{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-751573c72e7f4a03", "name": "Insecure pattern 'node_child_process' in docs/plans/publish-plugins-to-dist-repo-daily.html:356", "shortDescription": {"text": "Insecure pattern 'node_child_process' in docs/plans/publish-plugins-to-dist-repo-daily.html:356"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dee035d9657b6d45", "name": "Insecure pattern 'node_child_process' in scripts/build-dist.mjs:16", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/build-dist.mjs:16"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8f4c232b4aa78fc9", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-77166cbd46fcd8e4", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b11e957d69b1e005", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "anthropics/claude-code-action@beta can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6be293858f89ec27", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-11fe6710547243fb", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-de53ac274e5b4ecf", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-37716d9c0a33ad5c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 53 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d86524c0a5315e56", "name": "Agent authority lacks a verifier contract: .claude/rules/plugin-patterns.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/rules/plugin-patterns.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cf8554adedb0db04", "name": "Agent authority lacks a verifier contract: .claude/rules/marketplace.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/rules/marketplace.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-91467392067c9538", "name": "Agent authority lacks a verifier contract: .claude/commands/serve-docs.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/serve-docs.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-593c56aaf612eee2", "name": "Agent authority lacks a verifier contract: .claude/digests/code-digest-2026-05-31.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/digests/code-digest-2026-05-31.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-919d880bf42d1ccf", "name": "Agent instruction contains unpinned remote install: kit/plugins/plan-agent/skills/review-plan/SKILL.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: kit/plugins/plan-agent/skills/review-plan/SKILL.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f0b094786671b022", "name": "Agent instruction/config may expose a secret: kit/plugins/plan-agent/skills/refine-prompt/SKILL.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: kit/plugins/plan-agent/skills/refine-prompt/SKILL.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fed2a60d37a9ad65", "name": "Agent authority lacks a verifier contract: kit/plugins/agent-reviewer/skills/reviewing-agents/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: kit/plugins/agent-reviewer/skills/reviewing-agents/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4674fc51fe6f6e3d", "name": "Agent authority lacks a verifier contract: kit/plugins/code-review/skills/code-review-agent/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: kit/plugins/code-review/skills/code-review-agent/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8cc0e053707e6f8d", "name": "Agent authority lacks a verifier contract: kit/plugins/skill-reviewer/skills/reviewing-skills/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: kit/plugins/skill-reviewer/skills/reviewing-skills/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-347503385a8daf5a", "name": "Agent authority lacks a verifier contract: kit/plugins/issue-agent/skills/create-issue/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: kit/plugins/issue-agent/skills/create-issue/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-542b75d055183626", "name": "Agent authority lacks a verifier contract: kit/plugins/social-media-tools/skills/share-blog/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: kit/plugins/social-media-tools/skills/share-blog/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2e33a36fb656e76b", "name": "Agent authority lacks a verifier contract: kit/plugins/social-media-tools/skills/share-github/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: kit/plugins/social-media-tools/skills/share-github/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-24a561930f5d3281", "name": "Agent authority lacks a verifier contract: kit/plugins/social-media-tools/skills/share-selection/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: kit/plugins/social-media-tools/skills/share-selection/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4f2178a79ddd06e6", "name": "Agent instruction/config may expose a secret: kit/plugins/social-media-tools/skills/security-scrub/SKILL.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: kit/plugins/social-media-tools/skills/security-scrub/SKILL.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-09f6908e47c81e8a", "name": "Agent authority lacks a verifier contract: kit/plugins/social-media-tools/skills/security-scrub/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: kit/plugins/social-media-tools/skills/security-scrub/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c224e4dae5ea1d82", "name": "Agent authority lacks a verifier contract: kit/plugins/social-media-tools/skills/share-project/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: kit/plugins/social-media-tools/skills/share-project/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-18eac36a3f3fcc3f", "name": "Agent authority lacks a verifier contract: kit/plugins/social-media-tools/skills/share-code/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: kit/plugins/social-media-tools/skills/share-code/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f57e275ceb88e430", "name": "Agent authority lacks a verifier contract: kit/plugins/social-media-tools/skills/share-video/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: kit/plugins/social-media-tools/skills/share-video/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-77a8429db18319d3", "name": "Agent instruction contains unpinned remote install: kit/plugins/product-plans/skills/plan-review-agents/SKILL.