Generated source
This hub uses the same local package data as individual package pages: pkg.so package metadata, Homebrew enrichment, Geiger classifier output, secret-handling manifests, and approval-gate seeds where available.
security
Secret-risk packages
Packages with protected-tool coverage, approval-gate metadata, or non-low Geiger findings deserve explicit review before agents run them.
summary
Why this package group is here
Secret-risk packages currently includes 2475 package catalog entries. 0 have protected-tool coverage, 20 have approval-gate metadata, and 2137 have non-low Geiger classifier findings. The grouping comes from package metadata, so it can stay current as that metadata changes.
Review model
Use the hub to find command families that need tighter secret injection, approval gates, or manual review before agents run them.
High-signal tools
node7 approval-gate rules are present.cmake6 approval-gate rules are present.go7 approval-gate rules are present.pkgconf3 approval-gate rules are present.uv6 approval-gate rules are present.xcbeautify2 approval-gate rules are present.gemini-cli5 approval-gate rules are present.jq3 approval-gate rules are present.mkcert4 approval-gate rules are present.openssl@35 approval-gate rules are present.gh7 approval-gate rules are present.awscli8 approval-gate rules are present.
Approval-gated tools
node7 approval-gate rules are present.cmake6 approval-gate rules are present.go7 approval-gate rules are present.pkgconf3 approval-gate rules are present.uv6 approval-gate rules are present.xcbeautify2 approval-gate rules are present.gemini-cli5 approval-gate rules are present.jq3 approval-gate rules are present.
Related hubs
Representative package spokes
openssl@35 approval-gate rules are present.sqlitedoc example: bounded database toolxzbroad file, network, media, or database tool signalnode7 approval-gate rules are present.gh7 approval-gate rules are present.zstdbroad file, network, media, or database tool signalawscli8 approval-gate rules are present.lz4broad file, network, media, or database tool signalffmpeg4 approval-gate rules are present.pkgconf3 approval-gate rules are present.uv6 approval-gate rules are present.cmake6 approval-gate rules are present.jpeg-turbobroad file, network, media, or database tool signallibtifflibrary-like package without higher-risk signalsgo7 approval-gate rules are present.python@3.136 approval-gate rules are present.
packages
Indexed package pages
| Package | Manager | Signals | Why it appears here |
|---|---|---|---|
| node | Homebrew | approval gate, yellow risk, v26.8.1 | 7 approval-gate rules are present. |
| cmake | Homebrew | approval gate, yellow risk, v4.4.3 | 6 approval-gate rules are present. |
| go | Homebrew | approval gate, yellow risk, v1.27.1 | 7 approval-gate rules are present. |
| pkgconf | Homebrew | approval gate, green risk, v3.0.7 | 3 approval-gate rules are present. |
| uv | Homebrew | approval gate, v0.12.10 | 6 approval-gate rules are present. |
| xcbeautify | Homebrew | approval gate, green risk, v3.2.1 | 2 approval-gate rules are present. |
| gemini-cli | Homebrew | approval gate, v0.46.0 | 5 approval-gate rules are present. |
| jq | Homebrew | approval gate, green risk, v1.8.2 | 3 approval-gate rules are present. |
| mkcert | Homebrew | approval gate, green risk, v1.4.4 | 4 approval-gate rules are present. |
| openssl@3 | Homebrew | approval gate, v3.6.4 | 5 approval-gate rules are present. |
| gh | Homebrew | approval gate, blue risk, v2.100.0 | 7 approval-gate rules are present. |
| awscli | Homebrew | approval gate, v2.36.40 | 8 approval-gate rules are present. |
| ffmpeg | Homebrew | approval gate, blue risk, v9.0.1 | 4 approval-gate rules are present. |
| python@3.13 | Homebrew | approval gate, v3.13.15 | 6 approval-gate rules are present. |
| git | Homebrew | approval gate, blue risk, v2.55.0 | 6 approval-gate rules are present. |
| coreutils | Homebrew | approval gate, blue risk, v9.11 | 8 approval-gate rules are present. |
| imagemagick | Homebrew | approval gate, blue risk, v7.1.2-31 | 5 approval-gate rules are present. |
| mise | Homebrew | approval gate, orange risk, v2026.9.1 | 6 approval-gate rules are present. |
| pyenv | Homebrew | approval gate, orange risk, v2.8.5 | 5 approval-gate rules are present. |
| docker | Homebrew | approval gate, orange risk, v29.8.0 | 6 approval-gate rules are present. |
| gcc | Homebrew | yellow risk, v16.2.0 | compiler and toolchain runtime |
| llvm | Homebrew | yellow risk, v23.1.0 | compiler and toolchain runtime |
