rehan-remade/universal-modder

Review signals: 1 hardcoded secret, 69 known vulnerability. 1 static matches retained as context.

Gitleaks found a possible hardcoded secret; value withheld. examples/minecraft-gta5-passthrough/gta/src/ws.cpp

OSV reports a known vulnerability in this dependency version. pillow 69 findings.

1 hardcoded secret matches retained as context; full list in the evidence.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• The knowledge base search finds prior field notes for a game.: Real input produced the expected result: games/terraria/fal-arsenal-tmodloader.md

  Source: um kb search "grand theft auto" # before you start: prior art (works outside the repo too)

  Input: terraria

  Expected: games/terraria/fal-arsenal-tmodloader.md

  Command: ./bin/um kb search terraria --limit 1

  Observed: games/terraria/fal-arsenal-tmodloader.md Fal Arsenal: missiles, a tactical nuke, new enemies and a boss for Terraria [Terraria | xna-fna | loader-api | working] | # Fal Arsenal: missiles, a tactical nuke, new enemies and a boss for Terraria | video that got ~400k views. Code: `examples/terraria-tmodloader`. | - **Reference source:** `ilspycmd -p` on `Terraria.exe`, into a folder outside the repo.

Examples

• Search the local knowledge base for Terraria notes.: command completed successfully

  Source: README.md, A knowledge base that AIs write for AIs

  Input: terraria

  Expected: Terraria field note path

  Command: ./bin/um kb search terraria --limit 1

  Observed: games/terraria/fal-arsenal-tmodloader.md Fal Arsenal: missiles, a tactical nuke, new enemies and a boss for Terraria [Terraria | xna-fna | loader-api | working] | # Fal Arsenal: missiles, a tactical nuke, new enemies and a boss for Terraria | video that got ~400k views. Code: `examples/terraria-tmodloader`. | - **Reference source:** `ilspycmd -p` on `Terraria.exe`, into a folder outside the repo.

Local or hosted: local

Search the local knowledge base for Terraria field notes

pwd; ls -la; cat README.md; rg --files -g 'AGENTS.md' -g 'pyproject.toml' -g 'package.json' -g 'requirements*' -g 'Dockerfile' -g '.github/**' | head -100
cat AGENTS.md; cat pyproject.toml; python3 --version; id -u; command -v uv || true; command -v ffmpeg || true; ls -la .coldpass; sed -n '1,160p' bin/um
cat <host-path> 2>/dev/null || true; vault-search 'universal modder knowledge base CLI' 2>/dev/null || true; sed -n '1,100p' um/kb.py 2>/dev/null || ls um; sed -n '1,120p' um/cli.py; find . -name AGENTS.md -print; python3 -m pip --version; ffmpeg -version 2>/dev/null | head -1;
python3 -c 'import PIL,numpy,yaml; print("deps available", PIL.__version__, numpy.__version__, yaml.__version__)' 2>&1; ./bin/um kb search terraria
./bin/um kb search terraria --help; ./bin/um kb search "Fal Arsenal" --game terraria 2>&1 | head -15; python3 -m ensurepip --version 2>&1; command -v ffmpeg || true
mkdir -p .coldpass; cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["./bin/um","kb","search","terraria","--limit","1"],"cwd":"<guest-path>","expected_text":"games/terraria/fal-arsenal-tmodloader.md"}
EOF
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"The knowledge base search finds prior field notes for a game.","source":"um kb search \"grand theft auto\"                 # before you start: prior art (works outside the repo too)","input":"terraria","expected":"games/terraria/fal-arsenal-tmodloader.md","probe_kind":"cli","argv":["./bin/um","kb","search","terraria","--limit","1"],"expected_text":"games/terraria/fal-arsenal-tmodloader.md","cwd":"<guest-path>"}]
EOF
cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"Search the local knowledge base for Terraria notes.","source":"README.md, A knowledge base that AIs write for AIs","input":"terraria","expected":"Terraria field note path","argv":["./bin/um","kb","search","terraria","--limit","1"],"cwd":"<guest-path>","expected_text":"games/terraria/fal-arsenal-tmodloader.md"}]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"Inspected README and AGENTS.md entry points. The CLI performs on-demand scans, searches, conversions, and asset operations; no recurring scheduler or product cycle is documented."}
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Search the local knowledge base for Terraria field notes","operation_scope":"README-documented um kb search operation using Python 3.12.3; local launcher ran successfully without optional dependencies","steps":["Read README.md and project guidance.","Ran ./bin/um kb search terraria --limit 1; it returned games/terraria/fal-arsenal-tmodloader.md.","Validated and replayed probe, README claim, example, and cycle record with the supplied checker."],"deviations":["README recommends uv; uv was not present and was not needed for this local operation.","Base Python has no pip and Pillow is not installed; those packages are not needed by this search operation."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":null}
EOF
cat .coldpass/report.json; cat .coldpass/probe.json