{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-bb46624839133779", "name": "Possibly dead Python function: positive_float", "shortDescription": {"text": "Possibly dead Python function: positive_float"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-88fa2d0b489056d0", "name": "TODO/FIXME marker in shipping code \u2014 extensions/vscode/src/extension/services/cliParse.ts:13", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 extensions/vscode/src/extension/services/cliParse.ts:13"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-a260df2545ad0e5e", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 pages/src/components/MarkdownRenderer.tsx:171", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 pages/src/components/MarkdownRenderer.tsx:171"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 0.8}}, {"id": "scanner-083b05e2838844ac", "name": "dynamic urllib use detected \u2014 examples/gerrit_ci/post_review.py:241", "shortDescription": {"text": "dynamic urllib use detected \u2014 examples/gerrit_ci/post_review.py:241"}, "fullDescription": {"text": "Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.\n\nRule: python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected\nSeverity: WARNING\nOWASP: A01:2017 - Injection\nCWE: CWE-939: Improper Authorization in Handler for Custom URL Scheme\nCategory: security\nContext: non-production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-7ec4e87f99c8d4b1", "name": "dynamic urllib use detected \u2014 examples/gitflic_ci/post_review.py:341", "shortDescription": {"text": "dynamic urllib use detected \u2014 examples/gitflic_ci/post_review.py:341"}, "fullDescription": {"text": "Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.\n\nRule: python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected\nSeverity: WARNING\nOWASP: A01:2017 - Injection\nCWE: CWE-939: Improper Authorization in Handler for Custom URL Scheme\nCategory: security\nContext: non-production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-9466bed3017c0fe9", "name": "detect child process \u2014 extensions/vscode/src/extension/services/CliService.ts:35", "shortDescription": {"text": "detect child process \u2014 extensions/vscode/src/extension/services/CliService.ts:35"}, "fullDescription": {"text": "Detected calls to child_process from a function argument `bin`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed.\n\nRule: javascript.lang.security.detect-child-process.detect-child-process\nSeverity: ERROR\nOWASP: A01:2017 - Injection, A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-80b3abc4cb539e4c", "name": "react dangerouslysetinnerhtml \u2014 pages/src/components/MarkdownRenderer.tsx:171", "shortDescription": {"text": "react dangerouslysetinnerhtml \u2014 pages/src/components/MarkdownRenderer.tsx:171"}, "fullDescription": {"text": "Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HTML.\n\nRule: typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml\nSeverity: WARNING\nOWASP: A07:2017 - Cross-Site Scripting (XSS), A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-89aa284a340cce4b", "name": "detect child process \u2014 scripts/update.js:61", "shortDescription": {"text": "detect child process \u2014 scripts/update.js:61"}, "fullDescription": {"text": "Detected calls to child_process from a function argument `binPath`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed.\n\nRule: javascript.lang.security.detect-child-process.detect-child-process\nSeverity: ERROR\nOWASP: A01:2017 - Injection, A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-8b2a3e9a6fffa842", "name": "CVE-2026-46600: golang.org/x/net v0.55.0 \u2014 go.mod", "shortDescription": {"text": "CVE-2026-46600: golang.org/x/net v0.55.0 \u2014 go.mod"}, "fullDescription": {"text": "Parsing an invalid SVCB or HTTPS RR can panic when the size of a param ...\n\nParsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.\n\nPackage: golang.org/x/net\nInstalled: v0.55.0\nFixed in: 0.56.0\nSeverity: UNKNOWN\nFix: Upgrade golang.org/x/net to 0.56.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "info", "confidence": 1.0}}, {"id": "scanner-aad9f00e610f00c0", "name": "CVE-2026-56852: golang.org/x/text v0.37.0 \u2014 go.mod", "shortDescription": {"text": "CVE-2026-56852: golang.org/x/text v0.37.0 \u2014 go.mod"}, "fullDescription": {"text": "A norm.Iter can enter an infinite loop when handling input containing  ...\n\nA norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.\n\nPackage: golang.org/x/text\nInstalled: v0.37.0\nFixed in: 0.39.0\nSeverity: UNKNOWN\nFix: Upgrade golang.org/x/text to 0.39.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d62091cfb11b93ca", "name": "Agent authority lacks a verifier contract: .claude/commands/open-code-review.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/open-code-review.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-311dc1e692bdd9e0", "name": "Agent authority lacks a verifier contract: .claude/commands/tag.