{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-3a8a7f833bc3cc42", "name": "Stray `console.log` in TS/JS \u2014 scripts/post-matcher/postMatcher.js:123", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/post-matcher/postMatcher.js:123"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eac03e61c6e4235a", "name": "Stray `console.log` in TS/JS \u2014 src/pages/api/spotify/top-items.ts:51", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/pages/api/spotify/top-items.ts:51"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3af45efe1956b56f", "name": "Stray `console.log` in TS/JS \u2014 src/pages/api/spotify/[type]/[time_range].ts:62", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/pages/api/spotify/[type]/[time_range].ts:62"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1857eeae3382fc2c", "name": "Insecure pattern 'node_child_process' in scripts/sync-obsidian-library.mjs:14", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/sync-obsidian-library.mjs:14"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-63ea2428069d21aa", "name": "Insecure pattern 'node_child_process' in scripts/agent-content/publish-from-packet.mjs:5", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/agent-content/publish-from-packet.mjs:5"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dc32002093f067f6", "name": "Insecure pattern 'node_child_process' in scripts/agent-content/process-nores-image.mjs:5", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/agent-content/process-nores-image.mjs:5"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1c63111e5366c87b", "name": "Insecure pattern 'node_child_process' in .github/skills/pilcrow/scripts/resolve-speech.mjs:28", "shortDescription": {"text": "Insecure pattern 'node_child_process' in .github/skills/pilcrow/scripts/resolve-speech.mjs:28"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7f98b0ce6ecc5cb3", "name": "Insecure pattern 'node_child_process' in .cursor/skills/pilcrow/scripts/resolve-speech.mjs:28", "shortDescription": {"text": "Insecure pattern 'node_child_process' in .cursor/skills/pilcrow/scripts/resolve-speech.mjs:28"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f3127848f69158a7", "name": "Insecure pattern 'node_child_process' in .claude/skills/pilcrow/scripts/resolve-speech.mjs:28", "shortDescription": {"text": "Insecure pattern 'node_child_process' in .claude/skills/pilcrow/scripts/resolve-speech.mjs:28"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ecf1a58745d57d63", "name": "Insecure pattern 'direct_innerhtml_assignment' in public/js/tinkerings/true-crime-garage-map/main.js:8060", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/js/tinkerings/true-crime-garage-map/main.js:8060"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-69eda44251b6df68", "name": "Insecure pattern 'direct_innerhtml_assignment' in public/js/no-reserv-ai-tions-map/main.js:73", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/js/no-reserv-ai-tions-map/main.js:73"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4c56c3b5f6875f16", "name": "Insecure pattern 'direct_innerhtml_assignment' in public/js/posts/true-crime/mapping-the-long-island-murder-victims/scro", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/js/posts/true-crime/mapping-the-long-island-murder-victims/scrollama.min.js:1"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-89e9eb03e2952828", "name": "Insecure pattern 'direct_innerhtml_assignment' in public/admin/index.html:21", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/admin/index.html:21"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-25cd5ed2bb8fb832", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ff17fed1b7b9a1ee", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-865712073edef689", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4c14e5025d96e4a1", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-53dd1d446fd14a06", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c54599f5acffba4", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ede2a3eb3f83b285", "name": "Very large file: public/js/tinkerings/true-crime-garage-map/main.js (8306 lines)", "shortDescription": {"text": "Very large file: public/js/tinkerings/true-crime-garage-map/main.js (8306 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "2 test file(s) for 52 source file(s) (ratio 0.04). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 202 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-11825279136b53a3", "name": "CI is configured but no tests are detected", "shortDescription": {"text": "CI is configured but no tests are detected"}, "fullDescription": {"text": "A CI pipeline exists, but the scan found no test files to gate. Opus labeled this generated-code pattern as config theater: release machinery exists, but it has little behavioral signal."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, tests. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license, tests. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bea357a6497a2d5d", "name": "Agent authority lacks a verifier contract: CLAUDE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: CLAUDE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cc55229a7a3c078d", "name": "Agent authority lacks a verifier contract: .mcp.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .mcp.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1bd0c17b30417b2f", "name": "Agent authority lacks a verifier contract: .cursor/mcp.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .cursor/mcp.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d4149546a1f443df", "name": "Agent authority lacks a verifier contract: .cursor/skills/pilcrow/reference/verify.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .cursor/skills/pilcrow/reference/verify.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-451f80adab95392d", "name": "Agent authority lacks a verifier contract: .cursor/skills/pilcrow/reference/_genres.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .cursor/skills/pilcrow/reference/_genres.