Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo
118 of your 186 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.

Scan timing: clone 5.57s · analysis 12.18s · 30.7 MB · GitHub API rate-limit (preflight)

calesthio/OpenMontage

https://github.com/calesthio/OpenMontage.git · scanned 2026-06-22 13:35 UTC (1 month, 1 week ago) · 10 languages

799 raw signals (173 security + 626 graph) 11/13 scanners ran 38th percentile · Python · large (100-500K LoC)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 1 month, 1 week ago · v1 · 314 actionable findings from 2 signal sources. 460 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
73.4
/100
Security checks
83
41 findings
System graph
64
77.8% cov · 273 findings
Critical
1
click to filter
Agents
10
0 votes
Crowd
0
reported
Score breakdown â 2026-05-18-v5
Component Sub-score Weight Contribution
structure_score 85.0 0.15 12.75
security_score 100.0 0.25 25.00
testing_score 38.0 0.20 7.60
documentation_score 88.0 0.15 13.20
practices_score 42.0 0.15 6.30
code_quality 56.0 0.10 5.60
Overall 1.00 70.4
security_score may be inflated — optional security scanners were skipped on this fast scan
Severity distribution — click a segment to filter
Active filters: severity: medium × excluding tests × Reset all
Severity: Critical 1 High 56 Medium 166 Low 49 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 41 System graph 273 Crowd 0 Layer: Quality 162 Security 128 Software 21 Frontend 3
Scan summary Repository scanned at 63.8/100 with 77.8% coverage. It contains 3457 nodes across 0 cross-layer flows, written primarily in mixed languages. Engine surfaced 626 findings — concentrated in security (458), quality (140), software (25). Risk profile is high: 1 critical, 60 high, 490 medium. Recommended next step: open the security layer findings first — that's where the highest-impact wins live.

Showing 166 of 314 actionable findings. 774 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

medium Security checks quality Quality conf 0.74 4 occurrences Critical user action appears to be handled by a no-op or placeholder
Wire the action to a real backend mutation or remove/disable the control until it is implemented. Add an end-to-end or integration test that performs the action and observes persisted state.
4 files, 4 locations
.agents/skills/beautiful-mermaid/scripts/create-html.ts:77
.agents/skills/bfl-api/references/code-examples/typescript-client.ts:469
.claude/skills/beautiful-mermaid/scripts/create-html.ts:77
.claude/skills/bfl-api/references/code-examples/typescript-client.ts:469
medium Security checks quality Quality conf 0.72 Runtime environment contract is missing referenced variables
Add every required runtime variable to .env.example or deployment docs with safe placeholder values, then verify CI/deploy bootstraps from that contract.
.agents/skills/bfl-api/references/code-examples/python-client.py:456
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/ai-video-gen/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/ai-video-gen/SKILL.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/avatar-video/references/assets.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/avatar-video/references/assets.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/avatar-video/references/dimensions.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/avatar-video/references/dimensions.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/avatar-video/references/photo-avatars.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/avatar-video/references/photo-avatars.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/create-video/references/assets.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/create-video/references/assets.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/create-video/references/dimensions.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/create-video/references/dimensions.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/create-video/references/prompt-optimizer.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/create-video/references/prompt-optimizer.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/create-video/references/video-agent.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/create-video/references/video-agent.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/create-video/references/visual-styles.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/create-video/references/visual-styles.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/create-video/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/create-video/SKILL.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/elevenlabs/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/elevenlabs/SKILL.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/faceswap/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/faceswap/SKILL.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/ffmpeg/reference.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/ffmpeg/reference.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/ffmpeg/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/ffmpeg/SKILL.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/flux-best-practices/rules/typography-text.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/flux-best-practices/rules/typography-text.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/heygen/references/assets.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/heygen/references/assets.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/heygen/references/authentication.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/heygen/references/authentication.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/heygen/references/dimensions.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/heygen/references/dimensions.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/heygen/references/photo-avatars.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/heygen/references/photo-avatars.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/heygen/references/prompt-optimizer.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/heygen/references/prompt-optimizer.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/heygen/references/video-agent.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/heygen/references/video-agent.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/heygen/references/visual-styles.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/heygen/references/visual-styles.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/manimce-best-practices/rules/cli.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/manimce-best-practices/rules/cli.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/manimce-best-practices/rules/config.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/manimce-best-practices/rules/config.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/manimce-best-practices/rules/scenes.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/manimce-best-practices/rules/scenes.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/manimce-best-practices/rules/text-animations.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/manimce-best-practices/rules/text-animations.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/references/equation_transforms.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/manimgl-best-practices/references/equation_transforms.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/references/parallax_starfield.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/manimgl-best-practices/references/parallax_starfield.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/references/rotating_exponentials.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/manimgl-best-practices/references/rotating_exponentials.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/references/spring_mass_system.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/manimgl-best-practices/references/spring_mass_system.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/references/three_d_surfaces.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/manimgl-best-practices/references/three_d_surfaces.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/references/transit_animation.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/manimgl-best-practices/references/transit_animation.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/references/vector_fields.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/manimgl-best-practices/references/vector_fields.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/rules/interactive.