{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-19fb410b6f71ef9b", "name": "CVE-2026-41321: @astrojs/cloudflare 12.6.13 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-41321: @astrojs/cloudflare 12.6.13 \u2014 package-lock.json"}, "fullDescription": {"text": "Cloudflare has SSRF via redirect following through its image-binding-transform endpoint (incomplete fix for GHSA-qpr4)\n\n@astrojs/cloudflare is an SSR adapter for use with Cloudflare Workers targets. Prior to 13.1.10, the fetch() call for remote images in packages/integrations/cloudflare/src/utils/image-binding-transform.ts uses the default redirect: 'follow' behavior. This allows the Cloudflare Worker to follow HTTP redirects to arbitrary URLs, bypassing the isRemoteAllowed() domain allowlist check which only validates the initial URL. This vulnerabiity is caused by an incomplete fix for CVE-2025-58179. This vuln\n\nPackage: @astrojs/cloudflare\nInstalled: 12.6.13\nFixed in: 13.1.10\nSeverity: LOW\nFix: Upgrade @astrojs/cloudflare to 13.1.10"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1da231e583257116", "name": "CVE-2026-50146: astro 5.18.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-50146: astro 5.18.2 \u2014 package-lock.json"}, "fullDescription": {"text": "Astro: Reflected XSS via unescaped slot name\n\nAstro is a web framework. Prior to 6.3.3, when a component uses a client:* directive, Astro inserts named slot content into a data-astro-template attribute without HTML escaping the slot name allowing an attacker to break out of the attribute context and inject arbitrary HTML, resulting in reflected XSS during SSR. This vulnerability is fixed in 6.3.3.\n\nPackage: astro\nInstalled: 5.18.2\nFixed in: 6.3.3\nSeverity: HIGH\nFix: Upgrade astro to 6.3.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f364e94843093d09", "name": "CVE-2026-54299: astro 5.18.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-54299: astro 5.18.2 \u2014 package-lock.json"}, "fullDescription": {"text": "Astro: Host header SSRF in prerendered error page fetch\n\nAstro is a web framework. Prior to 6.4.6, Astro SSR apps with prerendered error pages (/404 or /500 using export const prerender = true) fetch those pages over HTTP at runtime when an error occurs. The URL for this fetch is derived from request.url, which in turn gets its origin from the incoming Host header. When the Host header is not validated against allowedDomains, an attacker can point the fetch at an arbitrary host and read the response. This vulnerability is fixed in 6.4.6.\n\nPackage: astro\nInstalled: 5.18.2\nFixed in: 6.4.6\nSeverity: HIGH\nFix: Upgrade astro to 6.4.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f5a950e9afe91e47", "name": "CVE-2026-41067: astro 5.18.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-41067: astro 5.18.2 \u2014 package-lock.json"}, "fullDescription": {"text": "Astro: XSS in define:vars via incomplete </script> tag sanitization\n\nAstro is a web framework. Prior to 6.1.6, the defineScriptVars function in Astro's server-side rendering pipeline uses a case-sensitive regex /<\\/script>/g to sanitize values injected into inline <script> tags via the define:vars directive. HTML parsers close <script> elements case-insensitively and also accept whitespace or / before the closing >, allowing an attacker to bypass the sanitization with payloads like </Script>, </script >, or </script/> and inject arbitrary HTML/JavaScript. This vu\n\nPackage: astro\nInstalled: 5.18.2\nFixed in: 6.1.6\nSeverity: MEDIUM\nFix: Upgrade astro to 6.1.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-15fa7555c28626f1", "name": "CVE-2026-54298: astro 5.18.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-54298: astro 5.18.2 \u2014 package-lock.json"}, "fullDescription": {"text": "Astro: XSS via Unescaped Attribute Names in Spread Props\n\nAstro is a web framework. Prior to 6.4.6, the spreadAttributes function in Astro's server-side rendering pipeline iterates over object keys and passes them directly to addAttribute, which interpolates the key into the HTML output without escaping. When a developer uses the spread syntax {...props} on an HTML element and the object keys come from an untrusted source (API, CMS, URL parameters), an attacker can inject arbitrary HTML attributes including event handlers like onmousemove, onclick, or \n\nPackage: astro\nInstalled: 5.18.2\nFixed in: 6.4.6\nSeverity: MEDIUM\nFix: Upgrade astro to 6.4.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-88e029e5a26fb226", "name": "CVE-2026-59729: astro 5.18.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-59729: astro 5.18.2 \u2014 package-lock.json"}, "fullDescription": {"text": "Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)\n\n## Summary\n\nThe fix for CVE-2026-54298 (GHSA-jrpj-wcv7-9fh9) added an `INVALID_ATTR_NAME_CHAR` guard to `addAttribute()` so that spread-prop attribute names containing `\"' >/=` or whitespace are dropped. A second attribute-rendering path, `renderHTMLElement()` in `packages/astro/src/runtime/server/render/dom.ts`, has its own inline attribute loop that does not go through `addAttribute()` and was not updated. It interpolates the attribute name unescaped and only escapes the value, so untrusted pr\n\nPackage: astro\nInstalled: 5.18.2\nFixed in: 7.0.6\nSeverity: MEDIUM\nFix: Upgrade astro to 7.0.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4b28269afe8b5070", "name": "GHSA-4g3v-8h47-v7g6: astro 5.18.2 \u2014 package-lock.json", "shortDescription": {"text": "GHSA-4g3v-8h47-v7g6: astro 5.18.2 \u2014 package-lock.json"}, "fullDescription": {"text": "Astro: Reflected XSS via unescaped View Transition animation properties\n\n## Summary\n\nAstro's server-side View Transition CSS generator interpolates animation properties into an inline `<style>` element without escaping them for the CSS and HTML contexts.