Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo
192 of your 321 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.

Scan timing: clone 4.48s · analysis 15.66s · 30.6 MB · GitHub preflight 679ms

bytedance/deer-flow

https://github.com/bytedance/deer-flow.git · scanned 2026-06-23 23:06 UTC (1 month ago) · 10 languages

854 raw signals (300 security + 554 graph) 11/13 scanners ran 3rd percentile · Python · large (100-500K LoC)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 1 month ago · v1 · 605 actionable findings from 2 signal sources. 232 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
50.3
/100
Security checks
60
126 findings
System graph
41
100.0% cov · 479 findings
Critical
7
click to filter
Agents
10
0 votes
Crowd
0
reported
Score breakdown â 2026-05-18-v5
Component Sub-score Weight Contribution
structure_score 40.0 0.15 6.00
security_score 100.0 0.25 25.00
testing_score 100.0 0.20 20.00
documentation_score 100.0 0.15 15.00
practices_score 70.0 0.15 10.50
code_quality 46.0 0.10 4.60
Overall 1.00 81.1
security_score may be inflated — optional security scanners were skipped on this fast scan
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 7 High 124 Medium 157 Low 155 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 126 System graph 479 Crowd 0 Layer: Cicd 8 Quality 263 Security 220 Software 29 Frontend 20 Hardware 5 Api 60
Corpus Intelligence Cross-corpus context (cohort percentile, top patterns, fix plan) is shown only on repositories you own. Sign up and connect your repo to view it.
Scan summary Repository scanned at 40.5/100 with 100.0% coverage. It contains 12642 nodes across 30 cross-layer flows, written primarily in mixed languages. Engine surfaced 554 findings — concentrated in security (228), quality (187), api (60). Risk profile is high: 12 critical, 94 high, 164 medium. Recommended next step: open the security layer findings first — that's where the highest-impact wins live.

Showing 441 of 605 actionable findings. 837 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

high Security checks quality Quality conf 1.00 ✓ Repobility 12 occurrences [MINED107] Missing import: `http` used but not imported: The file uses `http.something(...)` but never imports `http`. This raises NameError at runtime the first time the line executes.
Add `import http` at the top of the file.
11 files, 12 locations
backend/packages/harness/deerflow/agents/middlewares/token_budget_middleware.py:216, 245 (2 hits)
backend/app/channels/manager.py:1576
backend/app/gateway/auth/user_provisioning.py:111
backend/packages/harness/deerflow/agents/memory/summarization_hook.py:27
backend/packages/harness/deerflow/agents/middlewares/loop_detection_middleware.py:316
backend/packages/harness/deerflow/agents/middlewares/memory_middleware.py:101
backend/packages/harness/deerflow/agents/middlewares/uploads_middleware.py:243
backend/packages/harness/deerflow/community/browserless/browserless_client.py:86
critical Security checks security Crypto conf 1.00 [SEC039] Plaintext-equivalent password hash — unsalted single-pass digest: Single-pass digest of a password is cryptographically strong as a hash, but is rainbow-table-attackable when used for passwords: there's no salt and no key-stretching. Attackers with the hash database can crack 90%+ of common passwords offline in hours. CWE-916 (use of password hash without computational effort).
Use a purpose-built password hash: - Python: passlib.hash.argon2.hash(password) - Python: bcrypt.hashpw(password.encode(), bcrypt.gensalt()) - Python: hashlib.pbkdf2_hmac('sha256', password, salt, 600000) - PHP: password_hash($password, PASSWORD_ARGON2ID) - Node.js: argon2.hash(password) …
backend/app/gateway/auth/password.py:29
critical System graph security Skillspector conf 0.60 2 occurrences SkillSpector TT3 (taint) in skills/public/image-generation/scripts/generate.py
response = requests.post( f"{_minimax_host()}/v1/image_generation", headers={"Authorization": f"Bearer {api_key}", "Content-Type": "application/json"}, json=body, t Credentials or environment variables flow to a network sink. This is a high-confidence indicator of c…
lines 133, 173
skills/public/image-generation/scripts/generate.py:133, 173 (2 hits)
Mcp skillTaintTt3
critical System graph security Skillspector conf 0.60 SkillSpector TT3 (taint) in skills/public/music-generation/scripts/generate.py
response = requests.post( f"{host}/v1/music_generation", headers={"Authorization": f"Bearer {api_key}", "Content-Type": "application/json"}, json=body, timeout=300, Credentials or environment variables flow to a network sink. This is a high-confidence indicator of c…
skills/public/music-generation/scripts/generate.py:51 Mcp skillTaintTt3
critical System graph security Skillspector conf 0.60 2 occurrences SkillSpector TT3 (taint) in skills/public/podcast-generation/scripts/generate.py
response = requests.post(url, json=payload, headers=headers, timeout=60) Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration. Skill: podcast-generation Rule: TT3 Category: taint Severity: CRITICAL Confidence: 0.60 Remediat…
lines 133, 185
skills/public/podcast-generation/scripts/generate.py:133, 185 (2 hits)
Mcp skillTaintTt3
critical System graph security Skillspector conf 0.60 6 occurrences SkillSpector TT3 (taint) in skills/public/video-generation/scripts/generate.py
response = requests.get( f"{host}/v1/query/video_generation", headers={"Authorization": auth}, params={"task_id": task_id}, timeout=30, Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exf…
lines 62, 87, 118, 138, 162, 172
skills/public/video-generation/scripts/generate.py:62, 87, 118, 138, 162, 172 (6 hits)
Mcp skillTaintTt3
high Security checks security auth conf 0.70 [AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: GET /threads/:thread_id/artifacts/::...artifact_path/route.