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/tag.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6eb7bc995ebf3180", "name": "Agent authority lacks a verifier contract: skills/open-code-review-delegate/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/open-code-review-delegate/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c63409b348b05b89", "name": "Agent instruction contains unpinned remote install: skills/open-code-review-delegate/SKILL.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: skills/open-code-review-delegate/SKILL.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b4d555927f70d5e6", "name": "Agent instruction contains unpinned remote install: skills/open-code-review/SKILL.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: skills/open-code-review/SKILL.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9461ce093e5acaa7", "name": "Agent authority lacks a verifier contract: plugins/open-code-review/skills/open-code-review-delegate/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: plugins/open-code-review/skills/open-code-review-delegate/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f6eb440491ce2adb", "name": "Agent instruction contains unpinned remote install: plugins/open-code-review/skills/open-code-review-delegate/SKILL.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: plugins/open-code-review/skills/open-code-review-delegate/SKILL.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e3873b9f93bd763c", "name": "Agent instruction contains unpinned remote install: plugins/open-code-review/skills/open-code-review/SKILL.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: plugins/open-code-review/skills/open-code-review/SKILL.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bddb1999e2212a74", "name": "SkillSpector E1 (data-exfil) in skills/open-code-review/SKILL.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in skills/open-code-review/SKILL.md"}, "fullDescription": {"text": "https://api.anthropic.com/\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: open-code-review\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.50\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.5}}, {"id": "scanner-111c3191ca3fd200", "name": "SkillSpector E1 (data-exfil) in plugins/open-code-review/skills/open-code-review/SKILL.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in plugins/open-code-review/skills/open-code-review/SKILL.md"}, "fullDescription": {"text": "https://api.anthropic.com/\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: open-code-review\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.50\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.5}}, {"id": "scanner-e637c415447867e4", "name": "Run SkillSpector's LLM-backed analysis in your own pipeline", "shortDescription": {"text": "Run SkillSpector's LLM-backed analysis in your own pipeline"}, "fullDescription": {"text": "Repobility ran SkillSpector's static rules server-side. The deeper LLM-backed analyzers \u2014 tool-poisoning (TP*), semantic security discovery (SSD*), developer-intent mismatch (SDI*) \u2014 are meant to run on YOUR machine with YOUR model; repobility never sends your code to an LLM. Recipe:\n\n# 1. Install SkillSpector in your own isolated env\npipx install \"skillspector @ git+https://github.com/NVIDIA/SkillSpector.git\"\n\n# 2. Point it at YOUR LLM pipeline (pick one) - your code stays on your machine\nexport SKILLSPECTOR_PROVIDER=anthropic && export ANTHROPIC_API_KEY=sk-ant-...\n# export SKILLSPECTOR_PROVIDER=openai   && export OPENAI_API_KEY=sk-...\n# export SKILLSPECTOR_PROVIDER=openai OPENAI_API_KEY=ollama OPENAI_BASE_URL=http://localhost:11434/v1 SKILLSPECTOR_MODEL=llama3.1:8b\n# export SKILLSPECTOR_PROVIDER=nv_build && export NVIDIA_INFERENCE_KEY=nvapi-...\n\n# 3. Run the LLM-backed scan per skill (omit --no-llm to enable the LLM analyzers)\nskillspector scan skills/open-code-review --format sarif "}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e821e22dbeb3571f", "name": "Insecure pattern 'dangerous_innerhtml' in pages/src/components/MarkdownRenderer.tsx:171", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in pages/src/components/MarkdownRenderer.tsx:171"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-c63b58847ecb976a", "name": "Insecure pattern 'direct_innerhtml_assignment' in pages/src/components/MarkdownRenderer.tsx:123", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in pages/src/components/MarkdownRenderer.tsx:123"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-a18af38124ed74a3", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0f883454d11648ef", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/cache@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c1e62c8a8becdce0", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/deploy-pages@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-11fe6710547243fb", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-46c644c6227e4d4a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "softprops/action-gh-release@v2 