PurpleDoubleD/ locally-uncensored
score capped at 25 — 3,037 stars — findings likely legitimate code patterns
FINDINGS ░▒▓
what this code does░▒▓
What happens when you open, install or run it, from the findings below.
- when runsetup.sh downloads a script from ollama.com and pipes it to the shell. setup.sh:95
- when runsrc-tauri/src/commands/abliterate/mod.rs and 2 other files start system processes. src-tauri/src/commands/abliterate/mod.rs, src-tauri/src/commands/computer/desk/platform/macos.rs, src-tauri/src/commands/gpu_roles.rs
- when runsrc-tauri/src/commands/agent.rs and 2 other files reference SSH key or cloud credential paths (such as ~/.ssh or ~/.aws/credentials). src-tauri/src/commands/agent.rs, src/lib/dev-fs-jail.ts, src/lib/voice/work-scope.ts
- when runsrc-tauri/plugins/lu-native/src/commands.rs and 2 other files read the clipboard. src-tauri/plugins/lu-native/src/commands.rs, src/lib/lu-native.ts, src/mobile/platform/clipboard.ts
json() { # Datei, Pfad als JS-Ausdruck hinter dem Objekt
node -e 'const o=JSON.parse(require("fs").readFileSync(process.argv[1],"utf8"));console.log(eval("o"+process.argv[2]))' "$1" "$2"
}
+8 set_phase("quantize", &format!("Quantizing to {q}"));
let mut cmd = Command::new(bin);
cmd.arg(&converted).arg(&partial).arg(q);
run_python(cmd, "quantize", |_| {})?;+8 }
let _ = std::process::Command::new("/usr/bin/open").arg(settings_url(permission)).spawn();
}
+8pub fn env_of(selection: &GpuSelection) -> Vec<String> {
let mut cmd = std::process::Command::new("lu-gpu-plan-never-run");
crate::commands::gpu::apply_gpu_env(&mut cmd, selection);
let mu...+8echo. powershell -NoProfile -Command ^ "Write-Host '';Write-Host ' +---------------------------------------------------------------+' -F Yellow;Write-Host ' | This script starts Locally Uncens...+5
echo " macOS: brew install node"
echo " Ubuntu: curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash - && sudo apt install -y nodejs"
echo " Arch: sudo pacman ...+10 source = inspect.getsource(tools)
for banned in ("subprocess", "os.system", "os.popen", "exec(", "eval(", "open(", "importlib", "__import__", "pty", "shutil"):
assert banned not in sou...+8 source = inspect.getsource(tools)
for banned in ("subprocess", "os.system", "os.popen", "exec(", "eval(", "open(", "importlib", "__import__", "pty", "shutil"):
assert banned not in sou...+7/// app (`willPerformHTTPRedirection` is not called for it). A public address
/// answering `302 Location: https://192.168.1.1/...` would be followed. So
/// before a download is handed to the system,...+5/// reqwest's default policy follows up to 10 redirects and checks nothing on the /// way, so a public URL answering `302 Location: http://169.254.169.254/…` (or /// `http://127.0.0.1:11434/…`) reache...+5
for url in [
"http://127.0.0.1:8127/", "http://localhost/", "http://192.168.1.1/", "http://10.0.0.1/",
"http://172.16.0.1/", "http://169.254.169.254/latest/meta-data/",...+5 fetched.push('/__probe-image.png')
return route.fulfill({ status: 200, contentType: 'image/png', body: Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8BQDwAE...+2/// /// The webview cannot do this on a phone: `navigator.clipboard.readText()` /// is refused in the Android WebView (NotAllowedError, seen on the /// emulator), so every "Paste" button was dead ther...+4
/// bridge (`remote.rs`, `#[serde(rename = "chatId")]`), so a paired device could /// read `~/.ssh` / `~/.aws` and write shell rc files or LaunchAgents, i.e. code /// execution at next login without e...+5
for (const rel of [
'.ssh', '.aws', '.gnupg', '.kube', '.docker', '.config', '.lu',
'Library/Keychains', 'AppData',
]) {+5// The clipboard of the system, asked directly. The Android WebView refuses // `navigator.clipboard.readText()` (NotAllowedError), so "Paste" needs this. // On iOS the system asks "Allow Paste" once f...+4
* Read from the text of the command, so it catches what a model writes when * it means to leave (`cat ~/.ssh/id_rsa`, `cd ..`, `ls /etc`) and not what a * program does once it runs. The executable ...+5
if (typeof navigator !== 'undefined' && navigator.clipboard && typeof navigator.clipboard.readText === 'function') {
const text = await navigator.clipboard.readText()
return text ? { s...+4iVBORw0KGgoAAAANSUhEUgAAAEAAAAAwCAIAAAAuKetIAAAAQ0lEQVR42u3P...+0
GkXfo59ChoEBQveBAULygQRC84EIQoKEd2VibUKHgQJChYECGFOAZwEAAAAA...+3
iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8...+0
iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk...+0
GkXfo59ChoEBQveBAULygQRC84EIQoKEd2VibUKHgQJChYECGFOAZwEAAAAA...+3
Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.
2431 files scanned @ 5c9c444 | 10/30/2026 | heuristic scan — always review manually
github
PurpleDoubleD/locally-uncensored
The all-in-one local AI studio for your desktop: chat, image and video generation and a coding agent in one free, open source app. Windows and Linux. No Docker, no terminal, no cloud required.
network indicators░▒▓
Hosts this code names or would connect to. Top 50 of 461, decoded and call-site destinations first. Informational, not scored.