\n\nAn attacker-controlled value passed to an animation property such as `duration` can contain a `</style>` sequence, terminate the generated style element, and inject arbitrary HTML or JavaScript.\n\nThis is similar to GHSA-8hv8-536x-4wqp, but exploits a different injection point: unescaped View Transition animation val\n\nPackage: astro\nInstalled: 5.18.2\nFixed in: 7.1.0\nSeverity: MEDIUM\nFix: Upgrade astro to 7.1.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-eb211a1b96b6addd", "name": "CVE-2026-45028: astro 5.18.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-45028: astro 5.18.2 \u2014 package-lock.json"}, "fullDescription": {"text": "Astro: Server island encrypted parameters vulnerable to cross-component replay\n\nAstro is a web framework. Astro versions prior to 6.1.10 used AES-GCM encryption to protect the confidentiality and integrity of server island props and slots parameters, but did not bind the ciphertext to its intended component or parameter type. An attacker could replay one component's encrypted props (p) value as another component's slots (s) value, or vice versa. Since slots contain raw unescaped HTML while props may contain user-controlled values, this could lead to XSS in applications. Thi\n\nPackage: astro\nInstalled: 5.18.2\nFixed in: 6.1.10\nSeverity: LOW\nFix: Upgrade astro to 6.1.10"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fd470b05b74a3aa6", "name": "CVE-2026-59727: astro 5.18.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-59727: astro 5.18.2 \u2014 package-lock.json"}, "fullDescription": {"text": "Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands\n\n### Summary\n\nWhen a `transition:persist`, `transition:scope`, or `transition:persist-props` directive is applied to a client-hydrated (`client:*`) component, Astro copied the directive value onto the rendered `<astro-island>` element **without HTML-escaping it**. If a developer reflects attacker-controlled input into one of these directives, an attacker can break out of the attribute and inject arbitrary HTML/JavaScript into the server-rendered output, resulting in reflected cross-site scripting\n\nPackage: astro\nInstalled: 5.18.2\nFixed in: 7.0.4\nSeverity: LOW\nFix: Upgrade astro to 7.0.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1f3b6fac697d7180", "name": "GHSA-g7r4-m6w7-qqqr: esbuild 0.27.7 \u2014 package-lock.json", "shortDescription": {"text": "GHSA-g7r4-m6w7-qqqr: esbuild 0.27.7 \u2014 package-lock.json"}, "fullDescription": {"text": "esbuild allows arbitrary file read when running the development server on Windows\n\n### Summary\n\nThe development server contains a path traversal vulnerability on Windows when serving files from `servedir`.\n\nDue to the use of `path.Clean()` (which only normalizes forward-slash `/` separators) instead of a Windows-aware path normalization function, it is possible to craft requests using backslashes (`\\`) that bypass the intended directory containment logic. An attacker can escape the configured `servedir` root and access arbitrary files on the filesystem.\nThis issue affects Wind\n\nPackage: esbuild\nInstalled: 0.27.7\nFixed in: 0.28.1\nSeverity: LOW\nFix: Upgrade esbuild to 0.28.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-696edaf1bfda3eab", "name": "GHSA-f88m-g3jw-g9cj: sharp 0.34.5 \u2014 package-lock.json", "shortDescription": {"text": "GHSA-f88m-g3jw-g9cj: sharp 0.34.5 \u2014 package-lock.json"}, "fullDescription": {"text": "sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591\n\n### Impact\n\nA number of vulnerabilities, two rated as \"High\" severity using CVSSv4, have been discovered and fixed in the upstream libvips dependency.\n\nThose processing untrusted input with versions of sharp prior to 0.35.0 are affected.\n\n### Patches\n\n#### Using prebuilt binaries provided by sharp?\n\nMost people rely on the prebuilt binaries provided by sharp.\n\nPlease upgrade sharp to the latest version, currently 0.35.3, which provides libvips 8.18.3.\n\n#### Using a globally-installed libvips?\n\nP\n\nPackage: sharp\nInstalled: 0.34.5\nFixed in: 0.35.0\nSeverity: HIGH\nFix: Upgrade sharp to 0.35.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-86e7197a8a1ee69a", "name": "CVE-2026-12151: undici 7.14.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-12151: undici 7.14.0 \u2014 package-lock.json"}, "fullDescription": {"text": "undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames\n\nImpact:\nThe undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service.\n\nAffected applications are those using the undici WebSocket client\n\nPackage: undici\nInstalled: 7.14.0\nFixed in: 6.27.0, 7.28.0, 8.5.0\nSeverity: HIGH\nFix: Upgrade undici to 6.27.0, 7.28.0, 8.5.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4915ef4e3455f006", "name": "CVE-2026-1526: undici 7.14.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-1526: undici 7.14.0 \u2014 package-lock.json"}, "fullDescription": {"text": "undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression\n\nThe undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a WebSocket connection negotiates the permessage-deflate extension, the client decompresses incoming compressed frames without enforcing any limit on the decompressed data size. A malicious WebSocket server can send a small compressed frame (a \"decompression bomb\") that expands to an extremely large size in memory, causing the Node.js process to e\n\nPackage: undici\nInstalled: 7.14.0\nFixed in: 6.24.0, 7.24.0\nSeverity: HIGH\nFix: Upgrade undici to 6.24.0, 7.24.