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1838a141491ce38c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cb639d9a10a47b23", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d089797dc9cc14ff", "name": "Very large file: scripts/github-actions/post-review-comments.js (1203 lines)", "shortDescription": {"text": "Very large file: scripts/github-actions/post-review-comments.js (1203 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-51c98421682028ce", "name": "Very large file: scripts/github-actions/post-review-comments.test.js (1337 lines)", "shortDescription": {"text": "Very large file: scripts/github-actions/post-review-comments.test.js (1337 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cbd2b08afadd4a7f", "name": "Very large file: cmd/opencodereview/provider_tui.go (2953 lines)", "shortDescription": {"text": "Very large file: cmd/opencodereview/provider_tui.go (2953 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1481afbb9c67f5d1", "name": "Very large file: cmd/opencodereview/provider_tui_test.go (2922 lines)", "shortDescription": {"text": "Very large file: cmd/opencodereview/provider_tui_test.go (2922 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f9bed7e186b2e936", "name": "Very large file: cmd/opencodereview/provider_tui_funcs_test.go (1947 lines)", "shortDescription": {"text": "Very large file: cmd/opencodereview/provider_tui_funcs_test.go (1947 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6777036e7e932620", "name": "Node manifest has dependencies but no lockfile: package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1cb907756974e99e", "name": "Node manifest has dependencies but no lockfile: pages/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: pages/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 14 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 88 placeholder/mock markers across 27 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-54bf88987546694e", "name": "Legacy-named symbol `last_old` in examples/gitflic_ci/post_review.py:195", "shortDescription": {"text": "Legacy-named symbol `last_old` in examples/gitflic_ci/post_review.py:195"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9034b22f722b474d", "name": "Network/subprocess call without timeout or try/except \u2014 examples/gitflic_ci/post_review.py:378", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 examples/gitflic_ci/post_review.py:378"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-72fbf2054ef58a7e", "name": "Frontend route `/docs/:slug` has no Link/navigate to it \u2014 pages/src/App.tsx", "shortDescription": {"text": "Frontend route `/docs/:slug` has no Link/navigate to it \u2014 pages/src/App.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9849503e3892fd82", "name": "Frontend route `/blog/:slug` has no Link/navigate to it \u2014 pages/src/App.tsx", "shortDescription": {"text": "Frontend route `/blog/:slug` has no Link/navigate to it \u2014 pages/src/App.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f831716a8fdf5222", "name": "Vulnerable dependency dompurify 3.4.11: GHSA-c2j3-45gr-mqc4", "shortDescription": {"text": "Vulnerable dependency dompurify 3.4.11: GHSA-c2j3-45gr-mqc4"}, "fullDescription": {"text": "OSV.dev reports `dompurify` at version `3.4.11` (declared in `pages/package.json`) is affected by GHSA-c2j3-45gr-mqc4.\nNote: `3.4.11` is the declared floor of a range \u2014 the installed version may be newer.\n\nDOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-c2j3-45gr-mqc4\nFix: upgrade `dompurify` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.7}}, {"id": "scanner-9ce6142591a38c1c", "name": "Vulnerable dependency @babel/core 7.23.5: GHSA-4x5r-pxfx-6jf8", "shortDescription": {"text": "Vulnerable dependency @babel/core 7.23.5: GHSA-4x5r-pxfx-6jf8"}, "fullDescription": {"text": "OSV.dev reports `@babel/core` at version `7.23.5` (declared in `pages/package.json`) is affected by GHSA-4x5r-pxfx-6jf8 (aka CVE-2026-49356).\nNote: `7.23.5` is the declared floor of a range \u2014 the installed version may be newer.\n\n@babel/core: Arbitrary File Read via sourceMappingURL Comment\n\nAliases: CVE-2026-49356\nAdvisory: https://osv.dev/vulnerability/GHSA-4x5r-pxfx-6jf8\nFix: upgrade `@babel/core` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.7}}, {"id": "scanner-c128c72a9fe60ad1", "name": "Vulnerable dependency webpack 5.89.0: GHSA-38r7-794h-5758", "shortDescription": {"text": "Vulnerable dependency webpack 5.89.0: GHSA-38r7-794h-5758"}, "fullDescription": {"text": "OSV.dev reports `webpack` at version `5.89.0` (declared in `pages/package.json`) is affected by GHSA-38r7-794h-5758 (aka CVE-2025-68157).\nNote: `5.89.0` is the declared floor of a range \u2014 the installed version may be newer.