Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

Scan timing: clone 1.69s · analysis 0.42s · 0.6 MB · GitHub preflight 504ms

kulturpool/EDMLib

https://github.com/kulturpool/EDMLib.git · scanned 2026-05-25 08:26 UTC (1 week, 4 days ago) · 10 languages

108 findings (56 legacy + 52 scanner) 81st percentile · Python · small (2-20K LoC) Scanner says 87 (lower by 5)

File as issue Image v2 schema
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 1 week, 4 days ago · v2 · 82 findings from 2 sources. Findings combine the legacy security pipeline AND the multi-layer engine (atlas, wiring, flows, ranked) AND verified AI agent contributions.

JSON
Combined
85.9
/100
Repobility
85
56 legacy
9-layer
87
88.9% cov · 26 gaps
Critical
0
click to filter
Agents
6
0 votes
Crowd
0
reported
Score breakdown â 2026-05-18-v5
Component Sub-score Weight Contribution
structure_score 75.0 0.15 11.25
security_score 98.7 0.25 24.68
testing_score 100.0 0.20 20.00
documentation_score 50.0 0.15 7.50
practices_score 67.0 0.15 10.05
code_quality 80.0 0.10 8.00
Overall 1.00 81.5
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 0 High 44 Medium 3 Low 25 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Legacy 56 9-layer 26 Crowd 0 Layer: Cicd 4 Quality 57 Software 15 Api 1 Hardware 3 Frontend 1 Security 1
Scan summary Repository scanned at 86.8/100 with 88.9% coverage. It contains 240 nodes across 0 cross-layer flows, written primarily in mixed languages. Engine surfaced 26 findings — concentrated in software (12), quality (8), hardware (3). Risk profile is high: 0 critical, 1 high, 1 medium. Recommended next step: open the software layer findings first — that's where the highest-impact wins live.