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/manimgl-best-practices/rules/interactive.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/rules/scenes.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/manimgl-best-practices/rules/scenes.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/manimgl-best-practices/SKILL.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/music/references/api_reference.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/music/references/api_reference.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/music/references/installation.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/music/references/installation.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/music/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/music/SKILL.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/playwright-recording/reference.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/playwright-recording/reference.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/3d.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/3d.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/audio-visualization.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/audio-visualization.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/audio.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/audio.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/charts.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/charts.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/display-captions.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/display-captions.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/ffmpeg.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/ffmpeg.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/fonts.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/fonts.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/gifs.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/gifs.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/import-srt-captions.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/import-srt-captions.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/light-leaks.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/light-leaks.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/lottie.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/lottie.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/maps.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/maps.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/parameters.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/parameters.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/transcribe-captions.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/transcribe-captions.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/transitions.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/transitions.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/transparent-videos.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/transparent-videos.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/videos.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/videos.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/voiceover.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/voiceover.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion/SKILL.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/sound-effects/references/installation.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/sound-effects/references/installation.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/sound-effects/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/sound-effects/SKILL.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/speech-to-text/references/installation.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/speech-to-text/references/installation.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/speech-to-text/references/realtime-client-side.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/speech-to-text/references/realtime-client-side.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/speech-to-text/references/realtime-server-side.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/speech-to-text/references/realtime-server-side.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/speech-to-text/references/transcription-options.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/speech-to-text/references/transcription-options.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/speech-to-text/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/speech-to-text/SKILL.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/text-to-speech/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/text-to-speech/SKILL.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/vercel-composition-patterns/AGENTS.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/vercel-composition-patterns/AGENTS.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/vercel-composition-patterns/rules/patterns-explicit-variants.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/vercel-composition-patterns/rules/patterns-explicit-variants.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/advanced-init-once.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/vercel-react-best-practices/rules/advanced-init-once.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/async-dependencies.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/vercel-react-best-practices/rules/async-dependencies.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/async-parallel.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/vercel-react-best-practices/rules/async-parallel.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/js-length-check-first.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/vercel-react-best-practices/rules/js-length-check-first.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/rendering-resource-hints.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/vercel-react-best-practices/rules/rendering-resource-hints.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/rendering-svg-precision.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/vercel-react-best-practices/rules/rendering-svg-precision.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/rerender-move-effect-to-event.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/vercel-react-best-practices/rules/rerender-move-effect-to-event.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/rerender-split-combined-hooks.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/vercel-react-best-practices/rules/rerender-split-combined-hooks.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/server-after-nonblocking.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/vercel-react-best-practices/rules/server-after-nonblocking.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/server-cache-react.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/vercel-react-best-practices/rules/server-cache-react.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/server-hoist-static-io.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/vercel-react-best-practices/rules/server-hoist-static-io.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/server-parallel-fetching.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/vercel-react-best-practices/rules/server-parallel-fetching.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/video-download/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/video-download/SKILL.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/video-edit/references/operations.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/video-edit/references/operations.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/video-understand/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/video-understand/SKILL.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/video_toolkit/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/video_toolkit/SKILL.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/visual-style/references/gallery/game-boy-color.visual-style.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/visual-style/references/gallery/game-boy-color.visual-style.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/web-design-guidelines/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/web-design-guidelines/SKILL.md VerificationClaude instruction
medium System graph security Agent instructions conf 1.00 Agent instruction contains unpinned remote install: .claude/skills/agents/references/installation.md
Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands.