\n\nwebpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects \u2192 SSRF + cache persistence\n\nAliases: CVE-2025-68157\nAdvisory: https://osv.dev/vulnerability/GHSA-38r7-794h-5758\nFix: upgrade `webpack` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.7}}, {"id": "scanner-cb2ab8240f2dd4fb", "name": "Vulnerable dependency webpack 5.89.0: GHSA-4vvj-4cpr-p986", "shortDescription": {"text": "Vulnerable dependency webpack 5.89.0: GHSA-4vvj-4cpr-p986"}, "fullDescription": {"text": "OSV.dev reports `webpack` at version `5.89.0` (declared in `pages/package.json`) is affected by GHSA-4vvj-4cpr-p986 (aka CVE-2024-43788).\nNote: `5.89.0` is the declared floor of a range \u2014 the installed version may be newer.\n\nWebpack's AutoPublicPathRuntimeModule has a DOM Clobbering Gadget that leads to XSS\n\nAliases: CVE-2024-43788\nAdvisory: https://osv.dev/vulnerability/GHSA-4vvj-4cpr-p986\nFix: upgrade `webpack` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-8b95b5cb42c7d1c6", "name": "Vulnerable dependency webpack 5.89.0: GHSA-8fgc-7cc6-rx7x", "shortDescription": {"text": "Vulnerable dependency webpack 5.89.0: GHSA-8fgc-7cc6-rx7x"}, "fullDescription": {"text": "OSV.dev reports `webpack` at version `5.89.0` (declared in `pages/package.json`) is affected by GHSA-8fgc-7cc6-rx7x (aka CVE-2025-68458).\nNote: `5.89.0` is the declared floor of a range \u2014 the installed version may be newer.\n\nwebpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior\n\nAliases: CVE-2025-68458\nAdvisory: https://osv.dev/vulnerability/GHSA-8fgc-7cc6-rx7x\nFix: upgrade `webpack` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.7}}, {"id": "scanner-b0db568ddb6254ae", "name": "Vulnerable dependency webpack-dev-server 5.2.4: GHSA-f5vj-f2hx-8m93", "shortDescription": {"text": "Vulnerable dependency webpack-dev-server 5.2.4: GHSA-f5vj-f2hx-8m93"}, "fullDescription": {"text": "OSV.dev reports `webpack-dev-server` at version `5.2.4` (declared in `pages/package.json`) is affected by GHSA-f5vj-f2hx-8m93 (aka CVE-2026-14620).\nNote: `5.2.4` is the declared floor of a range \u2014 the installed version may be newer.\n\nwebpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints\n\nAliases: CVE-2026-14620\nAdvisory: https://osv.dev/vulnerability/GHSA-f5vj-f2hx-8m93\nFix: upgrade `webpack-dev-server` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-97e946c785195d6f", "name": "Vulnerable dependency webpack-dev-server 5.2.4: GHSA-m28w-2pqf-7qgj", "shortDescription": {"text": "Vulnerable dependency webpack-dev-server 5.2.4: GHSA-m28w-2pqf-7qgj"}, "fullDescription": {"text": "OSV.dev reports `webpack-dev-server` at version `5.2.4` (declared in `pages/package.json`) is affected by GHSA-m28w-2pqf-7qgj (aka CVE-2026-14631).\nNote: `5.2.4` is the declared floor of a range \u2014 the installed version may be newer.\n\nwebpack-dev-server vulnerable to denial of service via a malformed Host or Origin header\n\nAliases: CVE-2026-14631\nAdvisory: https://osv.dev/vulnerability/GHSA-m28w-2pqf-7qgj\nFix: upgrade `webpack-dev-server` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-ff5925fbf152481b", "name": "Vulnerable dependency webpack-dev-server 5.2.4: GHSA-mx8g-39q3-5c79", "shortDescription": {"text": "Vulnerable dependency webpack-dev-server 5.2.4: GHSA-mx8g-39q3-5c79"}, "fullDescription": {"text": "OSV.dev reports `webpack-dev-server` at version `5.2.4` (declared in `pages/package.json`) is affected by GHSA-mx8g-39q3-5c79 (aka CVE-2026-9595).\nNote: `5.2.4` is the declared floor of a range \u2014 the installed version may be newer.\n\nwebpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies\n\nAliases: CVE-2026-9595\nAdvisory: https://osv.dev/vulnerability/GHSA-mx8g-39q3-5c79\nFix: upgrade `webpack-dev-server` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-6e191d25056e36d1", "name": "Dependency react-dom is a major version behind", "shortDescription": {"text": "Dependency react-dom is a major version behind"}, "fullDescription": {"text": "`react-dom` is pinned at `18.2.0` in `pages/package.json` while the latest release on the npm registry is `19.2.8` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `react-dom` to `19.2.8`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-87d18bea821cc2c7", "name": "Dependency react-router-dom is a major version behind", "shortDescription": {"text": "Dependency react-router-dom is a major version behind"}, "fullDescription": {"text": "`react-router-dom` is pinned at `6.8.0` in `pages/package.json` while the latest release on the npm registry is `7.18.1` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `react-router-dom` to `7.18.1`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-f9f92ad30a5383ba", "name": "Dependency react is a major version behind", "shortDescription": {"text": "Dependency react is a major version behind"}, "fullDescription": {"text": "`react` is pinned at `18.2.0` in `pages/package.json` while the latest release on the npm registry is `19.2.8` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `react` to `19.2.8`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}]}}, "automationDetails": {"id": "repobility/30788"}, "properties": {"repository": "alibaba/open-code-review", "repoUrl": "https://github.com/alibaba/open-code-review", "branch": "main"}, "results": [{"ruleId": "scanner-bb46624839133779", "level": "note", "message": {"text": "Possibly dead Python function: positive_float"}, "properties": {"repobilityId": "30519a8a44cc107e", "scanner": "scanner-primary", "fingerprint": "bb46624839133779", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/gerrit_ci/post_review.py:316"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-88fa2d0b489056d0", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 extensions/vscode/src/extension/services/cliParse.ts:13"}, "properties": {"repobilityId": "68f151a587e79269", "scanner": "scanner-primary", "fingerprint": "88fa2d0b489056d0", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "extensions/vscode/src/extension/services/cliParse.ts"}, "region": {"startLine": 13}}}]}, {"ruleId": "scanner-a260df2545ad0e5e", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 pages/src/components/MarkdownRenderer.tsx:171"}, "properties": {"repobilityId": "e832ed320fd9dad4", "scanner": "scanner-primary", "fingerprint": "a260df2545ad0e5e", "layer": "frontend", "severity": "medium", "confidence": 0.8, "tags": ["frontend-quality", "fq.dangerous-html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pages/src/components/MarkdownRenderer.tsx"}, "region": {"startLine": 171}}}]}, {"ruleId": "scanner-083b05e2838844ac", "level": "warning", "message": {"text": "dynamic urllib use detected \u2014 examples/gerrit_ci/post_review.py:241"}, "properties": {"repobilityId": "096f39182d36f7ef", "scanner": "scanner-primary", "fingerprint": "083b05e2838844ac", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "python", "non-production-context"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/gerrit_ci/post_review.py"}, "region": {"startLine": 241}}}]}, {"ruleId": "scanner-7ec4e87f99c8d4b1", "level": "warning", "message": {"text": "dynamic urllib use detected \u2014 examples/gitflic_ci/post_review.py:341"}, "properties": {"repobilityId": "d0e340d49677dc9b", "scanner": "scanner-primary", "fingerprint": "7ec4e87f99c8d4b1", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "python", "non-production-context"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/gitflic_ci/post_review.py"}, "region": {"startLine": 341}}}]}, {"ruleId": "scanner-9466bed3017c0fe9", "level": "warning", "message": {"text": "detect child process \u2014 extensions/vscode/src/extension/services/CliService.ts:35"}, "properties": {"repobilityId": "03a0cf354f03c7e5", "scanner": "scanner-primary", "fingerprint": "9466bed3017c0fe9", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "javascript"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "extensions/vscode/src/extension/services/CliService.ts"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-80b3abc4cb539e4c", "level": "warning", "message": {"text": "react dangerouslysetinnerhtml \u2014 pages/src/components/MarkdownRenderer.tsx:171"}, "properties": {"repobilityId": "0258b1134358a9f9", "scanner": "scanner-primary", "fingerprint": "80b3abc4cb539e4c", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["semgrep", "security", "react"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pages/src/components/MarkdownRenderer.tsx"}, "region": {"startLine": 171}}}]}, {"ruleId": "scanner-89aa284a340cce4b", "level": "warning", "message": {"text": "detect child process \u2014 scripts/update.js:61"}, "properties": {"repobilityId": "de804fb620d46f29", "scanner": "scanner-primary", "fingerprint": "89aa284a340cce4b", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "javascript"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/update.js"}, "region": {"startLine": 61}}}]}, {"ruleId": "scanner-8b2a3e9a6fffa842", "level": "none", "message": {"text": "CVE-2026-46600: golang.org/x/net v0.55.0 \u2014 go.mod"}, "properties": {"repobilityId": "d7ee3e21252eec23", "scanner": "scanner-primary", "fingerprint": "8b2a3e9a6fffa842", "layer": "security", "severity": "info", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-46600"]}}, {"ruleId": "scanner-aad9f00e610f00c0", "level": "none", "message": {"text": "CVE-2026-56852: golang.org/x/text v0.37.0 \u2014 go.mod"}, "properties": {"repobilityId": "b7935bed016c2ddc", "scanner": "scanner-primary", "fingerprint": "aad9f00e610f00c0", "layer": "security", "severity": "info", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-56852"]}}, {"ruleId": "scanner-d62091cfb11b93ca", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/open-code-review.md"}, "properties": {"repobilityId": "847545c7d77bdbca", "scanner": "scanner-primary", "fingerprint": "d62091cfb11b93ca", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/open-code-review.