Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

stablyai/orca

https://github.com/stablyai/orca · scanned 2026-07-23 19:44 UTC (5 days, 23 hours ago)

58 raw signals (0 security + 58 graph)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 5 days, 23 hours ago · v6 · last Δ +0.5 (diff) · 58 actionable findings from 1 signal source. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
71.7
/100
Security checks
72
0 findings
System graph
72
70.0% cov · 58 findings
Critical
0
click to filter
Agents
10
0 votes
Crowd
0
reported
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 0 High 11 Medium 30 Low 15 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 58 Crowd 0 Layer: Security 20 Quality 2 Frontend 1 Cicd 2 Dependencies 33
Corpus Intelligence Cross-corpus context (cohort percentile, top patterns, fix plan) is shown only on repositories you own. Sign up and connect your repo to view it.
Scan summary Repository scanned at 71.7/100 with 70.0% coverage. It contains 132 nodes across 0 cross-layer flows, written primarily in mixed languages. Engine surfaced 58 findings — concentrated in dependencies (33), security (20), quality (2). Risk profile is high: 0 critical, 11 high, 30 medium. Recommended next step: open the dependencies layer findings first — that's where the highest-impact wins live.

Showing 56 of 58 actionable findings. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

high System graph security Trivy conf 1.00 CVE-2026-12151: undici 7.26.0 — pnpm-lock.yaml
undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream …
VulnCve 2026 12151
high System graph security Trivy conf 1.00 CVE-2026-48779: ws 8.20.0 — pnpm-lock.yaml
ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memor…
VulnCve 2026 48779
high System graph security Trivy conf 1.00 CVE-2026-59869: js-yaml 4.1.1 — pnpm-lock.yaml
js-yaml: js-yaml: Denial of Service via crafted YAML documents js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where…
VulnCve 2026 59869
high System graph security Trivy conf 1.00 CVE-2026-6734: undici 7.26.0 — pnpm-lock.yaml
undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin. All requ…
VulnCve 2026 6734
high System graph security Trivy conf 1.00 CVE-2026-9697: undici 7.26.0 — pnpm-lock.yaml
undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy Impact: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://). The target HTTPS connection through the SOCKS5 tunnel falls back to Node's default tr…
VulnCve 2026 9697
high System graph security Skillspector conf 0.60 SkillSpector PE3 (priv-esc) in electron.vite.config.ts
.env Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts. Skill: unknown Rule: PE3 Category: priv-esc Severity: HIGH Confidence: 0.60 Remediation: Remove references to credential paths. Use environment variables or secrets managers. F…
electron.vite.config.ts:39 Mcp skillPriv escPe3
high System graph security Skillspector conf 0.80 SkillSpector SC4 (supply-chain) in package.json
ws==8.20.0 Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits. Skill: unknown Rule: SC4 Category: supply-chain Severity: HIGH Confidence: 0.80 Remediation: Update the dependency to a patched version that addresses…
package.json:103 Mcp skillSupply chainSc4
high System graph security Skillspector conf 0.70 SkillSpector SC6 (supply-chain) in package.json
oxlint Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them. Skill: unknown Rule: SC6 Category: supply-chain Severity: HIGH Confidence: 0.70 Remediation: Verify the …
package.json:166 Mcp skillSupply chainSc6
high System graph security Skillspector conf 0.85 SkillSpector TM1 (tool-misuse) in pnpm-lock.yaml
rm0YWsqUSRrjncSXGA7Zv78Nbnw4XL6/ Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns). Skill: unknown Rule: TM1 Category: tool-misuse Severity: HIGH Confidence: 0.85 Remediati…
pnpm-lock.yaml:873 Mcp skillTool misuseTm1
high System graph dependencies dependencies conf 0.90 Vulnerable dependency vite 7.3.2: GHSA-fx2h-pf6j-xcff
OSV.dev reports `vite` at version `7.3.2` (resolved in `pnpm-lock.yaml`) is affected by GHSA-fx2h-pf6j-xcff (aka CVE-2026-53571). vite: `server.fs.deny` bypass on Windows alternate paths Aliases: CVE-2026-53571 Advisory: https://osv.dev/vulnerability/GHSA-fx2h-pf6j-xcff Fix: upgrade `vite` past t…
package.json ScaOsvGhsa fx2h pf6j xcff
high System graph dependencies dependencies conf 1.00 Vulnerable dependency ws 8.20.0: GHSA-96hv-2xvq-fx4p
OSV.dev reports `ws` at version `8.20.0` (resolved in `pnpm-lock.yaml`) is affected by GHSA-96hv-2xvq-fx4p (aka CVE-2026-48779). ws: Memory exhaustion DoS from tiny fragments and data chunks Aliases: CVE-2026-48779 Advisory: https://osv.dev/vulnerability/GHSA-96hv-2xvq-fx4p Fix: upgrade `ws` past…
package.json ScaOsvGhsa 96hv 2xvq fx4p
medium System graph quality Agent instructions conf 1.00 Agent instructions exist but release-hardening basics are missing
AI-coder instruction files were found, but the repo is missing ci. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable.