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d7b98983ef71bc52", "name": "CVE-2026-1528: undici 7.14.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-1528: undici 7.14.0 \u2014 package-lock.json"}, "fullDescription": {"text": "undici: undici: Denial of Service via crafted WebSocket frame with large length\n\nImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process.\n\nPatches\n\nPatched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.\n\nPackage: undici\nInstalled: 7.14.0\nFixed in: 6.24.0, 7.24.0\nSeverity: HIGH\nFix: Upgrade undici to 6.24.0, 7.24.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3d7f798a91910b84", "name": "CVE-2026-2229: undici 7.14.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-2229: undici 7.14.0 \u2014 package-lock.json"}, "fullDescription": {"text": "undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter\n\nImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the\u00a0server_max_window_bits\u00a0parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatically advertises support for permessage-deflate compression. A malicious server can respond with an out-of-range\u00a0server_max_window_bits\u00a0value (outside zlib's valid range of 8-15). When the server subsequently sends a compressed frame, the client attempts to cre\n\nPackage: undici\nInstalled: 7.14.0\nFixed in: 6.24.0, 7.24.0\nSeverity: HIGH\nFix: Upgrade undici to 6.24.0, 7.24.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b72773bca899d00f", "name": "CVE-2026-1525: undici 7.14.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-1525: undici 7.14.0 \u2014 package-lock.json"}, "fullDescription": {"text": "undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers\n\nUndici allows duplicate HTTP\u00a0Content-Length\u00a0headers when they are provided in an array with case-variant names (e.g.,\u00a0Content-Length\u00a0and\u00a0content-length). This produces malformed HTTP/1.1 requests with multiple conflicting\u00a0Content-Length\u00a0values on the wire.\n\nWho is impacted:\n\n  *  Applications using\u00a0undici.request(),\u00a0undici.Client, or similar low-level APIs with headers passed as flat arrays\n  *  Applications that accept user-controlled header names without case-normalization\n\n\nPotential conseque\n\nPackage: undici\nInstalled: 7.14.0\nFixed in: 6.24.0, 7.24.0\nSeverity: MEDIUM\nFix: Upgrade undici to 6.24.0, 7.24.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a03d5f735d14f201", "name": "CVE-2026-1527: undici 7.14.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-1527: undici 7.14.0 \u2014 package-lock.json"}, "fullDescription": {"text": "undici: Undici: HTTP header injection and request smuggling vulnerability\n\nImpactWhen an application passes user-controlled input to the\u00a0upgrade\u00a0option of\u00a0client.request(), an attacker can inject CRLF sequences (\\r\\n) to:\n\n  *  Inject arbitrary HTTP headers\n  *  Terminate the HTTP request prematurely and smuggle raw data to non-HTTP services (Redis, Memcached, Elasticsearch)\nThe vulnerability exists because undici writes the\u00a0upgrade\u00a0value directly to the socket without validating for invalid header characters:\n\n// lib/dispatcher/client-h1.js:1121\nif (upgrade) {\n  heade\n\nPackage: undici\nInstalled: 7.14.0\nFixed in: 6.24.0, 7.24.0\nSeverity: MEDIUM\nFix: Upgrade undici to 6.24.0, 7.24.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cb37d03914225bec", "name": "CVE-2026-22036: undici 7.14.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-22036: undici 7.14.0 \u2014 package-lock.json"}, "fullDescription": {"text": "undici: Undici: Denial of Service via excessive decompression steps\n\nUndici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation. This vulnerability is fixed in 7.18.0 and 6.23.0.\n\nPackage: undici\nInstalled: 7.14.0\nFixed in: 7.18.2, 6.23.0\nSeverity: MEDIUM\nFix: Upgrade undici to 7.18.2, 6.23.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7d010cb450132f01", "name": "CVE-2026-9678: undici 7.14.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-9678: undici 7.14.0 \u2014 package-lock.json"}, "fullDescription": {"text": "undici: Undici: Information disclosure due to improper cache-control header parsing\n\nImpact:\nUndici's cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-Control header uses whitespace-padded qualified private or no-cache field names such as private=\" authorization\" or no-cache=\"\\tauthorization\". The parser preserves the surrounding whitespace, so later comparisons against the literal authorization field name fail and the response is stored.\n\nIn shared-cache mode, this allows a response containing one user's authenticated data to be serve\n\nPackage: undici\nInstalled: 7.14.0\nFixed in: 7.28.0, 8.5.0\nSeverity: MEDIUM\nFix: Upgrade undici to 7.28.0, 8.5.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d6e859dfa6e8de99", "name": "CVE-2026-9679: undici 7.14.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-9679: undici 7.14.0 \u2014 package-lock.json"}, "fullDescription": {"text": "undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding\n\nImpact:\nundici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into their literal byte equivalents. RFC 6265 \u00a75.4 does not specify any decoding and browsers do not decode either.