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-311dc1e692bdd9e0", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/tag.md"}, "properties": {"repobilityId": "dfd18f110571b387", "scanner": "scanner-primary", "fingerprint": "311dc1e692bdd9e0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/tag.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6eb7bc995ebf3180", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/open-code-review-delegate/SKILL.md"}, "properties": {"repobilityId": "2b30ed1a3823b218", "scanner": "scanner-primary", "fingerprint": "6eb7bc995ebf3180", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/open-code-review-delegate/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c63409b348b05b89", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: skills/open-code-review-delegate/SKILL.md"}, "properties": {"repobilityId": "3d277dd1f12e21b2", "scanner": "scanner-primary", "fingerprint": "c63409b348b05b89", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/open-code-review-delegate/SKILL.md"}, "region": {"startLine": 11}}}]}, {"ruleId": "scanner-b4d555927f70d5e6", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: skills/open-code-review/SKILL.md"}, "properties": {"repobilityId": "cd0987a28be618ea", "scanner": "scanner-primary", "fingerprint": "b4d555927f70d5e6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/open-code-review/SKILL.md"}, "region": {"startLine": 13}}}]}, {"ruleId": "scanner-9461ce093e5acaa7", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: plugins/open-code-review/skills/open-code-review-delegate/SKILL.md"}, "properties": {"repobilityId": "0f54e4dff8fc3da2", "scanner": "scanner-primary", "fingerprint": "9461ce093e5acaa7", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "plugins/open-code-review/skills/open-code-review-delegate/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f6eb440491ce2adb", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: plugins/open-code-review/skills/open-code-review-delegate/SKILL.md"}, "properties": {"repobilityId": "12dcf113ff2af000", "scanner": "scanner-primary", "fingerprint": "f6eb440491ce2adb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "plugins/open-code-review/skills/open-code-review-delegate/SKILL.md"}, "region": {"startLine": 11}}}]}, {"ruleId": "scanner-e3873b9f93bd763c", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: plugins/open-code-review/skills/open-code-review/SKILL.md"}, "properties": {"repobilityId": "14ad0a955c461c53", "scanner": "scanner-primary", "fingerprint": "e3873b9f93bd763c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "plugins/open-code-review/skills/open-code-review/SKILL.md"}, "region": {"startLine": 13}}}]}, {"ruleId": "scanner-bddb1999e2212a74", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in skills/open-code-review/SKILL.md"}, "properties": {"repobilityId": "3e4487ce1996787c", "scanner": "scanner-primary", "fingerprint": "bddb1999e2212a74", "layer": "security", "severity": "medium", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/open-code-review/SKILL.md"}, "region": {"startLine": 49}}}]}, {"ruleId": "scanner-111c3191ca3fd200", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in plugins/open-code-review/skills/open-code-review/SKILL.md"}, "properties": {"repobilityId": "54efa5f22b7c2df7", "scanner": "scanner-primary", "fingerprint": "111c3191ca3fd200", "layer": "security", "severity": "medium", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "plugins/open-code-review/skills/open-code-review/SKILL.md"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-e637c415447867e4", "level": "none", "message": {"text": "Run SkillSpector's LLM-backed analysis in your own pipeline"}, "properties": {"repobilityId": "1936f198ff5212bf", "scanner": "scanner-primary", "fingerprint": "e637c415447867e4", "layer": "security", "severity": "info", "confidence": 1.0, "tags": ["skillspector", "mcp-skill", "llm-advisory", "ai-coder"]}}, {"ruleId": "scanner-e821e22dbeb3571f", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in pages/src/components/MarkdownRenderer.tsx:171"}, "properties": {"repobilityId": "76c21b20f3b01028", "scanner": "scanner-primary", "fingerprint": "e821e22dbeb3571f", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pages/src/components/MarkdownRenderer.tsx"}, "region": {"startLine": 171}}}]}, {"ruleId": "scanner-c63b58847ecb976a", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in pages/src/components/MarkdownRenderer.tsx:123"}, "properties": {"repobilityId": "70314e525127de48", "scanner": "scanner-primary", "fingerprint": "c63b58847ecb976a", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pages/src/components/MarkdownRenderer.tsx"}, "region": {"startLine": 