# Secret-risk packages

Packages with protected-tool coverage, approval-gate metadata, or non-low Geiger findings deserve explicit review before agents run them.

- **Packages:** 2,484
- **Protected tools:** 0
- **Approval gates:** 20
- **Non-low risk:** 2,129
- **Updated:** 2026-07-08

## Why this package group is here

Secret-risk packages currently includes 2484 package catalog entries. 0 have protected-tool coverage, 20 have approval-gate metadata, and 2129 have non-low Geiger classifier findings. The grouping comes from package metadata, so it can stay current as that metadata changes.

## Generated source

This hub uses the same local package data as individual package pages: Nucleus package metadata, Homebrew enrichment, Geiger classifier output, secret-handling manifests, and approval-gate seeds where available.

## Review model

Use the hub to find command families that need tighter secret injection, approval gates, or manual review before agents run them.

## Indexed package pages

- [cmake](https://www.automicvault.com/pkg/brew/cmake/) - 6 approval-gate rules are present.
- [go](https://www.automicvault.com/pkg/brew/go/) - 7 approval-gate rules are present.
- [node](https://www.automicvault.com/pkg/brew/node/) - 7 approval-gate rules are present.
- [gemini-cli](https://www.automicvault.com/pkg/brew/gemini-cli/) - 5 approval-gate rules are present.
- [jq](https://www.automicvault.com/pkg/brew/jq/) - 3 approval-gate rules are present.
- [mkcert](https://www.automicvault.com/pkg/brew/mkcert/) - 4 approval-gate rules are present.
- [pkgconf](https://www.automicvault.com/pkg/brew/pkgconf/) - 3 approval-gate rules are present.
- [uv](https://www.automicvault.com/pkg/brew/uv/) - 6 approval-gate rules are present.
- [xcbeautify](https://www.automicvault.com/pkg/brew/xcbeautify/) - 2 approval-gate rules are present.
- [awscli](https://www.automicvault.com/pkg/brew/awscli/) - 8 approval-gate rules are present.
- [coreutils](https://www.automicvault.com/pkg/brew/coreutils/) - 8 approval-gate rules are present.
- [docker](https://www.automicvault.com/pkg/brew/docker/) - 6 approval-gate rules are present.
- [ffmpeg](https://www.automicvault.com/pkg/brew/ffmpeg/) - 4 approval-gate rules are present.
- [gh](https://www.automicvault.com/pkg/brew/gh/) - 7 approval-gate rules are present.
- [git](https://www.automicvault.com/pkg/brew/git/) - 6 approval-gate rules are present.
- [imagemagick](https://www.automicvault.com/pkg/brew/imagemagick/) - 5 approval-gate rules are present.
- [mise](https://www.automicvault.com/pkg/brew/mise/) - 6 approval-gate rules are present.
- [openssl@3](https://www.automicvault.com/pkg/brew/openssl-3/) - 5 approval-gate rules are present.
- [pyenv](https://www.automicvault.com/pkg/brew/pyenv/) - 5 approval-gate rules are present.
- [python@3.13](https://www.automicvault.com/pkg/brew/python-3-13/) - 6 approval-gate rules are present.
- [acl2](https://www.automicvault.com/pkg/brew/acl2/) - generalized runtime or code generation signal
- [agda](https://www.automicvault.com/pkg/brew/agda/) - generalized runtime or code generation signal
- [alda](https://www.automicvault.com/pkg/brew/alda/) - generalized runtime or code generation signal
- [algol68g](https://www.automicvault.com/pkg/brew/algol68g/) - generalized runtime or code generation signal
- [aliae](https://www.automicvault.com/pkg/brew/aliae/) - generalized runtime or code generation signal
- [ammonite-repl](https://www.automicvault.com/pkg/brew/ammonite-repl/) - generalized runtime or code generation signal
- [ant](https://www.automicvault.com/pkg/brew/ant/) - generalized runtime or code generation signal
- [apache-spark](https://www.automicvault.com/pkg/brew/apache-spark/) - broad file, network, media, or database tool signal
- [arturo](https://www.automicvault.com/pkg/brew/arturo/) - generalized runtime or code generation signal
- [ats2-postiats](https://www.automicvault.com/pkg/brew/ats2-postiats/) - generalized runtime or code generation signal
- [autojump](https://www.automicvault.com/pkg/brew/autojump/) - generalized runtime or code generation signal
- [aws-shell](https://www.automicvault.com/pkg/brew/aws-shell/) - generalized runtime or code generation signal
- [ballerina](https://www.automicvault.com/pkg/brew/ballerina/) - generalized runtime or code generation signal