Showing 57 of 82 findings. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

high Legacy quality quality conf 1.00 ✓ Repobility `self.get_aggregation` used but never assigned in __init__
Method `parse_single_class` of class `EDM_Parser` reads `self.get_aggregation`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
edmlib/parser.py:236 qualitylegacy
high Legacy quality quality conf 1.00 ✓ Repobility `self.get_instance_triples` used but never assigned in __init__
Method `parse_many_class` of class `EDM_Parser` reads `self.get_instance_triples`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
edmlib/parser.py:259 qualitylegacy
high Legacy quality quality conf 1.00 ✓ Repobility `self.get_instance_triples` used but never assigned in __init__
Method `parse_single_class` of class `EDM_Parser` reads `self.get_instance_triples`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
edmlib/parser.py:242 qualitylegacy
high Legacy quality quality conf 1.00 ✓ Repobility `self.get_many_ref` used but never assigned in __init__
Method `parse_many_class` of class `EDM_Parser` reads `self.get_many_ref`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
edmlib/parser.py:252 qualitylegacy
high Legacy quality quality conf 1.00 ✓ Repobility `self.get_many_ref` used but never assigned in __init__
Method `get_single_ref` of class `EDM_Parser` reads `self.get_many_ref`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
edmlib/parser.py:138 qualitylegacy
high Legacy quality quality conf 1.00 ✓ Repobility `self.get_rdf_graph` used but never assigned in __init__
Method `get_framed_json_ld` of class `EDM_Record` reads `self.get_rdf_graph`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
edmlib/edm/record.py:106 qualitylegacy
high Legacy quality quality conf 1.00 ✓ Repobility `self.get_rdf_graph` used but never assigned in __init__
Method `serialize` of class `EDM_Record` reads `self.get_rdf_graph`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
edmlib/edm/record.py:102 qualitylegacy
high Legacy quality quality conf 1.00 ✓ Repobility `self.get_single_ref` used but never assigned in __init__
Method `parse_single_class` of class `EDM_Parser` reads `self.get_single_ref`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
edmlib/parser.py:234 qualitylegacy
high Legacy quality quality conf 1.00 ✓ Repobility `self.get_webresources` used but never assigned in __init__
Method `parse_many_class` of class `EDM_Parser` reads `self.get_webresources`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
edmlib/parser.py:250 qualitylegacy
high Legacy quality quality conf 1.00 ✓ Repobility `self.label` used but never assigned in __init__
Method `get_triples` of class `EDM_BaseClass` reads `self.label`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
edmlib/edm/base.py:49 qualitylegacy
high Legacy quality quality conf 1.00 ✓ Repobility `self.model_fields` used but never assigned in __init__
Method `get_triples` of class `EDM_BaseClass` reads `self.model_fields`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
edmlib/edm/base.py:52 qualitylegacy
high Legacy quality quality conf 1.00 ✓ Repobility `self.parse_many_class` used but never assigned in __init__
Method `parse` of class `EDM_Parser` reads `self.parse_many_class`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
edmlib/parser.py:274 qualitylegacy
high Legacy quality quality conf 1.00 ✓ Repobility `self.parse_many_class` used but never assigned in __init__
Method `parse` of class `EDM_Parser` reads `self.parse_many_class`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
edmlib/parser.py:273 qualitylegacy
high Legacy quality quality conf 1.00 ✓ Repobility `self.parse_many_class` used but never assigned in __init__
Method `parse` of class `EDM_Parser` reads `self.parse_many_class`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
edmlib/parser.py:272 qualitylegacy
high Legacy quality quality conf 1.00 ✓ Repobility `self.parse_many_class` used but never assigned in __init__
Method `parse` of class `EDM_Parser` reads `self.parse_many_class`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
edmlib/parser.py:271 qualitylegacy
high Legacy quality quality conf 1.00 ✓ Repobility `self.parse_many_class` used but never assigned in __init__
Method `parse` of class `EDM_Parser` reads `self.parse_many_class`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
edmlib/parser.py:270 qualitylegacy
high Legacy quality quality conf 1.00 ✓ Repobility `self.parse_many_class` used but never assigned in __init__
Method `parse` of class `EDM_Parser` reads `self.parse_many_class`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
edmlib/parser.py:269 qualitylegacy
high Legacy quality quality conf 1.00 ✓ Repobility `self.parse_many_class` used but never assigned in __init__
Method `parse` of class `EDM_Parser` reads `self.parse_many_class`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
edmlib/parser.py:268 qualitylegacy
high Legacy quality quality conf 1.00 ✓ Repobility `self.parse_single_class` used but never assigned in __init__
Method `parse` of class `EDM_Parser` reads `self.parse_single_class`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
edmlib/parser.py:267 qualitylegacy
high Legacy quality quality conf 1.00 ✓ Repobility `self.parse_single_class` used but never assigned in __init__
Method `parse` of class `EDM_Parser` reads `self.parse_single_class`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
edmlib/parser.py:266 qualitylegacy
high Legacy quality quality conf 1.00 ✓ Repobility `self.value` used but never assigned in __init__
Method `is_optional` of class `CARDINALITY` reads `self.value`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
edmlib/edm/enums.py:204 qualitylegacy
high Legacy quality quality conf 1.00 ✓ Repobility `self.value` used but never assigned in __init__
Method `is_optional` of class `CARDINALITY` reads `self.value`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
edmlib/shared_types.py:29 qualitylegacy
high Legacy software dependency conf 0.90 ✓ Repobility Action `actions/checkout` pinned to mutable ref `@v6`
`uses: actions/checkout@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.
.github/workflows/publish-to-pypi.yml:18 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility Dockerfile FROM `python:3.12.9` not pinned by digest
`FROM python:3.12.9` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potentially different. Production images should pin to `image@sha256:...` for reproducibility + supply-chain integrity.
.devcontainer/Dockerfile:1 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility Workflow container/services image `registry.kpool.at/kulturpool/development-operations/ci-cd/docker-images/poetry-packaging/poetry-packaging:1.1.1` unpinned
`container/services image: registry.kpool.at/kulturpool/development-operations/ci-cd/docker-images/poetry-packaging/poetry-packaging:1.1.1` without `@sha256:...` pulls a mutable tag at workflow-run time. Treat workflow container references with the same supply-chain discipline as Dockerfile FROM li…
.github/workflows/publish-to-pypi.yml:13 dependencylegacy
high 9-layer hardware supply-chain conf 1.00 Dockerfile pipes a remote installer into a shell
Executing downloaded code during image build gives the remote endpoint build-time code execution. Prefer pinned packages or verify downloaded installers by checksum/signature.
