Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.

ibelick/ui-skills

https://github.com/ibelick/ui-skills · scanned 2026-07-23 19:41 UTC (5 days, 22 hours ago)

49 raw signals (0 security + 49 graph)

File as issue Image

UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 5 days, 22 hours ago · v7 · 49 actionable findings from 1 signal source. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON

90.0% cov · 49 findings

Severity distribution — click a segment to filter

Active filters: excluding tests × Reset all

Severity: Critical 0 High 11 Medium 25 Low 12 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 49 Crowd 0 Layer: Security 26 Quality 6 Cicd 2 Dependencies 15

Exclude dismissed / FP Exclude test files

Scan summary Repository scanned at 70.4/100 with 90.0% coverage. It contains 174 nodes across 9 cross-layer flows, written primarily in mixed languages. Engine surfaced 49 findings — concentrated in security (26), dependencies (15), quality (6). Risk profile is high: 0 critical, 11 high, 25 medium. Recommended next step: open the security layer findings first — that's where the highest-impact wins live.

Showing 48 of 49 actionable findings. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

high System graph security Trivy conf 1.00 CVE-2026-12151: undici 7.14.0 — package-lock.json

undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream …

VulnCve 2026 12151

high System graph security Trivy conf 1.00 CVE-2026-1526: undici 7.14.0 — package-lock.json

undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a WebSocket connection negotia…

VulnCve 2026 1526

high System graph security Trivy conf 1.00 CVE-2026-1528: undici 7.14.0 — package-lock.json

undici: undici: Denial of Service via crafted WebSocket frame with large length ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that te…

VulnCve 2026 1528

high System graph security Trivy conf 1.00 CVE-2026-2229: undici 7.14.0 — package-lock.json

undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension. When a WebSocket clie…

VulnCve 2026 2229

high System graph security Trivy conf 1.00 CVE-2026-48779: ws 8.18.0 — package-lock.json

ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memor…

VulnCve 2026 48779

high System graph security Trivy conf 1.00 CVE-2026-50146: astro 5.18.2 — package-lock.json

Astro: Reflected XSS via unescaped slot name Astro is a web framework. Prior to 6.3.3, when a component uses a client:* directive, Astro inserts named slot content into a data-astro-template attribute without HTML escaping the slot name allowing an attacker to break out of the attribute context an…

VulnCve 2026 50146

high System graph security Trivy conf 1.00 CVE-2026-54299: astro 5.18.2 — package-lock.json

Astro: Host header SSRF in prerendered error page fetch Astro is a web framework. Prior to 6.4.6, Astro SSR apps with prerendered error pages (/404 or /500 using export const prerender = true) fetch those pages over HTTP at runtime when an error occurs. The URL for this fetch is derived from reque…

VulnCve 2026 54299

high System graph security Trivy conf 1.00 GHSA-f88m-g3jw-g9cj: sharp 0.34.5 — package-lock.json

sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 ### Impact A number of vulnerabilities, two rated as "High" severity using CVSSv4, have been discovered and fixed in the upstream libvips dependency. Those processing untrusted input with v…

VulnGhsa f88m g3jw g9cj

high System graph dependencies dependencies conf 1.00 Vulnerable dependency astro 5.18.2: GHSA-2pvr-wf23-7pc7

OSV.dev reports `astro` at version `5.18.2` (resolved in `package-lock.json`) is affected by GHSA-2pvr-wf23-7pc7 (aka CVE-2026-54299). Astro: Host header SSRF in prerendered error page fetch Aliases: CVE-2026-54299 Advisory: https://osv.dev/vulnerability/GHSA-2pvr-wf23-7pc7 Fix: upgrade `astro` p…

package.json ScaOsvGhsa 2pvr wf23 7pc7

high System graph dependencies dependencies conf 1.00 Vulnerable dependency astro 5.18.2: GHSA-8hv8-536x-4wqp

