playrote.play.v1

ddotisacat/command-shadow-auditv0.1.2Public

Command shadow audit

When you type python3, what ACTUALLY runs -- and what did it silently replace? Five jobs, in order: statically parses a fixed list of shell rc files (~/.zshrc, ~/.zprofile, ~/.zshenv, ~/.bashrc, ~/.bash_profile, ~/.profile, ~/.bash_aliases -- plus whatever they literally `source` one level deep, tilde-expanded,

Read the full description

cycle-safe, each file degrading independently) for alias, function, and PATH-export definitions, by reading their own text; walks THIS process's own $PATH, in order, for a watchlist of common commands (a built-in list plus anything you add), recording every hit -- directory, whether it is a symlink, its one-level link target, and which version-manager convention that directory matches (asdf, nvm, pyenv, rbenv, conda/anaconda, brew, ~/.local/bin, ~/.rote/bin, or plain system); joins the two and reports, per command, the winner using the shell's own precedence -- a function beats an alias beats the first PATH hit, stated explicitly because that is the one number this whole play hangs on -- and everything

  • Published 3 Sep 2026
  • Downloads 3
  • Needs rote 0.62.0+
  • Digest sha256:399413ffd8a9…
  • Reference dotisacat/command-shadow-audit@0.1.2

Before you run it1 local tool

Everything here is checked on your machine when rote inspects the play. This page never learns what you have installed or which credentials you hold.

  • ○
    python3local tool

    Must be on your PATH when used. minimum version undeclared.

Inputs2, all optional

rote asks for these before running and shows the defaults it will use.

  • Commandscommands

    Extra commands to audit, comma-separated, added to the built-in watchlist (letters, digits, dash, underscore, dot only -- anything else is ignored with a note)

    optionalstringexample python3,nodecustom value allowed
  • Probe versionsprobe_versions

    1 = read --version from the safe allowlist binaries (opt-in; each candidate is realpath/ownership/write-permission trust-checked before it is ever run -- see resolve.py PROBE SAFETY), 0 = pure path analysis, no execution at all (0-1)

    optionalintegerdefault 0example 1custom value allowed

What it changes

No write operations are declared in this version's manifest.

Credentials remain in the recipient's local rote vault; this page and the publisher never receive them.

Runtime details
  • rote CLIversion 0.62.0 or newer
  • Servicesnone declared
  • Digestsha256:399413ffd8a9065d975537a88e3ae5e781d9d2bc4bc2013ec84bd6e80935ff18
  • Archive size29818 bytes
  • Published2026-09-03T21:52:23.979094+00:00
  • Published withrote 0.77.0

Credential values and current readiness remain local. Opening this page never prompts for a credential, opens an authorization browser, or calls a service this play uses.

A play is a published, versioned automation package that runs on your own machine through rote, a free command-line tool. Opening this page installs nothing and runs nothing.