Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo
118 of your 186 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.

Scan timing: clone 5.57s · analysis 12.18s · 30.7 MB · GitHub API rate-limit (preflight)

calesthio/OpenMontage

https://github.com/calesthio/OpenMontage.git · scanned 2026-06-22 13:35 UTC (1 month ago) · 10 languages

799 raw signals (173 security + 626 graph) 11/13 scanners ran 40th percentile · Python · large (100-500K LoC)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 1 month ago · v1 · 314 actionable findings from 2 signal sources. 460 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
73.4
/100
Security checks
83
41 findings
System graph
64
77.8% cov · 273 findings
Critical
1
click to filter
Agents
10
0 votes
Crowd
0
reported
Score breakdown â 2026-05-18-v5
Component Sub-score Weight Contribution
structure_score 85.0 0.15 12.75
security_score 100.0 0.25 25.00
testing_score 38.0 0.20 7.60
documentation_score 88.0 0.15 13.20
practices_score 42.0 0.15 6.30
code_quality 56.0 0.10 5.60
Overall 1.00 70.4
security_score may be inflated — optional security scanners were skipped on this fast scan
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 1 High 56 Medium 166 Low 49 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 41 System graph 273 Crowd 0 Layer: Quality 162 Security 128 Software 21 Frontend 3
Scan summary Repository scanned at 63.8/100 with 77.8% coverage. It contains 3457 nodes across 0 cross-layer flows, written primarily in mixed languages. Engine surfaced 626 findings — concentrated in security (458), quality (140), software (25). Risk profile is high: 1 critical, 60 high, 490 medium. Recommended next step: open the security layer findings first — that's where the highest-impact wins live.

Showing 272 of 314 actionable findings. 774 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

high Security checks quality Quality conf 1.00 ✓ Repobility [MINED107] Missing import: `warnings` used but not imported: The file uses `warnings.something(...)` but never imports `warnings`. This raises NameError at runtime the first time the line executes.
Add `import warnings` at the top of the file.
tools/analysis/composition_validator.py:241
high Security checks quality Quality conf 1.00 ✓ Repobility [MINED107] Missing import: `warnings` used but not imported: The file uses `warnings.something(...)` but never imports `warnings`. This raises NameError at runtime the first time the line executes.
Add `import warnings` at the top of the file.
tools/video/video_compose.py:853
critical System graph security Trivy conf 1.00 CVE-2022-37601: loader-utils 2.0.2 — remotion-composer/package-lock.json
loader-utils: prototype pollution in function parseQuery in parseQuery.js Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3. Package: loader-utils Installed: …
VulnCve 2022 37601
low Security checks security Injection conf 0.80 3 occurrences [SEC005] Command Injection Risk: Unsafe shell execution or eval of user input.
Use subprocess with shell=False and a list of args. Never eval user input.
3 files, 3 locations
.agents/skills/manimgl-best-practices/templates/3d_scene.py:258
.agents/skills/manimgl-best-practices/templates/basic_scene.py:134
.agents/skills/manimgl-best-practices/templates/math_scene.py:333
low Security checks security path traversal conf 0.80 [SEC013] Path Traversal — User Input in File Path: User-controlled input used in file path without sanitization. Allows reading arbitrary files.
Use os.path.realpath() and verify the path starts with your expected base directory. Use secure_filename() for uploads.
tools/enhancement/bg_remove.py:129
high System graph security Agent instructions conf 1.00 Agent instruction/config may expose a secret: .claude/skills/avatar-video/references/captions.md
Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only.
.claude/skills/avatar-video/references/captions.md:138 SecretsClaude instruction
high System graph security Agent instructions conf 1.00 Agent instruction/config may expose a secret: .claude/skills/avatar-video/references/photo-avatars.md
Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only.
.claude/skills/avatar-video/references/photo-avatars.md:169 SecretsClaude instruction
high System graph security Agent instructions conf 1.00 Agent instruction/config may expose a secret: .claude/skills/bfl-api/references/api-key-setup.md
Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only.
.claude/skills/bfl-api/references/api-key-setup.md:50 SecretsClaude instruction
high System graph security Agent instructions conf 1.00 Agent instruction/config may expose a secret: .claude/skills/bfl-api/references/webhook-integration.md
Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only.
.claude/skills/bfl-api/references/webhook-integration.md:270 SecretsClaude instruction
high System graph security Agent instructions conf 1.00 Agent instruction/config may expose a secret: .claude/skills/bfl-api/SKILL.md
Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only.
.claude/skills/bfl-api/SKILL.md:163 SecretsClaude instruction
high System graph security Agent instructions conf 1.00 Agent instruction/config may expose a secret: .claude/skills/heygen/references/captions.md
Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only.
.claude/skills/heygen/references/captions.md:138 SecretsClaude instruction
high System graph security Agent instructions conf 1.00 Agent instruction/config may expose a secret: .claude/skills/heygen/references/photo-avatars.md
Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only.
.claude/skills/heygen/references/photo-avatars.md:169 SecretsClaude instruction
high System graph security Agent instructions conf 1.00 Agent instruction/config may expose a secret: .claude/skills/ltx2/SKILL.md
Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only.
.claude/skills/ltx2/SKILL.md:164 SecretsClaude instruction
high System graph security Agent instructions conf 1.00 Agent instruction/config may expose a secret: .claude/skills/threejs-materials/SKILL.md
Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only.
.claude/skills/threejs-materials/SKILL.md:505 SecretsClaude instruction
high System graph security Agent instructions conf 1.00 Agent instruction/config may expose a secret: .claude/skills/video-translate/SKILL.md
Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only.
.claude/skills/video-translate/SKILL.md:230 SecretsClaude instruction
high System graph security Agent instructions conf 1.00 Agent instruction/config may expose a secret: .claude/skills/video_toolkit/SKILL.md
Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only.