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: kit/plugins/product-plans/skills/plan-review-agents/SKILL.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6e20c55c1f26bacb", "name": "Agent authority lacks a verifier contract: kit/plugins/code-simplifier/skills/code-simplifier/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: kit/plugins/code-simplifier/skills/code-simplifier/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-73d074de0d4a00c0", "name": "Agent authority lacks a verifier contract: kit/plugins/git-agent/skills/pr-agent/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: kit/plugins/git-agent/skills/pr-agent/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-92ab52e5a58c64cf", "name": "Commented-code block (5 lines) in tests/review-plan-skill.test.mjs:1", "shortDescription": {"text": "Commented-code block (5 lines) in tests/review-plan-skill.test.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d34a1cc62411d64f", "name": "Commented-code block (5 lines) in tests/plugins/test-backfill-digest.mjs:303", "shortDescription": {"text": "Commented-code block (5 lines) in tests/plugins/test-backfill-digest.mjs:303"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-09874dfbe5336b86", "name": "Commented-code block (5 lines) in scripts/build-dist.mjs:7", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/build-dist.mjs:7"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-600fb7077924e1ed", "name": "Commented-code block (5 lines) in scripts/backfill-plan-digests.mjs:170", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/backfill-plan-digests.mjs:170"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d89db016bc994497", "name": "Commented-code block (6 lines) in scripts/merge-marketplace.mjs:2", "shortDescription": {"text": "Commented-code block (6 lines) in scripts/merge-marketplace.mjs:2"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-166b9ca5a8e68c14", "name": "Commented-code block (6 lines) in scripts/merge-plans-index.mjs:2", "shortDescription": {"text": "Commented-code block (6 lines) in scripts/merge-plans-index.mjs:2"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e0a0ffbd9b68ffca", "name": "Commented-code block (5 lines) in kit/plugins/social-media-tools/scripts/session_usage.py:142", "shortDescription": {"text": "Commented-code block (5 lines) in kit/plugins/social-media-tools/scripts/session_usage.py:142"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nkit/plugins/plan-agent/hooks/validate-plan-filename.py:main, kit/plugins/plan-agent/hooks/rebuild-plans-index.py:main\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/19429"}, "properties": {"repository": "shawn-sandy/agentics", "repoUrl": "https://github.com/shawn-sandy/agentics", "branch": "main"}, "results": [{"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-751573c72e7f4a03", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in docs/plans/publish-plugins-to-dist-repo-daily.html:356"}, "properties": {"repobilityId": "39deffdd531b1cbf", "scanner": "scanner-primary", "fingerprint": "751573c72e7f4a03", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/plans/publish-plugins-to-dist-repo-daily.html"}, "region": {"startLine": 356}}}]}, {"ruleId": "scanner-dee035d9657b6d45", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/build-dist.mjs:16"}, "properties": {"repobilityId": "5e1f1b4c307c2627", "scanner": "scanner-primary", "fingerprint": "dee035d9657b6d45", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/build-dist.mjs"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-8f4c232b4aa78fc9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "979e3b58c19faf5e", "scanner": "scanner-primary", "fingerprint": "8f4c232b4aa78fc9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/claude-code-review.yml"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-8f4c232b4aa78fc9", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7572d8d133564421", "scanner": "scanner-primary", "fingerprint": "8f4c232b4aa78fc9", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/claude-code-review.yml"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-77166cbd46fcd8e4", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "50f3b563ffac10e9", "scanner": "scanner-primary", "fingerprint": "77166cbd46fcd8e4", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/claude-code-review.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b11e957d69b1e005", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f9b513edef62dc18", "scanner": "scanner-primary", "fingerprint": "b11e957d69b1e005", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/update-readme.yml"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-6be293858f89ec27", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "63d49a9bc61ab31d", "scanner": "scanner-primary", "fingerprint": "6be293858f89ec27", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/update-readme.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-11fe6710547243fb", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "c88f07fd35b9711f", "scanner": "scanner-primary", "fingerprint": "11fe6710547243fb", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy-pages.