io.github.CDCStream/captapi

Contained to critical — not scanned yet — tool surface unknown. Known so far: runs locally and hosted.

At worst: Arbitrary execution, or execution together with a live credential. A compromise here is a compromise of the host or the account.

• Runs locally and hosteddeclared+12

  Ships both an installable package and a hosted endpoint. Whichever you pick, the other is available: local execution borrows your machine's authority, hosted execution sends your prompts and tool arguments to a third party.

• executionup to +40

  not scanned yet — tool surface unknown. Nothing is known about what this entry can do, which is not the same as it being able to do little.

• credentialsup to +18

  No credential declaration found, from the publisher, the upstream registry, or the README. That is an absence of evidence, not evidence this entry needs nothing.

• supplyup to +6

  Never scanned, so neither the install-time scripts nor the size of the dependency tree behind this entry has been read.

Blast radius measures what this entry can reach, not how likely it is to misbehave — that is the trust score, and the two are deliberately separate axes. A high blast radius is not a defect: a filesystem server is supposed to write files. It never moves the trust grade in either direction. How this is calculated →