io.github.rm-rf-prod/groundtruth

The materials show it requires GT_GITHUB_TOKEN, which is a sensitive credential. Given its GitHub-related capability, an over-privileged or leaked token could allow repository data access or actions on behalf of the user. No minimum required scope is specified.

No explicit remote host is listed by the system, but the description mentions telemetry and the tool requires a GitHub token, indicating possible outbound data flow to external services, at least potentially to GitHub. With no README, the egress targets, data types, and whether telemetry can be disabled are not transparent.

The system explicitly marks it as executes-code, and the description includes code audit and a dispatch tool, suggesting it may start local processes or run analysis/dispatch logic. This is a common capability for such tools, but it is still a sensitive permission that can affect the local environment.

As a live docs and code-audit tool, it would reasonably need to read local code, documentation, or workspace content to perform analysis. The current materials do not show explicit write scope, nor do they indicate system privileges beyond its stated function. Because documentation is missing, the exact access boundary remains unclear.

The source is an official registry entry, and it is open source and auditable with updates within the last year, all of which are strong positive signals. Although community adoption is low and the license is unspecified with no README, these add uncertainty but are not enough on their own to raise it to high risk.