.claude/skills/video_toolkit/SKILL.md:7 SecretsClaude instruction
high System graph security Trivy conf 1.00 CVE-2022-37599: loader-utils 2.0.2 — remotion-composer/package-lock.json
loader-utils: regular expression denial of service in interpolateName.js A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the resourcePath variable in interpolateName.js. Package: loader-utils Install…
VulnCve 2022 37599
high System graph security Trivy conf 1.00 CVE-2022-37603: loader-utils 2.0.2 — remotion-composer/package-lock.json
loader-utils: Regular expression denial of service A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js. Package: loader-utils Installed: 2.0.2 Fixed in: 1.4.2, 2.0.…
VulnCve 2022 37603
high System graph security Trivy conf 1.00 CVE-2026-48779: ws 8.17.1 — remotion-composer/package-lock.json
ws is an open source WebSocket client and server for Node.js. All vers ... ### Impact A high volume of exceptionally small fragments and data chunks can be sent by a peer, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more m…
VulnCve 2026 48779
high System graph security Trivy conf 1.00 CVE-2026-6321: fast-uri 3.1.0 — remotion-composer/package-lock.json
fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory r…
VulnCve 2026 6321
high System graph security Trivy conf 1.00 CVE-2026-6322: fast-uri 3.1.0 — remotion-composer/package-lock.json
fast-uri: fast-uri: URI authority bypass due to improper delimiter handling fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host that combined an allowed domain, an encoded at-sign, and a…
VulnCve 2026 6322
high System graph security Skillspector conf 0.60 SkillSpector AST5 (behavioral-ast) in .claude/skills/manimgl-best-practices/templates/3d_scene.py
os.system(f"manimgl {__file__} ThreeDSceneTemplate") os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution. Skill: manimgl-best-practices Rule: AST5 Category: behavioral-ast Severity: HIGH Confidence: 0.60 Remediation: …
.claude/skills/manimgl-best-practices/templates/3d_scene.py:258 Mcp skillBehavioral astAst5
high System graph security Skillspector conf 0.60 SkillSpector AST5 (behavioral-ast) in .claude/skills/manimgl-best-practices/templates/basic_scene.py
os.system(f"manimgl {__file__} BasicSceneTemplate") os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution. Skill: manimgl-best-practices Rule: AST5 Category: behavioral-ast Severity: HIGH Confidence: 0.60 Remediation: R…
.claude/skills/manimgl-best-practices/templates/basic_scene.py:134 Mcp skillBehavioral astAst5
high System graph security Skillspector conf 0.60 SkillSpector AST5 (behavioral-ast) in .claude/skills/manimgl-best-practices/templates/math_scene.py
os.system(f"manimgl {__file__} MathSceneTemplate") os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution. Skill: manimgl-best-practices Rule: AST5 Category: behavioral-ast Severity: HIGH Confidence: 0.60 Remediation: Re…
.claude/skills/manimgl-best-practices/templates/math_scene.py:333 Mcp skillBehavioral astAst5
high System graph security Skillspector conf 0.80 SkillSpector E2 (data-exfil) in .claude/skills/ai-video-gen/SKILL.md
os.environ["HEYGEN_API_KEY"] Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: ai-video-gen Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.80 Remediation: Avoid reading sensitive env vars (API keys…
.claude/skills/ai-video-gen/SKILL.md:169 Mcp skillData exfilE2
high System graph security Skillspector conf 0.80 SkillSpector E2 (data-exfil) in .claude/skills/avatar-video/references/assets.md
os.environ["HEYGEN_API_KEY"] Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: avatar-video Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.80 Remediation: Avoid reading sensitive env vars (API keys…
.claude/skills/avatar-video/references/assets.md:145 Mcp skillData exfilE2
high System graph security Skillspector conf 0.80 SkillSpector E2 (data-exfil) in .claude/skills/avatar-video/references/avatars.md
os.environ["HEYGEN_API_KEY"] Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: avatar-video Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.80 Remediation: Avoid reading sensitive env vars (API keys…
.claude/skills/avatar-video/references/avatars.md:105 Mcp skillData exfilE2
high System graph security Skillspector conf 0.80 SkillSpector E2 (data-exfil) in .claude/skills/avatar-video/references/photo-avatars.md
os.environ["HEYGEN_API_KEY"] Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: avatar-video Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.80 Remediation: Avoid reading sensitive env vars (API keys…
.claude/skills/avatar-video/references/photo-avatars.md:263 Mcp skillData exfilE2
high System graph security Skillspector conf 0.80 SkillSpector E2 (data-exfil) in .claude/skills/avatar-video/references/quota.md
os.environ["HEYGEN_API_KEY"] Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: avatar-video Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.80 Remediation: Avoid reading sensitive env vars (API keys…
.claude/skills/avatar-video/references/quota.md:46 Mcp skillData exfilE2
high System graph security Skillspector conf 0.80 2 occurrences SkillSpector E2 (data-exfil) in .claude/skills/avatar-video/references/templates.md
os.environ["HEYGEN_API_KEY"] Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: avatar-video Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.80 Remediation: Avoid reading sensitive env vars (API keys…
lines 69, 226
.claude/skills/avatar-video/references/templates.md:69, 226 (2 hits)
Mcp skillData exfilE2
high System graph security Skillspector conf 0.80 SkillSpector E2 (data-exfil) in .claude/skills/avatar-video/references/video-generation.md
os.environ["HEYGEN_API_KEY"] Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: avatar-video Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.80 Remediation: Avoid reading sensitive env vars (API keys…
.claude/skills/avatar-video/references/video-generation.md:193 Mcp skillData exfilE2
high System graph security Skillspector conf 0.80 SkillSpector E2 (data-exfil) in .claude/skills/avatar-video/references/video-status.md
os.environ["HEYGEN_API_KEY"] Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: avatar-video Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.80 Remediation: Avoid reading sensitive env vars (API keys…
.claude/skills/avatar-video/references/video-status.md:72 Mcp skillData exfilE2
high System graph security Skillspector conf 0.80 SkillSpector E2 (data-exfil) in .claude/skills/avatar-video/references/voices.md
os.environ["HEYGEN_API_KEY"] Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: avatar-video Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.80 Remediation: Avoid reading sensitive env vars (API keys…
.claude/skills/avatar-video/references/voices.md:63 Mcp skillData exfilE2
high System graph security Skillspector conf 0.70 SkillSpector E2 (data-exfil) in .claude/skills/bfl-api/references/code-examples/python-client.py
os.environ.get("BFL_API_KEY Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: bfl-api Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.70 Remediation: Avoid reading sensitive env vars (API keys, toke…
.claude/skills/bfl-api/references/code-examples/python-client.py:456 Mcp skillData exfilE2
high System graph security Skillspector conf 0.80 SkillSpector E2 (data-exfil) in .claude/skills/create-video/references/assets.md
os.environ["HEYGEN_API_KEY"] Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: create-video Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.80 Remediation: Avoid reading sensitive env vars (API keys…
.claude/skills/create-video/references/assets.md:145 Mcp skillData exfilE2
high System graph security Skillspector conf 0.80 SkillSpector E2 (data-exfil) in .claude/skills/create-video/references/quota.md
os.environ["HEYGEN_API_KEY"] Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: create-video Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.80 Remediation: Avoid reading sensitive env vars (API keys…
.claude/skills/create-video/references/quota.md:46 Mcp skillData exfilE2
high System graph security Skillspector conf 0.80 SkillSpector E2 (data-exfil) in .claude/skills/create-video/references/video-agent.md
os.environ["HEYGEN_API_KEY"] Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: create-video Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.80 Remediation: Avoid reading sensitive env vars (API keys…
.claude/skills/create-video/references/video-agent.md:192 Mcp skillData exfilE2
high System graph security Skillspector conf 0.80 SkillSpector E2 (data-exfil) in .claude/skills/create-video/references/video-status.md
os.environ["HEYGEN_API_KEY"] Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: create-video Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.80 Remediation: Avoid reading sensitive env vars (API keys…
.claude/skills/create-video/references/video-status.md:72 Mcp skillData exfilE2
high System graph security Skillspector conf 0.80 3 occurrences SkillSpector E2 (data-exfil) in .claude/skills/faceswap/SKILL.md
os.environ["HEYGEN_API_KEY"] Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: faceswap Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.80 Remediation: Avoid reading sensitive env vars (API keys, to…
lines 116, 226, 240
.claude/skills/faceswap/SKILL.md:116, 226, 240 (3 hits)
Mcp skillData exfilE2
high System graph security Skillspector conf 0.80 SkillSpector E2 (data-exfil) in .claude/skills/heygen/references/assets.md
os.environ["HEYGEN_API_KEY"] Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: heygen Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.80 Remediation: Avoid reading sensitive env vars (API keys, toke…
