oscarlora/ad-production-kit

Review signals: 1 connection review, 3 download and execute, 13 known vulnerability, 1 outside write.

Reviewed as expected for a test run: resolver address lookups that send no data.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 8 distinct locations. 8 attributed processes.

Source contains download and execute; review its purpose. 2 distinct locations. 3 findings.

OSV reports a known vulnerability in this dependency version. 6 distinct locations. 13 findings.

Repository processes attempted these writes outside documented output/cache paths. /node_modules/@anthropic-ai/claude-agent-sdk 1 attributed processes.

PID 2765: <guest-path> · <guest-path>

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• Media tab searches the library: Real input produced the expected result: 00012_fast-sci-fi-metallic-whoosh-sting.mp3

  Source: **Media** (search the library)

  Input: sci-fi whoosh, audio only, keywords

  Expected: returns the sci-fi whoosh sound effect from the shared library catalog

  Command: <guest-path> tools/search-media.mjs --media workspaces/Shared/Library/inputs/media --query 'sci-fi whoosh' --type audio --keywords-only --limit 3

  Observed: 00012_fast-sci-fi-metallic-whoosh-sting.mp3 A fast sci-fi digital whoosh sound effect featuring a quick pitch-rising sweep followed by… 00005 [audio/?] 00005_sci-fi-digital-ui-transition-sound.mp3 Sound: Fast digital UI sound featuring a high-pitched synth laser chirp, swift whoosh, and…

Examples

• search a brand's media catalog from the command line (tools/ scripts, search-media --help): command completed successfully

  Source: tools/search-media.mjs (HELP text) and README.md How it's organized

  Input: --query glass breaking, keywords only, limit 3

  Expected: finds the glass breaking shatter sound effect in the shared library

  Command: <guest-path> tools/search-media.mjs --media workspaces/Shared/Library/inputs/media --query 'glass breaking' --keywords-only --limit 3

  Observed: 1 result for "glass breaking" [keywords]: 00018 [audio/?] 00018_glass-breaking-shatter.mp3 A glass breaking: a sharp shatter right at the start (<email> s), then a short scat…

• check that a workspace's kie.ai key works before generating ads: Not tested: no kie.ai key is available in this guest, and the key is required for ad generation (images, video, voices, music). Only the key-free parts (studio and media search) were exercised.

  Source: README.md How to set it up, step 3 (kie.ai key) and tools/check-keys.mjs HELP

  Expected: documented command completes successfully

  Observed: Not tested: no kie.ai key is available in this guest, and the key is required for ad generation (images, video, voices, music). Only the key-free parts (studio and media search) were exercised.

Local or hosted: both

Install ADPK with the README's setup script, start the local studio web app, and search the shared media library.