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c97580e66cbca88a", "name": "Agent authority lacks a verifier contract: .cursor/skills/pilcrow/reference/teach.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .cursor/skills/pilcrow/reference/teach.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-122f91b7f2906dc4", "name": "Agent authority lacks a verifier contract: .claude/settings.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/settings.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-78197c8cd89661c9", "name": "Agent authority lacks a verifier contract: .claude/commands/settle-rithmm-picks.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/settle-rithmm-picks.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-95dbded7043e541c", "name": "Agent authority lacks a verifier contract: .claude/commands/yil-design.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/yil-design.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-10b1979be48614d4", "name": "Agent authority lacks a verifier contract: .claude/commands/pr.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/pr.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6369e4264ef496e5", "name": "Agent authority lacks a verifier contract: .claude/commands/settle-martingale.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/settle-martingale.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-46d14c6c26d2801d", "name": "Agent authority lacks a verifier contract: .claude/skills/pilcrow/reference/verify.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/pilcrow/reference/verify.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a43239d10118c28a", "name": "Agent authority lacks a verifier contract: .claude/skills/pilcrow/reference/_genres.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/pilcrow/reference/_genres.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bf369da5c156cea1", "name": "Agent authority lacks a verifier contract: .claude/skills/pilcrow/reference/teach.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/pilcrow/reference/teach.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-81f2b0ded94f9ffe", "name": "Agent instruction/config may expose a secret: .claude/skills/new-content/SKILL.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/skills/new-content/SKILL.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c90a75abb09223b2", "name": "Agent authority lacks a verifier contract: .claude/skills/new-content/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/new-content/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a1935833bdc0f89f", "name": "Agent authority lacks a verifier contract: .claude/skills/graphify/references/extraction-spec.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/graphify/references/extraction-spec.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-67bf0687174894da", "name": "Agent authority lacks a verifier contract: .claude/skills/graphify/references/github-and-merge.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/graphify/references/github-and-merge.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-15ced4efabd6aa26", "name": "Agent authority lacks a verifier contract: .claude/skills/graphify/references/exports.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/graphify/references/exports.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7fda7562de1eb550", "name": "Agent authority lacks a verifier contract: .claude/skills/graphify/references/transcribe.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/graphify/references/transcribe.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-731805252e03a6a1", "name": "Agent authority lacks a verifier contract: .claude/skills/graphify/references/hooks.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/graphify/references/hooks.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c1acc8ddaaa7dc9b", "name": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/get-spotify-refresh-token.mjs:57", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/get-spotify-refresh-token.mjs:57"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-df5b6f48b14a2752", "name": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/settle-pending-bets.mjs:135", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/settle-pending-bets.mjs:135"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d65d84252aebe122", "name": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/generate-song-review.mjs:49", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/generate-song-review.mjs:49"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-75e1a94431af12dd", "name": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/stash-archive.mjs:70", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/stash-archive.mjs:70"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f4c24130f548f1c0", "name": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/generate-review.mjs:72", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/generate-review.mjs:72"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3d705ce6613db9bf", "name": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/test-spotify-endpoint.mjs:18", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/test-spotify-endpoint.mjs:18"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6edcf06f3b991530", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/scripts/stash.ts:32", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/scripts/stash.ts:32"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-95983a9e8760f95d", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/pages/api/spotify/top-items.ts:15", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/pages/api/spotify/top-items.ts:15"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5da3dab37a34b1c8", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/pages/api/spotify/[type]/[time_range].ts:26", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/pages/api/spotify/[type]/[time_range].ts:26"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/25206"}, "properties": {"repository": "dandenney/dandenney.com-astro", "repoUrl": "https://github.com/dandenney/dandenney.com-astro", "branch": "main"}, "results": [{"ruleId": "scanner-3a8a7f833bc3cc42", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/post-matcher/postMatcher.js:123"}, "properties": {"repobilityId": "049b9cb63d7786f1", "scanner": "scanner-primary", "fingerprint": "3a8a7f833bc3cc42", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-eac03e61c6e4235a", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/pages/api/spotify/top-items.ts:51"}, "properties": {"repobilityId": "8fa5c5ebeaefe9e0", "scanner": "scanner-primary", "fingerprint": "eac03e61c6e4235a", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-3af45efe1956b56f", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/pages/api/spotify/[type]/[time_range].ts:62"}, "properties": {"repobilityId": "3f3816681a561572", "scanner": "scanner-primary", "fingerprint": "3af45efe1956b56f", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-1857eeae3382fc2c", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/sync-obsidian-library.mjs:14"}, "properties": {"repobilityId": "4f67f267c5686501", "scanner": "scanner-primary", "fingerprint": "1857eeae3382fc2c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/sync-obsidian-library.mjs"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-63ea2428069d21aa", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/agent-content/publish-from-packet.mjs:5"}, "properties": {"repobilityId": "1260a91271194f9e", "scanner": "scanner-primary", "fingerprint": "63ea2428069d21aa", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/agent-content/publish-from-packet.mjs"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-dc32002093f067f6", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/agent-content/process-nores-image.mjs:5"}, "properties": {"repobilityId": "5d4c049b9d9e1b0d", "scanner": "scanner-primary", "fingerprint": "dc32002093f067f6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/agent-content/process-nores-image.mjs"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-1c63111e5366c87b", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in .github/skills/pilcrow/scripts/resolve-speech.mjs:28"}, "properties": {"repobilityId": "de813dec6aeee682", "scanner": "scanner-primary", "fingerprint": "1c63111e5366c87b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/skills/pilcrow/scripts/resolve-speech.mjs"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-7f98b0ce6ecc5cb3", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in .cursor/skills/pilcrow/scripts/resolve-speech.mjs:28"}, "properties": {"repobilityId": "57ad57566032f6b9", "scanner": "scanner-primary", "fingerprint": "7f98b0ce6ecc5cb3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".cursor/skills/pilcrow/scripts/resolve-speech.mjs"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-f3127848f69158a7", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in .claude/skills/pilcrow/scripts/resolve-speech.mjs:28"}, "properties": {"repobilityId": "e9dcf0ee7188d519", "scanner": "scanner-primary", "fingerprint": "f3127848f69158a7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/pilcrow/scripts/resolve-speech.mjs"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-ecf1a58745d57d63", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/js/tinkerings/true-crime-garage-map/main.js:8060"}, "properties": {"repobilityId": "8bcaca44a62c5302", "scanner": "scanner-primary", "fingerprint": "ecf1a58745d57d63", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/js/tinkerings/true-crime-garage-map/main.js"}, "region": {"startLine": 8060}}}]}, {"ruleId": "scanner-69eda44251b6df68", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/js/no-reserv-ai-tions-map/main.js:73"}, "properties": {"repobilityId": "5c1abaf82e229cb6", "scanner": "scanner-primary", "fingerprint": "69eda44251b6df68", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/js/no-reserv-ai-tions-map/main.js"}, "region": {"startLine": 73}}}]}, {"ruleId": "scanner-4c56c3b5f6875f16", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/js/posts/true-crime/mapping-the-long-island-murder-victims/scrollama.min.js:1"}, "properties": {"repobilityId": "dd2b4075597628d2", "scanner": "scanner-primary", "fingerprint": "4c56c3b5f6875f16", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/js/posts/true-crime/mapping-the-long-island-murder-victims/scrollama.min.js"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-89e9eb03e2952828", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/admin/index.html:21"}, "properties": {"repobilityId": "b96af6a0a5f105a2", "scanner": "scanner-primary", "fingerprint": "89e9eb03e2952828", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/admin/index.html"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-25cd5ed2bb8fb832", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a44d47cc6693dc37", "scanner": "scanner-primary", "fingerprint": "25cd5ed2bb8fb832", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/generate-review.yml"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-25cd5ed2bb8fb832", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ce0f9fe19c956902", "scanner": "scanner-primary", "fingerprint": "25cd5ed2bb8fb832", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/generate-review.yml"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-ff17fed1b7b9a1ee", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "e7a7b2ccee6d0321", "scanner": "scanner-primary", "fingerprint": "ff17fed1b7b9a1ee", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/generate-review.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-865712073edef689", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ced08ae47ca4d3d4", "scanner": "scanner-primary", "fingerprint": "865712073edef689", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/generate-song-review.yml"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-865712073edef689", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1365473a79b4891b", "scanner": "scanner-primary", "fingerprint": "865712073edef689", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/generate-song-review.yml"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-4c14e5025d96e4a1", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "a210b6ef87160d0b", "scanner": "scanner-primary", "fingerprint": "4c14e5025d96e4a1", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/generate-song-review.