nicobailon/pi-subagents

Component	Sub-score	Weight	Contribution
`structure_score`	100.0	0.15	15.00
`security_score`	85.0	0.25	21.25
`testing_score`	90.0	0.20	18.00
`documentation_score`	52.0	0.15	7.80
`practices_score`	72.0	0.15	10.80
`code_quality`	67.4	0.10	6.74
Overall		1.00	79.6

high Legacy quality quality conf 1.00 ✓ Repobility [MINED027] React State Array Mutation: state.X.push/splice/sort followed by setState — React skips re-render on mutated reference.

Review and fix per the pattern semantics. See CWE-682 / for context.

src/runs/shared/long-running-guard.ts:162 qualitylegacy

low Legacy software xss conf 1.00 [SEC040] innerHTML XSS — template literal with server-supplied data: Setting .innerHTML with a template literal that interpolates server-supplied or user-supplied data is the canonical stored/reflected XSS vector. The browser parses the HTML and executes any <script> or event-handler attributes in the data. CWE-79. Especially dangerous when the data comes from a CV parser, profile field, or any user-input pipeline.

For plain text: use el.textContent = data.value (auto-escapes). For HTML you need to render: el.innerHTML = DOMPurify.sanitize(html). For React/Vue/Svelte: stop using innerHTML; use the framework's binding. When data comes from CV/PDF parsers, sanitize at the parser boundary too.

src/runs/background/run-id-resolver.ts:80 xsslegacy

low Legacy software xss conf 1.00 [SEC040] innerHTML XSS — template literal with server-supplied data: Setting .innerHTML with a template literal that interpolates server-supplied or user-supplied data is the canonical stored/reflected XSS vector. The browser parses the HTML and executes any <script> or event-handler attributes in the data. CWE-79. Especially dangerous when the data comes from a CV parser, profile field, or any user-input pipeline.

For plain text: use el.textContent = data.value (auto-escapes). For HTML you need to render: el.innerHTML = DOMPurify.sanitize(html). For React/Vue/Svelte: stop using innerHTML; use the framework's binding. When data comes from CV/PDF parsers, sanitize at the parser boundary too.

src/extension/doctor.ts:102 xsslegacy

low Legacy software xss conf 1.00 [SEC040] innerHTML XSS — template literal with server-supplied data: Setting .innerHTML with a template literal that interpolates server-supplied or user-supplied data is the canonical stored/reflected XSS vector. The browser parses the HTML and executes any <script> or event-handler attributes in the data. CWE-79. Especially dangerous when the data comes from a CV parser, profile field, or any user-input pipeline.

For plain text: use el.textContent = data.value (auto-escapes). For HTML you need to render: el.innerHTML = DOMPurify.sanitize(html). For React/Vue/Svelte: stop using innerHTML; use the framework's binding. When data comes from CV/PDF parsers, sanitize at the parser boundary too.

src/agents/agent-serializer.ts:41 xsslegacy

high Legacy security path_traversal conf 1.00 [SEC114] path.join / Path() on user-controlled segment without containment check: filepath.Clean / path.Join on attacker-supplied segments does NOT prevent escape from the base directory. `../../../etc/passwd` resolves cleanly.

After joining, re-check containment: `if !strings.HasPrefix(filepath.Clean(joined), filepath.Clean(baseDir)+string(os.PathSeparator)) { error }`. In Node: `path.resolve(base, x); if (!resolved.startsWith(base + path.sep)) throw`.

src/shared/artifacts.ts:20 path_traversallegacy

high Legacy security path_traversal conf 1.00 [SEC114] path.join / Path() on user-controlled segment without containment check: filepath.Clean / path.Join on attacker-supplied segments does NOT prevent escape from the base directory. `../../../etc/passwd` resolves cleanly.

After joining, re-check containment: `if !strings.HasPrefix(filepath.Clean(joined), filepath.Clean(baseDir)+string(os.PathSeparator)) { error }`. In Node: `path.resolve(base, x); if (!resolved.startsWith(base + path.sep)) throw`.

src/runs/shared/single-output.ts:29 path_traversallegacy

high Legacy security path_traversal conf 1.00 [SEC114] path.join / Path() on user-controlled segment without containment check: filepath.Clean / path.Join on attacker-supplied segments does NOT prevent escape from the base directory. `../../../etc/passwd` resolves cleanly.