OSV.dev reports `astro` at version `5.18.2` (resolved in `package-lock.json`) is affected by GHSA-8hv8-536x-4wqp (aka CVE-2026-50146). Astro: Reflected XSS via unescaped slot name Aliases: CVE-2026-50146 Advisory: https://osv.dev/vulnerability/GHSA-8hv8-536x-4wqp Fix: upgrade `astro` past the aff…

package.json ScaOsvGhsa 8hv8 536x 4wqp

high System graph dependencies dependencies conf 0.90 Vulnerable dependency sharp 0.34.5: GHSA-f88m-g3jw-g9cj

OSV.dev reports `sharp` at version `0.34.5` (resolved in `package-lock.json`) is affected by GHSA-f88m-g3jw-g9cj. Note: `sharp` is a transitive dependency — pulled in by another package, not declared directly in a manifest. sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328…

package-lock.json ScaOsvGhsa f88m g3jw g9cj

medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: skills/baseline-ui/SKILL.md

This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.

skills/baseline-ui/SKILL.md VerificationSkill file

medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: skills/create-design-md/SKILL.md

skills/create-design-md/SKILL.md VerificationSkill file

medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: skills/improve-ui/SKILL.md

skills/improve-ui/SKILL.md VerificationSkill file

medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: skills/ui-skills-root/SKILL.md

skills/ui-skills-root/SKILL.md VerificationSkill file

medium System graph quality Placeholder conf 1.00 Critical user flow still appears backed by mock or placeholder data

A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded.

Mock dataCritical flowGenerated repo pattern

medium System graph security Trivy conf 1.00 CVE-2026-1525: undici 7.14.0 — package-lock.json

undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests w…

VulnCve 2026 1525

medium System graph security Trivy conf 1.00 CVE-2026-1527: undici 7.14.0 — package-lock.json

undici: Undici: HTTP header injection and request smuggling vulnerability ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to: * Inject arbitrary HTTP headers * Terminate the HTTP request premature…

VulnCve 2026 1527

medium System graph security Trivy conf 1.00 CVE-2026-22036: undici 7.14.0 — package-lock.json

undici: Undici: Denial of Service via excessive decompression steps Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leadin…

VulnCve 2026 22036

medium System graph security Trivy conf 1.00 CVE-2026-41067: astro 5.18.2 — package-lock.json

Astro: XSS in define:vars via incomplete </script> tag sanitization Astro is a web framework. Prior to 6.1.6, the defineScriptVars function in Astro's server-side rendering pipeline uses a case-sensitive regex /<\/script>/g to sanitize values injected into inline <script> tags via the define:vars …

VulnCve 2026 41067

medium System graph security Trivy conf 1.00 CVE-2026-45736: ws 8.18.0 — package-lock.json

ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray` ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument.…

VulnCve 2026 45736

medium System graph security Trivy conf 1.00 CVE-2026-54298: astro 5.18.2 — package-lock.json

Astro: XSS via Unescaped Attribute Names in Spread Props Astro is a web framework. Prior to 6.4.6, the spreadAttributes function in Astro's server-side rendering pipeline iterates over object keys and passes them directly to addAttribute, which interpolates the key into the HTML output without esc…

VulnCve 2026 54298

medium System graph security Trivy conf 1.00 CVE-2026-59729: astro 5.18.2 — package-lock.json

Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298) ## Summary The fix for CVE-2026-54298 (GHSA-jrpj-wcv7-9fh9) added an `INVALID_ATTR_NAME_CHAR` guard to `addAttribute()` so that spread-prop attribute names containing `"' >/=` or whitespace ar…

VulnCve 2026 59729

medium System graph security Trivy conf 1.00 CVE-2026-9678: undici 7.14.0 — package-lock.json

undici: Undici: Information disclosure due to improper cache-control header parsing Impact: Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-Control header uses whitespace-padded qualified private or no-cache field names such as private=" author…

VulnCve 2026 9678

medium System graph security Trivy conf 1.00 CVE-2026-9679: undici 7.14.0 — package-lock.json

undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding Impact: undici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into their literal byte equivalents. RFC 6265 §5.4 does not spe…

VulnCve 2026 9679

medium System graph dependencies dependencies conf 0.90 Dependency @astrojs/cloudflare is two or more major versions behind

`@astrojs/cloudflare` is pinned at `12.6.13` in `package.json` while the latest release on the npm registry is `14.1.4` — 2 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@astrojs/cloudfla…

package.json FreshnessOutdated

medium System graph dependencies dependencies conf 0.90 Dependency @astrojs/react is two or more major versions behind