\n\nApplications that parse a Set-Cookie header and then forward the parsed value into a response header (proxies, middleware, SSR frameworks) become vulnerable to HTTP response header injection: an attacker-controlled upstream can inj\n\nPackage: undici\nInstalled: 7.14.0\nFixed in: 6.27.0, 7.28.0, 8.5.0\nSeverity: MEDIUM\nFix: Upgrade undici to 6.27.0, 7.28.0, 8.5.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-47cdff4c8e1fd2dd", "name": "CVE-2026-11525: undici 7.14.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-11525: undici 7.14.0 \u2014 package-lock.json"}, "fullDescription": {"text": "undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header\n\nImpact:\nWhen undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the three standard tokens. For example, SameSite=NoneOfYourBusiness is parsed as None (the most permissive setting), and SameSite=StrictLax is parsed as Lax (a downgrade from Strict).\n\nAffected applications are those that consume Set-Cookie header\n\nPackage: undici\nInstalled: 7.14.0\nFixed in: 6.27.0, 7.28.0, 8.5.0\nSeverity: LOW\nFix: Upgrade undici to 6.27.0, 7.28.0, 8.5.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d3617b28604b6a59", "name": "CVE-2026-6733: undici 7.14.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-6733: undici 7.14.0 \u2014 package-lock.json"}, "fullDescription": {"text": "undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery.\n\nImpact:\nUndici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after a request completes. When the client dispatches the next request on that socket, it associates the injected response with the new request, causing responses to be delivered to the wrong requests.\n\nThis requires an attacker-controlled or compromised upstream HTTP/1.1 server and keep-ali\n\nPackage: undici\nInstalled: 7.14.0\nFixed in: 6.27.0, 7.28.0, 8.5.0\nSeverity: LOW\nFix: Upgrade undici to 6.27.0, 7.28.0, 8.5.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0c425cec230492e4", "name": "CVE-2026-48779: ws 8.18.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-48779: ws 8.18.0 \u2014 package-lock.json"}, "fullDescription": {"text": "ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments\n\nws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-si\n\nPackage: ws\nInstalled: 8.18.0\nFixed in: 5.2.5, 6.2.4, 7.5.11, 8.21.0\nSeverity: HIGH\nFix: Upgrade ws to 5.2.5, 6.2.4, 7.5.11, 8.21.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0fe255cdef58a6c1", "name": "CVE-2026-45736: ws 8.18.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-45736: ws 8.18.0 \u2014 package-lock.json"}, "fullDescription": {"text": "ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray`\n\nws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.\n\nPackage: ws\nInstalled: 8.18.0\nFixed in: 8.20.1\nSeverity: MEDIUM\nFix: Upgrade ws to 8.20.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dd2b4197d9a7e518", "name": "Agent authority lacks a verifier contract: skills/create-design-md/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/create-design-md/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fdd4eb3a7a585f09", "name": "Agent authority lacks a verifier contract: skills/ui-skills-root/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/ui-skills-root/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bd5e1c0db9f9634f", "name": "Agent authority lacks a verifier contract: skills/baseline-ui/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/baseline-ui/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1dee27c43f2a9d35", "name": "Agent authority lacks a verifier contract: skills/improve-ui/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/improve-ui/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e637c415447867e4", "name": "Run SkillSpector's LLM-backed analysis in your own pipeline", "shortDescription": {"text": "Run SkillSpector's LLM-backed analysis in your own pipeline"}, "fullDescription": {"text": "Repobility ran SkillSpector's static rules server-side. The deeper LLM-backed analyzers \u2014 tool-poisoning (TP*), semantic security discovery (SSD*), developer-intent mismatch (SDI*) \u2014 are meant to run on YOUR machine with YOUR model; repobility never sends your code to an LLM. Recipe:\n\n# 1. Install SkillSpector in your own isolated env\npipx install \"skillspector @ git+https://github.com/NVIDIA/SkillSpector.git\"\n\n# 2. Point it at YOUR LLM pipeline (pick one) - your code stays on your machine\nexport SKILLSPECTOR_PROVIDER=anthropic && export ANTHROPIC_API_KEY=sk-ant-...\n# export SKILLSPECTOR_PROVIDER=openai   && export OPENAI_API_KEY=sk-...\n# export SKILLSPECTOR_PROVIDER=openai OPENAI_API_KEY=ollama OPENAI_BASE_URL=http://localhost:11434/v1 SKILLSPECTOR_MODEL=llama3.1:8b\n# export SKILLSPECTOR_PROVIDER=nv_build && export NVIDIA_INFERENCE_KEY=nvapi-...\n\n# 3. Run the LLM-backed scan per skill (omit --no-llm to enable the LLM analyzers)\nskillspector scan skills/baseline-ui --format sarif --out"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-46c644c6227e4d4a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1838a141491ce38c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "4 tests / 20 src (ratio 0.20)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-321e4f5320333be3", "name": "Vulnerable dependency @astrojs/cloudflare 12.6.13: GHSA-88gm-j2wx-58h6", "shortDescription": {"text": "Vulnerable dependency @astrojs/cloudflare 12.6.13: GHSA-88gm-j2wx-58h6"}, "fullDescription": {"text": "OSV.dev reports `@astrojs/cloudflare` at version `12.6.13` (resolved in `package-lock.json`) is affected by GHSA-88gm-j2wx-58h6 (aka CVE-2026-41321).