- https://ollama.com/install.shurlnext to execsetup.sh:95 +4 more
- https://api.indexnow.org/IndexNowurlnext to network calldocs/scripts/ping-indexnow.sh:30
- https://deb.nodesource.com/setup_22.xurlnext to network callsetup.sh:65
- https://github.com/comfyanonymous/ComfyUI.giturlnext to execdev-server/comfy.ts:440 +1 more
- https://download.pytorch.org/whl/cu121urlnext to execdev-server/comfy.ts:479
- https://ollama.com/download/linuxurlnext to execsrc-tauri/src/commands/install/ollama.rs:317
- https://api.github.com/repos/$urlnext to network callscripts/enforce-prerelease.mjs:42 +2 more
- https://locallyuncensored.comurldocs/scripts/ping-indexnow.sh:7 +1 more
- https://github.com/ggml-org/llama.cpp.giturlscripts/build-llama.sh:57 +1 more
- https://www.apple.com/certificateauthority/urlscripts/macos-release-signing.sh:94 +1 more
- https://a.b/curlscripts/mobile/native-guard-tests.sh:254 +4 more
- http://a.b/curlscripts/mobile/native-guard-tests.sh:255 +1 more
- https://ollama.com/$urlsetup.sh:92
- com.example.appdomainscripts/mobile/native-guard-tests.sh:258 +4 more
- https://ollama.com/downloadurldev-server/ollama.ts:40
- https://api.search.brave.com/res/v1/web/searchurldev-server/web-search.ts:295 +1 more
- https://translate.google.com/translate_a/element.jsurldocs/assets/lu.js:196
- https://lu-labs.ai/appurldocs/assets/lu.js:292
- https://lu-labs.ai/api/lorasurlnext to network calltest onlye2e/cloud-character-download.spec.ts:65 +3 more
- https://lu-labs.ai/api/jobsurlnext to network calltest onlye2e/cloud-create-in-chat.spec.ts:48 +1 more
- https://lu-labs.ai/api/jobs/job-e2e-1/cancelurlnext to network calltest onlye2e/cloud-create-in-chat.spec.ts:54 +2 more
- https://lu-labs.ai/api/jobs/job-e2e-1urlnext to network calltest onlye2e/cloud-create-in-chat.spec.ts:60 +4 more
- https://lu-labs.ai/api/jobs/uploadurlnext to network calltest onlye2e/create-batch-edit.spec.ts:26 +1 more
- https://lu-labs.ai/api/jobs/job-batch-urlnext to network calltest onlye2e/create-batch-edit.spec.ts:44
- https://lu-labs.ai/howto/*.mp4urlnext to network calltest onlye2e/howto/entry-local.spec.ts:35 +2 more
- https://lu-labs.ai/api/jobs/catalogurlnext to network calltest onlye2e/howto/no-price.ts:81 +2 more
- https://lu-labs.ai/api/jobs/quotaurlnext to network calltest onlye2e/howto/no-price.ts:85 +1 more
- https://lu-labs.ai/api/jobs/studio-quoteurlnext to network calltest onlye2e/howto/public-catalog.ts:195
- https://lu-labs.ai/api/meurlnext to network calltest onlye2e/mobile/iap-support.ts:63
- https://lu-labs.ai/api/inference/v1/modelsurlnext to network calltest onlye2e/mobile/store-waechter.mobile.ts:111
- https://lu-labs.ai/api/account/content-policyurlnext to network calltest onlye2e/mobile/store-waechter.mobile.ts:117
- https://huggingface.co/api/models/*/*/tree/mainurlnext to network calltest onlye2e/mobile/store-waechter.mobile.ts:825
- https://lu-labs.ai/androidurlmobile-client/client.js:647
- https://lu-labs.ai/pricingurlmobile-tests/lib/selbsttest-ohne-geraet.mjs:364 +6 more
- https://play.google.com/store/apps/detailsurlpublic/webview-check.js:24
- https://huggingface.co/$urlscripts/fetch-gguf-head.mjs:33 +12 more
- https://lu-labs.ai/api/download/windowsurlscripts/release-rules.mjs:16
- https://pipelineconnector.connectors.signpath.io/GitHubActions/GitHubComurlscripts/signpath-stages.mjs:65
- https://github.comurlscripts/signpath-stages.mjs:314 +1 more
- https://api.github.comurlscripts/signpath-stages.mjs:379
- https://locallyuncensored.com/$urlscripts/site-publish-date.mjs:59
- https://docs.rs/regex/latest/regex/urlsrc-tauri/gen/schemas/acl-manifests.json:1 +3 more
- https://urlpattern.spec.whatwg.orgurlsrc-tauri/gen/schemas/desktop-schema.json:114 +2 more
- https://mydomain.dev/api/urlsrc-tauri/gen/schemas/desktop-schema.json:114 +2 more
- https://huggingface.co/Systran/faster-whisper-base.enurlsrc-tauri/resources/voice_loop/models.json:10 +1 more
- https://huggingface.co/Systran/faster-whisper-base.en/resolve/…/config.jsonurlsrc-tauri/resources/voice_loop/models.json:17
- https://huggingface.co/Systran/faster-whisper-base.en/resolve/…/model.binurlsrc-tauri/resources/voice_loop/models.json:23
- https://huggingface.co/Systran/faster-whisper-base.en/resolve/…/tokenizer.jsonurlsrc-tauri/resources/voice_loop/models.json:29
- https://huggingface.co/Systran/faster-whisper-base.en/resolve/…/vocabulary.txturlsrc-tauri/resources/voice_loop/models.json:35
- https://huggingface.co/kyutai/pocket-tts-without-voice-cloningurlsrc-tauri/resources/voice_loop/models.json:46 +16 more