Add ownership, tenant, relationship, or policy checks before reading or mutating the target object.
frontend/src/app/mock/api/threads/[thread_id]/artifacts/[[...artifact_path]]/route.ts:6
low Security checks quality Quality conf 1.00 ✓ Repobility 3 occurrences [MINED006] Overcatch Baseexception: except BaseException: ... — prevents Ctrl+C and SystemExit from working.
Review and fix per the pattern semantics. See CWE-705 / for context.
3 files, 3 locations
backend/app/channels/runtime_config_store.py:65
backend/app/channels/store.py:67
backend/packages/harness/deerflow/tools/builtins/update_agent_tool.py:58
low Security checks quality Quality conf 1.00 ✓ Repobility [MINED012] Curl Pipe Bash: curl ... | sh / bash — runs unverified network code.
Review and fix per the pattern semantics. See CWE-494 / A08:2021 for context.
scripts/check.sh:47
high Security checks quality Quality conf 1.00 ✓ Repobility 8 occurrences [MINED108] `self.path` used but never assigned in __init__: Method `do_GET` of class `ReviewHandler` reads `self.path`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
Initialize `self.path = <default>` in __init__, or add a class-level default.
lines 333, 348, 349, 357, 362, 363, 364, 378
skills/public/skill-creator/eval-viewer/generate_review.py:333, 348, 349, 357, 362, 363, 364, 378 (8 hits)
high Security checks quality Quality conf 1.00 ✓ Repobility [MINED110] Blocking call `input` inside async function `main`: `input` is a synchronous (blocking) call. When invoked inside an `async def` it stalls the event loop, preventing every other coroutine in the process from making progress.
Use the async equivalent: `aiohttp` instead of `requests`, `asyncio.sleep` instead of `time.sleep`, `aiofiles` instead of `open`.
backend/debug.py:125
high Security checks quality Quality conf 1.00 ✓ Repobility [MINED110] Blocking call `time.sleep` inside async function `create_sandbox`: `time.sleep` is a synchronous (blocking) call. When invoked inside an `async def` it stalls the event loop, preventing every other coroutine in the process from making progress.
Use the async equivalent: `aiohttp` instead of `requests`, `asyncio.sleep` instead of `time.sleep`, `aiofiles` instead of `open`.
docker/provisioner/app.py:491
high Security checks quality Quality conf 0.80 ✓ Repobility [MINED112] FastAPI DELETE /api/sandboxes/{sandbox_id} has no auth: Handler `destroy_sandbox` is registered with router/app.delete(...) but no Depends/Security parameter is declared and no auth marker appears in the function body.
Add Depends(get_current_user) or Security(...) to the handler signature. If the route is truly public, document it with a code comment so the rule knows it's intentional.
docker/provisioner/app.py:506
high Security checks quality Quality conf 0.80 ✓ Repobility [MINED112] FastAPI DELETE /{thread_id}/runs/{run_id}/feedback has no auth: Handler `delete_run_feedback` is registered with router/app.delete(...) but no Depends/Security parameter is declared and no auth marker appears in the function body.
Add Depends(get_current_user) or Security(...) to the handler signature. If the route is truly public, document it with a code comment so the rule knows it's intentional.
backend/app/gateway/routers/feedback.py:94
high Security checks quality Quality conf 0.80 ✓ Repobility [MINED112] FastAPI DELETE /{thread_id}/runs/{run_id}/feedback/{feedback_id} has no auth: Handler `delete_feedback` is registered with router/app.delete(...) but no Depends/Security parameter is declared and no auth marker appears in the function body.
Add Depends(get_current_user) or Security(...) to the handler signature. If the route is truly public, document it with a code comment so the rule knows it's intentional.
backend/app/gateway/routers/feedback.py:171
high Security checks quality Quality conf 0.80 ✓ Repobility [MINED112] FastAPI POST /api/sandboxes has no auth: Handler `create_sandbox` is registered with router/app.post(...) but no Depends/Security parameter is declared and no auth marker appears in the function body.
Add Depends(get_current_user) or Security(...) to the handler signature. If the route is truly public, document it with a code comment so the rule knows it's intentional.
docker/provisioner/app.py:434
high Security checks quality Quality conf 0.80 ✓ Repobility [MINED112] FastAPI POST /change-password has no auth: Handler `change_password` is registered with router/app.post(...) but no Depends/Security parameter is declared and no auth marker appears in the function body.
Add Depends(get_current_user) or Security(...) to the handler signature. If the route is truly public, document it with a code comment so the rule knows it's intentional.
backend/app/gateway/routers/auth.py:351
high Security checks quality Quality conf 0.80 ✓ Repobility [MINED112] FastAPI POST /logout has no auth: Handler `logout` is registered with router/app.post(...) but no Depends/Security parameter is declared and no auth marker appears in the function body.
Add Depends(get_current_user) or Security(...) to the handler signature. If the route is truly public, document it with a code comment so the rule knows it's intentional.
backend/app/gateway/routers/auth.py:344
high Security checks quality Quality conf 0.80 ✓ Repobility [MINED112] FastAPI POST /mcp/cache/reset has no auth: Handler `reset_mcp_tools_cache_endpoint` is registered with router/app.post(...) but no Depends/Security parameter is declared and no auth marker appears in the function body.
Add Depends(get_current_user) or Security(...) to the handler signature. If the route is truly public, document it with a code comment so the rule knows it's intentional.
backend/app/gateway/routers/mcp.py:268
high Security checks quality Quality conf 0.80 ✓ Repobility [MINED112] FastAPI POST /register has no auth: Handler `register` is registered with router/app.post(...) but no Depends/Security parameter is declared and no auth marker appears in the function body.