- [bam](https://www.automicvault.com/pkg/brew/bam/) - generalized runtime or code generation signal
- [bar](https://www.automicvault.com/pkg/brew/bar/) - generalized runtime or code generation signal
- [bas55](https://www.automicvault.com/pkg/brew/bas55/) - generalized runtime or code generation signal
- [bash](https://www.automicvault.com/pkg/brew/bash/) - doc example: shell runtime
- [bazel](https://www.automicvault.com/pkg/brew/bazel/) - generalized runtime or code generation signal
- [beakerlib](https://www.automicvault.com/pkg/brew/beakerlib/) - generalized runtime or code generation signal
- [befunge93](https://www.automicvault.com/pkg/brew/befunge93/) - generalized runtime or code generation signal
- [berkeley-db](https://www.automicvault.com/pkg/brew/berkeley-db/) - broad file, network, media, or database tool signal
- [bic](https://www.automicvault.com/pkg/brew/bic/) - generalized runtime or code generation signal
- [bold](https://www.automicvault.com/pkg/brew/bold/) - generalized runtime or code generation signal
- [boot-clj](https://www.automicvault.com/pkg/brew/boot-clj/) - generalized runtime or code generation signal
- [bpython](https://www.automicvault.com/pkg/brew/bpython/) - generalized runtime or code generation signal
- [brainfuck](https://www.automicvault.com/pkg/brew/brainfuck/) - generalized runtime or code generation signal
- [brpc](https://www.automicvault.com/pkg/brew/brpc/) - broad file, network, media, or database tool signal
- [brush](https://www.automicvault.com/pkg/brew/brush/) - generalized runtime or code generation signal
- [bsdmake](https://www.automicvault.com/pkg/brew/bsdmake/) - generalized runtime or code generation signal
- [build2](https://www.automicvault.com/pkg/brew/build2/) - generalized runtime or code generation signal
- [bunster](https://www.automicvault.com/pkg/brew/bunster/) - generalized runtime or code generation signal
- [byobu](https://www.automicvault.com/pkg/brew/byobu/) - generalized runtime or code generation signal
- [cadence](https://www.automicvault.com/pkg/brew/cadence/) - generalized runtime or code generation signal
- [cafeobj](https://www.automicvault.com/pkg/brew/cafeobj/) - generalized runtime or code generation signal
- [carapace](https://www.automicvault.com/pkg/brew/carapace/) - generalized runtime or code generation signal
- [cargo-make](https://www.automicvault.com/pkg/brew/cargo-make/) - generalized runtime or code generation signal
- [cbmbasic](https://www.automicvault.com/pkg/brew/cbmbasic/) - generalized runtime or code generation signal
- [chaiscript](https://www.automicvault.com/pkg/brew/chaiscript/) - generalized runtime or code generation signal
- [chapel](https://www.automicvault.com/pkg/brew/chapel/) - broad file, network, media, or database tool signal
- [checkbashisms](https://www.automicvault.com/pkg/brew/checkbashisms/) - generalized runtime or code generation signal
- [chicken](https://www.automicvault.com/pkg/brew/chicken/) - generalized runtime or code generation signal
- [chuck](https://www.automicvault.com/pkg/brew/chuck/) - broad file, network, media, or database tool signal
- [clarinet](https://www.automicvault.com/pkg/brew/clarinet/) - generalized runtime or code generation signal
- [cling](https://www.automicvault.com/pkg/brew/cling/) - generalized runtime or code generation signal
- [clojure](https://www.automicvault.com/pkg/brew/clojure/) - generalized runtime or code generation signal
- [compiledb](https://www.automicvault.com/pkg/brew/compiledb/) - broad file, network, media, or database tool signal
- [conduit](https://www.automicvault.com/pkg/brew/conduit/) - broad file, network, media, or database tool signal
- [couchbase-shell](https://www.automicvault.com/pkg/brew/couchbase-shell/) - generalized runtime or code generation signal
- [cpi](https://www.automicvault.com/pkg/brew/cpi/) - generalized runtime or code generation signal
- [cpu_features](https://www.automicvault.com/pkg/brew/cpu-features/) - generalized runtime or code generation signal
- [crash](https://www.automicvault.com/pkg/brew/crash/) - generalized runtime or code generation signal
- [create-dmg](https://www.automicvault.com/pkg/brew/create-dmg/) - generalized runtime or code generation signal