{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-7a8c3375c24b4ce8", "name": "Possible secret in scripts/key-decoder-sessions/kd-huojian-20260415160000/session_summary.json", "shortDescription": {"text": "Possible secret in scripts/key-decoder-sessions/kd-huojian-20260415160000/session_summary.json"}, "fullDescription": {"text": "Detected pattern matching openai_or_anthropic_key. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a6ad2b2b5a9490c1", "name": "Agent authority lacks a verifier contract: .codex/INSTALL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .codex/INSTALL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b17f8801cfaedd10", "name": "Agent authority lacks a verifier contract: .cursor/INSTALL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .cursor/INSTALL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2053c5cbf48f1aaa", "name": "Agent authority lacks a verifier contract: skills/sh-recover/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/sh-recover/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-31ba1d2373ebc77d", "name": "Agent authority lacks a verifier contract: skills/sh-run/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/sh-run/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-19b97a692cac2d99", "name": "Agent authority lacks a verifier contract: skills/sh-start/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/sh-start/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0d4668f2b8738566", "name": "Agent authority lacks a verifier contract: skills/sh-pack/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/sh-pack/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-32f7d63dc6dfce98", "name": "Agent authority lacks a verifier contract: skills/superpowers-harness/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/superpowers-harness/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-34b1e1cd5bd09c54", "name": "Agent authority lacks a verifier contract: .claude/INSTALL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/INSTALL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/23899"}, "properties": {"repository": "adi0754/SuperpowersHarness", "repoUrl": "https://github.com/adi0754/SuperpowersHarness", "branch": "main"}, "results": [{"ruleId": "scanner-7a8c3375c24b4ce8", "level": "error", "message": {"text": "Possible secret in scripts/key-decoder-sessions/kd-huojian-20260415160000/session_summary.json"}, "properties": {"repobilityId": "4c7a854b4d987dc6", "scanner": "scanner-primary", "fingerprint": "7a8c3375c24b4ce8", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/key-decoder-sessions/kd-huojian-20260415160000/session_summary.json"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-a6ad2b2b5a9490c1", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .codex/INSTALL.md"}, "properties": {"repobilityId": "9fa35450e85e063b", "scanner": "scanner-primary", "fingerprint": "a6ad2b2b5a9490c1", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "codex_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".codex/INSTALL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b17f8801cfaedd10", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .cursor/INSTALL.md"}, "properties": {"repobilityId": "9a385de073dec001", "scanner": "scanner-primary", "fingerprint": "b17f8801cfaedd10", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "cursor_rule"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".cursor/INSTALL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2053c5cbf48f1aaa", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/sh-recover/SKILL.md"}, "properties": {"repobilityId": "89aa5bc1e1776b4a", "scanner": "scanner-primary", "fingerprint": "2053c5cbf48f1aaa", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/sh-recover/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-31ba1d2373ebc77d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/sh-run/SKILL.md"}, "properties": {"repobilityId": "ec0354f6816d4db8", "scanner": "scanner-primary", "fingerprint": "31ba1d2373ebc77d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/sh-run/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-19b97a692cac2d99", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/sh-start/SKILL.md"}, "properties": {"repobilityId": "4a9173135e8a644f", "scanner": "scanner-primary", "fingerprint": "19b97a692cac2d99", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/sh-start/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0d4668f2b8738566", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/sh-pack/SKILL.md"}, "properties": {"repobilityId": "616f153bd8cbe333", "scanner": "scanner-primary", "fingerprint": "0d4668f2b8738566", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/sh-pack/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-32f7d63dc6dfce98", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/superpowers-harness/SKILL.md"}, "properties": {"repobilityId": "1a3ca95c1fdcd9a3", "scanner": "scanner-primary", "fingerprint": "32f7d63dc6dfce98", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/superpowers-harness/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-34b1e1cd5bd09c54", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/INSTALL.md"}, "properties": {"repobilityId": "8f2445d8f3f18b52", "scanner": "scanner-primary", "fingerprint": "34b1e1cd5bd09c54", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/INSTALL.md"}, "region": {"startLine": 1}}}]}]}]}