Medium

Secret Pattern

Package contains a possible secret pattern.

src/aislopfixer/engine/rules/secrets.pyView on unpkg · L7

bin/cli.jsView file

14L15: const { spawnSync } = require("child_process"); L16: const fs = require("fs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cli.jsView on unpkg · L14

src/aislopfixer/headless.pyView file

•path = src/aislopfixer/headless.py kind = build_helper sizeBytes = 8654 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/aislopfixer/headless.pyView on unpkg

README.mdView file

50patternName = generic_password severity = medium line = 50 matchedText = | 🔑 **Pl...ls |

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L50

Findings

4 Medium3 Low

MediumSecret Patternsrc/aislopfixer/engine/rules/secrets.py

MediumDynamic Requirebin/cli.js

MediumShips Build Helpersrc/aislopfixer/headless.py

MediumSecret PatternREADME.md

LowScripts Present

LowFilesystem

LowUrl Strings

Source & flagged code

4 flagged

src/aislopfixer/engine/rules/secrets.pyView file

Lines 1-27python

1"""Detect placeholder / hardcoded secrets — a runtime-breaking AI mistake.

3Generated code routinely leaves credentials as obvious placeholders::

5 const apiKey = "YOUR_API_KEY_HERE";

6 OPENAI_KEY = "sk-xxxxxxxxxxxxxxxxxxxx"

7 password: "changeme"

Medium

Secret Pattern

Package contains a possible secret pattern.

src/aislopfixer/engine/rules/secrets.pyView on unpkg · L7

8 token = "<your-token>"

10This is two mistakes at once: the app fails at runtime because the value is fake,

11and it normalizes hardcoding secrets in source. We flag the placeholder, never a

12value that looks like a *real* secret (those are caught by a different class of

13tool), and never the correct pattern — reading from the environment

14(``process.env.API_KEY``) carries no literal placeholder and is left alone.

16Three shapes:

18* **placeholder tokens** — ``YOUR_API_KEY``, ``your-token``, ``api_key_here``,

19 ``<your-secret>``. Word parts joined by ``_``/``-`` (or angle-bracketed), so

20 prose like "Change Password" is not matched.

21* **provider stub keys** — an ``sk-`` / ``pk_`` prefix followed by ``xxxx`` /

22 ``...`` / ``your`` rather than a real body.

23* **credential assignments** — a ``key|secret|token|password|…`` identifier

24 assigned a quoted placeholder value (``"changeme"``, ``"<...>"``, ``"xxxx…"``).

25"""

27from __future__ import annotations

bin/cli.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

2"use strict";

4/**

5 * npm launcher for aislopfixer (a Python / Textual TUI).

6 *

7 * Strategy: find a Python >= 3.11 on the host, create a private virtualenv in

8 * the user's home dir on first run, pip-install the bundled Python package

9 * (which pulls in `textual`), then exec the TUI with the user's args.

10 *

11 * The venv is keyed by package version so upgrades rebuild cleanly. After the

12 * first run everything is cached and startup is instant.

src/aislopfixer/headless.pyView file

•path = src/aislopfixer/headless.py kind = build_helper sizeBytes = 8654 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/aislopfixer/headless.pyView on unpkg

README.mdView file

Lines 30-70markdown

33Or straight from PyPI / source:

35```bash

36pip install aislopfixer # or: pip install -e . from a checkout

37aislopfixer ./path/to/project

38```