\n\nCloudflare has SSRF via redirect following through its image-binding-transform endpoint (incomplete fix for GHSA-qpr4)\n\nAliases: CVE-2026-41321\nAdvisory: https://osv.dev/vulnerability/GHSA-88gm-j2wx-58h6\nFix: upgrade `@astrojs/cloudflare` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d8b912c26e0edba5", "name": "Vulnerable dependency astro 5.18.2: GHSA-2pvr-wf23-7pc7", "shortDescription": {"text": "Vulnerable dependency astro 5.18.2: GHSA-2pvr-wf23-7pc7"}, "fullDescription": {"text": "OSV.dev reports `astro` at version `5.18.2` (resolved in `package-lock.json`) is affected by GHSA-2pvr-wf23-7pc7 (aka CVE-2026-54299).\n\nAstro: Host header SSRF in prerendered error page fetch\n\nAliases: CVE-2026-54299\nAdvisory: https://osv.dev/vulnerability/GHSA-2pvr-wf23-7pc7\nFix: upgrade `astro` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-002fd6566016b574", "name": "Vulnerable dependency astro 5.18.2: GHSA-4g3v-8h47-v7g6", "shortDescription": {"text": "Vulnerable dependency astro 5.18.2: GHSA-4g3v-8h47-v7g6"}, "fullDescription": {"text": "OSV.dev reports `astro` at version `5.18.2` (resolved in `package-lock.json`) is affected by GHSA-4g3v-8h47-v7g6.\n\nAstro: Reflected XSS via unescaped View Transition animation properties\n\nAdvisory: https://osv.dev/vulnerability/GHSA-4g3v-8h47-v7g6\nFix: upgrade `astro` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fdc4eed2ac6e5b85", "name": "Vulnerable dependency astro 5.18.2: GHSA-7pw4-f3q4-r2p2", "shortDescription": {"text": "Vulnerable dependency astro 5.18.2: GHSA-7pw4-f3q4-r2p2"}, "fullDescription": {"text": "OSV.dev reports `astro` at version `5.18.2` (resolved in `package-lock.json`) is affected by GHSA-7pw4-f3q4-r2p2 (aka CVE-2026-59727).\n\nAstro: Cross-site scripting via unescaped transition:* directive values on hydrated islands\n\nAliases: CVE-2026-59727\nAdvisory: https://osv.dev/vulnerability/GHSA-7pw4-f3q4-r2p2\nFix: upgrade `astro` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f0c467eb83c6750e", "name": "Vulnerable dependency astro 5.18.2: GHSA-8hv8-536x-4wqp", "shortDescription": {"text": "Vulnerable dependency astro 5.18.2: GHSA-8hv8-536x-4wqp"}, "fullDescription": {"text": "OSV.dev reports `astro` at version `5.18.2` (resolved in `package-lock.json`) is affected by GHSA-8hv8-536x-4wqp (aka CVE-2026-50146).\n\nAstro: Reflected XSS via unescaped slot name\n\nAliases: CVE-2026-50146\nAdvisory: https://osv.dev/vulnerability/GHSA-8hv8-536x-4wqp\nFix: upgrade `astro` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-263c52de898dd72c", "name": "Vulnerable dependency astro 5.18.2: GHSA-f48w-9m4c-m7f5", "shortDescription": {"text": "Vulnerable dependency astro 5.18.2: GHSA-f48w-9m4c-m7f5"}, "fullDescription": {"text": "OSV.dev reports `astro` at version `5.18.2` (resolved in `package-lock.json`) is affected by GHSA-f48w-9m4c-m7f5 (aka CVE-2026-59729).\n\nAstro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)\n\nAliases: CVE-2026-59729\nAdvisory: https://osv.dev/vulnerability/GHSA-f48w-9m4c-m7f5\nFix: upgrade `astro` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c04aa15e19cd5e45", "name": "Vulnerable dependency astro 5.18.2: GHSA-j687-52p2-xcff", "shortDescription": {"text": "Vulnerable dependency astro 5.18.2: GHSA-j687-52p2-xcff"}, "fullDescription": {"text": "OSV.dev reports `astro` at version `5.18.2` (resolved in `package-lock.json`) is affected by GHSA-j687-52p2-xcff (aka CVE-2026-41067).\n\nAstro: XSS in define:vars via incomplete </script> tag sanitization\n\nAliases: CVE-2026-41067\nAdvisory: https://osv.dev/vulnerability/GHSA-j687-52p2-xcff\nFix: upgrade `astro` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-af22a22f566ac7e4", "name": "Vulnerable dependency astro 5.18.2: GHSA-jrpj-wcv7-9fh9", "shortDescription": {"text": "Vulnerable dependency astro 5.18.2: GHSA-jrpj-wcv7-9fh9"}, "fullDescription": {"text": "OSV.dev reports `astro` at version `5.18.2` (resolved in `package-lock.json`) is affected by GHSA-jrpj-wcv7-9fh9 (aka CVE-2026-54298).\n\nAstro: XSS via Unescaped Attribute Names in Spread Props\n\nAliases: CVE-2026-54298\nAdvisory: https://osv.dev/vulnerability/GHSA-jrpj-wcv7-9fh9\nFix: upgrade `astro` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-254bf855603c11b6", "name": "Vulnerable dependency astro 5.18.2: GHSA-xr5h-phrj-8vxv", "shortDescription": {"text": "Vulnerable dependency astro 5.18.2: GHSA-xr5h-phrj-8vxv"}, "fullDescription": {"text": "OSV.dev reports `astro` at version `5.18.2` (resolved in `package-lock.json`) is affected by GHSA-xr5h-phrj-8vxv (aka CVE-2026-45028).\n\nAstro: Server island encrypted parameters vulnerable to cross-component replay\n\nAliases: CVE-2026-45028\nAdvisory: https://osv.dev/vulnerability/GHSA-xr5h-phrj-8vxv\nFix: upgrade `astro` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d30a32a023fc223e", "name": "Vulnerable dependency esbuild 0.27.7: GHSA-g7r4-m6w7-qqqr", "shortDescription": {"text": "Vulnerable dependency esbuild 0.27.7: GHSA-g7r4-m6w7-qqqr"}, "fullDescription": {"text": "OSV.dev reports `esbuild` at version `0.27.7` (resolved in `package-lock.json`) is affected by GHSA-g7r4-m6w7-qqqr.\nNote: `esbuild` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nesbuild allows arbitrary file read when running the development server on Windows\n\nAdvisory: https://osv.dev/vulnerability/GHSA-g7r4-m6w7-qqqr\nFix: upgrade `esbuild` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-61d5b79cfc7204fd", "name": "Vulnerable dependency sharp 0.34.5: GHSA-f88m-g3jw-g9cj", "shortDescription": {"text": "Vulnerable dependency sharp 0.34.5: GHSA-f88m-g3jw-g9cj"}, "fullDescription": {"text": "OSV.dev reports `sharp` at version `0.34.5` (resolved in `package-lock.json`) is affected by GHSA-f88m-g3jw-g9cj.