Layer 01 · Before it runs · Portcullis
What was it allowed to do?
Your AI takes orders from more than you typed. It obeys every add-on you installed, every skill in your repo, and any instruction hidden inside them. The label says “read-only”. It does not say that a note three folders down tells the agent to send your keys to a stranger.
Portcullis reads all of it before the agent starts and shows you, line by line, what could reach your secrets or send your data out. Then it signs a receipt, so “we checked” becomes something you can show rather than something you say.
What you get
It reads. It never runs.
Nothing it inspects is ever started, so the review itself cannot set anything off. You get a plain list of what each add-on can touch and the line where it says so, and a receipt that the review happened.
What it does not prove
Its limits, before you rely on it.
Signals, with a citation
not a verdict on the author
A finding says “this pattern can send data out,” never “this author is malicious.” Many of these patterns have ordinary explanations: a build tool shells out for good reason. Portcullis makes the pattern visible so a person can decide.
The scan ran
not that the package is harmless
The receipt attests that this scanner, at this version, examined these exact bytes. A result with no findings reads “no signals matched by this scanner’s current rules”, which says nothing about risks the rules do not cover.