.claude/skills/agents/references/installation.md:8 Supply chainClaude instruction
medium System graph security Agent instructions conf 1.00 Agent instruction contains unpinned remote install: .claude/skills/agents/SKILL.md
Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands.
.claude/skills/agents/SKILL.md:21 Supply chainClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent instructions exist but release-hardening basics are missing
AI-coder instruction files were found, but the repo is missing ci. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable.
Repo hardeningGenerated repo pattern
medium System graph quality Placeholder conf 1.00 Critical user flow still appears backed by mock or placeholder data
A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded.
Mock dataCritical flowGenerated repo pattern
medium System graph security Trivy conf 1.00 CVE-2026-41305: postcss 8.5.1 — remotion-composer/package-lock.json
postcss: PostCSS: Cross-Site Scripting (XSS) via improper escaping of style closing tags PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `</style>` sequences when stringifyin…
VulnCve 2026 41305
medium System graph security Trivy conf 1.00 CVE-2026-45736: ws 8.17.1 — remotion-composer/package-lock.json
ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray` ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument.…
VulnCve 2026 45736
medium System graph security Semgrep conf 1.00 dynamic urllib use detected — tools/audio/freesound_music.py:197
Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. R…
SecurityPython
medium System graph security Semgrep conf 1.00 dynamic urllib use detected — tools/audio/freesound_music.py:226
Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. R…
SecurityPython
medium System graph security Semgrep conf 1.00 dynamic urllib use detected — tools/audio/pixabay_music.py:352
Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. R…
SecurityPython
medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in .claude/skills/vercel-react-best-practices/AGENTS.md:2281
Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.
.claude/skills/vercel-react-best-practices/AGENTS.md:2281 Dangerous innerhtml
medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — .claude/skills/video-understand/scripts/understand_video.py:67
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — render_demo.py:63
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — tools/audio/elevenlabs_tts.py:149
`requests.post(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — tools/audio/piper_tts.py:127
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — tools/base_tool.py:318
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — tools/character/character_animation.py:104
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
runtime safetyRobustness
medium System graph security Skillspector conf 0.60 5 occurrences SkillSpector E1 (data-exfil) in .claude/skills/agents/references/agent-configuration.md
curl -X GET "https://api.elevenlabs.io/v1/convai/agents" -H "xi-api-key: $ELEVENLABS_API_KEY" ``` ### SDK: Get Agent ```python agent = client.conversational_ai.agents.get(agent_id="your-agent-id") ` Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. M…
lines 450, 464, 510, 542
.claude/skills/agents/references/agent-configuration.md:450, 464, 510, 542 (5 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.50 4 occurrences SkillSpector E1 (data-exfil) in .claude/skills/agents/references/client-tools.md
https://api.example.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: agents Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trusted and necessary.…
lines 49, 126, 472, 505
.claude/skills/agents/references/client-tools.md:49, 126, 472, 505 (4 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 2 occurrences SkillSpector E1 (data-exfil) in .claude/skills/agents/references/installation.md
cURL / REST API Set your API key as an environment variable: ```bash export ELEVENLABS_API_KEY="your-api-key" ``` Include in requests via the `xi-api-key` header: ```bash curl -X POST "https://api Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. M…
lines 101, 112
.claude/skills/agents/references/installation.md:101, 112 (2 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 5 occurrences SkillSpector E1 (data-exfil) in .claude/skills/agents/SKILL.md
cURL ```bash curl -X POST "https://api.elevenlabs.io/v1/convai/agents/create?enable_versioning=true" \ -H "xi-api-key: $ELEVENLABS_API_KEY" -H "Content-Type: application/json" \ -d Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is…
lines 83, 86, 154, 217, 220
.claude/skills/agents/SKILL.md:83, 86, 154, 217, 220 (5 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 15 occurrences SkillSpector E1 (data-exfil) in .claude/skills/ai-video-gen/SKILL.md
curl -X POST "https://api.heygen.com/v1/workflows/executions" \ -H "X-Api-Key: $HEYGEN_API_KEY" \ -H "Content-Type: application/json" \ -d Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: ai-video-gen Rule: …
