CartographyBLOCK

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: cli-review
description: >
  Runs a Greptile CLI review for the current local branch, installing or authenticating the CLI
  when needed, then summarizes JSON findings for the user. Use when the user wants Greptile
  feedback before opening a PR, outside a hosted PR review flow, or directly from a local checkout.
license: MIT
metadata:
  author: greptileai
  version: "1.0"
allowed-tools: Bash(git:*) Bash(greptile:*) Bash(command:*) Bash(curl:*) Bash(npm:*)
---

# CLI Review

Run a Greptile review from the local checkout and summarize the findings.

## Instructions

### 1. Confirm repository context

Start from the current repository root:

```bash
git rev-parse --show-toplevel
```

If the command fails, tell the user that the Greptile CLI review must be run from a git repository.

### 2. Check for the Greptile CLI

Check whether `greptile` is installed:

```bash
command -v greptile
```

If it is missing, do not install it automatically. Ask the user for permission, then show the recommended install command:

```bash
npm i -g greptile
```

If npm is unavailable, offer the shell installer fallback:

```bash
curl -fsSL "https://greptile.com/cli/install" | sh
```

After installation, re-run `command -v greptile`.

### 3. Ensure authentication

Check the signed-in account:

```bash
greptile whoami
```

If the CLI reports that authentication is missing, run:

```bash
greptile login
```

Wait for the user to complete the login flow before continuing.

### 4. Run the review

Prefer JSON output:

```bash
greptile review --json
```

If JSON output is unsupported or fails with a usage error, fall back to:

```bash
greptile review --agent
```

Do not hide the raw command failure if both commands fail. Summarize the failing command and the next action the user needs to take.

### 5. Summarize results

Parse JSON output when available and report:

- Review status
- Number of findings
- Highest severity findings first
- Files that need edits
- Suggested next command or fix path

When output is plain text, preserve the same structure as much as possible. Keep the summary concise and focused on actionable findings.

BLOCKgrade F · trust 40/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

What the source does

Filesystem

declared (4 observation(s))

Network

declared (5 observation(s))

Shell

declared (3 observation(s))

Dependencies

not all pinned

Secrets in source

found

Findings (25)

cache-payload.snapshot.test.ts.snap

<p><i>شش موجود افسانهای از دل دنیای کد ظهور کردهاند؛ هرکدام استادی بیهمتا در تخصص خود،<br>آمادهاند تا به فرمان شما آشوب را به نظم تبدیل کنند و چیزهایی بسازند که روزی ناممکن به نظر میرسیدند.</i></p>

<p><b>مجموعه Multi-Agent برای OpenCode</b> · ترکیب آزادانه مدلها · واگذاری خودکار taskها</p>

<p><sub>ساختهشده توسط <b>Boring Dystopia Development</b></sub></p>

<a href="https://svgdiagram.ai"><b>svgdiagram.ai</b></a> <sub>· یادداشتهایتان را به نمودارهای SVG تمیز و قابلویرایش تبدیل کنید</sub>

افزونه oh-my-opencode-slim یک Plugin برای هماهنگسازی و مدیریت Agentها در OpenCode است. این افزونه یک تیم داخلی از Agentهای تخصصی دارد که میتوانند Codebase را بررسی کنند، مستندات بهروز را پیدا کنند، مع

const dsn = 'postgres://deploy:[email protected]:5432/app';

'Subagent failed (sessionID: ses_5d4c3b): connection refused for postgres://deploy:hunter2@db';

'<task id="abc" state="running">text (sessionID: ses_9f8e7d) postgres://deploy:hunter2@db';

'<task id="[masked]" state="[masked]">text (sessionID: [masked]) postgres://deploy:...@db',

const token = 'glpat-Abcdef1234567890123';

const token = 'Z9xQ1w2e3r4t5y6u7i8o9p0a1s2d3f4g5h6j7';

const secret = 'Q1w2e3r4t5y6u7i8o9p0a1s2d3f4g5h6j7k8l9z0'; // 40 chars

curl -fsSL "https://greptile.com/cli/install" | sh

.all-contributorsrc

cache-payload.snapshot.test.ts

const IMG_HASH = createHash('sha1').update(IMG_BYTES).digest('hex').slice(0, 8);

const hash = createHash('sha1').update(data).digest('hex').slice(0, 8);

return createHash('md5').update(buffer).digest('hex');

const hasher = createHash('md5');

'Date.now()/Math.random() compose a per-run temp token for install bookkeeping; it names local directories and never reaches the prompt prefix.',

fs.writeFileSync(path.join(worktree, '.git'), 'gitdir: ../../../.git');

const dotted = `${os.tmpdir()}/__slim_missing_1143__/../../src`;

import { log } from '../../utils/logger';

import { log } from '../../utils/logger';

Gates applied: no_behavioural_pass.

[![ModelsAtlas audit: Cartography](https://modelsatlas.com/skills/alvinunreal/cartography/badge.svg)](https://modelsatlas.com/skills/alvinunreal/cartography/)

Not your listing, or something out of date? Claim or update your listing.