Add Depends(get_current_user) or Security(...) to the handler signature. If the route is truly public, document it with a code comment so the rule knows it's intentional.
backend/app/gateway/routers/auth.py:323
high Security checks quality Quality conf 0.80 ✓ Repobility [MINED112] FastAPI POST /stream has no auth: Handler `stateless_stream` is registered with router/app.post(...) but no Depends/Security parameter is declared and no auth marker appears in the function body.
Add Depends(get_current_user) or Security(...) to the handler signature. If the route is truly public, document it with a code comment so the rule knows it's intentional.
backend/app/gateway/routers/runs.py:36
high Security checks quality Quality conf 0.80 ✓ Repobility [MINED112] FastAPI POST /wait has no auth: Handler `stateless_wait` is registered with router/app.post(...) but no Depends/Security parameter is declared and no auth marker appears in the function body.
Add Depends(get_current_user) or Security(...) to the handler signature. If the route is truly public, document it with a code comment so the rule knows it's intentional.
backend/app/gateway/routers/runs.py:61
high Security checks quality Quality conf 0.80 ✓ Repobility [MINED112] FastAPI POST /{thread_id}/runs/{run_id}/feedback has no auth: Handler `create_feedback` is registered with router/app.post(...) but no Depends/Security parameter is declared and no auth marker appears in the function body.
Add Depends(get_current_user) or Security(...) to the handler signature. If the route is truly public, document it with a code comment so the rule knows it's intentional.
backend/app/gateway/routers/feedback.py:114
high Security checks quality Quality conf 0.80 ✓ Repobility [MINED112] FastAPI PUT /mcp/config has no auth: Handler `update_mcp_configuration` is registered with router/app.put(...) but no Depends/Security parameter is declared and no auth marker appears in the function body.
Add Depends(get_current_user) or Security(...) to the handler signature. If the route is truly public, document it with a code comment so the rule knows it's intentional.
backend/app/gateway/routers/mcp.py:289
high Security checks quality Quality conf 0.80 ✓ Repobility [MINED112] FastAPI PUT /{thread_id}/runs/{run_id}/feedback has no auth: Handler `upsert_feedback` is registered with router/app.put(...) but no Depends/Security parameter is declared and no auth marker appears in the function body.
Add Depends(get_current_user) or Security(...) to the handler signature. If the route is truly public, document it with a code comment so the rule knows it's intentional.
backend/app/gateway/routers/feedback.py:63
high Security checks software dependencies conf 0.90 ✓ Repobility 5 occurrences [MINED118] Dockerfile FROM `python:3.12-slim-bookworm` not pinned by digest: `FROM python:3.12-slim-bookworm` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potentially different. Production images should pin to `image@sha256:...` for reproducibility + supply-chain integrity.
Replace with: `FROM python:3.12-slim-bookworm@sha256:<digest>`. Get the digest from `docker manifest inspect`. Re-pin via a scheduled bot (Renovate, Dependabot).
3 files, 5 locations
backend/Dockerfile:11, 73 (2 hits)
frontend/Dockerfile:10, 38 (2 hits)
docker/provisioner/Dockerfile:1
high Security checks security auth conf 0.83 Secret-like setting is echoed into a password input value
Never prefill secret fields with stored values. Show a masked status such as configured/not configured, require explicit rotation to replace the value, and return the raw key only once at creation time.
frontend/src/app/(auth)/login/page.tsx:208
high System graph security Agent instructions conf 1.00 Agent instruction/config may expose a secret: .github/copilot-instructions.md
Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only.
.github/copilot-instructions.md:76 SecretsAgent instruction
high System graph quality Integrity conf 1.00 Blocking `time.sleep(...)` inside `async def create_sandbox` — docker/provisioner/app.py:491
Sync I/O inside an async function blocks the event loop. While `time.sleep(...)` is running, *all* other coroutines on this loop are paused — silent throughput collapse under concurrency. Use the async equivalent (`httpx.AsyncClient`, `asyncio.sleep`, `aiofiles`) or wrap with `await asyncio.to_thre…
docker/provisioner/app.py:491 Sync io in asyncPerformance
high System graph security Trivy conf 1.00 CVE-2026-33128: h3 1.15.5 — frontend/pnpm-lock.yaml
h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields H3 is a minimal H(TTP) framework. In versions prior to 1.15.6 and between 2.0.0 through 2.0.1-rc.14, createEventStream is vulnerable to Server-Sent Events (SSE) injection due to missing newline sanitization in fo…
VulnCve 2026 33128
high System graph security Trivy conf 1.00 CVE-2026-34601: @xmldom/xmldom 0.9.8 — frontend/pnpm-lock.yaml
xmldom: xmldom: XML structure injection via CDATA terminator xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In xmldom versions 0.6.0 and prior and @xmldom/xmldom prior to versions 0.8.12 and 0.9.9, xmldom/xmldom allows attacker-control…
VulnCve 2026 34601
high System graph security Trivy conf 1.00 CVE-2026-35209: defu 6.1.4 — frontend/pnpm-lock.yaml
defu: Prototype pollution via `__proto__` key in defaults argument defu is software that allows uers to assign default properties recursively. Prior to version 6.1.5, applications that pass unsanitized user input (e.g. parsed JSON request bodies, database records, or config files from untrusted so…
VulnCve 2026 35209
high System graph security Trivy conf 1.00 CVE-2026-39363: vite 7.3.1 — frontend/pnpm-lock.yaml
Vite: Vite: Information disclosure via WebSocket connection bypasses access control Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to connect to the Vite dev server’s WebSocket without an Origin header, an attacker can invoke fe…
VulnCve 2026 39363
high System graph security Trivy conf 1.00 CVE-2026-39364: vite 7.3.1 — frontend/pnpm-lock.yaml
vite: Vite: Information disclosure via query parameter manipulation on the development server Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with …
VulnCve 2026 39364
high System graph security Trivy conf 1.00 CVE-2026-41672: @xmldom/xmldom 0.9.8 — frontend/pnpm-lock.yaml
xmldom: @xmldom/xmldom: xmldom: Arbitrary XML Node Injection xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package allows attacker-controlle…
VulnCve 2026 41672
high System graph security Trivy conf 1.00 CVE-2026-41673: @xmldom/xmldom 0.9.8 — frontend/pnpm-lock.yaml
@xmldom/xmldom: xmldom: xmldom: Denial of Service via deeply nested XML documents xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, seven recursive …
VulnCve 2026 41673
high System graph security Trivy conf 1.00 CVE-2026-41674: @xmldom/xmldom 0.9.8 — frontend/pnpm-lock.yaml
xmldom: xmldom: Arbitrary XML markup injection xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package serializes DocumentType node fields (in…
VulnCve 2026 41674
high System graph security Trivy conf 1.00 CVE-2026-41675: @xmldom/xmldom 0.9.8 — frontend/pnpm-lock.yaml
xmldom: xmldom: Arbitrary XML node injection via crafted processing instructions xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package allow…
VulnCve 2026 41675