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-53dd1d446fd14a06", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "557351a3bb35b0bb", "scanner": "scanner-primary", "fingerprint": "53dd1d446fd14a06", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/settle-pending-bets.yml"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-53dd1d446fd14a06", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3e113bef07d4b854", "scanner": "scanner-primary", "fingerprint": "53dd1d446fd14a06", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/settle-pending-bets.yml"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-2c54599f5acffba4", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "142c9facc2a3d885", "scanner": "scanner-primary", "fingerprint": "2c54599f5acffba4", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/settle-pending-bets.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ede2a3eb3f83b285", "level": "note", "message": {"text": "Very large file: public/js/tinkerings/true-crime-garage-map/main.js (8306 lines)"}, "properties": {"repobilityId": "892fbe28f50a18e4", "scanner": "scanner-primary", "fingerprint": "ede2a3eb3f83b285", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "36f05dd85c2712c4", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "a0fe64c89ecbf674", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "927de55df5f0cc8e", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-11825279136b53a3", "level": "warning", "message": {"text": "CI is configured but no tests are detected"}, "properties": {"repobilityId": "f7402689a1c87505", "scanner": "scanner-primary", "fingerprint": "11825279136b53a3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "ci", "config-theater", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "7887605b302efed0", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "55c4fbd9742c0386", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-bea357a6497a2d5d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: CLAUDE.md"}, "properties": {"repobilityId": "aae72df3934829ac", "scanner": "scanner-primary", "fingerprint": "bea357a6497a2d5d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "CLAUDE.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cc55229a7a3c078d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .mcp.json"}, "properties": {"repobilityId": "51942fb3d5b8b5b4", "scanner": "scanner-primary", "fingerprint": "cc55229a7a3c078d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "mcp_config"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".mcp.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1bd0c17b30417b2f", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .cursor/mcp.json"}, "properties": {"repobilityId": "dd739e66f2986b13", "scanner": "scanner-primary", "fingerprint": "1bd0c17b30417b2f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "mcp_config"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".cursor/mcp.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d4149546a1f443df", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .cursor/skills/pilcrow/reference/verify.md"}, "properties": {"repobilityId": "de16c750932cf981", "scanner": "scanner-primary", "fingerprint": "d4149546a1f443df", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "cursor_rule"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".cursor/skills/pilcrow/reference/verify.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-451f80adab95392d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .cursor/skills/pilcrow/reference/_genres.md"}, "properties": {"repobilityId": "53bf5c26da78f50f", "scanner": "scanner-primary", "fingerprint": "451f80adab95392d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "cursor_rule"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".cursor/skills/pilcrow/reference/_genres.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c97580e66cbca88a", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .cursor/skills/pilcrow/reference/teach.md"}, "properties": {"repobilityId": "3c2b265220ba73f2", "scanner": "scanner-primary", "fingerprint": "c97580e66cbca88a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "cursor_rule"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".cursor/skills/pilcrow/reference/teach.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-122f91b7f2906dc4", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/settings.json"}, "properties": {"repobilityId": "a2967269048b6a9d", "scanner": "scanner-primary", "fingerprint": "122f91b7f2906dc4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/settings.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-78197c8cd89661c9", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/settle-rithmm-picks.md"}, "properties": {"repobilityId": "f81e731232e9223d", "scanner": "scanner-primary", "fingerprint": "78197c8cd89661c9", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/settle-rithmm-picks.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-95dbded7043e541c", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/yil-design.md"}, "properties": {"repobilityId": "8ef05d2413c072fb", "scanner": "scanner-primary", "fingerprint": "95dbded7043e541c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/yil-design.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-10b1979be48614d4", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/pr.md"}, "properties": {"repobilityId": "2027d0978556df31", "scanner": "scanner-primary", "fingerprint": "10b1979be48614d4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/pr.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6369e4264ef496e5", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/settle-martingale.md"}, "properties": {"repobilityId": "e1759228c885d039", "scanner": "scanner-primary", "fingerprint": "6369e4264ef496e5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/settle-martingale.