TrailSnapBLOCK

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: trailsnap-agent
description: Query a user's TrailSnap photo library through scoped MCP tools to find photos, reconstruct memories, build person timelines, create evidence-backed narratives, or propose an album plan for explicit in-app approval. Use for the user's own TrailSnap library; never claim a proposal was executed or changed the library.
---

# TrailSnap Agent

Use the `trailsnap_*` tools supplied by the TrailSnap Pi extension. Query tools are read-only and all tools are scoped to the Agent Token owner. `trailsnap_propose_album_organization` only records a pending plan; it never executes it.

- Start with the narrowest tool that answers the request. Use `trailsnap_investigate_memory` for fuzzy recollections and `trailsnap_get_person_timeline` only after resolving an `identity_id` with `trailsnap_list_people`.
- Treat candidate memories, inferred places, descriptions, and identified people as evidence to present with uncertainty, not confirmed facts.
- Paginate when the first result says more data is available. Avoid dumping large raw result sets; select representative photos and explain the selection.
- Preserve returned photo IDs and absolute thumbnail URLs when producing Markdown or HTML. Never invent a media URL or expose a local file path.
- Only call `trailsnap_propose_album_organization` when the user asks to organize or save the selected photos and the token has `albums:propose`. Return its `approval_url` and state clearly that nothing changes until the user confirms in TrailSnap.
- Never attempt to execute or approve a plan. Do not say that a photo, album, tag, date, or file was changed based on a proposal response.

For request-specific sequencing and output guidance, read [references/workflows.md](references/workflows.md).

BLOCKgrade F · trust 48/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

What the source does

Filesystem

declared (7 observation(s))

Network

declared (8 observation(s))

Shell

declared (3 observation(s))

Dependencies

not all pinned

Secrets in source

found

Findings (25)

exec(compile(ast.Module(body=methods, type_ignores=[]), "<baseline-face-matching>", "exec"), namespace)

exec(compile(source, 'baseline_storage.py', 'exec'), baseline.__dict__)

icon.icns

map_key = random.choice(keys)

print(f"API Token: {token[:10]}...{token[-5:]}" if len(token) > 15 else f"API Token: {token}")

<#

<#

<#

DB_URL: postgresql://trailsnap:trailsnap@localhost:55432/trailsnap

TS_DB_URL: postgresql://trailsnap:trailsnap@localhost:55432/trailsnap

RAILWAY_DB_URL: postgresql://trailsnap:trailsnap@localhost:55432/trailsnap

- DB_URL=postgresql://trailsnap:trailsnap@postgres:5432/trailsnap

- RAILWAY_DB_URL=postgresql://trailsnap:trailsnap@postgres:5432/railway

token: "tsnap_active_abcdefghijklmnop",

token: "tsnap_new_abcdefghijklmnop",

token: "tsnap_del_abcdefghijklmnop",

trailsnap-debug.keystore

gradle-wrapper.jar

.env.test.ci

.env.test.example

new Function('exports', 'module', code)(moduleExports.exports, moduleExports)

new Function('require', 'module', 'exports', code)(name => dependencies[name] ?? require(name), module, module.exports)

digest = hashlib.md5()

md5 = hashlib.md5() if expected_md5 else None

md5_digest = hashlib.md5() if expected_md5 else None

Gates applied: no_behavioural_pass.