.claude/skills/heygen/references/assets.md:145 Mcp skillData exfilE2
high System graph security Skillspector conf 0.80 2 occurrences SkillSpector E2 (data-exfil) in .claude/skills/heygen/references/authentication.md
os.environ["HEYGEN_API_KEY"] Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: heygen Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.80 Remediation: Avoid reading sensitive env vars (API keys, toke…
lines 73, 87
.claude/skills/heygen/references/authentication.md:73, 87 (2 hits)
Mcp skillData exfilE2
high System graph security Skillspector conf 0.80 SkillSpector E2 (data-exfil) in .claude/skills/heygen/references/avatars.md
os.environ["HEYGEN_API_KEY"] Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: heygen Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.80 Remediation: Avoid reading sensitive env vars (API keys, toke…
.claude/skills/heygen/references/avatars.md:105 Mcp skillData exfilE2
high System graph security Skillspector conf 0.80 SkillSpector E2 (data-exfil) in .claude/skills/heygen/references/photo-avatars.md
os.environ["HEYGEN_API_KEY"] Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: heygen Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.80 Remediation: Avoid reading sensitive env vars (API keys, toke…
.claude/skills/heygen/references/photo-avatars.md:263 Mcp skillData exfilE2
high System graph security Skillspector conf 0.80 SkillSpector E2 (data-exfil) in .claude/skills/heygen/references/quota.md
os.environ["HEYGEN_API_KEY"] Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: heygen Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.80 Remediation: Avoid reading sensitive env vars (API keys, toke…
.claude/skills/heygen/references/quota.md:46 Mcp skillData exfilE2
high System graph security Skillspector conf 0.80 2 occurrences SkillSpector E2 (data-exfil) in .claude/skills/heygen/references/templates.md
os.environ["HEYGEN_API_KEY"] Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: heygen Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.80 Remediation: Avoid reading sensitive env vars (API keys, toke…
lines 69, 226
.claude/skills/heygen/references/templates.md:69, 226 (2 hits)
Mcp skillData exfilE2
high System graph security Skillspector conf 0.80 SkillSpector E2 (data-exfil) in .claude/skills/heygen/references/video-agent.md
os.environ["HEYGEN_API_KEY"] Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: heygen Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.80 Remediation: Avoid reading sensitive env vars (API keys, toke…
.claude/skills/heygen/references/video-agent.md:192 Mcp skillData exfilE2
high System graph security Skillspector conf 0.80 SkillSpector E2 (data-exfil) in .claude/skills/heygen/references/video-generation.md
os.environ["HEYGEN_API_KEY"] Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: heygen Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.80 Remediation: Avoid reading sensitive env vars (API keys, toke…
.claude/skills/heygen/references/video-generation.md:193 Mcp skillData exfilE2
high System graph security Skillspector conf 0.80 SkillSpector E2 (data-exfil) in .claude/skills/heygen/references/video-status.md
os.environ["HEYGEN_API_KEY"] Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: heygen Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.80 Remediation: Avoid reading sensitive env vars (API keys, toke…
.claude/skills/heygen/references/video-status.md:72 Mcp skillData exfilE2
high System graph security Skillspector conf 0.80 SkillSpector E2 (data-exfil) in .claude/skills/heygen/references/voices.md
os.environ["HEYGEN_API_KEY"] Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: heygen Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.80 Remediation: Avoid reading sensitive env vars (API keys, toke…
.claude/skills/heygen/references/voices.md:63 Mcp skillData exfilE2
high System graph security Skillspector conf 0.60 SkillSpector P2 (prompt-injection) in .claude/skills/remotion-best-practices/rules/maps.md
⁠ Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended. Skill: remotion-best-practices Rule: P2 Category: prompt-injection Severity: HIGH Confidence: 0.60 Remediation: Audit all comments and invisible characters…
.claude/skills/remotion-best-practices/rules/maps.md:85 Mcp skillPrompt injectionP2
high System graph security Skillspector conf 0.85 SkillSpector P6 (prompt-injection) in .claude/skills/create-video/references/prompt-examples.md
Output Prompt Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties. Skill: create-video Rule: P6 Category: prompt-injection Severity: HIGH Confidence: 0.85 Remediation: Remove any instructions that reveal, pr…
.claude/skills/create-video/references/prompt-examples.md:21 Mcp skillPrompt injectionP6
high System graph security Skillspector conf 0.85 SkillSpector P6 (prompt-injection) in .claude/skills/heygen/references/prompt-examples.md
Output Prompt Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties. Skill: heygen Rule: P6 Category: prompt-injection Severity: HIGH Confidence: 0.85 Remediation: Remove any instructions that reveal, print, o…
.claude/skills/heygen/references/prompt-examples.md:21 Mcp skillPrompt injectionP6
high System graph security Skillspector conf 0.60 2 occurrences SkillSpector PE3 (priv-esc) in .claude/skills/ltx2/SKILL.md
.env Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts. Skill: ltx2 Rule: PE3 Category: priv-esc Severity: HIGH Confidence: 0.60 Remediation: Remove references to credential paths. Use environment variables or secrets managers. For …
lines 169, 170
.claude/skills/ltx2/SKILL.md:169, 170 (2 hits)
Mcp skillPriv escPe3
high System graph security Skillspector conf 0.85 SkillSpector RA1 (rogue-agent) in .claude/skills/ffmpeg/SKILL.md
Update this skill Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors. Skill: ffmpeg Rule: RA1 Category: rogue-agent Severity: HIGH Confidence: 0.85 Remediatio…
.claude/skills/ffmpeg/SKILL.md:429 Mcp skillRogue agentRa1
high System graph security Skillspector conf 0.85 SkillSpector RA1 (rogue-agent) in .claude/skills/playwright-recording/SKILL.md
Update this skill Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors. Skill: playwright-recording Rule: RA1 Category: rogue-agent Severity: HIGH Confidence: 0.…
.claude/skills/playwright-recording/SKILL.md:466 Mcp skillRogue agentRa1
high System graph security Skillspector conf 0.85 SkillSpector RA1 (rogue-agent) in .claude/skills/remotion/SKILL.md
Update this skill Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors. Skill: remotion Rule: RA1 Category: rogue-agent Severity: HIGH Confidence: 0.85 Remediat…
.claude/skills/remotion/SKILL.md:157 Mcp skillRogue agentRa1
high System graph security Skillspector conf 0.80 SkillSpector TM1 (tool-misuse) in .claude/skills/avatar-video/SKILL.md
DELETE /v2/videos/{video_id}` Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns). Skill: avatar-video Rule: TM1 Category: tool-misuse Severity: HIGH Confidence: 0.80 Remedia…
.claude/skills/avatar-video/SKILL.md:36 Mcp skillTool misuseTm1
high System graph security Skillspector conf 0.80 SkillSpector TM1 (tool-misuse) in .claude/skills/create-video/SKILL.md
DELETE /v2/videos/{video_id}` Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns). Skill: create-video Rule: TM1 Category: tool-misuse Severity: HIGH Confidence: 0.80 Remedia…
.claude/skills/create-video/SKILL.md:39 Mcp skillTool misuseTm1
high System graph security Skillspector conf 0.80 SkillSpector TM1 (tool-misuse) in .claude/skills/heygen/SKILL.md
DELETE /v2/videos/{video_id}` Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns). Skill: heygen Rule: TM1 Category: tool-misuse Severity: HIGH Confidence: 0.80 Remediation: …
.claude/skills/heygen/SKILL.md:36 Mcp skillTool misuseTm1
low Security checks quality Error handling conf 1.00 [ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even in cleanup code, log at DEBUG level.
Log the error: `except Exception: logger.debug('cleanup failed', exc_info=True)`. Or handle specific exception types.
tools/enhancement/upscale.py:336
low Security checks quality Error handling conf 1.00 [ERR002] Empty Catch Block: Empty catch blocks hide errors.
Log the error or rethrow it. Use console.error() at minimum.
.agents/skills/hyperframes/scripts/contrast-report.mjs:95
low Security checks quality Quality conf 1.00 [SEC087] JS: weak Math.random for crypto: Math.random() is not cryptographically secure; using it for tokens/keys/nonces is predictable. Ported from gosec G404 / eslint detect-pseudoRandomBytes concept (Apache-2.0).
Use `crypto.randomBytes(32).toString('hex')` (Node) or `crypto.getRandomValues()` (browser).
.claude/skills/d3-viz/assets/interactive-template.jsx:215
low Security checks quality Quality conf 1.00 [SEC087] JS: weak Math.random for crypto: Math.random() is not cryptographically secure; using it for tokens/keys/nonces is predictable. Ported from gosec G404 / eslint detect-pseudoRandomBytes concept (Apache-2.0).
Use `crypto.randomBytes(32).toString('hex')` (Node) or `crypto.getRandomValues()` (browser).
.agents/skills/d3-viz/assets/interactive-template.jsx:215
low Security checks quality Error handling conf 0.55 ✓ Repobility 25 occurrences Broad exception handler needs review
This handler catches Exception/BaseException. It is actionable when it swallows errors without logging, re-raising, or returning a structured error. Handlers that intentionally convert exceptions into typed error results should not be treated as high risk.