Repo hardeningGenerated repo pattern
medium System graph security Trivy conf 1.00 CVE-2026-45736: ws 8.20.0 — pnpm-lock.yaml
ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray` ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument.…
VulnCve 2026 45736
medium System graph security Trivy conf 1.00 CVE-2026-53550: js-yaml 4.1.1 — pnpm-lock.yaml
js-yaml: js-yaml: Denial of Service via crafted YAML merge keys js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence.…
VulnCve 2026 53550
medium System graph security Trivy conf 1.00 CVE-2026-9678: undici 7.26.0 — pnpm-lock.yaml
undici: Undici: Information disclosure due to improper cache-control header parsing Impact: Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-Control header uses whitespace-padded qualified private or no-cache field names such as private=" author…
VulnCve 2026 9678
medium System graph security Trivy conf 1.00 CVE-2026-9679: undici 7.26.0 — pnpm-lock.yaml
undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding Impact: undici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into their literal byte equivalents. RFC 6265 §5.4 does not spe…
VulnCve 2026 9679
medium System graph dependencies dependencies conf 0.90 Dependency @linear/sdk is two or more major versions behind
`@linear/sdk` is pinned at `82.1.0` in `package.json` while the latest release on the npm registry is `88.3.0` — 6 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@linear/sdk` to `88.3.0`.
package.json FreshnessOutdated
medium System graph security Coverage conf 1.00 No auth library detected
The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing.
auth
medium System graph cicd CI/CD security conf 1.00 No CI/CD pipelines detected
No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints.
CI/CD securityCoverage
medium System graph security Skillspector conf 0.75 SkillSpector RA2 (rogue-agent) in pnpm-lock.yaml
plist Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction. Skill: unknown Rule: RA2 Category: rogue-agent Severity: MEDIUM Confidence: 0.75 Remediatio…
pnpm-lock.yaml:2926 Mcp skillRogue agentRa2
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency @hono/node-server 1.19.14: GHSA-frvp-7c67-39w9
OSV.dev reports `@hono/node-server` at version `1.19.14` (resolved in `pnpm-lock.yaml`) is affected by GHSA-frvp-7c67-39w9. Note: `@hono/node-server` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Node.js Adapter for Hono: Path traversal in `serve-s…
pnpm-lock.yaml ScaOsvGhsa frvp 7c67 39w9
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency dompurify 3.2.7: GHSA-39q2-94rc-95cp
OSV.dev reports `dompurify` at version `3.2.7` (resolved in `pnpm-lock.yaml`) is affected by GHSA-39q2-94rc-95cp (aka CVE-2026-65903). DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation Aliases: CVE-2026-65903 Advisory: https://osv.dev/vulnerability/GHSA-39q2-…
pnpm-lock.yaml ScaOsvGhsa 39q2 94rc 95cp
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency dompurify 3.2.7: GHSA-76mc-f452-cxcm
OSV.dev reports `dompurify` at version `3.2.7` (resolved in `pnpm-lock.yaml`) is affected by GHSA-76mc-f452-cxcm (aka CVE-2026-65902). DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR` Aliases: CVE-2026-6…
pnpm-lock.yaml ScaOsvGhsa 76mc f452 cxcm
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency dompurify 3.2.7: GHSA-cj63-jhhr-wcxv
OSV.dev reports `dompurify` at version `3.2.7` (resolved in `pnpm-lock.yaml`) is affected by GHSA-cj63-jhhr-wcxv (aka CVE-2026-65913). DOMPurify USE_PROFILES prototype pollution allows event handlers Aliases: CVE-2026-65913 Advisory: https://osv.dev/vulnerability/GHSA-cj63-jhhr-wcxv Fix: upgrade …
pnpm-lock.yaml ScaOsvGhsa cj63 jhhr wcxv
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency dompurify 3.2.7: GHSA-cjmm-f4jc-qw8r