high System graph security Trivy conf 1.00 CVE-2026-45134: langsmith 0.5.2 — frontend/pnpm-lock.yaml
LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to LangSmith SDK Python 0.8.0 and JS/TS 0.6.0, the LangSmith SDK's prompt pull methods (pull_prompt / pull_prompt…
VulnCve 2026 45134
high System graph security Trivy conf 1.00 CVE-2026-4800: lodash-es 4.17.21 — frontend/pnpm-lock.yaml
lodash: lodash: Arbitrary code execution via untrusted input in template imports Impact: The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both p…
VulnCve 2026 4800
high System graph security Trivy conf 1.00 CVE-2026-4800: lodash-es 4.17.23 — frontend/pnpm-lock.yaml
lodash: lodash: Arbitrary code execution via untrusted input in template imports Impact: The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both p…
VulnCve 2026 4800
high System graph security Trivy conf 1.00 CVE-2026-53571: vite 7.3.1 — frontend/pnpm-lock.yaml
vite: `server.fs.deny` bypass on Windows alternate paths Vite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, the contents of files that are specified by server.fs.deny can be returned to the browser on Windows. Vite’s dev server denies direct access to sensitive…
VulnCve 2026 53571
high System graph api Wiring conf 1.00 Dangling fetch: GET /api/v1/auth/me (frontend/src/app/(auth)/auth/callback/page.tsx:33)
`frontend/src/app/(auth)/auth/callback/page.tsx:33` calls `GET /api/v1/auth/me` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/v1/auth/me` If this points at an external API, prefix it with `https://` so the matcher …
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: GET /api/v1/auth/me (frontend/src/components/workspace/gateway-offline-banner.tsx:51)
`frontend/src/components/workspace/gateway-offline-banner.tsx:51` calls `GET /api/v1/auth/me` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/v1/auth/me` If this points at an external API, prefix it with `https://` s…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: GET /api/v1/auth/me (frontend/src/core/auth/AuthProvider.tsx:74)
`frontend/src/core/auth/AuthProvider.tsx:74` calls `GET /api/v1/auth/me` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/v1/auth/me` If this points at an external API, prefix it with `https://` so the matcher skips i…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: GET /api/v1/auth/providers (frontend/src/app/(auth)/login/page.tsx:104)
`frontend/src/app/(auth)/login/page.tsx:104` calls `GET /api/v1/auth/providers` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/v1/auth/providers` If this points at an external API, prefix it with `https://` so the m…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: GET /api/v1/auth/setup-status (frontend/src/app/(auth)/login/page.tsx:92)
`frontend/src/app/(auth)/login/page.tsx:92` calls `GET /api/v1/auth/setup-status` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/v1/auth/setup-status` If this points at an external API, prefix it with `https://` so …
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: GET /api/v1/auth/setup-status (frontend/src/app/(auth)/setup/page.tsx:39)
`frontend/src/app/(auth)/setup/page.tsx:39` calls `GET /api/v1/auth/setup-status` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/v1/auth/setup-status` If this points at an external API, prefix it with `https://` so …
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST /api/v1/auth/change-password (frontend/src/app/(auth)/setup/page.tsx:116)
`frontend/src/app/(auth)/setup/page.tsx:116` calls `POST /api/v1/auth/change-password` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/v1/auth/change-password` If this points at an external API, prefix it with `https…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST /api/v1/auth/change-password (frontend/src/components/workspace/settings/account-settings-page.tsx:42)
`frontend/src/components/workspace/settings/account-settings-page.tsx:42` calls `POST /api/v1/auth/change-password` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/v1/auth/change-password` If this points at an extern…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST /api/v1/auth/initialize (frontend/src/app/(auth)/setup/page.tsx:75)
`frontend/src/app/(auth)/setup/page.tsx:75` calls `POST /api/v1/auth/initialize` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/v1/auth/initialize` If this points at an external API, prefix it with `https://` so the…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST /api/v1/auth/logout (frontend/src/core/auth/AuthProvider.tsx:119)
`frontend/src/core/auth/AuthProvider.tsx:119` calls `POST /api/v1/auth/logout` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/v1/auth/logout` If this points at an external API, prefix it with `https://` so the match…
Dangling fetchFetch
high System graph security Trivy conf 1.00 DS-0002: Image user should not be 'root' — backend/Dockerfile
Image user should not be 'root' Specify at least 1 USER command in Dockerfile with non-root user as argument Rule: DS-0002 Severity: HIGH Target: backend/Dockerfile
Misconfig
high System graph security Trivy conf 1.00 DS-0002: Image user should not be 'root' — docker/provisioner/Dockerfile
Image user should not be 'root' Specify at least 1 USER command in Dockerfile with non-root user as argument Rule: DS-0002 Severity: HIGH Target: docker/provisioner/Dockerfile
Misconfig
high System graph security Trivy conf 1.00 DS-0002: Image user should not be 'root' — frontend/Dockerfile
Image user should not be 'root' Specify at least 1 USER command in Dockerfile with non-root user as argument Rule: DS-0002 Severity: HIGH Target: frontend/Dockerfile
Misconfig
high System graph security Trivy conf 1.00 DS-0029: 'apt-get' missing '--no-install-recommends' — backend/Dockerfile
'apt-get' missing '--no-install-recommends' '--no-install-recommends' flag is missed: 'apt-get update && apt-get install -y curl build-essential gnupg ca-certificates && mkdir -p /etc/apt/keyrings && curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | gpg…
Misconfig
high System graph security auth conf 1.00 FastAPI DELETE `clear_memory` without auth dependency — backend/app/gateway/routers/memory.py:208
`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/app/gateway/routers/memory.py:208 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI DELETE `delete_agent` without auth dependency — backend/app/gateway/routers/agents.py:424
`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/app/gateway/routers/agents.py:424 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI DELETE `delete_custom_skill` without auth dependency — backend/app/gateway/routers/skills.py:191
`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/app/gateway/routers/skills.py:191 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI DELETE `delete_feedback` without auth dependency — backend/app/gateway/routers/feedback.py:169
`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/app/gateway/routers/feedback.py:169 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI DELETE `delete_memory_fact_endpoint` without auth dependency — backend/app/gateway/routers/memory.py:249
`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/app/gateway/routers/memory.py:249 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI DELETE `delete_run_feedback` without auth dependency — backend/app/gateway/routers/feedback.py:92