lines 37, 54, 86, 89, 122, 166, 167, 194, +3 more
.claude/skills/ai-video-gen/SKILL.md:37, 54, 86, 89, 122, 166, 167, 194, +3 more (15 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 7 occurrences SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/assets.md
curl ```bash curl -X POST "https://upload.heygen.com/v1/asset" \ -H "X-Api-Key: $HEYGEN_API_KEY" \ -H "Content-Type: image/jpeg" \ --data-binary Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: avatar-video…
lines 41, 76, 112, 142, 190, 312
.claude/skills/avatar-video/references/assets.md:41, 76, 112, 142, 190, 312 (7 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.50 9 occurrences SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/avatars.md
https://api.heygen.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: avatar-video Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trusted and neces…
lines 18, 58, 82, 104, 258, 297, 314, 392, +1 more
.claude/skills/avatar-video/references/avatars.md:18, 58, 82, 104, 258, 297, 314, 392, +1 more (9 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 2 occurrences SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/dimensions.md
curl ```bash # Landscape 1080p curl -X POST "https://api.heygen.com/v2/video/generate" \ -H "X-Api-Key: $HEYGEN_API_KEY" \ -H "Content-Type: application/json" \ -d Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. …
lines 66, 70
.claude/skills/avatar-video/references/dimensions.md:66, 70 (2 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 44 occurrences SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/photo-avatars.md
curl -X POST "https://upload.heygen.com/v1/asset" \ -H "X-Api-Key: $HEYGEN_API_KEY" \ -H "Content-Type: image/jpeg" \ --data-binary '@./portrait.jpg' ``` Response: ```json { "code": 100, "d Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. M…
lines 19, 47, 50, 88, 91, 155, 172, 173, +33 more
.claude/skills/avatar-video/references/photo-avatars.md:19, 47, 50, 88, 91, 155, 172, 173, +33 more (44 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.50 6 occurrences SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/quota.md
https://api.heygen.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: avatar-video Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trusted and neces…
lines 15, 30, 45, 85, 113, 137
.claude/skills/avatar-video/references/quota.md:15, 30, 45, 85, 113, 137 (6 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 6 occurrences SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/remotion-integration.md
fetch("https://api.heygen.com/v2/video/generate", { method: "POST" Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: avatar-video Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.60 Remediation: …
lines 96, 179, 218
.claude/skills/avatar-video/references/remotion-integration.md:96, 179, 218 (6 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.50 10 occurrences SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/templates.md
https://api.heygen.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: avatar-video Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trusted and neces…
lines 15, 46, 68, 121, 130, 158, 161, 198, +2 more
.claude/skills/avatar-video/references/templates.md:15, 46, 68, 121, 130, 158, 161, 198, +2 more (10 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 16 occurrences SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/video-generation.md
curl ```bash curl -X POST "https://api.heygen.com/v2/video/generate" \ -H "X-Api-Key: $HEYGEN_API_KEY" \ -H "Content-Type: application/json" \ -d Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: avatar-vide…
lines 40, 43, 164, 190, 191, 413, 518, 532, +4 more
.claude/skills/avatar-video/references/video-generation.md:40, 43, 164, 190, 191, 413, 518, 532, +4 more (16 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.50 5 occurrences SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/video-status.md
https://api.heygen.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: avatar-video Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trusted and neces…
lines 19, 49, 71, 354, 355
.claude/skills/avatar-video/references/video-status.md:19, 49, 71, 354, 355 (5 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.50 4 occurrences SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/voices.md
https://api.heygen.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: avatar-video Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trusted and neces…
lines 15, 40, 62, 429
.claude/skills/avatar-video/references/voices.md:15, 40, 62, 429 (4 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 5 occurrences SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/webhooks.md