`@astrojs/react` is pinned at `4.4.2` in `package.json` while the latest release on the npm registry is `6.0.1` — 2 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@astrojs/react` to `6.0.1…

package.json FreshnessOutdated

medium System graph dependencies dependencies conf 0.90 Dependency astro is two or more major versions behind

`astro` is pinned at `5.16.7` in `package.json` while the latest release on the npm registry is `7.1.3` — 2 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `astro` to `7.1.3`.

package.json FreshnessOutdated

medium System graph security Trivy conf 1.00 GHSA-4g3v-8h47-v7g6: astro 5.18.2 — package-lock.json

Astro: Reflected XSS via unescaped View Transition animation properties ## Summary Astro's server-side View Transition CSS generator interpolates animation properties into an inline `<style>` element without escaping them for the CSS and HTML contexts. An attacker-controlled value passed to an a…

VulnGhsa 4g3v 8h47 v7g6

medium System graph cicd CI/CD security conf 1.00 GitHub Actions workflow grants broad write permissions

CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions.

.github/workflows/release.yml CI/CD securitySupply chainGithub actions

medium System graph security Coverage conf 1.00 No auth library detected

The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing.

auth

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency astro 5.18.2: GHSA-4g3v-8h47-v7g6

OSV.dev reports `astro` at version `5.18.2` (resolved in `package-lock.json`) is affected by GHSA-4g3v-8h47-v7g6. Astro: Reflected XSS via unescaped View Transition animation properties Advisory: https://osv.dev/vulnerability/GHSA-4g3v-8h47-v7g6 Fix: upgrade `astro` past the affected range per th…

package.json ScaOsvGhsa 4g3v 8h47 v7g6

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency astro 5.18.2: GHSA-f48w-9m4c-m7f5

OSV.dev reports `astro` at version `5.18.2` (resolved in `package-lock.json`) is affected by GHSA-f48w-9m4c-m7f5 (aka CVE-2026-59729). Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298) Aliases: CVE-2026-59729 Advisory: https://osv.dev/vulnera…

package.json ScaOsvGhsa f48w 9m4c m7f5

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency astro 5.18.2: GHSA-j687-52p2-xcff

OSV.dev reports `astro` at version `5.18.2` (resolved in `package-lock.json`) is affected by GHSA-j687-52p2-xcff (aka CVE-2026-41067). Astro: XSS in define:vars via incomplete </script> tag sanitization Aliases: CVE-2026-41067 Advisory: https://osv.dev/vulnerability/GHSA-j687-52p2-xcff Fix: upgra…

package.json ScaOsvGhsa j687 52p2 xcff

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency astro 5.18.2: GHSA-jrpj-wcv7-9fh9

OSV.dev reports `astro` at version `5.18.2` (resolved in `package-lock.json`) is affected by GHSA-jrpj-wcv7-9fh9 (aka CVE-2026-54298). Astro: XSS via Unescaped Attribute Names in Spread Props Aliases: CVE-2026-54298 Advisory: https://osv.dev/vulnerability/GHSA-jrpj-wcv7-9fh9 Fix: upgrade `astro` …

package.json ScaOsvGhsa jrpj wcv7 9fh9

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency astro 5.18.2: GHSA-xr5h-phrj-8vxv

OSV.dev reports `astro` at version `5.18.2` (resolved in `package-lock.json`) is affected by GHSA-xr5h-phrj-8vxv (aka CVE-2026-45028). Astro: Server island encrypted parameters vulnerable to cross-component replay Aliases: CVE-2026-45028 Advisory: https://osv.dev/vulnerability/GHSA-xr5h-phrj-8vxv…

package.json ScaOsvGhsa xr5h phrj 8vxv

low System graph security Trivy conf 1.00 CVE-2026-11525: undici 7.14.0 — package-lock.json

undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC…

VulnCve 2026 11525

low System graph security Trivy conf 1.00 CVE-2026-41321: @astrojs/cloudflare 12.6.13 — package-lock.json