`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/app/gateway/routers/feedback.py:92 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI DELETE `delete_thread_data` without auth dependency — backend/app/gateway/routers/threads.py:213
`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/app/gateway/routers/threads.py:213 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI DELETE `delete_uploaded_file` without auth dependency — backend/app/gateway/routers/uploads.py:380
`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/app/gateway/routers/uploads.py:380 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI DELETE `destroy_sandbox` without auth dependency — docker/provisioner/app.py:505
`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
docker/provisioner/app.py:505 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI DELETE `disconnect_channel_connection` without auth dependency — backend/app/gateway/routers/channel_connections.py:541
`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/app/gateway/routers/channel_connections.py:541 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI DELETE `disconnect_channel_provider_runtime` without auth dependency — backend/app/gateway/routers/channel_connections.py:557
`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/app/gateway/routers/channel_connections.py:557 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI PATCH `patch_thread` without auth dependency — backend/app/gateway/routers/threads.py:358
`@router.patch` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/app/gateway/routers/threads.py:358 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI PATCH `update_memory_fact_endpoint` without auth dependency — backend/app/gateway/routers/memory.py:268
`@router.patch` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/app/gateway/routers/memory.py:268 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `cancel_run` without auth dependency — backend/app/gateway/routers/thread_runs.py:521
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/app/gateway/routers/thread_runs.py:521 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `change_password` without auth dependency — backend/app/gateway/routers/auth.py:350
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/app/gateway/routers/auth.py:350 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `configure_channel_provider_runtime` without auth dependency — backend/app/gateway/routers/channel_connections.py:639
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/app/gateway/routers/channel_connections.py:639 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `connect_channel_provider` without auth dependency — backend/app/gateway/routers/channel_connections.py:604
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/app/gateway/routers/channel_connections.py:604 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `create_agent_endpoint` without auth dependency — backend/app/gateway/routers/agents.py:192
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/app/gateway/routers/agents.py:192 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `create_feedback` without auth dependency — backend/app/gateway/routers/feedback.py:112
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/app/gateway/routers/feedback.py:112 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `create_memory_fact_endpoint` without auth dependency — backend/app/gateway/routers/memory.py:225
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/app/gateway/routers/memory.py:225 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `create_run` without auth dependency — backend/app/gateway/routers/thread_runs.py:436
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/app/gateway/routers/thread_runs.py:436 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `create_sandbox` without auth dependency — docker/provisioner/app.py:433
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
docker/provisioner/app.py:433 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `create_thread` without auth dependency — backend/app/gateway/routers/threads.py:247
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/app/gateway/routers/threads.py:247 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `generate_suggestions` without auth dependency — backend/app/gateway/routers/suggestions.py:141
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/app/gateway/routers/suggestions.py:141 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `get_thread_history` without auth dependency — backend/app/gateway/routers/threads.py:599
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/app/gateway/routers/threads.py:599 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `import_memory` without auth dependency — backend/app/gateway/routers/memory.py:308
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/app/gateway/routers/memory.py:308 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `initialize_admin` without auth dependency — backend/app/gateway/routers/auth.py:496
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/app/gateway/routers/auth.py:496 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `install_skill` without auth dependency — backend/app/gateway/routers/skills.py:103
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/app/gateway/routers/skills.py:103 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `prepare_regenerate_run` without auth dependency — backend/app/gateway/routers/thread_runs.py:425
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/app/gateway/routers/thread_runs.py:425 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `reload_memory` without auth dependency — backend/app/gateway/routers/memory.py:188
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/app/gateway/routers/memory.py:188 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `reset_mcp_tools_cache_endpoint` without auth dependency — backend/app/gateway/routers/mcp.py:262
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/app/gateway/routers/mcp.py:262 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `restart_channel` without auth dependency — backend/app/gateway/routers/channels.py:41
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/app/gateway/routers/channels.py:41 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `rollback_custom_skill` without auth dependency — backend/app/gateway/routers/skills.py:234
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/app/gateway/routers/skills.py:234 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `search_assistants` without auth dependency — backend/app/gateway/routers/assistants_compat.py:88
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/app/gateway/routers/assistants_compat.py:88 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `search_threads` without auth dependency — backend/app/gateway/routers/threads.py:321
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/app/gateway/routers/threads.py:321 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `stateless_stream` without auth dependency — backend/app/gateway/routers/runs.py:35
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/app/gateway/routers/runs.py:35 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `stateless_wait` without auth dependency — backend/app/gateway/routers/runs.py:60
