Kitchen Report

capture · Version 01a1a71c-6a22-75a9-84db-3e1404610554

Checked: 2026-11-04T15:14:42.442Z · Report generation 1

Status: complete · Analysis: live

Kitchen Report · Stage 1 of 2: Source check

Source check ✓ 2026-11-04T15:11:13.680Z

Kitchen Report · Stage 2 of 2

Buyer headline scores

Features found in source

All promised features found 100 / 100

App specification source review: 11 of 11 features (100%); partial features count half. Source review based on your App specification (11 features).

Security screening

Good, small improvements suggested 88 / 100

3 security issue(s) found; serious issues reduce this score most. No scan guarantees safety.

Setup files

Some setup steps missing 57 / 100

Present: README, no environment variables detected, App specification or AGENTS. Missing: known install command, run entry point. Static check in .; code was not executed. Checks README, environment example, install and run scripts, app specification or AGENTS, confirmed How to run it (confirmed) and run manifest (absent). The app was not executed.

Dependency & license health

Not checked

Not checked

Dependency and license evidence has not been checked.

The AI read 32 of 66 source files.

What you get

App specification source review: 11 of 11 features found in source (100%)

Actual run verification: Not tested. Source review does not prove the app works. Dependency warnings permit publishing; harmful content and unresolved rights or license blockers prevent it. Checks do not guarantee safety.

Findings

Persistent 'Allow all' bypasses per-action approval

Medium — could affect users in some situations; plan a fix.

A user who clicks 'Allow all' once grants the model permission to synthesize arbitrary clicks, keystrokes, and scrolls in the target app for the rest of the conversation, which could be abused by prompt-injected content on screen.

Fix hint: Require explicit user confirmation for every action, or at minimum re-prompt when the target app or action type changes, and never persist an 'allow all' decision across turns without a visible indicator.

open · Review finding

ai-security · Sources/Capture/Chat/ChatSession.swift

Accessibility tree read may capture unintended text

Low — limited impact; fix during routine maintenance.

The reader walks the focused window's accessibility tree and may capture sensitive text (e.g., other fields) that the user did not intend to expose, though secure text fields are skipped.

Fix hint: Add a confirmation step or restrict document reading to user-initiated, clearly scoped windows, and document the data exposure.

open · Review finding

ai-security · Sources/Capture/Features/DocumentTextReader.swift

Model output rendered as markdown from untrusted screen content

Low — limited impact; fix during routine maintenance.

Screen content is fed to the model and its reply is rendered as markdown; a malicious page could induce the model to emit links or formatting that mislead the user into clicking.

Fix hint: Sanitize or escape the text before rendering, or render as plain text, and consider stripping markdown links to non-http schemes.

open · Review finding

ai-security · Sources/Capture/Chat/ChatPanel.swift

Platform check: macOS selected but no macOS project found

Low — an improvement hint for the developer, with no confirmed user harm.

Fix hint: Review the platforms in your listing Basics. This information does not affect the score or publication.

open · Review finding

platform-check ·

For developers: code quality

Improvement hints only; excluded from buyer headline scores.

Code cleanliness: 82 / 100 (AI maintainability review). Architecture: 83 / 100 (AI structure review). Test presence: 0 test files (presence signal only). Coverage: Not checked.

CaptureCoordinator centralizes capture flow cleanly; debug hooks are well isolated behind DEBUG.

Sources/Capture/CaptureCoordinator.swift

ChatSession is large; splitting tool execution and streaming into helpers would aid readability.

Sources/Capture/Chat/ChatSession.swift

TranslationOverlay mixes layout, drawing, and pixel analysis; consider extracting ImagePixels.

Sources/Capture/UI/TranslationOverlay.swift

Source coverage: Sampled. Build not run by CookThisApp.