OSV.dev reports `dompurify` at version `3.2.7` (resolved in `pnpm-lock.yaml`) is affected by GHSA-cjmm-f4jc-qw8r (aka CVE-2026-65912). DOMPurify ADD_ATTR predicate skips URI validation Aliases: CVE-2026-65912 Advisory: https://osv.dev/vulnerability/GHSA-cjmm-f4jc-qw8r Fix: upgrade `dompurify` pas…
pnpm-lock.yaml ScaOsvGhsa cjmm f4jc qw8r
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency dompurify 3.2.7: GHSA-cmwh-pvxp-8882
OSV.dev reports `dompurify` at version `3.2.7` (resolved in `pnpm-lock.yaml`) is affected by GHSA-cmwh-pvxp-8882 (aka CVE-2026-65898). DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch) Aliases: CVE-202…
pnpm-lock.yaml ScaOsvGhsa cmwh pvxp 8882
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency dompurify 3.2.7: GHSA-crv5-9vww-q3g8
OSV.dev reports `dompurify` at version `3.2.7` (resolved in `pnpm-lock.yaml`) is affected by GHSA-crv5-9vww-q3g8 (aka CVE-2026-41239). DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode Aliases: CVE-2026-41239 Advisory: https://osv.dev/vulnerability/GHSA-crv5-9vww-q3g8 Fix: upgrade `dom…
pnpm-lock.yaml ScaOsvGhsa crv5 9vww q3g8
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency dompurify 3.2.7: GHSA-h7mw-gpvr-xq4m
OSV.dev reports `dompurify` at version `3.2.7` (resolved in `pnpm-lock.yaml`) is affected by GHSA-h7mw-gpvr-xq4m (aka CVE-2026-41240). DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix) Aliases: CVE-2026-41240 Advisory: https://osv.dev/vulnerabil…
pnpm-lock.yaml ScaOsvGhsa h7mw gpvr xq4m
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency dompurify 3.2.7: GHSA-h8r8-wccr-v5f2
OSV.dev reports `dompurify` at version `3.2.7` (resolved in `pnpm-lock.yaml`) is affected by GHSA-h8r8-wccr-v5f2 (aka CVE-2026-65914). DOMPurify is vulnerable to mutation-XSS via Re-Contextualization Aliases: CVE-2026-65914 Advisory: https://osv.dev/vulnerability/GHSA-h8r8-wccr-v5f2 Fix: upgrade …
pnpm-lock.yaml ScaOsvGhsa h8r8 wccr v5f2
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency dompurify 3.2.7: GHSA-hpcv-96wg-7vj8
OSV.dev reports `dompurify` at version `3.2.7` (resolved in `pnpm-lock.yaml`) is affected by GHSA-hpcv-96wg-7vj8 (aka CVE-2026-49458). DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks Aliases: CVE-2026-49458 Advisory: https://osv.dev…
pnpm-lock.yaml ScaOsvGhsa hpcv 96wg 7vj8
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency dompurify 3.2.7: GHSA-r47g-fvhr-h676
OSV.dev reports `dompurify` at version `3.2.7` (resolved in `pnpm-lock.yaml`) is affected by GHSA-r47g-fvhr-h676 (aka CVE-2026-49459). DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM Aliases: CVE-2026-49459 Advisory: https:/…
pnpm-lock.yaml ScaOsvGhsa r47g fvhr h676
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency dompurify 3.2.7: GHSA-rp9w-3fw7-7cwq
OSV.dev reports `dompurify` at version `3.2.7` (resolved in `pnpm-lock.yaml`) is affected by GHSA-rp9w-3fw7-7cwq (aka CVE-2026-49978). DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content Aliases: CVE-2026-49978 Advisory: https://osv.dev/vulnerability/GHSA-rp9…
pnpm-lock.yaml ScaOsvGhsa rp9w 3fw7 7cwq
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency dompurify 3.2.7: GHSA-v2wj-7wpq-c8vv
OSV.dev reports `dompurify` at version `3.2.7` (resolved in `pnpm-lock.yaml`) is affected by GHSA-v2wj-7wpq-c8vv (aka CVE-2026-0540). DOMPurify contains a Cross-site Scripting vulnerability Aliases: CVE-2026-0540 Advisory: https://osv.dev/vulnerability/GHSA-v2wj-7wpq-c8vv Fix: upgrade `dompurify`…
pnpm-lock.yaml ScaOsvGhsa v2wj 7wpq c8vv
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency dompurify 3.2.7: GHSA-v9jr-rg53-9pgp
