forensify

# Forensify The agent stack you have already installed is your biggest blind spot. `repo-forensics` catches threats before install. Forensify tells you what is already on this machine, across every agent framework, and where the credential, injection, and auto-execution surfaces are right now. ## What makes this different Every Codex user has `~/.codex/auth.json`. TruffleHog will tell you it contains secrets. Forensify tells you its permissions are 0o644 (world-readable), its auth_mode is apiKey (non-rotating, broad-scope), it has not been refreshed in 47 days, AND OpenClaw's `models status` command is known to silently overwrite it (openai/codex#54506). That cross-ecosystem stack interaction finding is a class no existing credential scanner produces. ## How it works Three stages, each a separate component: **1. Inventory (zero-LLM, deterministic)** The agent runs `{baseDir}/scripts/build_inventory.py`. It reads `{baseDir}/config/ecosystem_roots.json`, detects which ecosystems are installed, walks every surface (skills, MCP, hooks, plugins, commands, memory, credentials), and emits a JSON inventory. No model calls. Every string is NFKC-normalized and bidi-override-rejected before output. **2. Domain analysis (6 parallel sub-agents)** The orchestrator at `{baseDir}/orchestrator/` splits findings across six risk domains. Each domain sub-agent receives a `DomainJob` with the inventory slice and filtered scanner findings for its surface. Sub-agents run with hostile-data po...