{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-840df5dc1b52d03b", "name": "Possibly dead Python function: heading1", "shortDescription": {"text": "Possibly dead Python function: heading1"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6c1e4513de59396f", "name": "Possibly dead Python function: heading2", "shortDescription": {"text": "Possibly dead Python function: heading2"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-80cb8292c50b7454", "name": "Possibly dead Python function: heading3", "shortDescription": {"text": "Possibly dead Python function: heading3"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9900d78c405030af", "name": "Possibly dead Python function: paragraph", "shortDescription": {"text": "Possibly dead Python function: paragraph"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e09516719548c736", "name": "Possibly dead Python function: walk", "shortDescription": {"text": "Possibly dead Python function: walk"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 37 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cbb5857940ba0dc2", "name": "Agent instruction/config may expose a secret: AGENTS.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: AGENTS.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-521df3c136a98ff6", "name": "Agent instruction/config may expose a secret: skills/repo-tooling/ai-agent-skills-update/SKILL.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: skills/repo-tooling/ai-agent-skills-update/SKILL.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9692c44e3813b829", "name": "Agent instruction contains unpinned remote install: skills/repo-tooling/ai-agent-skills-update/SKILL.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: skills/repo-tooling/ai-agent-skills-update/SKILL.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-65312a283c34b146", "name": "Agent authority lacks a verifier contract: skills/nav-2009/nav2009-development/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/nav-2009/nav2009-development/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d1283306f6bbf29d", "name": "Agent authority lacks a verifier contract: skills/nav-2009/nav2009-permissions-security/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/nav-2009/nav2009-permissions-security/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6978190a1bd560d2", "name": "Agent authority lacks a verifier contract: skills/documents/branded-report/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/documents/branded-report/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-25689c9f03472e8b", "name": "Commented-code block (7 lines) in tests/validate-skills.mjs:14", "shortDescription": {"text": "Commented-code block (7 lines) in tests/validate-skills.mjs:14"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-472afa0145355cd0", "name": "Network/subprocess call without timeout or try/except \u2014 skills/time-tracking/7pace-time-tracker/scripts/timetracker.py:3", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 skills/time-tracking/7pace-time-tracker/scripts/timetracker.py:337"}, "fullDescription": {"text": "`requests.get(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6a4d3199fe3a0285", "name": "Commented-code block (5 lines) in skills/time-tracking/7pace-time-tracker/scripts/test_timetracker.py:202", "shortDescription": {"text": "Commented-code block (5 lines) in skills/time-tracking/7pace-time-tracker/scripts/test_timetracker.py:202"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-488037b10181f5ec", "name": "Network/subprocess call without timeout or try/except \u2014 skills/documents/branded-report/scripts/build_report.py:211", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 skills/documents/branded-report/scripts/build_report.py:211"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nskills/time-tracking/7pace-time-tracker/scripts/timetracker.py:get_worklogs, skills/time-tracking/7pace-time-tracker/scripts/timetracker.py:get_worklog\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/22703"}, "properties": {"repository": "whobat/AI-Agent-skills", "repoUrl": "https://github.com/whobat/AI-Agent-skills", "branch": "main"}, "results": [{"ruleId": "scanner-840df5dc1b52d03b", "level": "note", "message": {"text": "Possibly dead Python function: heading1"}, "properties": {"repobilityId": "48ff11818c5f901b", "scanner": "scanner-primary", "fingerprint": "840df5dc1b52d03b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/documents/branded-report/scripts/docx_render.py:95"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6c1e4513de59396f", "level": "note", "message": {"text": "Possibly dead Python function: heading2"}, "properties": {"repobilityId": "74b10cde51fda614", "scanner": "scanner-primary", "fingerprint": "6c1e4513de59396f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/documents/branded-report/scripts/docx_render.py:106"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-80cb8292c50b7454", "level": "note", "message": {"text": "Possibly