11 files, 25 locations
tools/analysis/video_analyzer.py:237, 254, 298, 323, 362, 396, 437, 471, +2 more (10 hits)
tools/video/green_screen_processor.py:273, 360, 504, 564 (4 hits)
tools/video/corpus_builder.py:222, 475 (2 hits)
tools/video/video_compose.py:1155, 1845 (2 hits)
lib/scoring.py:418
lib/source_media_review.py:184
tools/analysis/scene_detect.py:240
tools/character/character_animation.py:861
Error handlingquality
medium Security checks quality Quality conf 0.74 4 occurrences Critical user action appears to be handled by a no-op or placeholder
Wire the action to a real backend mutation or remove/disable the control until it is implemented. Add an end-to-end or integration test that performs the action and observes persisted state.
4 files, 4 locations
.agents/skills/beautiful-mermaid/scripts/create-html.ts:77
.agents/skills/bfl-api/references/code-examples/typescript-client.ts:469
.claude/skills/beautiful-mermaid/scripts/create-html.ts:77
.claude/skills/bfl-api/references/code-examples/typescript-client.ts:469
medium Security checks quality Quality conf 0.72 Runtime environment contract is missing referenced variables
Add every required runtime variable to .env.example or deployment docs with safe placeholder values, then verify CI/deploy bootstraps from that contract.
.agents/skills/bfl-api/references/code-examples/python-client.py:456
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/ai-video-gen/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/ai-video-gen/SKILL.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/avatar-video/references/assets.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/avatar-video/references/assets.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/avatar-video/references/dimensions.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/avatar-video/references/dimensions.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/avatar-video/references/photo-avatars.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/avatar-video/references/photo-avatars.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/create-video/references/assets.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/create-video/references/assets.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/create-video/references/dimensions.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/create-video/references/dimensions.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/create-video/references/prompt-optimizer.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/create-video/references/prompt-optimizer.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/create-video/references/video-agent.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/create-video/references/video-agent.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/create-video/references/visual-styles.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/create-video/references/visual-styles.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/create-video/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/create-video/SKILL.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/elevenlabs/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/elevenlabs/SKILL.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/faceswap/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/faceswap/SKILL.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/ffmpeg/reference.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/ffmpeg/reference.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/ffmpeg/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/ffmpeg/SKILL.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/flux-best-practices/rules/typography-text.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/flux-best-practices/rules/typography-text.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/heygen/references/assets.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/heygen/references/assets.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/heygen/references/authentication.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/heygen/references/authentication.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/heygen/references/dimensions.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/heygen/references/dimensions.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/heygen/references/photo-avatars.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/heygen/references/photo-avatars.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/heygen/references/prompt-optimizer.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/heygen/references/prompt-optimizer.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/heygen/references/video-agent.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/heygen/references/video-agent.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/heygen/references/visual-styles.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/heygen/references/visual-styles.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/manimce-best-practices/rules/cli.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/manimce-best-practices/rules/cli.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/manimce-best-practices/rules/config.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/manimce-best-practices/rules/config.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/manimce-best-practices/rules/scenes.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/manimce-best-practices/rules/scenes.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/manimce-best-practices/rules/text-animations.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/manimce-best-practices/rules/text-animations.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/references/equation_transforms.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/manimgl-best-practices/references/equation_transforms.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/references/parallax_starfield.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/manimgl-best-practices/references/parallax_starfield.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/references/rotating_exponentials.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/manimgl-best-practices/references/rotating_exponentials.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/references/spring_mass_system.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/manimgl-best-practices/references/spring_mass_system.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/references/three_d_surfaces.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/manimgl-best-practices/references/three_d_surfaces.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/references/transit_animation.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/manimgl-best-practices/references/transit_animation.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/references/vector_fields.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/manimgl-best-practices/references/vector_fields.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/rules/interactive.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/manimgl-best-practices/rules/interactive.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/rules/scenes.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/manimgl-best-practices/rules/scenes.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/manimgl-best-practices/SKILL.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/music/references/api_reference.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/music/references/api_reference.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/music/references/installation.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/music/references/installation.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/music/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/music/SKILL.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/playwright-recording/reference.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/playwright-recording/reference.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/3d.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/3d.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/audio-visualization.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/audio-visualization.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/audio.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/audio.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/charts.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/charts.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/display-captions.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/display-captions.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/ffmpeg.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/ffmpeg.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/fonts.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/fonts.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/gifs.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/gifs.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/import-srt-captions.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/import-srt-captions.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/light-leaks.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/light-leaks.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/lottie.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/lottie.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/maps.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/maps.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/parameters.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/parameters.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/transcribe-captions.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/transcribe-captions.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/transitions.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/transitions.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/transparent-videos.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/transparent-videos.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/videos.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/videos.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/voiceover.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/voiceover.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion/SKILL.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/sound-effects/references/installation.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/sound-effects/references/installation.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/sound-effects/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/sound-effects/SKILL.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/speech-to-text/references/installation.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/speech-to-text/references/installation.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/speech-to-text/references/realtime-client-side.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/speech-to-text/references/realtime-client-side.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/speech-to-text/references/realtime-server-side.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/speech-to-text/references/realtime-server-side.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/speech-to-text/references/transcription-options.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/speech-to-text/references/transcription-options.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/speech-to-text/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/speech-to-text/SKILL.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/text-to-speech/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/text-to-speech/SKILL.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/vercel-composition-patterns/AGENTS.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/vercel-composition-patterns/AGENTS.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/vercel-composition-patterns/rules/patterns-explicit-variants.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/vercel-composition-patterns/rules/patterns-explicit-variants.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/advanced-init-once.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/vercel-react-best-practices/rules/advanced-init-once.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/async-dependencies.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/vercel-react-best-practices/rules/async-dependencies.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/async-parallel.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/vercel-react-best-practices/rules/async-parallel.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/js-length-check-first.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/vercel-react-best-practices/rules/js-length-check-first.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/rendering-resource-hints.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/vercel-react-best-practices/rules/rendering-resource-hints.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/rendering-svg-precision.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/vercel-react-best-practices/rules/rendering-svg-precision.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/rerender-move-effect-to-event.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/vercel-react-best-practices/rules/rerender-move-effect-to-event.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/rerender-split-combined-hooks.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/vercel-react-best-practices/rules/rerender-split-combined-hooks.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/server-after-nonblocking.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/vercel-react-best-practices/rules/server-after-nonblocking.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/server-cache-react.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/vercel-react-best-practices/rules/server-cache-react.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/server-hoist-static-io.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/vercel-react-best-practices/rules/server-hoist-static-io.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/server-parallel-fetching.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/vercel-react-best-practices/rules/server-parallel-fetching.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/video-download/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/video-download/SKILL.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/video-edit/references/operations.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/video-edit/references/operations.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/video-understand/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/video-understand/SKILL.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/video_toolkit/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/video_toolkit/SKILL.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/visual-style/references/gallery/game-boy-color.visual-style.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/visual-style/references/gallery/game-boy-color.visual-style.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/web-design-guidelines/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/web-design-guidelines/SKILL.md VerificationClaude instruction
medium System graph security Agent instructions conf 1.00 Agent instruction contains unpinned remote install: .claude/skills/agents/references/installation.md
Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands.
.claude/skills/agents/references/installation.md:8 Supply chainClaude instruction
medium System graph security Agent instructions conf 1.00 Agent instruction contains unpinned remote install: .claude/skills/agents/SKILL.md
Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands.
.claude/skills/agents/SKILL.md:21 Supply chainClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent instructions exist but release-hardening basics are missing
AI-coder instruction files were found, but the repo is missing ci. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable.
Repo hardeningGenerated repo pattern
medium System graph quality Placeholder conf 1.00 Critical user flow still appears backed by mock or placeholder data
A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded.
Mock dataCritical flowGenerated repo pattern
medium System graph security Trivy conf 1.00 CVE-2026-41305: postcss 8.5.1 — remotion-composer/package-lock.json
postcss: PostCSS: Cross-Site Scripting (XSS) via improper escaping of style closing tags PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `</style>` sequences when stringifyin…
VulnCve 2026 41305
medium System graph security Trivy conf 1.00 CVE-2026-45736: ws 8.17.1 — remotion-composer/package-lock.json
ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray` ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument.…
VulnCve 2026 45736
medium System graph security Semgrep conf 1.00 dynamic urllib use detected — tools/audio/freesound_music.py:197
Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. R…
SecurityPython
medium System graph security Semgrep conf 1.00 dynamic urllib use detected — tools/audio/freesound_music.py:226
Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. R…
SecurityPython
medium System graph security Semgrep conf 1.00 dynamic urllib use detected — tools/audio/pixabay_music.py:352
Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. R…
SecurityPython
medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in .claude/skills/vercel-react-best-practices/AGENTS.md:2281
Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.
