{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-88cc4ae7bbe50da6", "name": "Possibly dead Python function: key", "shortDescription": {"text": "Possibly dead Python function: key"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-545845cfdb21aa66", "name": "Possibly dead Python function: classify_anthropic", "shortDescription": {"text": "Possibly dead Python function: classify_anthropic"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-74bb0395e9ee12fa", "name": "Possibly dead Python function: classify", "shortDescription": {"text": "Possibly dead Python function: classify"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f4c911bc96d24809", "name": "Possibly dead Python function: from_env", "shortDescription": {"text": "Possibly dead Python function: from_env"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d3d23b675f4d7349", "name": "Possibly dead Python function: category_dir", "shortDescription": {"text": "Possibly dead Python function: category_dir"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-190a2b656659c74a", "name": "Possibly dead Python function: by_framework", "shortDescription": {"text": "Possibly dead Python function: by_framework"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a783a94b5d73ea97", "name": "Possibly dead Python function: categories", "shortDescription": {"text": "Possibly dead Python function: categories"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b010a8fca9aeb949", "name": "Insecure pattern 'exec_used' in catalog/coding/githubcopilotunrealengine.json:4", "shortDescription": {"text": "Insecure pattern 'exec_used' in catalog/coding/githubcopilotunrealengine.json:4"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ab61183f9a9848b8", "name": "Insecure pattern 'weak_hash' in catalog/robotics/tweetfeed.json:4", "shortDescription": {"text": "Insecure pattern 'weak_hash' in catalog/robotics/tweetfeed.json:4"}, "fullDescription": {"text": "Found a known-risky pattern (weak_hash). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a54da7e8cf53ded2", "name": "Insecure pattern 'exec_used' in catalog/web-dev/githubcopilotunrealengine.json:4", "shortDescription": {"text": "Insecure pattern 'exec_used' in catalog/web-dev/githubcopilotunrealengine.json:4"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d8e8213ca45b9c12", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ee252b4a1468bf6e", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-65a716a27d2be993", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0e35a712e79de265", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "0 test file(s) for 32 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-11825279136b53a3", "name": "CI is configured but no tests are detected", "shortDescription": {"text": "CI is configured but no tests are detected"}, "fullDescription": {"text": "A CI pipeline exists, but the scan found no test files to gate. Opus labeled this generated-code pattern as config theater: release machinery exists, but it has little behavioral signal."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1c2f6fa5305c2791", "name": "Agent authority lacks a verifier contract: adapters/continue/mcp.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: adapters/continue/mcp.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6ffbe5047e518245", "name": "Agent authority lacks a verifier contract: adapters/comfyui/mcp.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: adapters/comfyui/mcp.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ecf874267f782722", "name": "Agent authority lacks a verifier contract: adapters/haystack/mcp.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: adapters/haystack/mcp.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-afa416c053743346", "name": "Agent authority lacks a verifier contract: adapters/unstructured/mcp.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: adapters/unstructured/mcp.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6b93f779f14b3383", "name": "Agent authority lacks a verifier contract: adapters/aider/mcp.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: adapters/aider/mcp.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a25f64deb24efc7e", "name": "Agent authority lacks a verifier contract: adapters/openbb-terminal/mcp.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: adapters/openbb-terminal/mcp.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b92ec243e06826f4", "name": "Agent authority lacks a verifier contract: adapters/marker/mcp.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: adapters/marker/mcp.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f2d7487aea546dec", "name": "Agent authority lacks a verifier contract: adapters/cline/mcp.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: adapters/cline/mcp.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8d80bc662db711df", "name": "Agent authority lacks a verifier contract: adapters/pandas-ai/mcp.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: adapters/pandas-ai/mcp.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-abb035407ee11765", "name": "Agent authority lacks a verifier contract: adapters/langgraph/mcp.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: adapters/langgraph/mcp.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-84a0e220e9b20ea3", "name": "Agent authority lacks a verifier contract: adapters/autogpt/mcp.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: adapters/autogpt/mcp.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-aff08fa6c98ab7d8", "name": "Agent authority lacks a verifier contract: adapters/browser-use/mcp.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: adapters/browser-use/mcp.