curl -X POST "https://api.heygen.com/v1/webhook/endpoint.add" \ -H "X-Api-Key: $HEYGEN_API_KEY" \ -H "Content-Type: application/json" \ -d Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: avatar-video Rule: …
lines 186, 205, 362
.claude/skills/avatar-video/references/webhooks.md:186, 205, 362 (5 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.50 SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/SKILL.md
https://api.heygen.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: avatar-video Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trusted and neces…
.claude/skills/avatar-video/SKILL.md:24 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.70 8 occurrences SkillSpector E1 (data-exfil) in .claude/skills/bfl-api/references/code-examples/curl-examples.sh
curl -s -X POST "${BASE_URL}/v1/flux-2-pro" \ -H "x-key: ${API_KEY}" \ -H "Content-Type: application/json" \ -d Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: bfl-api Rule: E1 Category: data-exfil Severit…
lines 34, 81, 90, 139, 142, 145, 148, 151
.claude/skills/bfl-api/references/code-examples/curl-examples.sh:34, 81, 90, 139, 142, 145, 148, 151 (8 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 8 occurrences SkillSpector E1 (data-exfil) in .claude/skills/bfl-api/references/endpoints.md
curl -X POST "https://api.bfl.ai/v1/flux-2-pro" \ -H "x-key: YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "prompt": "A serene mountain landscape at golden hour", "width": Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Ma…
lines 157, 172, 179, 199, 211, 223, 237
.claude/skills/bfl-api/references/endpoints.md:157, 172, 179, 199, 211, 223, 237 (8 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.70 SkillSpector E1 (data-exfil) in .claude/skills/bfl-api/references/polling-patterns.md
requests.post(endpoint, headers=self.headers, json= Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: bfl-api Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.70 Remediation: Verify the destination U…
.claude/skills/bfl-api/references/polling-patterns.md:137 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.70 2 occurrences SkillSpector E1 (data-exfil) in .claude/skills/bfl-api/references/rate-limiting.md
requests.post(endpoint, json= Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: bfl-api Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.70 Remediation: Verify the destination URL is trusted and nece…
lines 75, 165
.claude/skills/bfl-api/references/rate-limiting.md:75, 165 (2 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 5 occurrences SkillSpector E1 (data-exfil) in .claude/skills/bfl-api/references/webhook-integration.md
curl -X POST "https://api.bfl.ai/v1/flux-2-pro" \ -H "x-key: YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: bfl-api Rule: E1 Category: data-exfil S…
lines 24, 289, 290
.claude/skills/bfl-api/references/webhook-integration.md:24, 289, 290 (5 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 7 occurrences SkillSpector E1 (data-exfil) in .claude/skills/bfl-api/SKILL.md
curl -X POST "https://api.bfl.ai/v1/flux-2-pro" \ -H "x-key: $BFL_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "prompt": "Change the background to a sunset", "input_image": "ht Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. M…
lines 84, 96, 204, 215, 224, 252
.claude/skills/bfl-api/SKILL.md:84, 96, 204, 215, 224, 252 (7 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 7 occurrences SkillSpector E1 (data-exfil) in .claude/skills/create-video/references/assets.md
curl ```bash curl -X POST "https://upload.heygen.com/v1/asset" \ -H "X-Api-Key: $HEYGEN_API_KEY" \ -H "Content-Type: image/jpeg" \ --data-binary Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: create-video…
lines 41, 76, 112, 142, 190, 312
.claude/skills/create-video/references/assets.md:41, 76, 112, 142, 190, 312 (7 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 2 occurrences SkillSpector E1 (data-exfil) in .claude/skills/create-video/references/dimensions.md
curl ```bash # Landscape 1080p curl -X POST "https://api.heygen.com/v2/video/generate" \ -H "X-Api-Key: $HEYGEN_API_KEY" \ -H "Content-Type: application/json" \ -d Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. …
lines 66, 70
.claude/skills/create-video/references/dimensions.md:66, 70 (2 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.50 6 occurrences SkillSpector E1 (data-exfil) in .claude/skills/create-video/references/quota.md
https://api.heygen.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: create-video Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trusted and neces…
lines 15, 30, 45, 85, 113, 137
.claude/skills/create-video/references/quota.md:15, 30, 45, 85, 113, 137 (6 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.50 10 occurrences SkillSpector E1 (data-exfil) in .claude/skills/create-video/references/video-agent.md
https://api.heygen.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: create-video Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trusted and neces…