cd <guest-path> && pwd && ls -la && git status 2>&1 | head -3; id -u; python3 --version; cat README.md 2>/dev/null | head -200
ls <guest-path> ; ls /inputs 2>&1; ls <guest-path> 2>&1
cd <guest-path> && cat package.json; ls -la tools studio .coldpass; cat tools/setup.sh | head -150
cd <guest-path> && ls studio; cat studio/README* 2>/dev/null | head -80; ls skills/set-up-adpk; sed -n 1,80p skills/set-up-adpk/SKILL.md; node -v; npm -v; which ffmpeg; uname -a; cat /etc/os-release | head -3
cd <guest-path> && sed -n 150,300p tools/setup.sh
cd <guest-path> && export NODE_USE_ENV_PROXY=1 && timeout 900 bash tools/setup.sh </dev/null 2>&1 | tail -60; echo "EXIT=${PIPESTATUS[0]}"
cd <guest-path> && export PATH="$HOME/.local/node/bin:$HOME/.local/bin:$PATH" && node -v && npm -v && cat studio/package.json && sed -n 1,60p studio/dev.mjs && cat tools/check-keys.mjs && node tools/check-keys.mjs --help 2>&1 | head -20; echo ---; node tools/search-media.mjs --help 2>&1 | head -30
cd <guest-path> && echo HOME=$HOME && ls -la workspaces 2>&1; ls workspaces/Shared 2>&1; ls workspaces/Shared/Library 2>&1 | head; find workspaces -maxdepth 4 -name "*.json" 2>/dev/null | head -20; sed -n 1,40p tools/lib/catalog.mjs | head -5; ls tools/lib
cd <guest-path> && find workspaces -maxdepth 6 | head -40; cat workspaces/Shared/Library/.sync-state.json | head -c 600; echo; sed -n 1,40p tools/search-media.mjs | head -60
cd <guest-path> && head -30 _catalog/index.md; ls _catalog/json | wc -l; ls _catalog/json | head -3; cat ../../../../tools/search-media.mjs | grep -n "readRecords\|keywords-only\|console.log" | head
cd <guest-path> && export PATH="$HOME/.local/node/bin:$HOME/.local/bin:$PATH" && node tools/search-media.mjs --media workspaces/Shared/Library/inputs/media --query "glass breaking" --keywords-only --limit 3 2>&1; echo EXIT=$?
cd <guest-path> && export PATH="$HOME/.local/node/bin:$HOME/.local/bin:$PATH" && (timeout 900 node dev.mjs > /tmp/studio-manual.log 2>&1 &) ; for i in $(seq 1 80); do sleep 3; if curl -s -m 3 http://127.0.0.1:4179/ | grep -q "Ad Production Kit"; then echo UP after $((i*3))s; break; fi; done; tail -15 /tmp/studio-manual.log; curl -s -m 5 -o /dev/null -w "%{http_code}\n" http://127.0.0.1:4179/
cd <guest-path> && find app -path "*api*" -name "route.*" | head -20; grep -rn "api/" app --include=*.tsx -l | head -5
cd <guest-path> && for p in "api/Shared/Library/media" "api/Shared/Library/ads" "api/Shared/Library/workflow"; do echo "== $p"; curl -s -m 10 -w "\nHTTP %{http_code}\n" "http://127.0.0.1:4179/$p" | head -c 600; echo; done; sed -n 1,40p "app/api/[ws]/[brand]/media/route.js"
cd <guest-path> && pkill -f "node dev.mjs"; pkill -f "next start\|next dev\|next-server"; sleep 2; curl -s -m 3 -o /dev/null -w "%{http_code}\n" http://127.0.0.1:4179/ ; echo "--- schedule/cron/webhook grep:"; grep -rniE "cron|setInterval|--once|--now|webhook|schedule" tools studio/app studio/lib studio/engine studio/dev.mjs README.md AGENTS.md 2>/dev/null | grep -v node_modules | head -30; echo "--- tests:"; find . -path ./studio/node_modules -prune -o -path ./node_modules -prune -o \( -name "*.test.*" -o -name "*.spec.*" \) -print | head; ls .github 2>&1 | head -2; grep -n "test" AGENTS.md | head
cd <guest-path> && (ps -eo pid,args | grep -E "[d]ev\.mjs|[n]ext-server|[n]ext start" ); for p in $(ps -eo pid,args | grep -E "[d]ev\.mjs|[n]ext-server|[n]ext start" | awk '{print $1}'); do kill $p; done; sleep 2; curl -s -m 3 -o /dev/null -w "%{http_code}\n" http://127.0.0.1:4179/; echo "--- schedule/cron/webhook grep:"; grep -rniE "cron|setInterval|--once|--now|webhook|schedule" tools studio/app studio/lib studio/engine studio/dev.mjs README.md AGENTS.md 2>/dev/null | head -30; echo "--- tests:"; find . \( -path ./studio/node_modules -o -path ./node_modules \) -prune -o \( -name "*.test.*" -o -name "*.spec.*" \) -print | head; grep -n -i "test" AGENTS.md | head
ps -eo pid,args | grep -E "dev|next" | grep -v grep | head; echo done
cd <guest-path> && grep -rniE "cron|setInterval|--once|--now|webhook|schedule" tools studio/app studio/lib studio/engine studio/dev.mjs README.md AGENTS.md | head -30; echo "--- tests:"; find . -path ./studio/node_modules -prune -o -path ./node_modules -prune -o \( -name "*.test.*" -o -name "*.spec.*" \) -print | head; grep -n -i "test" AGENTS.md | head
cd <guest-path> && N=<guest-path>; $N tools/search-media.mjs --media workspaces/Shared/Library/inputs/media --query "coin clink" --keywords-only --limit 3; echo EXIT=$?; $N tools/search-media.mjs --media workspaces/Shared/Library/inputs/media --query "sci-fi whoosh" --type audio --keywords-only --limit 3; echo EXIT=$?; python3 -I -c "
t=open('README.md',encoding='utf-8').read()
for q in ['**Media** (search the library)','- \`studio/\` — the local web app','**Review and upload:**']:
    print(repr(q), q in t)
"
cd <guest-path> && mkdir -p .coldpass && N=<guest-path> && cat > .coldpass/probe.json <<'EOF'
{"kind":"http","argv":["<guest-path>","studio/dev.mjs"],"cwd":"<guest-path>","url":"http://127.0.0.1:4179/api/Shared/Library/media","expected_text":"00001_loud-vocal-scream-sound-effect.mp3"}
EOF