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-36d353623485e97c", "name": "Agent authority lacks a verifier contract: adapters/swe-agent/mcp.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: adapters/swe-agent/mcp.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4b3fa3c7eaa548e8", "name": "Agent authority lacks a verifier contract: adapters/stable-diffusion-webui/mcp.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: adapters/stable-diffusion-webui/mcp.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b382b99b5861032d", "name": "Agent authority lacks a verifier contract: adapters/open-interpreter/mcp.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: adapters/open-interpreter/mcp.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b0acf5edf71207b6", "name": "Agent authority lacks a verifier contract: adapters/autogen/mcp.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: adapters/autogen/mcp.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4957fe9bab469f5e", "name": "Agent authority lacks a verifier contract: adapters/faster-whisper/mcp.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: adapters/faster-whisper/mcp.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d87e27cdd45ac91e", "name": "Agent authority lacks a verifier contract: adapters/gpt-engineer/mcp.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: adapters/gpt-engineer/mcp.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c41b47aba749a440", "name": "Agent authority lacks a verifier contract: adapters/skyvern/mcp.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: adapters/skyvern/mcp.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b7dd55540103246f", "name": "Commented-code block (6 lines) in pipeline/nightly.py:46", "shortDescription": {"text": "Commented-code block (6 lines) in pipeline/nightly.py:46"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1dc51ad95dd5ab92", "name": "Commented-code block (5 lines) in pipeline/schema.py:77", "shortDescription": {"text": "Commented-code block (5 lines) in pipeline/schema.py:77"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f91f80d67356eeb0", "name": "Commented-code block (5 lines) in pipeline/benchmarks/swe_bench.py:75", "shortDescription": {"text": "Commented-code block (5 lines) in pipeline/benchmarks/swe_bench.py:75"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9367eace6ca5be05", "name": "Commented-code block (6 lines) in docs/integrate/nexus-tools-patch.py:158", "shortDescription": {"text": "Commented-code block (6 lines) in docs/integrate/nexus-tools-patch.py:158"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\npipeline/classifier.py:classify_keyword, pipeline/classifier.py:classify\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/24106"}, "properties": {"repository": "AllStreets/ONEXUS-Agents", "repoUrl": "https://github.com/AllStreets/ONEXUS-Agents", "branch": "main"}, "results": [{"ruleId": "scanner-88cc4ae7bbe50da6", "level": "note", "message": {"text": "Possibly dead Python function: key"}, "properties": {"repobilityId": "82ad9f64418e6fec", "scanner": "scanner-primary", "fingerprint": "88cc4ae7bbe50da6", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pipeline/weekly.py:100"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-545845cfdb21aa66", "level": "note", "message": {"text": "Possibly dead Python function: classify_anthropic"}, "properties": {"repobilityId": "74e03d4f189891b3", "scanner": "scanner-primary", "fingerprint": "545845cfdb21aa66", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pipeline/classifier.py:59"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-74bb0395e9ee12fa", "level": "note", "message": {"text": "Possibly dead Python function: classify"}, "properties": {"repobilityId": "4ae68d90aaac82d9", "scanner": "scanner-primary", "fingerprint": "74bb0395e9ee12fa", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pipeline/classifier.py:124"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f4c911bc96d24809", "level": "note", "message": {"text": "Possibly dead Python function: from_env"}, "properties": {"repobilityId": "e772ce5fbbc243da", "scanner": "scanner-primary", "fingerprint": "f4c911bc96d24809", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pipeline/budget.py:66"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d3d23b675f4d7349", "level": "note", "message": {"text": "Possibly dead Python function: category_dir"}, "properties": {"repobilityId": "d5bb0d9a0e008a78", "scanner": "scanner-primary", "fingerprint": "d3d23b675f4d7349", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pipeline/store.py:51"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-190a2b656659c74a", "level": "note", "message": {"text": "Possibly dead Python function: by_framework"}, "properties": {"repobilityId": "b4582de3e9978edb", "scanner": "scanner-primary", "fingerprint": "190a2b656659c74a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pipeline/client.py:172"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a783a94b5d73ea97", "level": "note", "message": {"text": "Possibly dead Python function: categories"}, "properties": {"repobilityId": "b8166d2977806fe4", "scanner": "scanner-primary", "fingerprint": "a783a94b5d73ea97", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pipeline/client.py:179"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b010a8fca9aeb949", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in catalog/coding/githubcopilotunrealengine.json:4"}, "properties": {"repobilityId": "cd4d67c5d6e8386a", "scanner": "scanner-primary", "fingerprint": "b010a8fca9aeb949", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "catalog/coding/githubcopilotunrealengine.json"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-ab61183f9a9848b8", "level": "warning", "message": {"text": "Insecure