What the reviewer found

An E2E test script for the DorkOS dev server. Every curl call hits localhost ports the test itself boots, the piped python3 just parses that local JSON, and rm -rf only wipes a named, disposable /tmp/dorkos-test-mode-4243 directory that gets recreated on the next boot.

• example-or-fixture — an example or test fixture
• network — calls the vendor’s API

What was read

The file as it ships in dork-labs/dorkos:

• .claude/commands/chat/rooms-test.md

What the static scan said

The scan flagged 3things. The reviewer kept 1 and dismissed 2 as false.

• SC2Downloads and executes remote code — false positive
• RMRecursive force delete — false positive
• NETMakes network calls — real

How this review was made

Sonnet 5 read the files above on 7 September 2026 and answered three questions: is it dangerous to whoever installs it, is each scanner finding real, and what should the installer know. The verdict is bound to the file's hash; when the file changes, it is scanned afresh and reviewed again. A script that changes while the definition does not is not re-reviewed — that is a known gap. How the scan and the review work.

Produced by agentmods.dev · Sonnet 5 · 7 September 2026