dead Python function: heading3"}, "properties": {"repobilityId": "e83278cb1d98a7a4", "scanner": "scanner-primary", "fingerprint": "80cb8292c50b7454", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/documents/branded-report/scripts/docx_render.py:117"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9900d78c405030af", "level": "note", "message": {"text": "Possibly dead Python function: paragraph"}, "properties": {"repobilityId": "7eecaf3a75690e9e", "scanner": "scanner-primary", "fingerprint": "9900d78c405030af", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/documents/branded-report/scripts/docx_render.py:127"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e09516719548c736", "level": "note", "message": {"text": "Possibly dead Python function: walk"}, "properties": {"repobilityId": "0a89256752822a6e", "scanner": "scanner-primary", "fingerprint": "e09516719548c736", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/documents/branded-report/scripts/docx_render.py:260"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "03823d1d0cb29a5f", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "f9d2504ac53a2149", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "de5e58b1ce848b79", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-cbb5857940ba0dc2", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: AGENTS.md"}, "properties": {"repobilityId": "e12c7213d5eadf3e", "scanner": "scanner-primary", "fingerprint": "cbb5857940ba0dc2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "agents_md"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "AGENTS.md"}, "region": {"startLine": 81}}}]}, {"ruleId": "scanner-521df3c136a98ff6", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: skills/repo-tooling/ai-agent-skills-update/SKILL.md"}, "properties": {"repobilityId": "662b5c6a1c5ad9e0", "scanner": "scanner-primary", "fingerprint": "521df3c136a98ff6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/repo-tooling/ai-agent-skills-update/SKILL.md"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-9692c44e3813b829", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: skills/repo-tooling/ai-agent-skills-update/SKILL.md"}, "properties": {"repobilityId": "064a557b8f521c10", "scanner": "scanner-primary", "fingerprint": "9692c44e3813b829", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/repo-tooling/ai-agent-skills-update/SKILL.md"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-65312a283c34b146", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/nav-2009/nav2009-development/SKILL.md"}, "properties": {"repobilityId": "eea48916770ff37f", "scanner": "scanner-primary", "fingerprint": "65312a283c34b146", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/nav-2009/nav2009-development/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d1283306f6bbf29d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/nav-2009/nav2009-permissions-security/SKILL.md"}, "properties": {"repobilityId": "177d197001e57b99", "scanner": "scanner-primary", "fingerprint": "d1283306f6bbf29d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/nav-2009/nav2009-permissions-security/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6978190a1bd560d2", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/documents/branded-report/SKILL.md"}, "properties": {"repobilityId": "f67c89ff7884234f", "scanner": "scanner-primary", "fingerprint": "6978190a1bd560d2", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/documents/branded-report/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-25689c9f03472e8b", "level": "none", "message": {"text": "Commented-code block (7 lines) in tests/validate-skills.mjs:14"}, "properties": {"repobilityId": "6e7efa533a55bea4", "scanner": "scanner-primary", "fingerprint": "25689c9f03472e8b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-472afa0145355cd0", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 skills/time-tracking/7pace-time-tracker/scripts/timetracker.py:337"}, "properties": {"repobilityId": "c6088052e7e82055", "scanner": "scanner-primary", "fingerprint": "472afa0145355cd0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-6a4d3199fe3a0285", "level": "none", "message": {"text": "Commented-code block (5 lines) in skills/time-tracking/7pace-time-tracker/scripts/test_timetracker.py:202"}, "properties": {"repobilityId": "4a4191f4a79f7b2b", "scanner": "scanner-primary", "fingerprint": "6a4d3199fe3a0285", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-488037b10181f5ec", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 skills/documents/branded-report/scripts/build_report.py:211"}, "properties": {"repobilityId": "f7894f26d1c93abe", "scanner": "scanner-primary", "fingerprint": "488037b10181f5ec", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "7f74d1c1c5a48cf0", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}]}]}