pattern 'weak_hash' in catalog/robotics/tweetfeed.json:4"}, "properties": {"repobilityId": "13801b124330f56f", "scanner": "scanner-primary", "fingerprint": "ab61183f9a9848b8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "weak_hash"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "catalog/robotics/tweetfeed.json"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-a54da7e8cf53ded2", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in catalog/web-dev/githubcopilotunrealengine.json:4"}, "properties": {"repobilityId": "d94a3ee6f9ef24c2", "scanner": "scanner-primary", "fingerprint": "a54da7e8cf53ded2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "catalog/web-dev/githubcopilotunrealengine.json"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-d8e8213ca45b9c12", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "4960ad10d5f2f2f7", "scanner": "scanner-primary", "fingerprint": "d8e8213ca45b9c12", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/weekly.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ee252b4a1468bf6e", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "8410a23fe51251b5", "scanner": "scanner-primary", "fingerprint": "ee252b4a1468bf6e", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/nightly.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-65a716a27d2be993", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "3133a88ce98acc76", "scanner": "scanner-primary", "fingerprint": "65a716a27d2be993", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/scorecard.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0e35a712e79de265", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b41c52842d38a2aa", "scanner": "scanner-primary", "fingerprint": "0e35a712e79de265", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/submission.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-11825279136b53a3", "level": "warning", "message": {"text": "CI is configured but no tests are detected"}, "properties": {"repobilityId": "ca237be4036bbdb2", "scanner": "scanner-primary", "fingerprint": "11825279136b53a3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "ci", "config-theater", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-1c2f6fa5305c2791", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: adapters/continue/mcp.json"}, "properties": {"repobilityId": "36818ec470c5e458", "scanner": "scanner-primary", "fingerprint": "1c2f6fa5305c2791", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "mcp_config"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "adapters/continue/mcp.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6ffbe5047e518245", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: adapters/comfyui/mcp.json"}, "properties": {"repobilityId": "dab7f682a8fca059", "scanner": "scanner-primary", "fingerprint": "6ffbe5047e518245", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "mcp_config"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "adapters/comfyui/mcp.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ecf874267f782722", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: adapters/haystack/mcp.json"}, "properties": {"repobilityId": "2b25d674218c15dc", "scanner": "scanner-primary", "fingerprint": "ecf874267f782722", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "mcp_config"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "adapters/haystack/mcp.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-afa416c053743346", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: adapters/unstructured/mcp.json"}, "properties": {"repobilityId": "5e01d989a7414942", "scanner": "scanner-primary", "fingerprint": "afa416c053743346", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "mcp_config"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "adapters/unstructured/mcp.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6b93f779f14b3383", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: adapters/aider/mcp.json"}, "properties": {"repobilityId": "eb31d072794d3c21", "scanner": "scanner-primary", "fingerprint": "6b93f779f14b3383", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "mcp_config"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "adapters/aider/mcp.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a25f64deb24efc7e", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: adapters/openbb-terminal/mcp.json"}, "properties": {"repobilityId": "89ad755d9820d7ec", "scanner": "scanner-primary", "fingerprint": "a25f64deb24efc7e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "mcp_config"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "adapters/openbb-terminal/mcp.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b92ec243e06826f4", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: adapters/marker/mcp.json"}, "properties": {"repobilityId": "038eb563a9915f7e", "scanner": "scanner-primary", "fingerprint": "b92ec243e06826f4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "mcp_config"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "adapters/marker/mcp.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f2d7487aea546dec", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: adapters/cline/mcp.json"}, "properties": {"repobilityId": "dffd54f212673b16", "scanner": "scanner-primary", "fingerprint": "f2d7487aea546dec", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "mcp_config"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "adapters/cline/mcp.