.devcontainer/Dockerfile:17 supply-chaindockerremote-installer
medium Legacy cicd docker conf 0.90 Docker build context has no .dockerignore
Without .dockerignore, build context can include source history, local env files, dependencies, and generated artifacts.
.dockerignore dockerlegacy
medium Legacy quality quality conf 1.00 ✓ Repobility Mutable default argument in `cached_loader` (dict)
`def cached_loader(... = []/{}/set())` — Python's default value is constructed ONCE at function definition time and shared across all calls. Mutating it in one call mutates it for every future call too.
edmlib/edm/jsonld_cached_documentloader.py:12 qualitylegacy
medium 9-layer security coverage conf 1.00 No auth library detected
The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). Either auth lives in custom code, in a separate service, or is missing.
coverageauth
high Legacy cicd docker conf 0.56 Compose service does not declare a runtime user
If the image does not define USER internally, this service may run as root.
.devcontainer/compose.yml:1 dockerlegacy
high Legacy cicd docker conf 0.62 Compose service lacks no-new-privileges hardening
no-new-privileges prevents processes from gaining additional privileges through setuid binaries or file capabilities.
.devcontainer/compose.yml:1 dockerlegacy
high Legacy cicd docker conf 0.72 Dockerfile keeps pip download cache
Pip's package cache increases image size and can preserve unnecessary artifacts.
.devcontainer/Dockerfile:16 dockerlegacy
low Legacy quality documentation No LICENSE file
Add a LICENSE file to your repository. Use choosealicense.com to pick the right license (MIT for permissive, Apache 2.0 for patent protection, GPL for copyleft).
documentationlegacy
low 9-layer hardware coverage conf 1.00 Containers defined but no K8s/orchestration manifest found
Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo.
coveragedeployment
low 9-layer hardware supply-chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: python:3.12.9
Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.
.devcontainer/Dockerfile:1 supply-chaindockerpinned-dependencies
low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: examples/parse_jsonld.py
Source file with no class/function declarations — possible config, dead code, or scratch file.
dead-code-candidate
low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: examples/parse_rdf_xml.py
Source file with no class/function declarations — possible config, dead code, or scratch file.
dead-code-candidate
low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: examples/serialize_to_json_ld.py
Source file with no class/function declarations — possible config, dead code, or scratch file.
dead-code-candidate
low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: examples/validate.py
Source file with no class/function declarations — possible config, dead code, or scratch file.
dead-code-candidate
low 9-layer quality integrity conf 1.00 Near-duplicate function bodies in 2 places
Functions with the same first-5-line body hash: edmlib/parser.py:parse_single_class, edmlib/parser.py:parse This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate.
integrityduplicatedry
low 9-layer quality integrity conf 1.00 Near-duplicate function bodies in 2 places
Functions with the same first-5-line body hash: edmlib/edm/enums.py:get_namespace_tuples, edmlib/edm/enums.py:get This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate.
integrityduplicatedry
low 9-layer quality integrity conf 1.00 Near-duplicate function bodies in 2 places
Functions with the same first-5-line body hash: edmlib/edm/value_types.py:to_rdflib, edmlib/edm/value_types.py:to_rdflib This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate.
integrityduplicatedry
low 9-layer quality integrity conf 1.00 Near-duplicate function bodies in 4 places
Functions with the same first-5-line body hash: edmlib/edm/enums.py:list, edmlib/edm/enums.py:list, edmlib/edm/enums.py:list, edmlib/edm/enums.py:list This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene). Consolidate or document why they…
integrityduplicatedry
low 9-layer quality integrity conf 1.00 Near-duplicate function bodies in 4 places
Functions with the same first-5-line body hash: edmlib/edm/classes/context.py:validate_skos_pref_label, edmlib/edm/classes/context.py:validate_skos_pref_label, edmlib/edm/classes/context.py:validate_skos_pref_label, edmlib/edm/classes/context.py:validate_skos_pref_label This is *the* AI-coder fail…
integrityduplicatedry
low 9-layer software dead-code conf 1.00 Possibly dead Python function: cached_loader
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
edmlib/edm/jsonld_cached_documentloader.py:12 dead-code
low 9-layer software dead-code conf 1.00 Possibly dead Python function: cls_attribute_to_ref
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
edmlib/parser.py:61 dead-code
low 9-layer software dead-code conf 1.00 Possibly dead Python function: fetch_edm_hasView_heads
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
edmlib/edm/record.py:144 dead-code
low 9-layer software dead-code conf 1.00 Possibly dead Python function: fetch_edm_isShownAt_head
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
edmlib/edm/record.py:150 dead-code
low 9-layer software dead-code conf 1.00 Possibly dead Python function: fetch_edm_isShownBy_head
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
edmlib/edm/record.py:126 dead-code
low 9-layer software dead-code conf 1.00 Possibly dead Python function: fetch_edm_object_head
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
edmlib/edm/record.py:135 dead-code
low 9-layer software dead-code conf 1.00 Possibly dead Python function: has_edm_hasView
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
edmlib/edm/record.py:141 dead-code
low 9-layer software dead-code conf 1.00 Possibly dead Python function: has_edm_object
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
edmlib/edm/record.py:132 dead-code
low 9-layer quality complexity conf 1.00 Very large file: edmlib/edm/classes/core.py (1832 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
complexity
low Legacy quality quality conf 1.00 ✓ Repobility [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data.
Review and fix per the pattern semantics. See CWE-319 / A02:2021 for context.
edmlib/edm/validation/3d_vocabularies.py:7 qualitylegacy
low Legacy quality quality conf 1.00 ✓ Repobility [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data.
Review and fix per the pattern semantics. See CWE-319 / A02:2021 for context.
edmlib/edm/enums.py:17 qualitylegacy
low Legacy quality quality conf 1.00 ✓ Repobility [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data.
Review and fix per the pattern semantics. See CWE-319 / A02:2021 for context.
edmlib/edm/classes/service.py:24 qualitylegacy
low Legacy quality quality conf 1.00 ✓ Repobility [MINED067] Python Requests No Timeout: requests.get/post/etc. without timeout= can hang forever.
Review and fix per the pattern semantics. See CWE-400 / for context.
edmlib/edm/record.py:130 qualitylegacy
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/6eb8cbf3-dacf-4c7a-894e-f278de8ac11c/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/6eb8cbf3-dacf-4c7a-894e-f278de8ac11c/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.