OSV.dev reports `dompurify` at version `3.2.7` (resolved in `pnpm-lock.yaml`) is affected by GHSA-v9jr-rg53-9pgp (aka CVE-2026-41238). DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback Aliases: CVE-2026-41238 Advisory: https://osv.dev/vulnerability/GHSA-v9jr-rg53-9…
pnpm-lock.yaml ScaOsvGhsa v9jr rg53 9pgp
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency dompurify 3.4.5: GHSA-76mc-f452-cxcm
OSV.dev reports `dompurify` at version `3.4.5` (resolved in `pnpm-lock.yaml`) is affected by GHSA-76mc-f452-cxcm (aka CVE-2026-65902). DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR` Aliases: CVE-2026-6…
package.json ScaOsvGhsa 76mc f452 cxcm
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency dompurify 3.4.5: GHSA-cmwh-pvxp-8882
OSV.dev reports `dompurify` at version `3.4.5` (resolved in `pnpm-lock.yaml`) is affected by GHSA-cmwh-pvxp-8882 (aka CVE-2026-65898). DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch) Aliases: CVE-202…
package.json ScaOsvGhsa cmwh pvxp 8882
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency dompurify 3.4.5: GHSA-hpcv-96wg-7vj8
OSV.dev reports `dompurify` at version `3.4.5` (resolved in `pnpm-lock.yaml`) is affected by GHSA-hpcv-96wg-7vj8 (aka CVE-2026-49458). DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks Aliases: CVE-2026-49458 Advisory: https://osv.dev…
package.json ScaOsvGhsa hpcv 96wg 7vj8
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency dompurify 3.4.5: GHSA-r47g-fvhr-h676
OSV.dev reports `dompurify` at version `3.4.5` (resolved in `pnpm-lock.yaml`) is affected by GHSA-r47g-fvhr-h676 (aka CVE-2026-49459). DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM Aliases: CVE-2026-49459 Advisory: https:/…
package.json ScaOsvGhsa r47g fvhr h676
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency dompurify 3.4.5: GHSA-rp9w-3fw7-7cwq
OSV.dev reports `dompurify` at version `3.4.5` (resolved in `pnpm-lock.yaml`) is affected by GHSA-rp9w-3fw7-7cwq (aka CVE-2026-49978). DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content Aliases: CVE-2026-49978 Advisory: https://osv.dev/vulnerability/GHSA-rp9…
package.json ScaOsvGhsa rp9w 3fw7 7cwq
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency vite 7.3.2: GHSA-v6wh-96g9-6wx3
OSV.dev reports `vite` at version `7.3.2` (resolved in `pnpm-lock.yaml`) is affected by GHSA-v6wh-96g9-6wx3 (aka CVE-2026-53632). launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows Aliases: CVE-2026-53632 Advisory: https://osv.dev/vulnerability/GHSA-v6wh-96g9-6wx3 Fix: upgrade…
package.json ScaOsvGhsa v6wh 96g9 6wx3
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency ws 8.20.0: GHSA-58qx-3vcg-4xpx
OSV.dev reports `ws` at version `8.20.0` (resolved in `pnpm-lock.yaml`) is affected by GHSA-58qx-3vcg-4xpx (aka CVE-2026-45736). ws: Uninitialized memory disclosure Aliases: CVE-2026-45736 Advisory: https://osv.dev/vulnerability/GHSA-58qx-3vcg-4xpx Fix: upgrade `ws` past the affected range per th…
package.json ScaOsvGhsa 58qx 3vcg 4xpx
low System graph security Trivy conf 1.00 CVE-2026-11525: undici 7.26.0 — pnpm-lock.yaml
undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC…
VulnCve 2026 11525
low System graph security Trivy conf 1.00 CVE-2026-6733: undici 7.26.0 — pnpm-lock.yaml
undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. Impact: Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response…
VulnCve 2026 6733
low System graph quality Agent instructions conf 1.00 Multiple root agent instruction files without precedence
The repo has multiple top-level AI-coder instruction files. Without precedence rules, different agents may follow different policies.
Governance
low System graph cicd CI/CD security conf 1.00 package.json defines install-time lifecycle scripts
preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access.