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-de53ac274e5b4ecf", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "02600186fc092bd4", "scanner": "scanner-primary", "fingerprint": "de53ac274e5b4ecf", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/claude.yml"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-de53ac274e5b4ecf", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8ead6a2c2bfe167b", "scanner": "scanner-primary", "fingerprint": "de53ac274e5b4ecf", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/claude.yml"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-37716d9c0a33ad5c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "abfb5752158cf655", "scanner": "scanner-primary", "fingerprint": "37716d9c0a33ad5c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/claude.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "db6062745b75f473", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "47dcf04cb092e421", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "5b195e08d327d003", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "cb297e7f47750640", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-d86524c0a5315e56", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/rules/plugin-patterns.md"}, "properties": {"repobilityId": "9aa911d6a85f83db", "scanner": "scanner-primary", "fingerprint": "d86524c0a5315e56", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/rules/plugin-patterns.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cf8554adedb0db04", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/rules/marketplace.md"}, "properties": {"repobilityId": "a03c921b2c7b7bb0", "scanner": "scanner-primary", "fingerprint": "cf8554adedb0db04", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/rules/marketplace.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-91467392067c9538", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/serve-docs.md"}, "properties": {"repobilityId": "99a6804ea5aaba18", "scanner": "scanner-primary", "fingerprint": "91467392067c9538", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/serve-docs.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-593c56aaf612eee2", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/digests/code-digest-2026-05-31.md"}, "properties": {"repobilityId": "d85f8e227aea144c", "scanner": "scanner-primary", "fingerprint": "593c56aaf612eee2", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/digests/code-digest-2026-05-31.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-919d880bf42d1ccf", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: kit/plugins/plan-agent/skills/review-plan/SKILL.md"}, "properties": {"repobilityId": "88c191167fed8d27", "scanner": "scanner-primary", "fingerprint": "919d880bf42d1ccf", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "kit/plugins/plan-agent/skills/review-plan/SKILL.md"}, "region": {"startLine": 58}}}]}, {"ruleId": "scanner-f0b094786671b022", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: kit/plugins/plan-agent/skills/refine-prompt/SKILL.md"}, "properties": {"repobilityId": "7a49174e3b5d11b7", "scanner": "scanner-primary", "fingerprint": "f0b094786671b022", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "kit/plugins/plan-agent/skills/refine-prompt/SKILL.md"}, "region": {"startLine": 264}}}]}, {"ruleId": "scanner-fed2a60d37a9ad65", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: kit/plugins/agent-reviewer/skills/reviewing-agents/SKILL.md"}, "properties": {"repobilityId": "a699161f5543525f", "scanner": "scanner-primary", "fingerprint": "fed2a60d37a9ad65", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "kit/plugins/agent-reviewer/skills/reviewing-agents/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4674fc51fe6f6e3d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: kit/plugins/code-review/skills/code-review-agent/SKILL.md"}, "properties": {"repobilityId": "74d475cf5293afed", "scanner": "scanner-primary", "fingerprint": "4674fc51fe6f6e3d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "kit/plugins/code-review/skills/code-review-agent/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8cc0e053707e6f8d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: kit/plugins/skill-reviewer/skills/reviewing-skills/SKILL.md"}, "properties": {"repobilityId": "1062739c53b59885", "scanner": "scanner-primary", "fingerprint": "8cc0e053707e6f8d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "kit/plugins/skill-reviewer/skills/reviewing-skills/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-347503385a8daf5a", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: kit/plugins/issue-agent/skills/create-issue/SKILL.md"}, "properties": {"repobilityId": "09c11620c8d05415", "scanner": "scanner-primary", "fingerprint": "347503385a8daf5a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "kit/plugins/issue-agent/skills/create-issue/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-542b75d055183626", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: kit/plugins/social-media-tools/skills/share-blog/SKILL.md"}, "properties": {"repobilityId": "6adc0c4f894ba7a1", "scanner": "scanner-primary", "fingerprint": "542b75d055183626", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "kit/plugins/social-media-tools/skills/share-blog/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2e33a36fb656e76b", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: kit/plugins/social-media-tools/skills/share-github/SKILL.md"}, "properties": {"repobilityId": "507045e6c3527b19", "scanner": "scanner-primary", "fingerprint": "2e33a36fb656e76b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "kit/plugins/social-media-tools/skills/share-github/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-24a561930f5d3281", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: kit/plugins/social-media-tools/skills/share-selection/SKILL.md"}, "properties": {"repobilityId": "e819e5af66b4633d", "scanner": "scanner-primary", "fingerprint": "24a561930f5d3281", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "kit/plugins/social-media-tools/skills/share-selection/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4f2178a79ddd06e6", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: kit/plugins/social-media-tools/skills/security-scrub/SKILL.md"}, "properties": {"repobilityId": "cb5bdb5dafc57494", "scanner": "scanner-primary", "fingerprint": "4f2178a79ddd06e6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "kit/plugins/social-media-tools/skills/security-scrub/SKILL.md"}, "region": {"startLine": 59}}}]}, {"ruleId": "scanner-09f6908e47c81e8a", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: kit/plugins/social-media-tools/skills/security-scrub/SKILL.md"}, "properties": {"repobilityId": "2158697df1ce2147", "scanner": "scanner-primary", "fingerprint": "09f6908e47c81e8a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "kit/plugins/social-media-tools/skills/security-scrub/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c224e4dae5ea1d82", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: kit/plugins/social-media-tools/skills/share-project/SKILL.md"}, "properties": {"repobilityId": "2c50857cb4100c3f", "scanner": "scanner-primary", "fingerprint": "c224e4dae5ea1d82", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "kit/plugins/social-media-tools/skills/share-project/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-18eac36a3f3fcc3f", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: kit/plugins/social-media-tools/skills/share-code/SKILL.md"}, "properties": {"repobilityId": "ff38af6aa9b1299c", "scanner": "scanner-primary", "fingerprint": "18eac36a3f3fcc3f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "kit/plugins/social-media-tools/skills/share-code/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f57e275ceb88e430", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: kit/plugins/social-media-tools/skills/share-video/SKILL.md"}, "properties": {"repobilityId": "fdf1f2a099db5d76", "scanner": "scanner-primary", "fingerprint": "f57e275ceb88e430", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "kit/plugins/social-media-tools/skills/share-video/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-77a8429db18319d3", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: kit/plugins/product-plans/skills/plan-review-agents/SKILL.md"}, "properties": {"repobilityId": "43401262bda8d78d", "scanner": "scanner-primary", "fingerprint": "77a8429db18319d3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "kit/plugins/product-plans/skills/plan-review-agents/SKILL.md"}, "region": {"startLine": 107}}}]}, {"ruleId": "scanner-6e20c55c1f26bacb", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: kit/plugins/code-simplifier/skills/code-simplifier/SKILL.md"}, "properties": {"repobilityId": "3dbc435e3fbabe07", "scanner": "scanner-primary", "fingerprint": "6e20c55c1f26bacb", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "kit/plugins/code-simplifier/skills/code-simplifier/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-73d074de0d4a00c0", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: kit/plugins/git-agent/skills/pr-agent/SKILL.md"}, "properties": {"repobilityId": "e035c261b8eadae2", "scanner": "scanner-primary", "fingerprint": "73d074de0d4a00c0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "kit/plugins/git-agent/skills/pr-agent/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-92ab52e5a58c64cf", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/review-plan-skill.test.mjs:1"}, "properties": {"repobilityId": "3691b850ae3383d3", "scanner": "scanner-primary", "fingerprint": "92ab52e5a58c64cf", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d34a1cc62411d64f", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/plugins/test-backfill-digest.mjs:303"}, "properties": {"repobilityId": "b6ffc5469f2015d0", "scanner": "scanner-primary", "fingerprint": "d34a1cc62411d64f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-09874dfbe5336b86", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/build-dist.mjs:7"}, "properties": {"repobilityId": "a633e99ca21d6a12", "scanner": "scanner-primary", "fingerprint": "09874dfbe5336b86", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-600fb7077924e1ed", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/backfill-plan-digests.mjs:170"}, "properties": {"repobilityId": "f4ff7f3521f1f5be", "scanner": "scanner-primary", "fingerprint": "600fb7077924e1ed", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d89db016bc994497", "level": "none", "message": {"text": "Commented-code block (6 lines) in scripts/merge-marketplace.mjs:2"}, "properties": {"repobilityId": "c272620387bd50e4", "scanner": "scanner-primary", "fingerprint": "d89db016bc994497", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-166b9ca5a8e68c14", "level": "none", "message": {"text": "Commented-code block (6 lines) in scripts/merge-plans-index.mjs:2"}, "properties": {"repobilityId": "7e9b4de01231406c", "scanner": "scanner-primary", "fingerprint": "166b9ca5a8e68c14", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e0a0ffbd9b68ffca", "level": "none", "message": {"text": "Commented-code block (5 lines) in kit/plugins/social-media-tools/scripts/session_usage.py:142"}, "properties": {"repobilityId": "3aca6815b4034418", "scanner": "scanner-primary", "fingerprint": "e0a0ffbd9b68ffca", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "4f9115752adb500c", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}]}]}