lines 54, 92, 95, 141, 142, 189, 190, 250, +1 more
.claude/skills/create-video/references/video-agent.md:54, 92, 95, 141, 142, 189, 190, 250, +1 more (10 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.50 5 occurrences SkillSpector E1 (data-exfil) in .claude/skills/create-video/references/video-status.md
https://api.heygen.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: create-video Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trusted and neces…
lines 19, 49, 71, 354, 355
.claude/skills/create-video/references/video-status.md:19, 49, 71, 354, 355 (5 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 5 occurrences SkillSpector E1 (data-exfil) in .claude/skills/create-video/references/webhooks.md
curl -X POST "https://api.heygen.com/v1/webhook/endpoint.add" \ -H "X-Api-Key: $HEYGEN_API_KEY" \ -H "Content-Type: application/json" \ -d Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: create-video Rule: …
lines 186, 205, 362
.claude/skills/create-video/references/webhooks.md:186, 205, 362 (5 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 2 occurrences SkillSpector E1 (data-exfil) in .claude/skills/create-video/SKILL.md
curl -X POST "https://api.heygen.com/v1/video_agent/generate" \ -H "X-Api-Key: $HEYGEN_API_KEY" \ -H "Content-Type: application/json" \ -d Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: create-video Rule: …
lines 24
.claude/skills/create-video/SKILL.md:24 (2 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 19 occurrences SkillSpector E1 (data-exfil) in .claude/skills/faceswap/SKILL.md
curl -X POST "https://api.heygen.com/v1/workflows/executions" \ -H "X-Api-Key: $HEYGEN_API_KEY" \ -H "Content-Type: application/json" \ -d Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: faceswap Rule: E1 …
lines 23, 40, 50, 53, 81, 113, 114, 141, +6 more
.claude/skills/faceswap/SKILL.md:23, 40, 50, 53, 81, 113, 114, 141, +6 more (19 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 7 occurrences SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/assets.md
curl ```bash curl -X POST "https://upload.heygen.com/v1/asset" \ -H "X-Api-Key: $HEYGEN_API_KEY" \ -H "Content-Type: image/jpeg" \ --data-binary Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: heygen Rule:…
lines 41, 76, 112, 142, 190, 312
.claude/skills/heygen/references/assets.md:41, 76, 112, 142, 190, 312 (7 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.50 4 occurrences SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/authentication.md
https://api.heygen.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: heygen Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trusted and necessary. …
lines 35, 42, 72, 86
.claude/skills/heygen/references/authentication.md:35, 42, 72, 86 (4 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.50 9 occurrences SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/avatars.md
https://api.heygen.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: heygen Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trusted and necessary. …
lines 18, 58, 82, 104, 258, 297, 314, 392, +1 more
.claude/skills/heygen/references/avatars.md:18, 58, 82, 104, 258, 297, 314, 392, +1 more (9 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 2 occurrences SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/dimensions.md
curl ```bash # Landscape 1080p curl -X POST "https://api.heygen.com/v2/video/generate" \ -H "X-Api-Key: $HEYGEN_API_KEY" \ -H "Content-Type: application/json" \ -d Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. …
lines 66, 70
.claude/skills/heygen/references/dimensions.md:66, 70 (2 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 44 occurrences SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/photo-avatars.md
curl -X POST "https://upload.heygen.com/v1/asset" \ -H "X-Api-Key: $HEYGEN_API_KEY" \ -H "Content-Type: image/jpeg" \ --data-binary '@./portrait.jpg' ``` Response: ```json { "code": 100, "d Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. M…
lines 19, 47, 50, 88, 91, 155, 172, 173, +33 more
.claude/skills/heygen/references/photo-avatars.md:19, 47, 50, 88, 91, 155, 172, 173, +33 more (44 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.50 6 occurrences SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/quota.md
https://api.heygen.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: heygen Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trusted and necessary. …
lines 15, 30, 45, 85, 113, 137
.claude/skills/heygen/references/quota.md:15, 30, 45, 85, 113, 137 (6 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 6 occurrences SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/remotion-integration.md
fetch("https://api.heygen.com/v2/video/generate", { method: "POST" Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: heygen Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.60 Remediation: Verify…
lines 96, 179, 218