.claude/skills/vercel-react-best-practices/AGENTS.md:2281 Dangerous innerhtml
medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — .claude/skills/video-understand/scripts/understand_video.py:67
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — render_demo.py:63
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — tools/audio/elevenlabs_tts.py:149
`requests.post(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — tools/audio/piper_tts.py:127
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — tools/base_tool.py:318
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — tools/character/character_animation.py:104
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
runtime safetyRobustness
medium System graph security Skillspector conf 0.60 5 occurrences SkillSpector E1 (data-exfil) in .claude/skills/agents/references/agent-configuration.md
curl -X GET "https://api.elevenlabs.io/v1/convai/agents" -H "xi-api-key: $ELEVENLABS_API_KEY" ``` ### SDK: Get Agent ```python agent = client.conversational_ai.agents.get(agent_id="your-agent-id") ` Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. M…
lines 450, 464, 510, 542
.claude/skills/agents/references/agent-configuration.md:450, 464, 510, 542 (5 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.50 4 occurrences SkillSpector E1 (data-exfil) in .claude/skills/agents/references/client-tools.md
https://api.example.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: agents Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trusted and necessary.…
lines 49, 126, 472, 505
.claude/skills/agents/references/client-tools.md:49, 126, 472, 505 (4 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 2 occurrences SkillSpector E1 (data-exfil) in .claude/skills/agents/references/installation.md
cURL / REST API Set your API key as an environment variable: ```bash export ELEVENLABS_API_KEY="your-api-key" ``` Include in requests via the `xi-api-key` header: ```bash curl -X POST "https://api Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. M…
lines 101, 112
.claude/skills/agents/references/installation.md:101, 112 (2 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 5 occurrences SkillSpector E1 (data-exfil) in .claude/skills/agents/SKILL.md
cURL ```bash curl -X POST "https://api.elevenlabs.io/v1/convai/agents/create?enable_versioning=true" \ -H "xi-api-key: $ELEVENLABS_API_KEY" -H "Content-Type: application/json" \ -d Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is…
lines 83, 86, 154, 217, 220
.claude/skills/agents/SKILL.md:83, 86, 154, 217, 220 (5 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 15 occurrences SkillSpector E1 (data-exfil) in .claude/skills/ai-video-gen/SKILL.md
curl -X POST "https://api.heygen.com/v1/workflows/executions" \ -H "X-Api-Key: $HEYGEN_API_KEY" \ -H "Content-Type: application/json" \ -d Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: ai-video-gen Rule: …
lines 37, 54, 86, 89, 122, 166, 167, 194, +3 more
.claude/skills/ai-video-gen/SKILL.md:37, 54, 86, 89, 122, 166, 167, 194, +3 more (15 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 7 occurrences SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/assets.md
curl ```bash curl -X POST "https://upload.heygen.com/v1/asset" \ -H "X-Api-Key: $HEYGEN_API_KEY" \ -H "Content-Type: image/jpeg" \ --data-binary Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: avatar-video…
lines 41, 76, 112, 142, 190, 312
.claude/skills/avatar-video/references/assets.md:41, 76, 112, 142, 190, 312 (7 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.50 9 occurrences SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/avatars.md
https://api.heygen.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: avatar-video Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trusted and neces…
lines 18, 58, 82, 104, 258, 297, 314, 392, +1 more
.claude/skills/avatar-video/references/avatars.md:18, 58, 82, 104, 258, 297, 314, 392, +1 more (9 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 2 occurrences SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/dimensions.md
curl ```bash # Landscape 1080p curl -X POST "https://api.heygen.com/v2/video/generate" \ -H "X-Api-Key: $HEYGEN_API_KEY" \ -H "Content-Type: application/json" \ -d Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. …
lines 66, 70
.claude/skills/avatar-video/references/dimensions.md:66, 70 (2 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 44 occurrences SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/photo-avatars.md
curl -X POST "https://upload.heygen.com/v1/asset" \ -H "X-Api-Key: $HEYGEN_API_KEY" \ -H "Content-Type: image/jpeg" \ --data-binary '@./portrait.jpg' ``` Response: ```json { "code": 100, "d Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. M…
lines 19, 47, 50, 88, 91, 155, 172, 173, +33 more
.claude/skills/avatar-video/references/photo-avatars.md:19, 47, 50, 88, 91, 155, 172, 173, +33 more (44 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.50 6 occurrences SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/quota.md
https://api.heygen.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: avatar-video Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trusted and neces…
lines 15, 30, 45, 85, 113, 137
.claude/skills/avatar-video/references/quota.md:15, 30, 45, 85, 113, 137 (6 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 6 occurrences SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/remotion-integration.md
fetch("https://api.heygen.com/v2/video/generate", { method: "POST" Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: avatar-video Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.60 Remediation: …
lines 96, 179, 218
.claude/skills/avatar-video/references/remotion-integration.md:96, 179, 218 (6 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.50 10 occurrences SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/templates.md
https://api.heygen.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: avatar-video Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trusted and neces…
lines 15, 46, 68, 121, 130, 158, 161, 198, +2 more
.claude/skills/avatar-video/references/templates.md:15, 46, 68, 121, 130, 158, 161, 198, +2 more (10 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 16 occurrences SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/video-generation.md
curl ```bash curl -X POST "https://api.heygen.com/v2/video/generate" \ -H "X-Api-Key: $HEYGEN_API_KEY" \ -H "Content-Type: application/json" \ -d Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: avatar-vide…
lines 40, 43, 164, 190, 191, 413, 518, 532, +4 more
.claude/skills/avatar-video/references/video-generation.md:40, 43, 164, 190, 191, 413, 518, 532, +4 more (16 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.50 5 occurrences SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/video-status.md
https://api.heygen.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: avatar-video Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trusted and neces…
lines 19, 49, 71, 354, 355
.claude/skills/avatar-video/references/video-status.md:19, 49, 71, 354, 355 (5 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.50 4 occurrences SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/voices.md
https://api.heygen.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: avatar-video Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trusted and neces…
lines 15, 40, 62, 429
.claude/skills/avatar-video/references/voices.md:15, 40, 62, 429 (4 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 5 occurrences SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/webhooks.md
curl -X POST "https://api.heygen.com/v1/webhook/endpoint.add" \ -H "X-Api-Key: $HEYGEN_API_KEY" \ -H "Content-Type: application/json" \ -d Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: avatar-video Rule: …
lines 186, 205, 362
.claude/skills/avatar-video/references/webhooks.md:186, 205, 362 (5 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.50 SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/SKILL.md
https://api.heygen.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: avatar-video Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trusted and neces…
.claude/skills/avatar-video/SKILL.md:24 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.70 8 occurrences SkillSpector E1 (data-exfil) in .claude/skills/bfl-api/references/code-examples/curl-examples.sh
curl -s -X POST "${BASE_URL}/v1/flux-2-pro" \ -H "x-key: ${API_KEY}" \ -H "Content-Type: application/json" \ -d Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: bfl-api Rule: E1 Category: data-exfil Severit…
lines 34, 81, 90, 139, 142, 145, 148, 151
.claude/skills/bfl-api/references/code-examples/curl-examples.sh:34, 81, 90, 139, 142, 145, 148, 151 (8 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 8 occurrences SkillSpector E1 (data-exfil) in .claude/skills/bfl-api/references/endpoints.md
curl -X POST "https://api.bfl.ai/v1/flux-2-pro" \ -H "x-key: YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "prompt": "A serene mountain landscape at golden hour", "width": Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Ma…