\nNote: `sharp` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nsharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591\n\nAdvisory: https://osv.dev/vulnerability/GHSA-f88m-g3jw-g9cj\nFix: upgrade `sharp` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-750aa6f59ce9280a", "name": "Dependency @astrojs/cloudflare is two or more major versions behind", "shortDescription": {"text": "Dependency @astrojs/cloudflare is two or more major versions behind"}, "fullDescription": {"text": "`@astrojs/cloudflare` is pinned at `12.6.13` in `package.json` while the latest release on the npm registry is `14.1.4` \u2014 2 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@astrojs/cloudflare` to `14.1.4`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-3b8cc800c8fb9098", "name": "Dependency @astrojs/react is two or more major versions behind", "shortDescription": {"text": "Dependency @astrojs/react is two or more major versions behind"}, "fullDescription": {"text": "`@astrojs/react` is pinned at `4.4.2` in `package.json` while the latest release on the npm registry is `6.0.1` \u2014 2 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@astrojs/react` to `6.0.1`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-d4d72a29ef8d7d30", "name": "Dependency astro is two or more major versions behind", "shortDescription": {"text": "Dependency astro is two or more major versions behind"}, "fullDescription": {"text": "`astro` is pinned at `5.16.7` in `package.json` while the latest release on the npm registry is `7.1.3` \u2014 2 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `astro` to `7.1.3`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-5c99c8ebb84b7e38", "name": "Dependency marked is a major version behind", "shortDescription": {"text": "Dependency marked is a major version behind"}, "fullDescription": {"text": "`marked` is pinned at `17.0.1` in `package.json` while the latest release on the npm registry is `18.0.7` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `marked` to `18.0.7`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}]}}, "automationDetails": {"id": "repobility/30754"}, "properties": {"repository": "ibelick/ui-skills", "repoUrl": "https://github.com/ibelick/ui-skills", "branch": "main"}, "results": [{"ruleId": "scanner-19fb410b6f71ef9b", "level": "note", "message": {"text": "CVE-2026-41321: @astrojs/cloudflare 12.6.13 \u2014 package-lock.json"}, "properties": {"repobilityId": "d49a459ff8363940", "scanner": "scanner-primary", "fingerprint": "19fb410b6f71ef9b", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41321"]}}, {"ruleId": "scanner-1da231e583257116", "level": "error", "message": {"text": "CVE-2026-50146: astro 5.18.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "ce78c0ab0829a055", "scanner": "scanner-primary", "fingerprint": "1da231e583257116", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-50146"]}}, {"ruleId": "scanner-f364e94843093d09", "level": "error", "message": {"text": "CVE-2026-54299: astro 5.18.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "2f634c11030f999c", "scanner": "scanner-primary", "fingerprint": "f364e94843093d09", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54299"]}}, {"ruleId": "scanner-f5a950e9afe91e47", "level": "warning", "message": {"text": "CVE-2026-41067: astro 5.18.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "b3480f89c15da470", "scanner": "scanner-primary", "fingerprint": "f5a950e9afe91e47", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41067"]}}, {"ruleId": "scanner-15fa7555c28626f1", "level": "warning", "message": {"text": "CVE-2026-54298: astro 5.18.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "022850f10e8133da", "scanner": "scanner-primary", "fingerprint": "15fa7555c28626f1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54298"]}}, {"ruleId": "scanner-88e029e5a26fb226", "level": "warning", "message": {"text": "CVE-2026-59729: astro 5.18.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "93644af7589e43c2", "scanner": "scanner-primary", "fingerprint": "88e029e5a26fb226", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59729"]}}, {"ruleId": "scanner-4b28269afe8b5070", "level": "warning", "message": {"text": "GHSA-4g3v-8h47-v7g6: astro 5.18.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "52f4814601b0bcc2", "scanner": "scanner-primary", "fingerprint": "4b28269afe8b5070", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-4g3v-8h47-v7g6"]}}, {"ruleId": "scanner-eb211a1b96b6addd", "level": "note", "message": {"text": "CVE-2026-45028: astro 5.18.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "5b8fbaad7fdc18af", "scanner": "scanner-primary", "fingerprint": "eb211a1b96b6addd", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45028"]}}, {"ruleId": "scanner-fd470b05b74a3aa6", "level": "note", "message": {"text": "CVE-2026-59727: astro 5.18.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "2e857aba9a73f70a", "scanner": "scanner-primary", "fingerprint": "fd470b05b74a3aa6", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59727"]}}, {"ruleId": "scanner-1f3b6fac697d7180", "level": "note", "message": {"text": "GHSA-g7r4-m6w7-qqqr: esbuild 0.27.7 \u2014 package-lock.json"}, "properties": {"repobilityId": "3cbf3ec0823db623", "scanner": "scanner-primary", "fingerprint": "1f3b6fac697d7180", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-g7r4-m6w7-qqqr"]}}, {"ruleId": "scanner-696edaf1bfda3eab", "level": "error", "message": {"text": "GHSA-f88m-g3jw-g9cj: sharp 0.34.5 \u2014 package-lock.json"}, "properties": {"repobilityId": "d0b02bd3a646af1f", "scanner": "scanner-primary", "fingerprint": "696edaf1bfda3eab", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-f88m-g3jw-g9cj"]}}, {"ruleId": "scanner-86e7197a8a1ee69a", "level": "error", "message": {"text": "CVE-2026-12151: undici 7.14.