.claude/skills/heygen/references/remotion-integration.md:96, 179, 218 (6 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.50 10 occurrences SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/templates.md
https://api.heygen.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: heygen Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trusted and necessary. …
lines 15, 46, 68, 121, 130, 158, 161, 198, +2 more
.claude/skills/heygen/references/templates.md:15, 46, 68, 121, 130, 158, 161, 198, +2 more (10 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.50 10 occurrences SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/video-agent.md
https://api.heygen.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: heygen Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trusted and necessary. …
lines 54, 92, 95, 141, 142, 189, 190, 250, +1 more
.claude/skills/heygen/references/video-agent.md:54, 92, 95, 141, 142, 189, 190, 250, +1 more (10 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 16 occurrences SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/video-generation.md
curl ```bash curl -X POST "https://api.heygen.com/v2/video/generate" \ -H "X-Api-Key: $HEYGEN_API_KEY" \ -H "Content-Type: application/json" \ -d Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: heygen Rule…
lines 40, 43, 164, 190, 191, 413, 518, 532, +4 more
.claude/skills/heygen/references/video-generation.md:40, 43, 164, 190, 191, 413, 518, 532, +4 more (16 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.50 5 occurrences SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/video-status.md
https://api.heygen.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: heygen Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trusted and necessary. …
lines 19, 49, 71, 354, 355
.claude/skills/heygen/references/video-status.md:19, 49, 71, 354, 355 (5 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.50 4 occurrences SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/voices.md
https://api.heygen.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: heygen Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trusted and necessary. …
lines 15, 40, 62, 429
.claude/skills/heygen/references/voices.md:15, 40, 62, 429 (4 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 5 occurrences SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/webhooks.md
curl -X POST "https://api.heygen.com/v1/webhook/endpoint.add" \ -H "X-Api-Key: $HEYGEN_API_KEY" \ -H "Content-Type: application/json" \ -d Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: heygen Rule: E1 Ca…
lines 186, 205, 362
.claude/skills/heygen/references/webhooks.md:186, 205, 362 (5 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.50 SkillSpector E1 (data-exfil) in .claude/skills/music/references/api_reference.md
https://api.elevenlabs.io/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: music Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trusted and necessary…
.claude/skills/music/references/api_reference.md:169 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 2 occurrences SkillSpector E1 (data-exfil) in .claude/skills/music/references/installation.md
cURL / REST API Set your API key as an environment variable: ```bash export ELEVENLABS_API_KEY="your-api-key" ``` Include in requests via the `xi-api-key` header: ```bash curl -X POST "https://api Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. M…
lines 39, 50
.claude/skills/music/references/installation.md:39, 50 (2 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 2 occurrences SkillSpector E1 (data-exfil) in .claude/skills/music/SKILL.md
cURL ```bash curl -X POST "https://api.elevenlabs.io/v1/music" \ -H "xi-api-key: $ELEVENLABS_API_KEY" -H "Content-Type: application/json" \ -d Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: music Rule: E1 …
lines 48, 51
.claude/skills/music/SKILL.md:48, 51 (2 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.50 SkillSpector E1 (data-exfil) in .claude/skills/remotion-best-practices/rules/compositions.md
https://api.example.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: remotion-best-practices Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trust…
.claude/skills/remotion-best-practices/rules/compositions.md:113 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.50 SkillSpector E1 (data-exfil) in .claude/skills/remotion-best-practices/rules/voiceover.md
https://api.elevenlabs.io/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: remotion-best-practices Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is tru…
.claude/skills/remotion-best-practices/rules/voiceover.md:32 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.50 2 occurrences SkillSpector E1 (data-exfil) in .claude/skills/setup-api-key/SKILL.md
https://api.elevenlabs.io/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: setup-api-key Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trusted and n…