lines 157, 172, 179, 199, 211, 223, 237
.claude/skills/bfl-api/references/endpoints.md:157, 172, 179, 199, 211, 223, 237 (8 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.70 SkillSpector E1 (data-exfil) in .claude/skills/bfl-api/references/polling-patterns.md
requests.post(endpoint, headers=self.headers, json= Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: bfl-api Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.70 Remediation: Verify the destination U…
.claude/skills/bfl-api/references/polling-patterns.md:137 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.70 2 occurrences SkillSpector E1 (data-exfil) in .claude/skills/bfl-api/references/rate-limiting.md
requests.post(endpoint, json= Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: bfl-api Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.70 Remediation: Verify the destination URL is trusted and nece…
lines 75, 165
.claude/skills/bfl-api/references/rate-limiting.md:75, 165 (2 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 5 occurrences SkillSpector E1 (data-exfil) in .claude/skills/bfl-api/references/webhook-integration.md
curl -X POST "https://api.bfl.ai/v1/flux-2-pro" \ -H "x-key: YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: bfl-api Rule: E1 Category: data-exfil S…
lines 24, 289, 290
.claude/skills/bfl-api/references/webhook-integration.md:24, 289, 290 (5 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 7 occurrences SkillSpector E1 (data-exfil) in .claude/skills/bfl-api/SKILL.md
curl -X POST "https://api.bfl.ai/v1/flux-2-pro" \ -H "x-key: $BFL_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "prompt": "Change the background to a sunset", "input_image": "ht Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. M…
lines 84, 96, 204, 215, 224, 252
.claude/skills/bfl-api/SKILL.md:84, 96, 204, 215, 224, 252 (7 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 7 occurrences SkillSpector E1 (data-exfil) in .claude/skills/create-video/references/assets.md
curl ```bash curl -X POST "https://upload.heygen.com/v1/asset" \ -H "X-Api-Key: $HEYGEN_API_KEY" \ -H "Content-Type: image/jpeg" \ --data-binary Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: create-video…
lines 41, 76, 112, 142, 190, 312
.claude/skills/create-video/references/assets.md:41, 76, 112, 142, 190, 312 (7 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 2 occurrences SkillSpector E1 (data-exfil) in .claude/skills/create-video/references/dimensions.md
curl ```bash # Landscape 1080p curl -X POST "https://api.heygen.com/v2/video/generate" \ -H "X-Api-Key: $HEYGEN_API_KEY" \ -H "Content-Type: application/json" \ -d Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. …
lines 66, 70
.claude/skills/create-video/references/dimensions.md:66, 70 (2 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.50 6 occurrences SkillSpector E1 (data-exfil) in .claude/skills/create-video/references/quota.md
https://api.heygen.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: create-video Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trusted and neces…
lines 15, 30, 45, 85, 113, 137
.claude/skills/create-video/references/quota.md:15, 30, 45, 85, 113, 137 (6 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.50 10 occurrences SkillSpector E1 (data-exfil) in .claude/skills/create-video/references/video-agent.md
https://api.heygen.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: create-video Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trusted and neces…
lines 54, 92, 95, 141, 142, 189, 190, 250, +1 more
.claude/skills/create-video/references/video-agent.md:54, 92, 95, 141, 142, 189, 190, 250, +1 more (10 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.50 5 occurrences SkillSpector E1 (data-exfil) in .claude/skills/create-video/references/video-status.md
https://api.heygen.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: create-video Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trusted and neces…
lines 19, 49, 71, 354, 355
.claude/skills/create-video/references/video-status.md:19, 49, 71, 354, 355 (5 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 5 occurrences SkillSpector E1 (data-exfil) in .claude/skills/create-video/references/webhooks.md
curl -X POST "https://api.heygen.com/v1/webhook/endpoint.add" \ -H "X-Api-Key: $HEYGEN_API_KEY" \ -H "Content-Type: application/json" \ -d Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: create-video Rule: …
lines 186, 205, 362
.claude/skills/create-video/references/webhooks.md:186, 205, 362 (5 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 2 occurrences SkillSpector E1 (data-exfil) in .claude/skills/create-video/SKILL.md
curl -X POST "https://api.heygen.com/v1/video_agent/generate" \ -H "X-Api-Key: $HEYGEN_API_KEY" \ -H "Content-Type: application/json" \ -d Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: create-video Rule: …
lines 24
.claude/skills/create-video/SKILL.md:24 (2 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 19 occurrences SkillSpector E1 (data-exfil) in .claude/skills/faceswap/SKILL.md
curl -X POST "https://api.heygen.com/v1/workflows/executions" \ -H "X-Api-Key: $HEYGEN_API_KEY" \ -H "Content-Type: application/json" \ -d Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: faceswap Rule: E1 …
lines 23, 40, 50, 53, 81, 113, 114, 141, +6 more
.claude/skills/faceswap/SKILL.md:23, 40, 50, 53, 81, 113, 114, 141, +6 more (19 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 7 occurrences SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/assets.md
curl ```bash curl -X POST "https://upload.heygen.com/v1/asset" \ -H "X-Api-Key: $HEYGEN_API_KEY" \ -H "Content-Type: image/jpeg" \ --data-binary Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: heygen Rule:…
lines 41, 76, 112, 142, 190, 312
.claude/skills/heygen/references/assets.md:41, 76, 112, 142, 190, 312 (7 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.50 4 occurrences SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/authentication.md
https://api.heygen.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: heygen Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trusted and necessary. …
lines 35, 42, 72, 86
.claude/skills/heygen/references/authentication.md:35, 42, 72, 86 (4 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.50 9 occurrences SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/avatars.md
https://api.heygen.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: heygen Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trusted and necessary. …
lines 18, 58, 82, 104, 258, 297, 314, 392, +1 more
.claude/skills/heygen/references/avatars.md:18, 58, 82, 104, 258, 297, 314, 392, +1 more (9 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 2 occurrences SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/dimensions.md
curl ```bash # Landscape 1080p curl -X POST "https://api.heygen.com/v2/video/generate" \ -H "X-Api-Key: $HEYGEN_API_KEY" \ -H "Content-Type: application/json" \ -d Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. …
lines 66, 70
.claude/skills/heygen/references/dimensions.md:66, 70 (2 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 44 occurrences SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/photo-avatars.md
curl -X POST "https://upload.heygen.com/v1/asset" \ -H "X-Api-Key: $HEYGEN_API_KEY" \ -H "Content-Type: image/jpeg" \ --data-binary '@./portrait.jpg' ``` Response: ```json { "code": 100, "d Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. M…
lines 19, 47, 50, 88, 91, 155, 172, 173, +33 more
.claude/skills/heygen/references/photo-avatars.md:19, 47, 50, 88, 91, 155, 172, 173, +33 more (44 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.50 6 occurrences SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/quota.md
https://api.heygen.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: heygen Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trusted and necessary. …
lines 15, 30, 45, 85, 113, 137
.claude/skills/heygen/references/quota.md:15, 30, 45, 85, 113, 137 (6 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 6 occurrences SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/remotion-integration.md
fetch("https://api.heygen.com/v2/video/generate", { method: "POST" Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: heygen Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.60 Remediation: Verify…
lines 96, 179, 218
.claude/skills/heygen/references/remotion-integration.md:96, 179, 218 (6 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.50 10 occurrences SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/templates.md
https://api.heygen.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: heygen Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trusted and necessary. …
lines 15, 46, 68, 121, 130, 158, 161, 198, +2 more
.claude/skills/heygen/references/templates.md:15, 46, 68, 121, 130, 158, 161, 198, +2 more (10 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.50 10 occurrences SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/video-agent.md
https://api.heygen.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: heygen Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trusted and necessary. …