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/app/gateway/routers/runs.py:60 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `stream_existing_run` without auth dependency — backend/app/gateway/routers/thread_runs.py:584
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/app/gateway/routers/thread_runs.py:584 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `stream_run` without auth dependency — backend/app/gateway/routers/thread_runs.py:444
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/app/gateway/routers/thread_runs.py:444 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `update_thread_state` without auth dependency — backend/app/gateway/routers/threads.py:497
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/app/gateway/routers/threads.py:497 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `upload_files` without auth dependency — backend/app/gateway/routers/uploads.py:213
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/app/gateway/routers/uploads.py:213 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `wait_run` without auth dependency — backend/app/gateway/routers/thread_runs.py:472
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/app/gateway/routers/thread_runs.py:472 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI PUT `update_agent` without auth dependency — backend/app/gateway/routers/agents.py:273
`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/app/gateway/routers/agents.py:273 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI PUT `update_custom_skill` without auth dependency — backend/app/gateway/routers/skills.py:154
`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/app/gateway/routers/skills.py:154 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI PUT `update_mcp_configuration` without auth dependency — backend/app/gateway/routers/mcp.py:283
`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/app/gateway/routers/mcp.py:283 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI PUT `update_skill` without auth dependency — backend/app/gateway/routers/skills.py:304
`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/app/gateway/routers/skills.py:304 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI PUT `update_user_profile` without auth dependency — backend/app/gateway/routers/agents.py:396
`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/app/gateway/routers/agents.py:396 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI PUT `upsert_feedback` without auth dependency — backend/app/gateway/routers/feedback.py:61
`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/app/gateway/routers/feedback.py:61 securityAuth fastapi unauth mutation
high System graph security Skillspector conf 0.70 SkillSpector E2 (data-exfil) in skills/public/skill-creator/scripts/improve_description.py
for k, v in os.environ.items() Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: skill-creator Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.70 Remediation: Avoid reading sensitive env vars (API k…
skills/public/skill-creator/scripts/improve_description.py:33 Mcp skillData exfilE2
high System graph security Skillspector conf 0.70 SkillSpector E2 (data-exfil) in skills/public/skill-creator/scripts/run_eval.py
for k, v in os.environ.items() Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: skill-creator Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.70 Remediation: Avoid reading sensitive env vars (API k…
skills/public/skill-creator/scripts/run_eval.py:83 Mcp skillData exfilE2
high System graph security Skillspector conf 0.95 SkillSpector OH1 (output-handling) in skills/public/skill-creator/eval-viewer/generate_review.py
subprocess.run( ["lsof", "-ti", f":{port}"], capture_output Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution. Skill: skill-creator Rule: O…
skills/public/skill-creator/eval-viewer/generate_review.py:291 Mcp skillOutput handlingOh1
high System graph security Skillspector conf 0.95 SkillSpector OH1 (output-handling) in skills/public/skill-creator/scripts/improve_description.py
subprocess.run( cmd, input=prompt, capture_output Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution. Skill: skill-creator Rule: OH1 Catego…
skills/public/skill-creator/scripts/improve_description.py:35 Mcp skillOutput handlingOh1
high System graph security Skillspector conf 0.70 SkillSpector P2 (prompt-injection) in skills/public/frontend-design/SKILL.md
<!-- Floating corner badge with hover effect --> <a href="https://deerflow.tech" target="_blank" class="deerflow-badge">✦ Deerflow</a> <!-- Monogram with tooltip --> Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recomme…
skills/public/frontend-design/SKILL.md:76 Mcp skillPrompt injectionP2
high System graph security Skillspector conf 0.70 2 occurrences SkillSpector PE3 (priv-esc) in skills/public/github-deep-research/scripts/github_api.py
access token Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts. Skill: github-deep-research Rule: PE3 Category: priv-esc Severity: HIGH Confidence: 0.70 Remediation: Remove references to credential paths. Use environment variables o…
lines 62, 63
skills/public/github-deep-research/scripts/github_api.py:62, 63 (2 hits)
Mcp skillPriv escPe3
high System graph security Skillspector conf 0.85 SkillSpector RA1 (rogue-agent) in skills/public/skill-creator/scripts/init_skill.py
Edit SKILL Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors. Skill: skill-creator Rule: RA1 Category: rogue-agent Severity: HIGH Confidence: 0.85 Remediatio…
skills/public/skill-creator/scripts/init_skill.py:266 Mcp skillRogue agentRa1
high System graph security Skillspector conf 0.90 SkillSpector SC2 (supply-chain) in skills/public/claude-to-deerflow/scripts/chat.sh
curl -s -X POST "${LANGGRAPH_URL}/threads" \ -H "Content-Type: application/json" \ -d '{}') THREAD_ID=$(echo "$THREAD_RESP" | python Remote code is downloaded and executed. This bypasses code review and could introduce malicious code. Skill: claude-to-deerflow Rule: SC2 Category: suppl…
skills/public/claude-to-deerflow/scripts/chat.sh:36 Mcp skillSupply chainSc2
high System graph security Skillspector conf 0.90 6 occurrences SkillSpector SC2 (supply-chain) in skills/public/claude-to-deerflow/scripts/status.sh
curl -s "${GATEWAY_URL}/api/models" | python Remote code is downloaded and executed. This bypasses code review and could introduce malicious code. Skill: claude-to-deerflow Rule: SC2 Category: supply-chain Severity: HIGH Confidence: 0.90 Remediation: Avoid downloading and executing remote scri…
lines 41, 44, 47, 50, 67, 74
skills/public/claude-to-deerflow/scripts/status.sh:41, 44, 47, 50, 67, 74 (6 hits)
Mcp skillSupply chainSc2
high System graph security Semgrep conf 1.00 use defused xml — skills/public/systematic-literature-review/scripts/arxiv_search.py:147
The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. Rule: python.lang.security.use-defused-xml.use-d…
SecurityPython
high System graph security Semgrep conf 1.00 use defused xml — skills/public/systematic-literature-review/scripts/arxiv_search.py:216
The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. Rule: python.lang.security.use-defused-xml.use-d…
SecurityPython
medium Security checks security auth conf 0.92 [AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.