Cloudflare has SSRF via redirect following through its image-binding-transform endpoint (incomplete fix for GHSA-qpr4) @astrojs/cloudflare is an SSR adapter for use with Cloudflare Workers targets. Prior to 13.1.10, the fetch() call for remote images in packages/integrations/cloudflare/src/utils/i…

VulnCve 2026 41321

low System graph security Trivy conf 1.00 CVE-2026-45028: astro 5.18.2 — package-lock.json

Astro: Server island encrypted parameters vulnerable to cross-component replay Astro is a web framework. Astro versions prior to 6.1.10 used AES-GCM encryption to protect the confidentiality and integrity of server island props and slots parameters, but did not bind the ciphertext to its intended …

VulnCve 2026 45028

low System graph security Trivy conf 1.00 CVE-2026-59727: astro 5.18.2 — package-lock.json

Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands ### Summary When a `transition:persist`, `transition:scope`, or `transition:persist-props` directive is applied to a client-hydrated (`client:*`) component, Astro copied the directive value onto the render…

VulnCve 2026 59727

low System graph security Trivy conf 1.00 CVE-2026-6733: undici 7.14.0 — package-lock.json

undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. Impact: Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response…

VulnCve 2026 6733

low System graph dependencies dependencies conf 0.90 Dependency marked is a major version behind

`marked` is pinned at `17.0.1` in `package.json` while the latest release on the npm registry is `18.0.7` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `marked` to `18.0.7`.

package.json FreshnessOutdated

low System graph security Trivy conf 1.00 GHSA-g7r4-m6w7-qqqr: esbuild 0.27.7 — package-lock.json

esbuild allows arbitrary file read when running the development server on Windows ### Summary The development server contains a path traversal vulnerability on Windows when serving files from `servedir`. Due to the use of `path.Clean()` (which only normalizes forward-slash `/` separators) instea…

VulnGhsa g7r4 m6w7 qqqr

low System graph cicd CI/CD security conf 1.00 GitHub Action is tag-pinned rather than SHA-pinned

actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.

.github/workflows/release.yml:17 CI/CD securitySupply chainGithub actions

low System graph quality Tests conf 1.00 Low test-to-source ratio

4 tests / 20 src (ratio 0.20).

low System graph dependencies dependencies conf 1.00 Vulnerable dependency @astrojs/cloudflare 12.6.13: GHSA-88gm-j2wx-58h6

OSV.dev reports `@astrojs/cloudflare` at version `12.6.13` (resolved in `package-lock.json`) is affected by GHSA-88gm-j2wx-58h6 (aka CVE-2026-41321). Cloudflare has SSRF via redirect following through its image-binding-transform endpoint (incomplete fix for GHSA-qpr4) Aliases: CVE-2026-41321 Advi…

package.json ScaOsvGhsa 88gm j2wx 58h6

low System graph dependencies dependencies conf 1.00 Vulnerable dependency astro 5.18.2: GHSA-7pw4-f3q4-r2p2

OSV.dev reports `astro` at version `5.18.2` (resolved in `package-lock.json`) is affected by GHSA-7pw4-f3q4-r2p2 (aka CVE-2026-59727). Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands Aliases: CVE-2026-59727 Advisory: https://osv.dev/vulnerability/GHSA-7…

package.json ScaOsvGhsa 7pw4 f3q4 r2p2

low System graph dependencies dependencies conf 0.90 Vulnerable dependency esbuild 0.27.7: GHSA-g7r4-m6w7-qqqr

OSV.dev reports `esbuild` at version `0.27.7` (resolved in `package-lock.json`) is affected by GHSA-g7r4-m6w7-qqqr. Note: `esbuild` is a transitive dependency — pulled in by another package, not declared directly in a manifest. esbuild allows arbitrary file read when running the development server…

package-lock.json ScaOsvGhsa g7r4 m6w7 qqqr

For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.

For AI agents + API integrations

Email me when this repo regresses

Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.

API access

This page is publicly accessible at: https://repobility.com/scan/1c46d1ef-57dc-49b4-876a-2ca5bfba906d/

To check status programmatically (no auth required):

curl -s https://repobility.com/api/v1/public/scan/1c46d1ef-57dc-49b4-876a-2ca5bfba906d/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.