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "99c415fea2a5f85c", "scanner": "scanner-primary", "fingerprint": "86e7197a8a1ee69a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12151"]}}, {"ruleId": "scanner-4915ef4e3455f006", "level": "error", "message": {"text": "CVE-2026-1526: undici 7.14.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "4c3f3677e1b89ca5", "scanner": "scanner-primary", "fingerprint": "4915ef4e3455f006", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-1526"]}}, {"ruleId": "scanner-d7b98983ef71bc52", "level": "error", "message": {"text": "CVE-2026-1528: undici 7.14.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "6c0e52a9fbae3105", "scanner": "scanner-primary", "fingerprint": "d7b98983ef71bc52", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-1528"]}}, {"ruleId": "scanner-3d7f798a91910b84", "level": "error", "message": {"text": "CVE-2026-2229: undici 7.14.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "9c2610ae57d2db62", "scanner": "scanner-primary", "fingerprint": "3d7f798a91910b84", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-2229"]}}, {"ruleId": "scanner-b72773bca899d00f", "level": "warning", "message": {"text": "CVE-2026-1525: undici 7.14.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "a568b02bb57f57d9", "scanner": "scanner-primary", "fingerprint": "b72773bca899d00f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-1525"]}}, {"ruleId": "scanner-a03d5f735d14f201", "level": "warning", "message": {"text": "CVE-2026-1527: undici 7.14.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "a733ed916ee3efd8", "scanner": "scanner-primary", "fingerprint": "a03d5f735d14f201", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-1527"]}}, {"ruleId": "scanner-cb37d03914225bec", "level": "warning", "message": {"text": "CVE-2026-22036: undici 7.14.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "bbecb1155de1de5e", "scanner": "scanner-primary", "fingerprint": "cb37d03914225bec", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-22036"]}}, {"ruleId": "scanner-7d010cb450132f01", "level": "warning", "message": {"text": "CVE-2026-9678: undici 7.14.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "ab54ffad93081021", "scanner": "scanner-primary", "fingerprint": "7d010cb450132f01", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-9678"]}}, {"ruleId": "scanner-d6e859dfa6e8de99", "level": "warning", "message": {"text": "CVE-2026-9679: undici 7.14.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "4615f8d61406dccb", "scanner": "scanner-primary", "fingerprint": "d6e859dfa6e8de99", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-9679"]}}, {"ruleId": "scanner-47cdff4c8e1fd2dd", "level": "note", "message": {"text": "CVE-2026-11525: undici 7.14.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "4a99f39de3f3b456", "scanner": "scanner-primary", "fingerprint": "47cdff4c8e1fd2dd", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-11525"]}}, {"ruleId": "scanner-d3617b28604b6a59", "level": "note", "message": {"text": "CVE-2026-6733: undici 7.14.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "ea5eccab85d6eb97", "scanner": "scanner-primary", "fingerprint": "d3617b28604b6a59", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-6733"]}}, {"ruleId": "scanner-0c425cec230492e4", "level": "error", "message": {"text": "CVE-2026-48779: ws 8.18.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "f7e31279300ec7e6", "scanner": "scanner-primary", "fingerprint": "0c425cec230492e4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48779"]}}, {"ruleId": "scanner-0fe255cdef58a6c1", "level": "warning", "message": {"text": "CVE-2026-45736: ws 8.18.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "7635a49db32e4699", "scanner": "scanner-primary", "fingerprint": "0fe255cdef58a6c1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45736"]}}, {"ruleId": "scanner-dd2b4197d9a7e518", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/create-design-md/SKILL.md"}, "properties": {"repobilityId": "2f77f3ccfc8df7a2", "scanner": "scanner-primary", "fingerprint": "dd2b4197d9a7e518", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/create-design-md/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fdd4eb3a7a585f09", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/ui-skills-root/SKILL.md"}, "properties": {"repobilityId": "fbb0b84f066b5878", "scanner": "scanner-primary", "fingerprint": "fdd4eb3a7a585f09", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/ui-skills-root/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bd5e1c0db9f9634f", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/baseline-ui/SKILL.md"}, "properties": {"repobilityId": "fa4c6c2c694509af", "scanner": "scanner-primary", "fingerprint": "bd5e1c0db9f9634f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/baseline-ui/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1dee27c43f2a9d35", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/improve-ui/SKILL.md"}, "properties": {"repobilityId": "5d47ee3c8054269b", "scanner": "scanner-primary", "fingerprint": "1dee27c43f2a9d35", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/improve-ui/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e637c415447867e4", "level": "none", "message": {"text": "Run SkillSpector's LLM-backed analysis in your own pipeline"}, "properties": {"repobilityId": "1936f198ff5212bf", "scanner": "scanner-primary", "fingerprint": "e637c415447867e4", "layer": "security", "severity": "info", "confidence": 