package.json CI/CD securitySupply chainNpm
low System graph security Skillspector conf 0.70 SkillSpector EA3 (excessive-agency) in LICENSE
NOT LIMITED TO Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface. Skill: unknown Rule: EA3 Category: excessive-agency Severity: LOW Confidence: 0.70 Remediat…
LICENSE:16 Mcp skillExcessive agencyEa3
low System graph security Skillspector conf 0.40 SkillSpector SC1 (supply-chain) in package.json
"@electron-toolkit/preload": "^3.0.2" Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions. Skill: unknown Rule: SC1 Category: supply-chain Severity: LOW Confidence: 0.40 Remediation: Pin all dependency versions in requirements.txt or pypro…
package.json:85 Mcp skillSupply chainSc1
low System graph dependencies dependencies conf 0.90 Vulnerable dependency @babel/core 7.29.0: GHSA-4x5r-pxfx-6jf8
OSV.dev reports `@babel/core` at version `7.29.0` (resolved in `pnpm-lock.yaml`) is affected by GHSA-4x5r-pxfx-6jf8 (aka CVE-2026-49356). Note: `@babel/core` is a transitive dependency — pulled in by another package, not declared directly in a manifest. @babel/core: Arbitrary File Read via sourceM…
pnpm-lock.yaml ScaOsvGhsa 4x5r pxfx 6jf8
low System graph dependencies dependencies conf 1.00 Vulnerable dependency dompurify 3.2.7: GHSA-c2j3-45gr-mqc4
OSV.dev reports `dompurify` at version `3.2.7` (resolved in `pnpm-lock.yaml`) is affected by GHSA-c2j3-45gr-mqc4. DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements. Advisory: https://osv.dev/vulnerability/GHSA-c2j3-45gr-mqc4 Fix: upgrade `dompurify`…
pnpm-lock.yaml ScaOsvGhsa c2j3 45gr mqc4
low System graph dependencies dependencies conf 1.00 Vulnerable dependency dompurify 3.2.7: GHSA-gvmj-g25r-r7wr
OSV.dev reports `dompurify` at version `3.2.7` (resolved in `pnpm-lock.yaml`) is affected by GHSA-gvmj-g25r-r7wr (aka CVE-2026-65900). DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes Aliases: CVE-2026-65900 Adv…
pnpm-lock.yaml ScaOsvGhsa gvmj g25r r7wr
low System graph dependencies dependencies conf 1.00 Vulnerable dependency dompurify 3.2.7: GHSA-vxr8-fq34-vvx9
OSV.dev reports `dompurify` at version `3.2.7` (resolved in `pnpm-lock.yaml`) is affected by GHSA-vxr8-fq34-vvx9 (aka CVE-2026-65899). DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output Aliases: CVE-2026-65899 Advisory: https://osv.dev/vulne…
pnpm-lock.yaml ScaOsvGhsa vxr8 fq34 vvx9
low System graph dependencies dependencies conf 1.00 Vulnerable dependency dompurify 3.2.7: GHSA-x4vx-rjvf-j5p4
OSV.dev reports `dompurify` at version `3.2.7` (resolved in `pnpm-lock.yaml`) is affected by GHSA-x4vx-rjvf-j5p4 (aka CVE-2026-65901). DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects Alias…
pnpm-lock.yaml ScaOsvGhsa x4vx rjvf j5p4
low System graph dependencies dependencies conf 0.90 Vulnerable dependency dompurify 3.4.5: GHSA-c2j3-45gr-mqc4
OSV.dev reports `dompurify` at version `3.4.5` (resolved in `pnpm-lock.yaml`) is affected by GHSA-c2j3-45gr-mqc4. DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements. Advisory: https://osv.dev/vulnerability/GHSA-c2j3-45gr-mqc4 Fix: upgrade `dompurify`…
package.json ScaOsvGhsa c2j3 45gr mqc4
low System graph dependencies dependencies conf 0.90 Vulnerable dependency dompurify 3.4.5: GHSA-gvmj-g25r-r7wr
OSV.dev reports `dompurify` at version `3.4.5` (resolved in `pnpm-lock.yaml`) is affected by GHSA-gvmj-g25r-r7wr (aka CVE-2026-65900). DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes Aliases: CVE-2026-65900 Adv…
package.json ScaOsvGhsa gvmj g25r r7wr
low System graph dependencies dependencies conf 0.90 Vulnerable dependency dompurify 3.4.5: GHSA-vxr8-fq34-vvx9
OSV.dev reports `dompurify` at version `3.4.5` (resolved in `pnpm-lock.yaml`) is affected by GHSA-vxr8-fq34-vvx9 (aka CVE-2026-65899). DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output Aliases: CVE-2026-65899 Advisory: https://osv.dev/vulne…
package.json ScaOsvGhsa vxr8 fq34 vvx9
low System graph dependencies dependencies conf 0.90 Vulnerable dependency dompurify 3.4.5: GHSA-x4vx-rjvf-j5p4
OSV.dev reports `dompurify` at version `3.4.5` (resolved in `pnpm-lock.yaml`) is affected by GHSA-x4vx-rjvf-j5p4 (aka CVE-2026-65901). DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects Alias…
package.json ScaOsvGhsa x4vx rjvf j5p4
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/4b0dc229-d343-431b-aa0b-1d3617a3471b/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/4b0dc229-d343-431b-aa0b-1d3617a3471b/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.