Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.

ibelick/ui-skills

https://github.com/ibelick/ui-skills · scanned 2026-07-23 19:41 UTC (3 months ago)

49 raw signals (0 security + 49 graph)

File as issue Image

UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 3 months ago · v7 · 49 actionable findings from 1 signal source. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON

90.0% cov · 49 findings

Severity distribution — click a segment to filter

Active filters: severity: high × excluding tests × Reset all

Severity: Critical 0 High 11 Medium 25 Low 12 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 49 Crowd 0 Layer: Security 26 Quality 6 Cicd 2 Dependencies 15

Exclude dismissed / FP Exclude test files

Scan summary Repository scanned at 70.4/100 with 90.0% coverage. It contains 174 nodes across 9 cross-layer flows, written primarily in mixed languages. Engine surfaced 49 findings — concentrated in security (26), dependencies (15), quality (6). Risk profile is high: 0 critical, 11 high, 25 medium. Recommended next step: open the security layer findings first — that's where the highest-impact wins live.

Showing 11 of 49 actionable findings. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

high System graph security Trivy conf 1.00 CVE-2026-12151: undici 7.14.0 — package-lock.json

undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream …

VulnCve 2026 12151

high System graph security Trivy conf 1.00 CVE-2026-1526: undici 7.14.0 — package-lock.json

undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a WebSocket connection negotia…

VulnCve 2026 1526

high System graph security Trivy conf 1.00 CVE-2026-1528: undici 7.14.0 — package-lock.json

undici: undici: Denial of Service via crafted WebSocket frame with large length ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that te…

VulnCve 2026 1528

high System graph security Trivy conf 1.00 CVE-2026-2229: undici 7.14.0 — package-lock.json

undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension. When a WebSocket clie…

VulnCve 2026 2229

high System graph security Trivy conf 1.00 CVE-2026-48779: ws 8.18.0 — package-lock.json

ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memor…

VulnCve 2026 48779

high System graph security Trivy conf 1.00 CVE-2026-50146: astro 5.18.2 — package-lock.json

Astro: Reflected XSS via unescaped slot name Astro is a web framework. Prior to 6.3.3, when a component uses a client:* directive, Astro inserts named slot content into a data-astro-template attribute without HTML escaping the slot name allowing an attacker to break out of the attribute context an…

VulnCve 2026 50146

high System graph security Trivy conf 1.00 CVE-2026-54299: astro 5.18.2 — package-lock.json

Astro: Host header SSRF in prerendered error page fetch Astro is a web framework. Prior to 6.4.6, Astro SSR apps with prerendered error pages (/404 or /500 using export const prerender = true) fetch those pages over HTTP at runtime when an error occurs. The URL for this fetch is derived from reque…

VulnCve 2026 54299

high System graph security Trivy conf 1.00 GHSA-f88m-g3jw-g9cj: sharp 0.34.5 — package-lock.json

sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 ### Impact A number of vulnerabilities, two rated as "High" severity using CVSSv4, have been discovered and fixed in the upstream libvips dependency. Those processing untrusted input with v…

VulnGhsa f88m g3jw g9cj

high System graph dependencies dependencies conf 1.00 Vulnerable dependency astro 5.18.2: GHSA-2pvr-wf23-7pc7

OSV.dev reports `astro` at version `5.18.2` (resolved in `package-lock.json`) is affected by GHSA-2pvr-wf23-7pc7 (aka CVE-2026-54299). Astro: Host header SSRF in prerendered error page fetch Aliases: CVE-2026-54299 Advisory: https://osv.dev/vulnerability/GHSA-2pvr-wf23-7pc7 Fix: upgrade `astro` p…

package.json ScaOsvGhsa 2pvr wf23 7pc7

high System graph dependencies dependencies conf 1.00 Vulnerable dependency astro 5.18.2: GHSA-8hv8-536x-4wqp

OSV.dev reports `astro` at version `5.18.2` (resolved in `package-lock.json`) is affected by GHSA-8hv8-536x-4wqp (aka CVE-2026-50146). Astro: Reflected XSS via unescaped slot name Aliases: CVE-2026-50146 Advisory: https://osv.dev/vulnerability/GHSA-8hv8-536x-4wqp Fix: upgrade `astro` past the aff…

package.json ScaOsvGhsa 8hv8 536x 4wqp

high System graph dependencies dependencies conf 0.90 Vulnerable dependency sharp 0.34.5: GHSA-f88m-g3jw-g9cj

OSV.dev reports `sharp` at version `0.34.5` (resolved in `package-lock.json`) is affected by GHSA-f88m-g3jw-g9cj. Note: `sharp` is a transitive dependency — pulled in by another package, not declared directly in a manifest. sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328…

package-lock.json ScaOsvGhsa f88m g3jw g9cj

For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.

For AI agents + API integrations

Email me when this repo regresses

Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.

API access

This page is publicly accessible at: https://repobility.com/scan/1c46d1ef-57dc-49b4-876a-2ca5bfba906d/

To check status programmatically (no auth required):

curl -s https://repobility.com/api/v1/public/scan/1c46d1ef-57dc-49b4-876a-2ca5bfba906d/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.