Add .repobility/access.yml mapping routes to anonymous, authenticated, owner, admin, and super_admin. Keep business-specific rules in the repo so CI can enforce them.
high Security checks security auth conf 0.74 [AUC002] Low visible authorization coverage in route inventory: Only 11.1% of discovered routes show nearby authentication, authorization, middleware, or public-route evidence.
Review the access matrix and add explicit framework auth declarations or policy-file exceptions for intentionally public routes.
high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: DELETE /memory/:...path/route.
Require an explicit admin, maintainer, super_admin, or scoped service role in code and .repobility/access.yml.
frontend/src/app/api/memory/[...path]/route.ts:43
high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: DELETE /memory/route.
Require an explicit admin, maintainer, super_admin, or scoped service role in code and .repobility/access.yml.
frontend/src/app/api/memory/route.ts:33
high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /memory/:...path/route.
Require an explicit admin, maintainer, super_admin, or scoped service role in code and .repobility/access.yml.
frontend/src/app/api/memory/[...path]/route.ts:29
high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /memory/route.
Require an explicit admin, maintainer, super_admin, or scoped service role in code and .repobility/access.yml.
frontend/src/app/api/memory/route.ts:29
high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /threads/:thread_id/artifacts/::...artifact_path/route.
Require an explicit admin, maintainer, super_admin, or scoped service role in code and .repobility/access.yml.
frontend/src/app/mock/api/threads/[thread_id]/artifacts/[[...artifact_path]]/route.ts:6
high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: PATCH /memory/:...path/route.
Require an explicit admin, maintainer, super_admin, or scoped service role in code and .repobility/access.yml.
frontend/src/app/api/memory/[...path]/route.ts:50
high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /memory/:...path/route.
Require an explicit admin, maintainer, super_admin, or scoped service role in code and .repobility/access.yml.
frontend/src/app/api/memory/[...path]/route.ts:36
high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /threads/search/route.
Require an explicit admin, maintainer, super_admin, or scoped service role in code and .repobility/access.yml.
frontend/src/app/mock/api/threads/search/route.ts:16
low Security checks quality Error handling conf 1.00 [ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even in cleanup code, log at DEBUG level.
Log the error: `except Exception: logger.debug('cleanup failed', exc_info=True)`. Or handle specific exception types.
backend/packages/harness/deerflow/tools/builtins/invoke_acp_agent_tool.py:197
low Security checks quality Error handling conf 1.00 [ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even in cleanup code, log at DEBUG level.
Log the error: `except Exception: logger.debug('cleanup failed', exc_info=True)`. Or handle specific exception types.
backend/packages/harness/deerflow/runtime/serialization.py:30
medium Security checks software Open redirect conf 1.00 [SEC046] Client-side open redirect — window.location = server-supplied URL: Assigning window.location from a server-supplied URL trusts the server endpoint to never return a hostile destination. If that endpoint is ever subverted (compromised admin, JSON injection, MITM on a webhook), users get redirected to a phishing site they trust because the original page is yours. CWE-601 (server-side OR client-side). Complement to server-side SEC030.
Validate the URL is same-origin or on an explicit allowlist before assignment: const u = new URL(serverUrl, location.href); if (u.origin !== location.origin && !ALLOWED.includes(u.host)) return; location.assign(u); Even better: have the server return a path (/checkout/done) instead of a full …
frontend/src/core/api/fetcher.ts:84
high Security checks quality Quality conf 0.72 Agent control bridge may listen on a network interface without visible auth
Bind local agent bridges to 127.0.0.1 by default. If remote access is required, require a bearer token or mTLS, enforce origin/CSRF checks for browser clients, and document the threat model.
docker/docker-compose.yaml:7
low Security checks quality Error handling conf 0.55 ✓ Repobility 22 occurrences Broad exception handler needs review
This handler catches Exception/BaseException. It is actionable when it swallows errors without logging, re-raising, or returning a structured error. Handlers that intentionally convert exceptions into typed error results should not be treated as high risk.