| openjdk | Homebrew | yellow risk, v26.0.2.1 | Java runtime and development kit |
| ruby | Homebrew | yellow risk, v4.0.6 | doc example: interpreter runtime |
| deno | Homebrew | yellow risk, v2.9.6 | doc example: JavaScript runtime |
| util-linux | Homebrew | yellow risk, v2.42.3 | generalized runtime or code generation signal |
| ninja | Homebrew | yellow risk, v1.13.2 | build system capable of executing project logic |
| luajit | Homebrew | yellow risk, v2.1.1788460057 | generalized runtime or code generation signal |
| bash | Homebrew | yellow risk, v5.3.15 | doc example: shell runtime |
| maven | Homebrew | yellow risk, v3.9.16 | build system capable of executing project logic |
| ghostscript | Homebrew | yellow risk, v10.07.1 | generalized runtime or code generation signal |
| lua | Homebrew | yellow risk, v5.5.1 | doc example: interpreter runtime |
| shellcheck | Homebrew | yellow risk, v0.11.0 | generalized runtime or code generation signal |
| starship | Homebrew | yellow risk, v1.26.0 | generalized runtime or code generation signal |
| perl | Homebrew | yellow risk, v5.44.0 | broad file, network, media, or database tool signal |
| gradle | Homebrew | yellow risk, v9.7.1 | build system capable of executing project logic |
| meson | Homebrew | yellow risk, v1.12.0 | build system capable of executing project logic |
| zsh | Homebrew | yellow risk, v5.9.2 | doc example: shell runtime |
| fish | Homebrew | yellow risk, v4.9.2 | generalized runtime or code generation signal |
| eza | Homebrew | yellow risk, v0.23.5 | generalized runtime or code generation signal |
| zoxide | Homebrew | yellow risk, v0.10.0 | generalized runtime or code generation signal |
| mongosh | Homebrew | yellow risk, v2.9.2 | broad file, network, media, or database tool signal |
| powershell | Homebrew | yellow risk, v7.6.5 | generalized runtime or code generation signal |
| mesa | Homebrew | yellow risk, v26.2.2 | generalized runtime or code generation signal |
| orc | Homebrew | yellow risk, v0.4.43 | generalized runtime or code generation signal |
| go-task | Homebrew | yellow risk, v3.53.1 | generalized runtime or code generation signal |
| doxygen | Homebrew | yellow risk, v1.18.0 | generalized runtime or code generation signal |
| zig | Homebrew | yellow risk, v0.16.0 | generalized runtime or code generation signal |
| parallel | Homebrew | yellow risk, v20260822 | broad file, network, media, or database tool signal |
| httpie | Homebrew | yellow risk, v3.2.4 | generalized runtime or code generation signal |
| shfmt | Homebrew | yellow risk, v3.14.1 | generalized runtime or code generation signal |
| oh-my-posh | Homebrew | yellow risk, v31.1.3 | generalized runtime or code generation signal |
| erlang | Homebrew | yellow risk, v29.0.6 | generalized runtime or code generation signal |
| mosh | Homebrew | yellow risk, v1.4.0 | broad file, network, media, or database tool signal |
| nushell | Homebrew | yellow risk, v0.115.1 | generalized runtime or code generation signal |
| crun | Homebrew | yellow risk, v1.29.1 | generalized runtime or code generation signal |
| sbt | Homebrew | yellow risk, v2.0.8 | generalized runtime or code generation signal |
| gauche | Homebrew | yellow risk, v0.9.15 | generalized runtime or code generation signal |
| mono | Homebrew | yellow risk, v6.14.1 | broad file, network, media, or database tool signal |
| nano | Homebrew | yellow risk, v9.2 | generalized runtime or code generation signal |
| fswatch | Homebrew | yellow risk, v1.22.0 | generalized runtime or code generation signal |
| gum | Homebrew | yellow risk, v2.0.0 | generalized runtime or code generation signal |
| kcov | Homebrew | yellow risk, v43 | generalized runtime or code generation signal |
| mit-scheme | Homebrew | yellow risk, v12.1 | generalized runtime or code generation signal |
| chicken | Homebrew | yellow risk, v6.0.0 | generalized runtime or code generation signal |
| percona-toolkit | Homebrew | yellow risk, v3.7.1-4 | broad file, network, media, or database tool signal |
| kotlin | Homebrew | yellow risk, v2.4.10 | generalized runtime or code generation signal |
| carapace | Homebrew | yellow risk, v1.7.3 | generalized runtime or code generation signal |
| mujs | Homebrew | yellow risk, v1.3.10 | generalized runtime or code generation signal |
| swift | Homebrew | yellow risk, v6.3.3 | broad file, network, media, or database tool signal |
| ant | Homebrew | yellow risk, v1.10.18 | generalized runtime or code generation signal |
| bazel | Homebrew | yellow risk, v9.2.0 | generalized runtime or code generation signal |