123}}}]}, {"ruleId": "scanner-a18af38124ed74a3", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d4e7436f549cb03a", "scanner": "scanner-primary", "fingerprint": "a18af38124ed74a3", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ocr-review.yml"}, "region": {"startLine": 48}}}]}, {"ruleId": "scanner-0f883454d11648ef", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "df3bbd93212781a6", "scanner": "scanner-primary", "fingerprint": "0f883454d11648ef", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/vscode-ext.yml"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-c1e62c8a8becdce0", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4a5232ca5f9d3d6d", "scanner": "scanner-primary", "fingerprint": "c1e62c8a8becdce0", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy-pages.yml"}, "region": {"startLine": 61}}}]}, {"ruleId": "scanner-11fe6710547243fb", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "c88f07fd35b9711f", "scanner": "scanner-primary", "fingerprint": "11fe6710547243fb", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy-pages.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f0dc584a111ffc00", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 147}}}]}, {"ruleId": "scanner-1838a141491ce38c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b8fd4f5048f96576", "scanner": "scanner-primary", "fingerprint": "1838a141491ce38c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cb639d9a10a47b23", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "edeab51902066991", "scanner": "scanner-primary", "fingerprint": "cb639d9a10a47b23", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d089797dc9cc14ff", "level": "note", "message": {"text": "Very large file: scripts/github-actions/post-review-comments.js (1203 lines)"}, "properties": {"repobilityId": "864a0f10480dc1a3", "scanner": "scanner-primary", "fingerprint": "d089797dc9cc14ff", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-51c98421682028ce", "level": "note", "message": {"text": "Very large file: scripts/github-actions/post-review-comments.test.js (1337 lines)"}, "properties": {"repobilityId": "f9ab45ac49f804df", "scanner": "scanner-primary", "fingerprint": "51c98421682028ce", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-cbd2b08afadd4a7f", "level": "note", "message": {"text": "Very large file: cmd/opencodereview/provider_tui.go (2953 lines)"}, "properties": {"repobilityId": "1bac54ee97db2afd", "scanner": "scanner-primary", "fingerprint": "cbd2b08afadd4a7f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-1481afbb9c67f5d1", "level": "note", "message": {"text": "Very large file: cmd/opencodereview/provider_tui_test.go (2922 lines)"}, "properties": {"repobilityId": "086304104d2cbaf4", "scanner": "scanner-primary", "fingerprint": "1481afbb9c67f5d1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f9bed7e186b2e936", "level": "note", "message": {"text": "Very large file: cmd/opencodereview/provider_tui_funcs_test.go (1947 lines)"}, "properties": {"repobilityId": "1f53d25aa34668d7", "scanner": "scanner-primary", "fingerprint": "f9bed7e186b2e936", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6777036e7e932620", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: package.json"}, "properties": {"repobilityId": "7edae0550c126386", "scanner": "scanner-primary", "fingerprint": "6777036e7e932620", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1cb907756974e99e", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: pages/package.json"}, "properties": {"repobilityId": "aa1f95d2d4ba510c", "scanner": "scanner-primary", "fingerprint": "1cb907756974e99e", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pages/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "bd4694019b16b275", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "27420d8130218405", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "1cf6b0b075484055", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "b0773f05896d25cb", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-54bf88987546694e", "level": "note", "message": {"text": "Legacy-named symbol `last_old` in examples/gitflic_ci/post_review.py:195"}, "properties": {"repobilityId": "66e06acd6f21f94a", "scanner": "scanner-primary", "fingerprint": "54bf88987546694e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-9034b22f722b474d", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 examples/gitflic_ci/post_review.py:378"}, "properties": {"repobilityId": "62b23dfd096d8285", "scanner": "scanner-primary", "fingerprint": "9034b22f722b474d", "layer": "quality", "severity": "medium", "confidence": 0.85, "tags": ["integrity", "fragile-runtime", "robustness"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/gitflic_ci/post_review.py"}, "region": {"startLine": 378}}}]}, {"ruleId": "scanner-72fbf2054ef58a7e", "level": "warning", "message": {"text": "Frontend route `/docs/:slug` has no Link/navigate to it \u2014 