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-46d14c6c26d2801d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/pilcrow/reference/verify.md"}, "properties": {"repobilityId": "e8dd17d8388718b1", "scanner": "scanner-primary", "fingerprint": "46d14c6c26d2801d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/pilcrow/reference/verify.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a43239d10118c28a", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/pilcrow/reference/_genres.md"}, "properties": {"repobilityId": "5597936e3b20dfcc", "scanner": "scanner-primary", "fingerprint": "a43239d10118c28a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/pilcrow/reference/_genres.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bf369da5c156cea1", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/pilcrow/reference/teach.md"}, "properties": {"repobilityId": "bb6b660a72d4588a", "scanner": "scanner-primary", "fingerprint": "bf369da5c156cea1", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/pilcrow/reference/teach.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-81f2b0ded94f9ffe", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/skills/new-content/SKILL.md"}, "properties": {"repobilityId": "d1eeafa2b4fe6f86", "scanner": "scanner-primary", "fingerprint": "81f2b0ded94f9ffe", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/new-content/SKILL.md"}, "region": {"startLine": 146}}}]}, {"ruleId": "scanner-c90a75abb09223b2", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/new-content/SKILL.md"}, "properties": {"repobilityId": "b5306ad2c9601852", "scanner": "scanner-primary", "fingerprint": "c90a75abb09223b2", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/new-content/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a1935833bdc0f89f", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/graphify/references/extraction-spec.md"}, "properties": {"repobilityId": "4fef067851faa0d1", "scanner": "scanner-primary", "fingerprint": "a1935833bdc0f89f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/graphify/references/extraction-spec.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-67bf0687174894da", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/graphify/references/github-and-merge.md"}, "properties": {"repobilityId": "84b936571a8ef538", "scanner": "scanner-primary", "fingerprint": "67bf0687174894da", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/graphify/references/github-and-merge.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-15ced4efabd6aa26", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/graphify/references/exports.md"}, "properties": {"repobilityId": "8b5734cf7f620ddc", "scanner": "scanner-primary", "fingerprint": "15ced4efabd6aa26", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/graphify/references/exports.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7fda7562de1eb550", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/graphify/references/transcribe.md"}, "properties": {"repobilityId": "613539b1b890be15", "scanner": "scanner-primary", "fingerprint": "7fda7562de1eb550", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/graphify/references/transcribe.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-731805252e03a6a1", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/graphify/references/hooks.md"}, "properties": {"repobilityId": "2df6fda7f2229e1d", "scanner": "scanner-primary", "fingerprint": "731805252e03a6a1", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/graphify/references/hooks.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c1acc8ddaaa7dc9b", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/get-spotify-refresh-token.mjs:57"}, "properties": {"repobilityId": "3e2e95f22b8751d6", "scanner": "scanner-primary", "fingerprint": "c1acc8ddaaa7dc9b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-df5b6f48b14a2752", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/settle-pending-bets.mjs:135"}, "properties": {"repobilityId": "793d522a021d6abd", "scanner": "scanner-primary", "fingerprint": "df5b6f48b14a2752", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-d65d84252aebe122", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/generate-song-review.mjs:49"}, "properties": {"repobilityId": "badaa9fd52db2aa7", "scanner": "scanner-primary", "fingerprint": "d65d84252aebe122", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-75e1a94431af12dd", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/stash-archive.mjs:70"}, "properties": {"repobilityId": "249df46b2b1dc374", "scanner": "scanner-primary", "fingerprint": "75e1a94431af12dd", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-f4c24130f548f1c0", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/generate-review.mjs:72"}, "properties": {"repobilityId": "a6f4f8974b6c80c3", "scanner": "scanner-primary", "fingerprint": "f4c24130f548f1c0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-3d705ce6613db9bf", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/test-spotify-endpoint.mjs:18"}, "properties": {"repobilityId": "a1de07c208484cf8", "scanner": "scanner-primary", "fingerprint": "3d705ce6613db9bf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-6edcf06f3b991530", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/scripts/stash.ts:32"}, "properties": {"repobilityId": "8b3d66506f6f218f", "scanner": "scanner-primary", "fingerprint": "6edcf06f3b991530", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-95983a9e8760f95d", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/pages/api/spotify/top-items.ts:15"}, "properties": {"repobilityId": "2a6bc786b7cd6628", "scanner": "scanner-primary", "fingerprint": "95983a9e8760f95d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-5da3dab37a34b1c8", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/pages/api/spotify/[type]/[time_range].ts:26"}, "properties": {"repobilityId": "3f2e44116f54377b", "scanner": "scanner-primary", "fingerprint": "5da3dab37a34b1c8", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}]}]}