After joining, re-check containment: `if !strings.HasPrefix(filepath.Clean(joined), filepath.Clean(baseDir)+string(os.PathSeparator)) { error }`. In Node: `path.resolve(base, x); if (!resolved.startsWith(base + path.sep)) throw`.

src/extension/doctor.ts:109 path_traversallegacy

high Legacy software dependency conf 0.90 ✓ Repobility Action `actions/checkout` pinned to mutable ref `@v5`

`uses: actions/checkout@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.

.github/workflows/release.yml:18 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility Action `actions/setup-node` pinned to mutable ref `@v5`

`uses: actions/setup-node@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.

.github/workflows/release.yml:19 dependencylegacy

medium Legacy software dependency conf 0.90 GitHub Action `actions/checkout@v5` is 1 major version(s) behind (latest v6.0.2)

`uses: actions/checkout@v5` is 1 major version(s) behind the latest published release v6.0.2. Old action majors run on deprecated runner images / Node versions and miss upstream fixes. This is the exact 'outdated GitHub Action' class Dependabot raises — and which Repobility had no coverage for.

.github/workflows/release.yml:18 dependencylegacy

medium Legacy software dependency conf 0.90 GitHub Action `actions/setup-node@v5` is 1 major version(s) behind (latest v6.4.0)

`uses: actions/setup-node@v5` is 1 major version(s) behind the latest published release v6.4.0. Old action majors run on deprecated runner images / Node versions and miss upstream fixes. This is the exact 'outdated GitHub Action' class Dependabot raises — and which Repobility had no coverage for.

.github/workflows/release.yml:19 dependencylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Duplicated blocks are a common artifact when generated code is pasted or recreated instead of reused. They increase maintenance cost because every future bug fix must be found in multiple locations.

src/slash/slash-bridge.ts:142 qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Duplicated blocks are a common artifact when generated code is pasted or recreated instead of reused. They increase maintenance cost because every future bug fix must be found in multiple locations.

src/runs/shared/nested-events.ts:726 qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Duplicated blocks are a common artifact when generated code is pasted or recreated instead of reused. They increase maintenance cost because every future bug fix must be found in multiple locations.

src/intercom/intercom-bridge.ts:120 qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Duplicated blocks are a common artifact when generated code is pasted or recreated instead of reused. They increase maintenance cost because every future bug fix must be found in multiple locations.

src/extension/index.ts:188 qualitylegacy

low Legacy quality documentation No LICENSE file

Add a LICENSE file to your repository. Use choosealicense.com to pick the right license (MIT for permissive, Apache 2.0 for patent protection, GPL for copyleft).

documentationlegacy

low Legacy software dependency conf 0.90 npm package `@earendil-works/pi-agent-core` is minor version(s) behind (^0.74.0 -> 0.78.0)

`@earendil-works/pi-agent-core` is pinned/resolved at ^0.74.0 but the latest stable release on the npm registry is 0.78.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-updat…

package.json dependencylegacy

low Legacy software dependency conf 0.90 npm package `@earendil-works/pi-ai` is minor version(s) behind (^0.74.0 -> 0.78.0)

`@earendil-works/pi-ai` is pinned/resolved at ^0.74.0 but the latest stable release on the npm registry is 0.78.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs ra…

package.json dependencylegacy

low Legacy software dependency conf 0.90 npm package `@earendil-works/pi-coding-agent` is minor version(s) behind (^0.74.0 -> 0.78.0)

`@earendil-works/pi-coding-agent` is pinned/resolved at ^0.74.0 but the latest stable release on the npm registry is 0.78.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-upd…

package.json dependencylegacy

low Legacy software dependency conf 0.90 npm package `@earendil-works/pi-tui` is minor version(s) behind (^0.74.0 -> 0.78.0)

`@earendil-works/pi-tui` is pinned/resolved at ^0.74.0 but the latest stable release on the npm registry is 0.78.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs r…

package.json dependencylegacy

low Legacy quality quality conf 1.00 ✓ Repobility [MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError if wrong.

Review and fix per the pattern semantics. See CWE-476 / for context.

src/runs/background/top-level-async.ts:11 qualitylegacy

low Legacy quality quality conf 1.00 ✓ Repobility [MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError if wrong.

Review and fix per the pattern semantics. See CWE-476 / for context.

src/runs/background/result-watcher.ts:193 qualitylegacy

low Legacy quality quality conf 1.00 ✓ Repobility [MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError if wrong.

Review and fix per the pattern semantics. See CWE-476 / for context.

src/agents/chain-serializer.ts:97 qualitylegacy

Complete repo analysis