jankhunt42, Changelog

Compare any two versions of this skill before upgrading. 15 versions published.

Version history

  1. v4.15.0Latestbc5bb2ea32ec

    jankhunt42 4.15.0 reports where non-production meets production (P-ENV-001): a development configuration such as .env.local or appsettings.Development.json whose connection reaches a production asset, a production configuration that reaches a test system or a payment sandbox, and linked components in different environments. Review; block in the citizen profile.

  2. v4.14.07d0459a37b01

    jankhunt42 4.14.0 reads an agent sandbox's own network log in the passport (passport --sandbox-log): OpenShell's OCSF JSON export or Agent Substrate's egress gateway log. Connections, allowed or blocked, to destinations the repository does not declare make P-RUN-003 review (block in the citizen profile); a log only adds outcomes.

  3. v4.13.077cb7cad9510

    jankhunt42 4.13.0 reads Agent Substrate manifests: an actor template that puts an API key inside the sandbox (JH713), and egress rules that allow every host or pass a keyed AI API through where the gateway cannot inject the key (JH709, JH710). passport --emit-sandbox-policy substrate writes an egress policy whose gateway injects AI API keys from a Secret, and a project kept under a folder named out/ or build/ is now scanned.

  4. v4.12.04261efcd8e07

    jankhunt42 4.12.0 reads agent skills and Claude Code command files for allowed-tools that pre-approves any shell command (JH712): bare Bash, Bash(*), or a shell or interpreter followed only by a wildcard, which lets the agent run any command without asking during the turn that invokes the skill.

  5. v4.11.0703e6eeec81e

    jankhunt42 4.11.0 gives every finding a prompt a citizen developer can paste into their coding agent (file, problem, change, check to rerun; never the secret's value), scan --prompt for all findings at once, and the OWASP Citizen Development and Agentic Applications 2026 risks each rule's findings are an instance of, in JSON, SARIF, Markdown, HTML and the passport.

  6. v4.10.01088ba785945

    jankhunt42 4.10.0 gives n8n workflow exports the checks Power Automate flows have: triggers anyone with the URL can use (JH156), shell commands (JH157) and SQL (JH158) built from workflow data or written by an AI agent, critical when an open trigger feeds them, and personal data sent to AI models (JH159). Older exports n8n still imports are read, and an export the reader rejects is reported.

  7. v4.9.07bbd4a0b54a4

    jankhunt42 4.9.0 reads a Supabase project's migrations as the database they build: tables the API serves without row-level security (JH134, critical when granted to anon, following Supabase's 2026 grant change), policies that trust user_metadata any signed-in user can change (JH154), and views that bypass row-level security or expose auth.users (JH155).

  8. v4.8.07bbd4a0b54a4

    jankhunt42 4.8.0 reads Copilot Studio agents' topics, tools and instructions, from solution exports and from agents cloned with the VS Code extension, against Microsoft's list of common agent misconfigurations: tools on the maker's credentials (JH150), unencrypted or connector-bypassing HTTP requests (JH151), generative orchestration without instructions (JH152), and email sent wherever the AI chooses (JH153); API keys typed into a topic's headers are found too.

  9. v4.7.02900dbc511af

    jankhunt42 4.7.0 completes the Power Platform reader: canvas app formulas in .msapp files (alone or inside a solution), Copilot Studio agents that need no sign-in (JH148), and environment variables that hold a secret as plain text (JH149), with secret values never shown in any report.

  10. v4.6.08237d4752f05

    jankhunt42 4.6.0 is pared down to its core: what is broken in software citizen developers and their AI agents build, what it can reach, whether it can ship, and the opt-in sandbox. supply-chain, triage, doctor, scan --cve/--calibrate/--since and 16 style rules are removed (each removed command says what to use instead); the Jank Score is now security, reliability and tests.

  11. v4.5.06c764df96351

    jankhunt42 4.5.0: deeper into the sandbox, and a scan your team can make its own. detonate is now sandbox. The sandbox loads each dependency after installing it, so code that runs only when a package is loaded (including .pth files) is seen; --fetch also fetches hash-pinned Python requirements; pyproject.toml dependencies install and load; four more canary credential files; curl and wget in the image. --ignore-rule sets a rule aside in CI, and --ruleset applies a site policy of your own rules.

  12. v4.4.3e6c8d3e9be0a

    jankhunt42 4.4.3: deeper into the sandbox, and a scan your team can make its own. detonate is now sandbox. The sandbox loads each dependency after installing it, so code that runs only when a package is loaded (including .pth files) is seen; --fetch also fetches hash-pinned Python requirements; pyproject.toml dependencies install and load; four more canary credential files; curl and wget in the image. --ignore-rule sets a rule aside in CI, and --ruleset applies a site policy of your own rules.

  13. v4.4.2e6c8d3e9be0a

    jankhunt42 4.4.2: deeper into the sandbox, and a scan your team can make its own. detonate is now sandbox. The sandbox loads each dependency after installing it, so code that runs only when a package is loaded (including .pth files) is seen; --fetch also fetches hash-pinned Python requirements; pyproject.toml dependencies install and load; four more canary credential files; curl and wget in the image. --ignore-rule sets a rule aside in CI, and --ruleset applies a site policy of your own rules.

  14. v4.1.05211bb45d065

    jankhunt42 4.1.0: deeper into the sandbox, and a scan your team can make its own. detonate is now sandbox. The sandbox loads each dependency after installing it, so code that runs only when a package is loaded (including .pth files) is seen; --fetch also fetches hash-pinned Python requirements; pyproject.toml dependencies install and load; four more canary credential files; curl and wget in the image. --ignore-rule sets a rule aside in CI, and --ruleset applies a site policy of your own rules.

  15. v4.0.175af30156b65

    No changelog provided.