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8d80bc662db711df", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: adapters/pandas-ai/mcp.json"}, "properties": {"repobilityId": "f41a52ed3320f4b9", "scanner": "scanner-primary", "fingerprint": "8d80bc662db711df", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "mcp_config"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "adapters/pandas-ai/mcp.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-abb035407ee11765", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: adapters/langgraph/mcp.json"}, "properties": {"repobilityId": "c890b8d38d5698b9", "scanner": "scanner-primary", "fingerprint": "abb035407ee11765", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "mcp_config"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "adapters/langgraph/mcp.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-84a0e220e9b20ea3", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: adapters/autogpt/mcp.json"}, "properties": {"repobilityId": "9f582d7c692c46a3", "scanner": "scanner-primary", "fingerprint": "84a0e220e9b20ea3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "mcp_config"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "adapters/autogpt/mcp.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-aff08fa6c98ab7d8", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: adapters/browser-use/mcp.json"}, "properties": {"repobilityId": "1da8a33a59413055", "scanner": "scanner-primary", "fingerprint": "aff08fa6c98ab7d8", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "mcp_config"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "adapters/browser-use/mcp.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-36d353623485e97c", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: adapters/swe-agent/mcp.json"}, "properties": {"repobilityId": "8b2ef46dd9882bcc", "scanner": "scanner-primary", "fingerprint": "36d353623485e97c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "mcp_config"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "adapters/swe-agent/mcp.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4b3fa3c7eaa548e8", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: adapters/stable-diffusion-webui/mcp.json"}, "properties": {"repobilityId": "91d5dbfc5466bc7f", "scanner": "scanner-primary", "fingerprint": "4b3fa3c7eaa548e8", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "mcp_config"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "adapters/stable-diffusion-webui/mcp.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b382b99b5861032d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: adapters/open-interpreter/mcp.json"}, "properties": {"repobilityId": "d5397486707faa85", "scanner": "scanner-primary", "fingerprint": "b382b99b5861032d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "mcp_config"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "adapters/open-interpreter/mcp.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b0acf5edf71207b6", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: adapters/autogen/mcp.json"}, "properties": {"repobilityId": "0f00baaf6afa3117", "scanner": "scanner-primary", "fingerprint": "b0acf5edf71207b6", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "mcp_config"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "adapters/autogen/mcp.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4957fe9bab469f5e", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: adapters/faster-whisper/mcp.json"}, "properties": {"repobilityId": "2d4a134d80b5d4b2", "scanner": "scanner-primary", "fingerprint": "4957fe9bab469f5e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "mcp_config"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "adapters/faster-whisper/mcp.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d87e27cdd45ac91e", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: adapters/gpt-engineer/mcp.json"}, "properties": {"repobilityId": "dd8d6cd18af20588", "scanner": "scanner-primary", "fingerprint": "d87e27cdd45ac91e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "mcp_config"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "adapters/gpt-engineer/mcp.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c41b47aba749a440", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: adapters/skyvern/mcp.json"}, "properties": {"repobilityId": "522d479508424eca", "scanner": "scanner-primary", "fingerprint": "c41b47aba749a440", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "mcp_config"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "adapters/skyvern/mcp.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b7dd55540103246f", "level": "none", "message": {"text": "Commented-code block (6 lines) in pipeline/nightly.py:46"}, "properties": {"repobilityId": "23e8730a519d522f", "scanner": "scanner-primary", "fingerprint": "b7dd55540103246f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1dc51ad95dd5ab92", "level": "none", "message": {"text": "Commented-code block (5 lines) in pipeline/schema.py:77"}, "properties": {"repobilityId": "14b38074acf84082", "scanner": "scanner-primary", "fingerprint": "1dc51ad95dd5ab92", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f91f80d67356eeb0", "level": "none", "message": {"text": "Commented-code block (5 lines) in pipeline/benchmarks/swe_bench.py:75"}, "properties": {"repobilityId": "2e606b1a12241f18", "scanner": "scanner-primary", "fingerprint": "f91f80d67356eeb0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9367eace6ca5be05", "level": "none", "message": {"text": "Commented-code block (6 lines) in docs/integrate/nexus-tools-patch.py:158"}, "properties": {"repobilityId": "3f0ea313fa026754", "scanner": "scanner-primary", "fingerprint": "9367eace6ca5be05", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "3d09c11c444a3ae0", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}]}]}