1.0, "tags": ["skillspector", "mcp-skill", "llm-advisory", "ai-coder"]}}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2644034c718fb80d", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-1838a141491ce38c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b8fd4f5048f96576", "scanner": "scanner-primary", "fingerprint": "1838a141491ce38c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "f7e1f85f3a1797cb", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-321e4f5320333be3", "level": "note", "message": {"text": "Vulnerable dependency @astrojs/cloudflare 12.6.13: GHSA-88gm-j2wx-58h6"}, "properties": {"repobilityId": "a78e517692a6cb78", "scanner": "scanner-primary", "fingerprint": "321e4f5320333be3", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-88gm-j2wx-58h6"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d8b912c26e0edba5", "level": "error", "message": {"text": "Vulnerable dependency astro 5.18.2: GHSA-2pvr-wf23-7pc7"}, "properties": {"repobilityId": "53588ad650a4390e", "scanner": "scanner-primary", "fingerprint": "d8b912c26e0edba5", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-2pvr-wf23-7pc7"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-002fd6566016b574", "level": "warning", "message": {"text": "Vulnerable dependency astro 5.18.2: GHSA-4g3v-8h47-v7g6"}, "properties": {"repobilityId": "8e977bc8b82c8616", "scanner": "scanner-primary", "fingerprint": "002fd6566016b574", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-4g3v-8h47-v7g6"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fdc4eed2ac6e5b85", "level": "note", "message": {"text": "Vulnerable dependency astro 5.18.2: GHSA-7pw4-f3q4-r2p2"}, "properties": {"repobilityId": "d3f9cc4046b6ebbf", "scanner": "scanner-primary", "fingerprint": "fdc4eed2ac6e5b85", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-7pw4-f3q4-r2p2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f0c467eb83c6750e", "level": "error", "message": {"text": "Vulnerable dependency astro 5.18.2: GHSA-8hv8-536x-4wqp"}, "properties": {"repobilityId": "c35e0b22e7c7b0cc", "scanner": "scanner-primary", "fingerprint": "f0c467eb83c6750e", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-8hv8-536x-4wqp"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-263c52de898dd72c", "level": "warning", "message": {"text": "Vulnerable dependency astro 5.18.2: GHSA-f48w-9m4c-m7f5"}, "properties": {"repobilityId": "4b56b7cd03efabb4", "scanner": "scanner-primary", "fingerprint": "263c52de898dd72c", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-f48w-9m4c-m7f5"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c04aa15e19cd5e45", "level": "warning", "message": {"text": "Vulnerable dependency astro 5.18.2: GHSA-j687-52p2-xcff"}, "properties": {"repobilityId": "1de39ad05138dd79", "scanner": "scanner-primary", "fingerprint": "c04aa15e19cd5e45", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-j687-52p2-xcff"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-af22a22f566ac7e4", "level": "warning", "message": {"text": "Vulnerable dependency astro 5.18.2: GHSA-jrpj-wcv7-9fh9"}, "properties": {"repobilityId": "83eb74a7d94c8c07", "scanner": "scanner-primary", "fingerprint": "af22a22f566ac7e4", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-jrpj-wcv7-9fh9"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-254bf855603c11b6", "level": "warning", "message": {"text": "Vulnerable dependency astro 5.18.2: GHSA-xr5h-phrj-8vxv"}, "properties": {"repobilityId": "86eada4b37b05242", "scanner": "scanner-primary", "fingerprint": "254bf855603c11b6", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-xr5h-phrj-8vxv"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d30a32a023fc223e", "level": "note", "message": {"text": "Vulnerable dependency esbuild 0.27.7: GHSA-g7r4-m6w7-qqqr"}, "properties": {"repobilityId": "dbc426c2dd693105", "scanner": "scanner-primary", "fingerprint": "d30a32a023fc223e", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-g7r4-m6w7-qqqr", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-61d5b79cfc7204fd", "level": "error", "message": {"text": "Vulnerable dependency sharp 0.34.5: GHSA-f88m-g3jw-g9cj"}, "properties": {"repobilityId": "c3222d5482f512fc", "scanner": "scanner-primary", "fingerprint": "61d5b79cfc7204fd", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-f88m-g3jw-g9cj", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-750aa6f59ce9280a", "level": "warning", "message": {"text": "Dependency @astrojs/cloudflare is two or more major versions behind"}, "properties": {"repobilityId": "b96c953cb9273666", "scanner": "scanner-primary", "fingerprint": "750aa6f59ce9280a", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3b8cc800c8fb9098", "level": "warning", "message": {"text": "Dependency @astrojs/react is two or more major versions behind"}, "properties": {"repobilityId": "650034190c0421ed", "scanner": "scanner-primary", "fingerprint": "3b8cc800c8fb9098", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d4d72a29ef8d7d30", "level": "warning", "message": {"text": "Dependency astro is two or more major versions behind"}, "properties": {"repobilityId": "a327b4a79011583d", "scanner": "scanner-primary", "fingerprint": "d4d72a29ef8d7d30", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5c99c8ebb84b7e38", "level": "note", "message": {"text": "Dependency marked is a major version behind"}, "properties": {"repobilityId": "726209b81e2063fb", "scanner": "scanner-primary", "fingerprint": "5c99c8ebb84b7e38", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}]}]}