lines 54, 92, 95, 141, 142, 189, 190, 250, +1 more
.claude/skills/heygen/references/video-agent.md:54, 92, 95, 141, 142, 189, 190, 250, +1 more (10 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 16 occurrences SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/video-generation.md
curl ```bash curl -X POST "https://api.heygen.com/v2/video/generate" \ -H "X-Api-Key: $HEYGEN_API_KEY" \ -H "Content-Type: application/json" \ -d Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: heygen Rule…
lines 40, 43, 164, 190, 191, 413, 518, 532, +4 more
.claude/skills/heygen/references/video-generation.md:40, 43, 164, 190, 191, 413, 518, 532, +4 more (16 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.50 5 occurrences SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/video-status.md
https://api.heygen.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: heygen Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trusted and necessary. …
lines 19, 49, 71, 354, 355
.claude/skills/heygen/references/video-status.md:19, 49, 71, 354, 355 (5 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.50 4 occurrences SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/voices.md
https://api.heygen.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: heygen Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trusted and necessary. …
lines 15, 40, 62, 429
.claude/skills/heygen/references/voices.md:15, 40, 62, 429 (4 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 5 occurrences SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/webhooks.md
curl -X POST "https://api.heygen.com/v1/webhook/endpoint.add" \ -H "X-Api-Key: $HEYGEN_API_KEY" \ -H "Content-Type: application/json" \ -d Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: heygen Rule: E1 Ca…
lines 186, 205, 362
.claude/skills/heygen/references/webhooks.md:186, 205, 362 (5 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.50 SkillSpector E1 (data-exfil) in .claude/skills/music/references/api_reference.md
https://api.elevenlabs.io/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: music Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trusted and necessary…
.claude/skills/music/references/api_reference.md:169 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 2 occurrences SkillSpector E1 (data-exfil) in .claude/skills/music/references/installation.md
cURL / REST API Set your API key as an environment variable: ```bash export ELEVENLABS_API_KEY="your-api-key" ``` Include in requests via the `xi-api-key` header: ```bash curl -X POST "https://api Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. M…
lines 39, 50
.claude/skills/music/references/installation.md:39, 50 (2 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 2 occurrences SkillSpector E1 (data-exfil) in .claude/skills/music/SKILL.md
cURL ```bash curl -X POST "https://api.elevenlabs.io/v1/music" \ -H "xi-api-key: $ELEVENLABS_API_KEY" -H "Content-Type: application/json" \ -d Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: music Rule: E1 …
lines 48, 51
.claude/skills/music/SKILL.md:48, 51 (2 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.50 SkillSpector E1 (data-exfil) in .claude/skills/remotion-best-practices/rules/compositions.md
https://api.example.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: remotion-best-practices Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trust…
.claude/skills/remotion-best-practices/rules/compositions.md:113 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.50 SkillSpector E1 (data-exfil) in .claude/skills/remotion-best-practices/rules/voiceover.md
https://api.elevenlabs.io/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: remotion-best-practices Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is tru…
.claude/skills/remotion-best-practices/rules/voiceover.md:32 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.50 2 occurrences SkillSpector E1 (data-exfil) in .claude/skills/setup-api-key/SKILL.md
https://api.elevenlabs.io/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: setup-api-key Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trusted and n…
lines 22, 58
.claude/skills/setup-api-key/SKILL.md:22, 58 (2 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 2 occurrences SkillSpector E1 (data-exfil) in .claude/skills/sound-effects/references/installation.md
cURL / REST API Set your API key as an environment variable: ```bash export ELEVENLABS_API_KEY="your-api-key" ``` Include in requests via the `xi-api-key` header: ```bash curl -X POST "https://api Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. M…
lines 39, 50
.claude/skills/sound-effects/references/installation.md:39, 50 (2 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 2 occurrences SkillSpector E1 (data-exfil) in .claude/skills/sound-effects/SKILL.md
cURL ```bash curl -X POST "https://api.elevenlabs.io/v1/sound-generation" \ -H "xi-api-key: $ELEVENLABS_API_KEY" -H "Content-Type: application/json" \ -d Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: sound…
lines 46, 49
.claude/skills/sound-effects/SKILL.md:46, 49 (2 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.85 SkillSpector EA1 (excessive-agency) in .claude/skills/create-video/SKILL.md
tools:* Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution. Skill: create-video Rule: EA1 Category: excessive-agency Severity: MEDIUM Confiden…
.claude/skills/create-video/SKILL.md:47 Mcp skillExcessive agencyEa1
medium System graph security Skillspector conf 0.85 SkillSpector EA1 (excessive-agency) in .claude/skills/heygen/SKILL.md
tools:* Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution. Skill: heygen Rule: EA1 Category: excessive-agency Severity: MEDIUM Confidence: 0.…
.claude/skills/heygen/SKILL.md:45 Mcp skillExcessive agencyEa1
medium System graph security Skillspector conf 0.75 SkillSpector EA4 (excessive-agency) in .claude/skills/remotion-best-practices/rules/gifs.md
Loop indefinitely Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns. Skill: remotion-best-practices Rule: EA4 Category: excessive-agency Severity: MEDIUM Confi…
.claude/skills/remotion-best-practices/rules/gifs.md:63 Mcp skillExcessive agencyEa4
medium System graph security Skillspector conf 0.70 SkillSpector LP3 (mcp-least-priv) in .claude/skills/bfl-api/SKILL.md
MCP Least Privilege Without declared permissions the skill's intent is opaque and cannot be validated. Skill: bfl-api Rule: LP3 Category: mcp-least-priv Severity: MEDIUM Confidence: 0.70 Remediation: Add a 'permissions' field to SKILL.md listing the capabilities this skill requires.
.claude/skills/bfl-api/SKILL.md:1 Mcp skillMcp least privLp3
medium System graph security Skillspector conf 0.70 SkillSpector LP3 (mcp-least-priv) in .claude/skills/manimgl-best-practices/SKILL.md
MCP Least Privilege Without declared permissions the skill's intent is opaque and cannot be validated. Skill: manimgl-best-practices Rule: LP3 Category: mcp-least-priv Severity: MEDIUM Confidence: 0.70 Remediation: Add a 'permissions' field to SKILL.md listing the capabilities this skill requi…
.claude/skills/manimgl-best-practices/SKILL.md:1 Mcp skillMcp least privLp3
medium System graph security Skillspector conf 0.60 SkillSpector RA2 (rogue-agent) in .claude/skills/agents/references/installation.md
create and manage agents: ```bash npm install -g @elevenlabs/cli # or pnpm add -g @elevenlabs/cli # or yarn global add @elevenlabs/cli ``` Requires Node.js 16.0.0 or higher. ### Authentication ``` Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or sta…
.claude/skills/agents/references/installation.md:5 Mcp skillRogue agentRa2
medium System graph security Skillspector conf 0.75 3 occurrences SkillSpector RA2 (rogue-agent) in .claude/skills/avatar-video/references/avatars.md
pList Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction. Skill: avatar-video Rule: RA2 Category: rogue-agent Severity: MEDIUM Confidence: 0.75 Remed…
lines 282, 291, 301
.claude/skills/avatar-video/references/avatars.md:282, 291, 301 (3 hits)
Mcp skillRogue agentRa2
medium System graph security Skillspector conf 0.75 3 occurrences SkillSpector RA2 (rogue-agent) in .claude/skills/heygen/references/avatars.md
pList Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction. Skill: heygen Rule: RA2 Category: rogue-agent Severity: MEDIUM Confidence: 0.75 Remediation…
lines 282, 291, 301
.claude/skills/heygen/references/avatars.md:282, 291, 301 (3 hits)
Mcp skillRogue agentRa2
medium System graph security Skillspector conf 0.75 SkillSpector RA2 (rogue-agent) in .claude/skills/playwright-recording/SKILL.md
pList Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction. Skill: playwright-recording Rule: RA2 Category: rogue-agent Severity: MEDIUM Confidence: 0.7…
.claude/skills/playwright-recording/SKILL.md:369 Mcp skillRogue agentRa2
low Security checks quality Quality conf 0.60 30 occurrences Duplicated implementation block across source files
Duplicate implementation blocks are maintenance debt. Keep them visible, but they are not a high-severity defect unless the duplicated logic is security-sensitive or drifting.
