Conversation
…rrected requirements
…e on unsupported OS, empty-args crash on bash 3.2, toolchain hooks; scanner needs bash 4.2
🤖 CodeAnt AI — Review Status
|
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
codeant-ai
Bot
added
the
size:L
🏁 CodeAnt Quality Gate ResultsCommit: ✅ Overall Status: PASSEDQuality Gate Details
|
![codeant-ai[bot]](https://avatars.githubusercontent.com/in/646884?s=60&v=4){kind=small}
Comment on lines
+643
to
644
| RC_EXEMPT='/[.](cargo|deno|bun|rvm|nvm|pyenv|rbenv|sdkman|asdf|volta|fnm|ghcup|opam|orbstack|oh-my-zsh|zinit|zplug|antigen|zprezto|fzf|tmux|conda|local/bin|config/(fish|zsh|nvm|gh))/' \ | ||
| rc_rule "$f" "$disp" MEDIUM "A startup file loads a script from a writable or hidden directory" '(^|[^[:alnum:]_])(source|\.)[[:space:]]+[^#]*(([$]home|~)?/(tmp|var/tmp|private/tmp|var/folders|users/shared|downloads)/|application support|/[.][[:alnum:]_-]+/)' "Confirm you know this file. A sourced script runs with the same access you have." |
There was a problem hiding this comment.
Suggestion: RC_EXEMPT skips the whole line when any trusted toolchain path appears, allowing a second malicious source from /tmp or another hidden directory on that line to evade detection.
Assessment: 🟠 Major · 🔁 Occurrence: Rarely · 🏷️ Incorrect condition logic
Prompt for AI Agent 🤖
This is a comment left during a code review.
**Path:** apps/am-i-compromised/bin/host-audit.sh
**Line:** 643:644
**Comment:**
*Incorrect Condition Logic: `RC_EXEMPT` skips the whole line when any trusted toolchain path appears, allowing a second malicious source from `/tmp` or another hidden directory on that line to evade detection.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix
Comment on lines
+691
to
+696
| if [[ -n "${ZDOTDIR:-}" && "$ZDOTDIR" != "$HOME_DIR" && -d "$ZDOTDIR" ]]; then | ||
| for f in "$ZDOTDIR"/.zshrc "$ZDOTDIR"/.zprofile "$ZDOTDIR"/.zshenv "$ZDOTDIR"/.zlogin; do | ||
| [[ -f "$f" ]] || continue | ||
| audit_rc_file "$f" "ZDOTDIR/${f##*/}" | ||
| done | ||
| fi |
There was a problem hiding this comment.
Suggestion: When ZDOTDIR is assigned inside ~/.zshenv, this inherited environment value is empty, so the actual zsh startup directory is never scanned.
Assessment: 🟠 Major · 🔁 Occurrence: Sometimes · 🏷️ Possible bug
Prompt for AI Agent 🤖
This is a comment left during a code review.
**Path:** apps/am-i-compromised/bin/host-audit.sh
**Line:** 691:696
**Comment:**
*Possible Bug: When `ZDOTDIR` is assigned inside `~/.zshenv`, this inherited environment value is empty, so the actual zsh startup directory is never scanned.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix
Comment on lines
+868
to
+871
| # Language-toolchain bin directories are where pipx, cargo, bun and friends install tools. | ||
| if has "$cmd" '/\.(local/bin|cargo/bin|bun/bin|volta/bin|nvm/versions|pnpm)/'; then | ||
| return 1 | ||
| fi |
There was a problem hiding this comment.
Suggestion: The early return exempts commands containing a toolchain-looking path even when the same hook also loads code from another dangerous hidden or writable path.
Assessment: 🟠 Major · 🔁 Occurrence: Rarely · 🏷️ Security
Prompt for AI Agent 🤖
This is a comment left during a code review.
**Path:** apps/am-i-compromised/bin/host-audit.sh
**Line:** 868:871
**Comment:**
*Security: The early return exempts commands containing a toolchain-looking path even when the same hook also loads code from another dangerous hidden or writable path.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix
Comment on lines
+55
to
+59
| for newer_bash in /opt/homebrew/bin/bash /usr/local/bin/bash /opt/local/bin/bash /home/linuxbrew/.linuxbrew/bin/bash; do | ||
| if [[ -x "$newer_bash" ]] && "$newer_bash" -c '((BASH_VERSINFO[0] > 4 || (BASH_VERSINFO[0] == 4 && BASH_VERSINFO[1] >= 2)))' 2>/dev/null; then | ||
| exec "$newer_bash" "${BASH_SOURCE[0]}" "$@" | ||
| fi | ||
| done |
There was a problem hiding this comment.
Suggestion: Under old Bash, a compatible interpreter located elsewhere on PATH is ignored, so the source scan fails even though the promised newer Bash is installed and available.
Assessment: 🟠 Major · 🔁 Occurrence: Rarely · 🏷️ Api mismatch
Prompt for AI Agent 🤖
This is a comment left during a code review.
**Path:** apps/am-i-compromised/bin/scanner.sh
**Line:** 55:59
**Comment:**
*Api Mismatch: Under old Bash, a compatible interpreter located elsewhere on `PATH` is ignored, so the source scan fails even though the promised newer Bash is installed and available.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix
CodeAnt Nitpicks1 code suggestion1. URLs with a query directly after the authority, such as
|
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
User description
Follow-up to the 1.2.0 host audit. Makes it work on more setups and fixes what a portability review found.
hosttakes an optional project dir, defaults to the current folder, no root or sudohost: ZDOTDIR and XDG_CONFIG_HOME, empty-args crash on bash 3.2, no claim that persistence was checked on an unsupported OS, fewer false positives (toolchain dirs, bare sendMessage, hooks in ~/.local/bin)Checks: shellcheck, shfmt, 235 bats tests (26 skipped), scanner gate, Semgrep clean with suppressions off.
CodeAnt-AI Description
Make project scanning portable and host audits safer across environments
What Changed
sendMessagefunctions, and hooks installed in standard language-tool directories.Impact
✅ Clear scanner guidance on macOS✅ Host audits work against any selected project✅ Fewer false security findings💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.