Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.

39 of your 60 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.

Upstream (GitHub) caused delay on this scan — not Repobility.

GitHub API rate-limited (HTTP 403) — preflight skipped, fell back to direct git clone.
Clone from GitHub took 58.45s for a 612.8 MB repo slow.
Repobility's analysis ran in 1.74s after the clone landed.

2026-yarr-robotics/ros2-depth-point-cloude

https://github.com/2026-yarr-robotics/ros2-depth-point-cloude · scanned 2026-06-16 02:50 UTC (2 months, 1 week ago) · 10 languages

166 raw signals (55 security + 111 graph) 82nd percentile · Python · small (2-20K LoC)

File as issue Image

UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 2 months, 1 week ago · v7 · 22 actionable findings from 2 signal sources. 36 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON

44.4% cov · 3 findings

Score breakdown â 2026-05-18-v5

Component	Sub-score	Weight	Contribution
`structure_score`	80.0	0.15	12.00
`security_score`	100.0	0.25	25.00
`testing_score`	32.0	0.20	6.40
`documentation_score`	64.0	0.15	9.60
`practices_score`	40.0	0.15	6.00
`code_quality`	45.0	0.10	4.50
Overall		1.00	63.5

security_score may be inflated — optional security scanners were skipped on this fast scan

Severity distribution — click a segment to filter

Active filters: excluding tests × Reset all

Severity: Critical 2 High 1 Medium 1 Low 8 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 19 System graph 3 Crowd 0 Layer: Quality 17 Security 3 Frontend 1 Cicd 1

Exclude dismissed / FP Exclude test files

Corpus Intelligence Cross-corpus context (cohort percentile, top patterns, fix plan) is shown only on repositories you own. Sign up and connect your repo to view it.

Scan summary Repository scanned at 88.1/100 with 44.4% coverage. It contains 1 nodes across 0 cross-layer flows, written primarily in mixed languages. Engine surfaced 3 findings — concentrated in quality (1), frontend (1), cicd (1). Risk profile is low: 0 critical, 0 high, 1 medium. Recommended next step: open the quality layer findings first — that's where the highest-impact wins live.

Showing 12 of 22 actionable findings. 58 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

critical Security checks quality Quality conf 1.00 ✓ Repobility [MINED030] Python Pickle Loads: pickle.loads() can execute arbitrary code via __reduce__.

Review and fix per the pattern semantics. See CWE-502 / for context.

src/recode_sequence/recode_sequence/seq_io.py:217

critical Security checks quality Quality conf 1.00 [SEC081] Python: pickle.loads / marshal.loads on untrusted data: pickle.load(s) and marshal.load(s) execute arbitrary code on untrusted input. Ported from dlint DUO103 / DUO120 (BSD-3).

Use json, msgpack, or protobuf for untrusted data. If pickle is required, sign the payload with HMAC.

src/recode_sequence/recode_sequence/seq_io.py:217

low Security checks quality Quality conf 1.00 ✓ Repobility [MINED006] Overcatch Baseexception: except BaseException: ... — prevents Ctrl+C and SystemExit from working.

Review and fix per the pattern semantics. See CWE-705 / for context.

src/recode_sequence/recode_sequence/sequence_player_node.py:288

low Security checks quality Quality conf 1.00 ✓ Repobility [MINED006] Overcatch Baseexception: except BaseException: ... — prevents Ctrl+C and SystemExit from working.

Review and fix per the pattern semantics. See CWE-705 / for context.

src/recode_sequence/recode_sequence/handeye_tf_node.py:118

high Security checks quality Quality conf 1.00 ✓ Repobility 25 occurrences [MINED108] `self.aruco_samples` used but never assigned in __init__: Method `_handle_redetect` of class `WorldOriginNode` reads `self.aruco_samples`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.

Initialize `self.aruco_samples = <default>` in __init__, or add a class-level default.

lines 189, 190, 191, 192, 193, 202, 203, 213, +17 more

src/depth_digital_twin/depth_digital_twin/world_origin_node.py:189, 190, 191, 192, 193, 202, 203, 213, +17 more (25 hits)

low Security checks security path traversal conf 0.80 3 occurrences [SEC013] Path Traversal — User Input in File Path: User-controlled input used in file path without sanitization. Allows reading arbitrary files.

Use os.path.realpath() and verify the path starts with your expected base directory. Use secure_filename() for uploads.

3 files, 3 locations

src/depth_digital_twin/launch/digital_twin.launch.py:52

src/depth_digital_twin/launch/hand_fusion_add.launch.py:39

src/recode_sequence/launch/playback.launch.py:31

low Security checks quality Error handling conf 1.00 [ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even in cleanup code, log at DEBUG level.

Log the error: `except Exception: logger.debug('cleanup failed', exc_info=True)`. Or handle specific exception types.

src/depth_digital_twin/depth_digital_twin/world_origin_control.py:34

low Security checks security Deserialization conf 1.00 [SEC007] Unsafe Deserialization: Unsafe deserialization can execute arbitrary code.

Use yaml.safe_load() instead of yaml.load(). Avoid pickle for untrusted data.

src/recode_sequence/recode_sequence/seq_io.py:217

low Security checks quality Error handling conf 0.55 ✓ Repobility 3 occurrences Broad exception handler needs review

This handler catches Exception/BaseException. It is actionable when it swallows errors without logging, re-raising, or returning a structured error. Handlers that intentionally convert exceptions into typed error results should not be treated as high risk.

3 files, 3 locations

src/depth_digital_twin/depth_digital_twin/digital_twin_panel.py:500

src/depth_digital_twin/depth_digital_twin/point_cloud_node.py:1177

src/depth_digital_twin/depth_digital_twin/world_origin_control.py:57

Error handlingquality

medium System graph cicd CI/CD security conf 1.00 No CI/CD pipelines detected

No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints.

CI/CD securityCoverage

low Security checks quality Quality conf 0.60 Duplicated implementation block across source files

Duplicate implementation blocks are maintenance debt. Keep them visible, but they are not a high-severity defect unless the duplicated logic is security-sensitive or drifting.

src/depth_digital_twin/launch/digital_twin_sequence.launch.py:232 duplicationquality

low Security checks quality Documentation No LICENSE file

Add a LICENSE file to your repository. Use choosealicense.com to pick the right license (MIT for permissive, Apache 2.0 for patent protection, GPL for copyleft).

For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.

For AI agents + API integrations

Email me when this repo regresses

Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.

API access

This page is publicly accessible at: https://repobility.com/scan/7dd11e14-7f56-4932-bb87-853ec87a4835/

To check status programmatically (no auth required):

curl -s https://repobility.com/api/v1/public/scan/7dd11e14-7f56-4932-bb87-853ec87a4835/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.