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"Media tab searches the library","source":"**Media** (search the library)","input":"sci-fi whoosh, audio only, keywords","expected":"returns the sci-fi whoosh sound effect from the shared library catalog","probe_kind":"cli","argv":["<guest-path>","tools/search-media.mjs","--media","workspaces/Shared/Library/inputs/media","--query","sci-fi whoosh","--type","audio","--keywords-only","--limit","3"],"expected_text":"00012_fast-sci-fi-metallic-whoosh-sting.mp3","cwd":"<guest-path>"}]
EOF
cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"search a brand's media catalog from the command line (tools/ scripts, search-media --help)","source":"tools/search-media.mjs (HELP text) and README.md How it's organized","input":"--query glass breaking, keywords only, limit 3","expected":"finds the glass breaking shatter sound effect in the shared library","argv":["<guest-path>","tools/search-media.mjs","--media","workspaces/Shared/Library/inputs/media","--query","glass breaking","--keywords-only","--limit","3"],"cwd":"<guest-path>","expected_text":"00018_glass-breaking-shatter.mp3"},{"kind":"example","claim":"check that a workspace's kie.ai key works before generating ads","source":"README.md How to set it up, step 3 (kie.ai key) and tools/check-keys.mjs HELP","reason":"Not tested: no kie.ai key is available in this guest, and the key is required for ad generation (images, video, voices, music). Only the key-free parts (studio and media search) were exercised."}]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"Entry points inspected: README.md, tools/setup.sh, tools/*.mjs, studio/dev.mjs and studio/app (grep for cron, setInterval, --once, --now, webhook, schedule). The only timers are SSE heartbeat intervals (keep-alive pings in studio/app/api/[ws]/[brand]/watch and agent routes), which are not product cycles. The product runs on demand: the agent or the user runs a tool or opens the studio.","checks":[]}
EOF
python3 -I -m json.tool .coldpass/probe.json >/dev/null && python3 -I -m json.tool .coldpass/claims.json >/dev/null && python3 -I -m json.tool .coldpass/examples.json >/dev/null && python3 -I -m json.tool .coldpass/cycles.json >/dev/null && echo JSON_OK; ls -la .coldpass
cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay; echo "EXIT=$?"
cd <guest-path> && curl -s -m 3 -o /dev/null -w "port4179=%{http_code}\n" http://127.0.0.1:4179/ ; ps -eo pid,args | grep -E "[d]ev\.mjs|[n]ext" | head -3; mkdir -p .coldpass && cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Install ADPK with the README's setup script, start the local studio web app, and search the shared media library.","operation_scope":"Local, no kie.ai key. Covers the studio (http://127.0.0.1:4179) serving the media API and the keyword media search. Not tested: ad generation (images, video, voices, music), which needs a kie.ai API key that this guest does not have. Node 24.22.1 installed to <guest-path> (README requires Node 22.15+). Ubuntu 24.04, running as uid 1000 (no sudo needed since ffmpeg/whisper are not installed on Linux).","steps":["bash tools/setup.sh (run inside the checkout; the README's 'inside ADPK' form of the curl | bash installer)","node studio/dev.mjs (studio launcher, usage in its header; studio built and served on port 4179)","curl http://127.0.0.1:4179/api/Shared/Library/media (returned catalog records, including 00001_loud-vocal-scream-sound-effect.mp3)","node tools/search-media.mjs --media workspaces/Shared/Library/inputs/media --query \"sci-fi whoosh\" --type audio --keywords-only --limit 3 (returned 00012_fast-sci-fi-metallic-whoosh-sting.mp3)","node tools/search-media.mjs --media workspaces/Shared/Library/inputs/media --query \"glass breaking\" --keywords-only --limit 3 (returned 00018_glass-breaking-shatter.mp3)"],"deviations":["Did not run the curl | bash one-liner: the checkout is already the ADPK snapshot, so setup.sh was run from it (its documented 'inside ADPK' usage). Its get_kit step therefore did not clone, and no git init/fetch was needed.","setup.sh tried 'git config core.hooksPath' which failed silently because the snapshot is not a git repository; no effect on the run.","setup.sh added PATH lines to ~/.bashrc and ~/.profile (HOME is <guest-path>), as the script does by design.","ffmpeg and whisper.cpp were not installed: setup.sh only installs them on macOS; on Linux the media tools say how to get them when first used. Not needed for the operations tested.","The studio was started by hand once to verify it, then stopped before the checker ran its own copy.","Keyword search for 'coin clink' returned 0 results although the index describes a coin clink; not investigated further.","Could not run the kie.ai key check (tools/check-keys.mjs) or any generation step: no key available. Recorded as a blocked example, not as a product failure."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"No fix needed for the tested operations. To test ad generation, add a kie.ai key to .env as <WS>_KIE_API_KEY and run node tools/check-keys.mjs <WS>."}
EOF
python3 -I -m json.tool .coldpass/report.json >/dev/null && echo REPORT_OK
cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay | python3 -I -c "import json,sys; d=json.load(sys.stdin); print('valid=',d['valid'],'problems=',d['problems'],'replay=',d['replay']['status'])"; echo EXIT=${PIPESTATUS[0]}