12 files, 23 locations
remotion-composer/src/components/charts/PieChart.tsx:70, 71, 77 (3 hits)
tools/analysis/video_downloader.py:9, 10, 11 (3 hits)
remotion-composer/src/components/charts/LineChart.tsx:79, 85 (2 hits)
tools/analysis/video_analyzer.py:10, 13 (2 hits)
tools/audio/audio_enhance.py:5, 7 (2 hits)
tools/audio/audio_mixer.py:5, 7 (2 hits)
tools/audio/google_tts.py:7, 8 (2 hits)
tools/audio/music_gen.py:6, 7 (2 hits)
duplicationquality
low Security checks quality Quality conf 0.68 Multiple AI-agent scaffold marker files are present
Keep one current agent instruction file if it helps contributors, remove stale progress/completion markers, and make sure the README, tests, and CI describe the real supported behavior.
.github/copilot-instructions.md:1
low System graph quality Integrity conf 1.00 22 env vars used in code but missing from .env.example
Drift between code and config docs. The first few: `APPDATA`, `BFL_API_KEY`, `COVERR_API_KEY`, `DISPLAY`, `FAL_AI_API_KEY`, `FREESOUND_API_KEY`, `GEMINI_API_KEY`, `GOOGLE_APPLICATION_CREDENTIALS` + 14 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break.
config drift
low System graph quality Debug conf 1.00 Debug logging residue appears in source files
Found 39 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup.
CleanupRepo hardeningGenerated repo pattern
low System graph quality Tests conf 1.00 Low test-to-source ratio
28 tests / 272 src (ratio 0.10).
low System graph quality Agent instructions conf 1.00 Multiple root agent instruction files without precedence
The repo has multiple top-level AI-coder instruction files. Without precedence rules, different agents may follow different policies.
Governance
low System graph quality Integrity conf 1.00 Near-duplicate function bodies in 13 places
Functions with the same first-5-line body hash: .claude/skills/manimgl-best-practices/examples/value_matrix_transform.py:value_to_color, .claude/skills/manimgl-best-practices/examples/token_embeddings_flow.py:value_to_color, .claude/skills/manimgl-best-practices/examples/token_to_embedding.py:value…
duplicatesduplication
low System graph quality Integrity conf 1.00 10 occurrences Near-duplicate function bodies in 2 places
Functions with the same first-5-line body hash: lib/scoring.py:weighted_score, lib/scoring.py:weighted_score This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate.
10 occurrences
repo-level (10 hits)
duplicatesduplication
low System graph quality Integrity conf 1.00 4 occurrences Near-duplicate function bodies in 3 places
Functions with the same first-5-line body hash: .claude/skills/manimgl-best-practices/templates/basic_scene.py:construct, .claude/skills/manimgl-best-practices/templates/basic_scene.py:construct, .claude/skills/manimgl-best-practices/templates/basic_scene.py:construct This is *the* AI-coder failur…
4 occurrences
repo-level (4 hits)
duplicatesduplication
low System graph quality Integrity conf 1.00 3 occurrences Near-duplicate function bodies in 4 places
Functions with the same first-5-line body hash: .claude/skills/manimgl-best-practices/examples/blocks_3d.py:set_time, .claude/skills/manimgl-best-practices/examples/block_collision_basic.py:set_time, .claude/skills/manimgl-best-practices/examples/elastic_collision_vectors.py:set_time, .claude/skill…
3 occurrences
repo-level (3 hits)
duplicatesduplication
low System graph quality Integrity conf 1.00 Near-duplicate function bodies in 5 places
Functions with the same first-5-line body hash: .claude/skills/manimgl-best-practices/templates/3d_scene.py:construct, .claude/skills/manimgl-best-practices/templates/3d_scene.py:construct, .claude/skills/manimgl-best-practices/templates/3d_scene.py:construct, .claude/skills/manimgl-best-practices/…
duplicatesduplication
low System graph quality Integrity conf 1.00 Near-duplicate function bodies in 7 places
Functions with the same first-5-line body hash: .claude/skills/manimgl-best-practices/templates/math_scene.py:construct, .claude/skills/manimgl-best-practices/templates/math_scene.py:construct, .claude/skills/manimgl-best-practices/templates/math_scene.py:construct, .claude/skills/manimgl-best-prac…
duplicatesduplication
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `_link_or_copy` in tests/tools/test_clip_cache.py:19
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `_link_or_copy` in tools/video/clip_cache.py:354
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `eleven_multilingual_v2` in tools/audio/elevenlabs_tts.py:78
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `eleven_multilingual_v2` in tools/audio/tts_selector.py:50
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `inp_copy` in .claude/skills/manimgl-best-practices/examples/mlp_relu_visualization.py:160
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `kling_v2` in tools/video/_shared.py:22
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `text_copy` in .claude/skills/manimgl-best-practices/examples/autoregressive_flow.py:77
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `text_copy` in .claude/skills/manimgl-best-practices/examples/llm_prediction_pipeline.py:97
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph software Dead code conf 1.00 Possibly dead Python function: build_batch_prompts
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
lib/shot_prompt_builder.py:146
low System graph software Dead code conf 1.00 Possibly dead Python function: check_extension_permitted
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
lib/pipeline_loader.py:169
low System graph software Dead code conf 1.00 Possibly dead Python function: classify_from_brief
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
lib/delivery_promise.py:196
low System graph software Dead code conf 1.00 4 occurrences Possibly dead Python function: construct
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
4 files, 4 locations
.claude/skills/manimgl-best-practices/templates/3d_scene.py:228
.claude/skills/manimgl-best-practices/templates/basic_scene.py:97
.claude/skills/manimgl-best-practices/templates/interactive_scene.py:36
.claude/skills/manimgl-best-practices/templates/math_scene.py:292
low System graph software Dead code conf 1.00 Possibly dead Python function: format_ranking
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
lib/scoring.py:545
low System graph software Dead code conf 1.00 Possibly dead Python function: generate_batch
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
.claude/skills/bfl-api/references/code-examples/python-client.py:241
low System graph software Dead code conf 1.00 Possibly dead Python function: generate_i2i
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
.claude/skills/bfl-api/references/code-examples/python-client.py:196
low System graph software Dead code conf 1.00 Possibly dead Python function: generate_playbook
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
lib/playbook_generator.py:52
low System graph software Dead code conf 1.00 Possibly dead Python function: has_user_media
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
lib/source_media_review.py:387
low System graph software Dead code conf 1.00 Possibly dead Python function: knn
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
lib/corpus.py:288
low System graph software Dead code conf 1.00 Possibly dead Python function: model_info
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
lib/clip_embedder.py:55
low System graph software Dead code conf 1.00 Possibly dead Python function: require_env
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
lib/env_loader.py:29
low System graph software Dead code conf 1.00 Possibly dead Python function: resolve_path
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
lib/config_model.py:87
low System graph software Dead code conf 1.00 Possibly dead Python function: review_source_media
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
lib/source_media_review.py:215
low System graph software Dead code conf 1.00 Possibly dead Python function: save_playbook
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
lib/playbook_generator.py:200
low System graph software Dead code conf 1.00 Possibly dead Python function: verify_webhook_signature
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
.claude/skills/bfl-api/references/code-examples/python-client.py:426
low System graph quality Provenance conf 1.00 Shallow git history limits provenance confidence
The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence.
Git historyGenerated repo pattern
low System graph security Skillspector conf 0.70 SkillSpector EA3 (excessive-agency) in .claude/skills/manimce-best-practices/LICENSE.txt
NOT LIMITED TO Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface. Skill: manimce-best-practices Rule: EA3 Category: excessive-agency Severity: LOW Confidence:…
.claude/skills/manimce-best-practices/LICENSE.txt:16 Mcp skillExcessive agencyEa3
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — .claude/skills/beautiful-mermaid/scripts/create-html.ts:77
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — .claude/skills/beautiful-mermaid/scripts/render.ts:104
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — .claude/skills/bfl-api/references/code-examples/typescript-client.ts:12
Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
Fq console leak
low System graph quality Complexity conf 1.00 Very large file: tools/video/video_compose.py (2202 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/617a547c-4bc3-4472-9693-e91cc5635c6e/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/617a547c-4bc3-4472-9693-e91cc5635c6e/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.