lines 22, 58
.claude/skills/setup-api-key/SKILL.md:22, 58 (2 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 2 occurrences SkillSpector E1 (data-exfil) in .claude/skills/sound-effects/references/installation.md
cURL / REST API Set your API key as an environment variable: ```bash export ELEVENLABS_API_KEY="your-api-key" ``` Include in requests via the `xi-api-key` header: ```bash curl -X POST "https://api Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. M…
lines 39, 50
.claude/skills/sound-effects/references/installation.md:39, 50 (2 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 2 occurrences SkillSpector E1 (data-exfil) in .claude/skills/sound-effects/SKILL.md
cURL ```bash curl -X POST "https://api.elevenlabs.io/v1/sound-generation" \ -H "xi-api-key: $ELEVENLABS_API_KEY" -H "Content-Type: application/json" \ -d Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: sound…
lines 46, 49
.claude/skills/sound-effects/SKILL.md:46, 49 (2 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.85 SkillSpector EA1 (excessive-agency) in .claude/skills/create-video/SKILL.md
tools:* Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution. Skill: create-video Rule: EA1 Category: excessive-agency Severity: MEDIUM Confiden…
.claude/skills/create-video/SKILL.md:47 Mcp skillExcessive agencyEa1
medium System graph security Skillspector conf 0.85 SkillSpector EA1 (excessive-agency) in .claude/skills/heygen/SKILL.md
tools:* Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution. Skill: heygen Rule: EA1 Category: excessive-agency Severity: MEDIUM Confidence: 0.…
.claude/skills/heygen/SKILL.md:45 Mcp skillExcessive agencyEa1
medium System graph security Skillspector conf 0.75 SkillSpector EA4 (excessive-agency) in .claude/skills/remotion-best-practices/rules/gifs.md
Loop indefinitely Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns. Skill: remotion-best-practices Rule: EA4 Category: excessive-agency Severity: MEDIUM Confi…
.claude/skills/remotion-best-practices/rules/gifs.md:63 Mcp skillExcessive agencyEa4
medium System graph security Skillspector conf 0.70 SkillSpector LP3 (mcp-least-priv) in .claude/skills/bfl-api/SKILL.md
MCP Least Privilege Without declared permissions the skill's intent is opaque and cannot be validated. Skill: bfl-api Rule: LP3 Category: mcp-least-priv Severity: MEDIUM Confidence: 0.70 Remediation: Add a 'permissions' field to SKILL.md listing the capabilities this skill requires.
.claude/skills/bfl-api/SKILL.md:1 Mcp skillMcp least privLp3
medium System graph security Skillspector conf 0.70 SkillSpector LP3 (mcp-least-priv) in .claude/skills/manimgl-best-practices/SKILL.md
MCP Least Privilege Without declared permissions the skill's intent is opaque and cannot be validated. Skill: manimgl-best-practices Rule: LP3 Category: mcp-least-priv Severity: MEDIUM Confidence: 0.70 Remediation: Add a 'permissions' field to SKILL.md listing the capabilities this skill requi…
.claude/skills/manimgl-best-practices/SKILL.md:1 Mcp skillMcp least privLp3
medium System graph security Skillspector conf 0.60 SkillSpector RA2 (rogue-agent) in .claude/skills/agents/references/installation.md
create and manage agents: ```bash npm install -g @elevenlabs/cli # or pnpm add -g @elevenlabs/cli # or yarn global add @elevenlabs/cli ``` Requires Node.js 16.0.0 or higher. ### Authentication ``` Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or sta…
.claude/skills/agents/references/installation.md:5 Mcp skillRogue agentRa2
medium System graph security Skillspector conf 0.75 3 occurrences SkillSpector RA2 (rogue-agent) in .claude/skills/avatar-video/references/avatars.md
pList Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction. Skill: avatar-video Rule: RA2 Category: rogue-agent Severity: MEDIUM Confidence: 0.75 Remed…
lines 282, 291, 301
.claude/skills/avatar-video/references/avatars.md:282, 291, 301 (3 hits)
Mcp skillRogue agentRa2
medium System graph security Skillspector conf 0.75 3 occurrences SkillSpector RA2 (rogue-agent) in .claude/skills/heygen/references/avatars.md
pList Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction. Skill: heygen Rule: RA2 Category: rogue-agent Severity: MEDIUM Confidence: 0.75 Remediation…
lines 282, 291, 301
.claude/skills/heygen/references/avatars.md:282, 291, 301 (3 hits)
Mcp skillRogue agentRa2
medium System graph security Skillspector conf 0.75 SkillSpector RA2 (rogue-agent) in .claude/skills/playwright-recording/SKILL.md
pList Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction. Skill: playwright-recording Rule: RA2 Category: rogue-agent Severity: MEDIUM Confidence: 0.7…
.claude/skills/playwright-recording/SKILL.md:369 Mcp skillRogue agentRa2
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/617a547c-4bc3-4472-9693-e91cc5635c6e/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/617a547c-4bc3-4472-9693-e91cc5635c6e/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.