pages/src/App.tsx"}, "properties": {"repobilityId": "0c311a4f1d81ecb9", "scanner": "scanner-primary", "fingerprint": "72fbf2054ef58a7e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-9849503e3892fd82", "level": "warning", "message": {"text": "Frontend route `/blog/:slug` has no Link/navigate to it \u2014 pages/src/App.tsx"}, "properties": {"repobilityId": "6d6677b8558f7bf7", "scanner": "scanner-primary", "fingerprint": "9849503e3892fd82", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-f831716a8fdf5222", "level": "note", "message": {"text": "Vulnerable dependency dompurify 3.4.11: GHSA-c2j3-45gr-mqc4"}, "properties": {"repobilityId": "f00e188764eee076", "scanner": "scanner-primary", "fingerprint": "f831716a8fdf5222", "layer": "dependencies", "severity": "low", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-c2j3-45gr-mqc4"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pages/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9ce6142591a38c1c", "level": "note", "message": {"text": "Vulnerable dependency @babel/core 7.23.5: GHSA-4x5r-pxfx-6jf8"}, "properties": {"repobilityId": "6090329775f27715", "scanner": "scanner-primary", "fingerprint": "9ce6142591a38c1c", "layer": "dependencies", "severity": "low", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-4x5r-pxfx-6jf8", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pages/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c128c72a9fe60ad1", "level": "note", "message": {"text": "Vulnerable dependency webpack 5.89.0: GHSA-38r7-794h-5758"}, "properties": {"repobilityId": "6fc6a2c526d230db", "scanner": "scanner-primary", "fingerprint": "c128c72a9fe60ad1", "layer": "dependencies", "severity": "low", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-38r7-794h-5758", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pages/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cb2ab8240f2dd4fb", "level": "warning", "message": {"text": "Vulnerable dependency webpack 5.89.0: GHSA-4vvj-4cpr-p986"}, "properties": {"repobilityId": "c1b2e67205654e64", "scanner": "scanner-primary", "fingerprint": "cb2ab8240f2dd4fb", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-4vvj-4cpr-p986", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pages/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8b95b5cb42c7d1c6", "level": "note", "message": {"text": "Vulnerable dependency webpack 5.89.0: GHSA-8fgc-7cc6-rx7x"}, "properties": {"repobilityId": "2bfff3938758b2b4", "scanner": "scanner-primary", "fingerprint": "8b95b5cb42c7d1c6", "layer": "dependencies", "severity": "low", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-8fgc-7cc6-rx7x", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pages/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b0db568ddb6254ae", "level": "warning", "message": {"text": "Vulnerable dependency webpack-dev-server 5.2.4: GHSA-f5vj-f2hx-8m93"}, "properties": {"repobilityId": "50a4d17dc253e2ce", "scanner": "scanner-primary", "fingerprint": "b0db568ddb6254ae", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-f5vj-f2hx-8m93", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pages/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-97e946c785195d6f", "level": "warning", "message": {"text": "Vulnerable dependency webpack-dev-server 5.2.4: GHSA-m28w-2pqf-7qgj"}, "properties": {"repobilityId": "2ba81e6dca6adcf8", "scanner": "scanner-primary", "fingerprint": "97e946c785195d6f", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-m28w-2pqf-7qgj", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pages/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ff5925fbf152481b", "level": "warning", "message": {"text": "Vulnerable dependency webpack-dev-server 5.2.4: GHSA-mx8g-39q3-5c79"}, "properties": {"repobilityId": "65fce6d7af3bd05c", "scanner": "scanner-primary", "fingerprint": "ff5925fbf152481b", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-mx8g-39q3-5c79", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pages/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6e191d25056e36d1", "level": "note", "message": {"text": "Dependency react-dom is a major version behind"}, "properties": {"repobilityId": "58dace722d04e59d", "scanner": "scanner-primary", "fingerprint": "6e191d25056e36d1", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pages/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-87d18bea821cc2c7", "level": "note", "message": {"text": "Dependency react-router-dom is a major version behind"}, "properties": {"repobilityId": "b6fc97155b3cee20", "scanner": "scanner-primary", "fingerprint": "87d18bea821cc2c7", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pages/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f9f92ad30a5383ba", "level": "note", "message": {"text": "Dependency react is a major version behind"}, "properties": {"repobilityId": "39b64353ba166dae", "scanner": "scanner-primary", "fingerprint": "f9f92ad30a5383ba", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pages/package.json"}, "region": {"startLine": 1}}}]}]}]}