Skip to main content
← Back to list
01Issue
FeatureClosedSwamp CLITeam
AssigneesNone

Relationships

↔ sibling #210

#1168 Pin the deno runtime for extension checks — bare `deno` is a PATH-hijack surface for the test/lint runtime

Opened by kneel · 7/15/2026

Problem

Because the bundled deno path isn't pinned in the primary docs (see sibling issue), agents commonly resolve bare deno to run deno test / deno check / deno doc --lint. That's an execution-path hijack surface:

  • A malicious deno earlier on PATH, a ./deno in CWD, or a shell alias/function is executed instead of the vetted bundled runtime.
  • These are exactly the commands agents run frequently, often under broad auto-approval — so a hijack runs attacker code with little friction.
  • If a swapped binary can produce passing-looking output for deno test / deno check / deno doc --lint, it would defeat the guarantees those commands exist to enforce (hermetic scorer, slow-type lint, deno fmt/deno lint, bundle-time inlining) while appearing to succeed. I haven't verified how much of swamp's scoring re-runs independently server-side vs. trusts local check output — that's the key question to confirm, and it determines severity.

The net effect: the ergonomic gap trains agents into the precise behavior an attacker would exploit.

Proposed solution

  1. Everywhere the docs/tooling invoke deno for checks, mandate the absolute ~/.swamp/deno/deno and explicitly warn against bare deno.
  2. Add a swamp extension test / swamp extension check wrapper that shells out to the bundled binary itself, so agents never resolve deno from the environment — consistent with the repo's "use swamp, don't bypass it" rule and closing the hijack window entirely.

Alternatives considered

  • Put deno on PATH — makes the hijack worse, not better; the fix is an absolute swamp-controlled path.
  • Docs-only pinning (sibling issue) reduces exposure but doesn't close it; the wrapper is the durable fix.

Verification status

The PATH-resolution behavior (agents invoking bare deno) is observed. The downstream impact of a hijacked binary on scoring is hypothesized, not tested — flagged here so maintainers can confirm whether local check output is trusted or independently re-verified.

Environment

  • swamp skill docs as of 2026-07-15; bundled deno at ~/.swamp/deno/deno.
02Bog Flow
✓OPEN○TRIAGED○IN PROGRESS◉CLOSED

Closed

7/15/2026, 10:50:13 PM

No activity in this phase yet.

03Sludge Pulse
stack72 linked related to #2107/15/2026, 10:50:23 PM
Editable. Press Enter to edit.

kneel commented 7/15/2026, 10:48:04 PM

Sibling issue: #1167 — the DX/discoverability half (surface the deno path in the first-loaded guide + expose via CLI). This issue is the security/hardening half; distinct problem, shared remedy.

stack72 commented 7/15/2026, 10:50:11 PM

hey @kneel - this is a dupe of an idea I have in #210 where we create a command that will shim the deno commands in the bundled deno - I will close this but link it for reference

kneel commented 7/16/2026, 6:35:53 PM

darn clankers not searching first ;)

Sign in to post a ripple.