---
name: read-the-package
description: first, on every review: before anything is traced or judged
---

# Read the package

Part of security-reviewer. first, on every review: before anything is traced or judged

## When to use this

first, on every review: before anything is traced or judged

## What a good result looks like

Every file of the package read in memory with its digest, both halves of the declaration read into each system's access, reason, credential name, variable and spending, and every credential-shaped thing in the files named by file and line.

## When it comes back empty

With no descriptor and no runtime requirements there is no package to review: the job stops and says what it needs, and nothing is guessed about what the package would have declared.

## How to do it

Unpack the package in memory with scripts/tar.mjs (a link or a path that climbs out of the archive is reported and not read) and read what it declares with scripts/read-package.mjs: each system at its access with its reason from the descriptor; its kind, the NAME of its credential, the variable it is placed in, its settings and what it spends from the runtime requirements; the ceilings, binaries, folders, dependencies, refusals and programs. Read every file for what looks like a credential with the publisher's list (scripts/secrets.mjs), and report a match by file and line, never its bytes. Write <records>/<job id>/declared.json.

## Scripts

Run these from this skill's folder; each one says what it needs at the top.

- scripts/read-package.mjs
- scripts/tar.mjs
- scripts/secrets.mjs