12 files, 20 locations
backend/packages/harness/deerflow/sandbox/tools.py:1423, 1432, 1484, 1712 (4 hits)
scripts/doctor.py:332, 373, 428 (3 hits)
skills/public/github-deep-research/scripts/github_api.py:260, 270, 282 (3 hits)
backend/app/channels/wecom.py:287, 383 (2 hits)
backend/debug.py:89
backend/packages/harness/deerflow/agents/lead_agent/prompt.py:677
backend/packages/harness/deerflow/agents/middlewares/title_middleware.py:140
backend/packages/harness/deerflow/config/app_config.py:351
Error handlingquality
high Security checks quality Quality conf 0.74 Codex auth.json is read or copied without visible secret-file hardening
Use the platform credential store where possible. If auth files must be touched, enforce 0600 permissions, avoid backups in the repo/workspace, redact logs, and document rotation if the file is exposed.
backend/packages/harness/deerflow/models/credential_loader.py:9
medium Security checks quality Quality conf 0.74 11 occurrences Critical user action appears to be handled by a no-op or placeholder
Wire the action to a real backend mutation or remove/disable the control until it is implemented. Add an end-to-end or integration test that performs the action and observes persisted state.
8 files, 11 locations
frontend/src/components/workspace/todo-list.tsx:4, 22 (2 hits)
frontend/src/core/threads/types.ts:3, 9 (2 hits)
skills/public/chart-visualization/scripts/generate.js:153, 157 (2 hits)
frontend/src/app/workspace/agents/[agent_name]/chats/[thread_id]/page.tsx:21
frontend/src/app/workspace/chats/[thread_id]/page.tsx:22
frontend/src/core/config/index.ts:22
frontend/src/core/threads/hooks.ts:1440
frontend/src/core/todos/types.ts:1
high Security checks cicd CI/CD security conf 0.82 3 occurrences Docker final stage has no non-root USER
Add a non-root USER in the final runtime stage after files and permissions are prepared.
3 files, 3 locations
backend/Dockerfile:73
docker/provisioner/Dockerfile:1
frontend/Dockerfile:38
CI/CD securitycontainers
high Security checks quality Quality conf 0.74 15 occurrences Frontend API reference is not matched by discovered backend routes
Add the backend route, update the frontend constant to the implemented endpoint, or document that the route is served by another service and exclude it with .repobilityignore.
7 files, 15 locations
frontend/src/app/(auth)/login/page.tsx:92, 104, 132, 133 (4 hits)
frontend/next.config.js:37, 48, 56 (3 hits)
frontend/src/app/(auth)/setup/page.tsx:39, 75, 116 (3 hits)
frontend/src/app/api/memory/route.ts:30, 34 (2 hits)
frontend/scripts/save-demo.js:11
frontend/src/app/(auth)/auth/callback/page.tsx:33
frontend/src/components/workspace/gateway-offline-banner.tsx:18
medium Security checks cicd CI/CD security conf 0.90 ✓ Repobility 10 occurrences GitHub Action is tag-pinned rather than SHA-pinned
[MINED115] Action `astral-sh/setup-uv` pinned to mutable ref `@v3`: `uses: astral-sh/setup-uv@v3` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party a…
5 files, 10 locations
.github/workflows/backend-blocking-io-tests.yml:38 (2 hits)
.github/workflows/backend-unit-tests.yml:32 (2 hits)
.github/workflows/label-sync.yml:32 (2 hits)
.github/workflows/lint-check.yml:24 (2 hits)
.github/workflows/replay-e2e.yml:59, 79 (2 hits)
CI/CD securitySupply chainGitHub Actions
medium Security checks quality Quality conf 0.78 Mock or fake data appears wired into production source
Move demo data into fixtures/stories/seeds, wire production paths to the real API or datastore, and add an integration test that proves the displayed data comes from the live contract.
frontend/src/core/threads/static-demo.ts:6
medium Security checks quality Quality conf 0.69 8 occurrences Mutation journey appears local-only with no backend write
Move the mutation into a backend/API/server action, handle failure states, and test the full write/read-back path against the real datastore.
8 files, 8 locations
frontend/src/app/workspace/agents/new/page.tsx:50
frontend/src/components/ai-elements/web-preview.tsx:112
frontend/src/components/ui/magic-bento.tsx:34
frontend/src/components/workspace/artifacts/artifact-trigger.tsx:21
frontend/src/components/workspace/messages/message-list-item.tsx:96
frontend/src/core/i18n/hooks.ts:28
frontend/src/core/settings/local.ts:78
frontend/src/core/tasks/context.tsx:52
high Security checks software dependencies conf 0.70 Remote install command pipes network code directly to a shell
Publish a package-manager install path or add checksum/signature verification before execution. For docs, show the inspect-then-run flow and pin the downloaded artifact version.
backend/packages/harness/deerflow/agents/middlewares/sandbox_audit_middleware.py:32
medium Security checks quality Quality conf 0.72 Runtime environment contract is missing referenced variables
Add every required runtime variable to .env.example or deployment docs with safe placeholder values, then verify CI/deploy bootstraps from that contract.
backend/app/gateway/auth/config.py:68
medium Security checks quality Quality conf 0.76 4 occurrences Shipping source still contains a stub implementation
Replace the stub with real behavior, or remove the route/module from the active product surface until it is implemented and covered by a test.
4 files, 4 locations
backend/app/gateway/auth/providers.py:15
backend/app/gateway/auth/repositories/base.py:38
backend/packages/harness/deerflow/persistence/json_compat.py:191
backend/packages/harness/deerflow/runtime/stream_bridge/async_provider.py:53
medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — frontend/src/components/ai-elements/code-block.tsx:115
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
Fq dangerous html
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/scripts/save-demo.js:14
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/app/(auth)/login/page.tsx:142
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/app/api/memory/[...path]/route.ts:17
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/app/api/memory/route.ts:17
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/app/workspace/chats/[thread_id]/page.tsx:45
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/components/workspace/input-box.tsx:688
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/core/agents/api.ts:39
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/core/api/feedback.ts:17
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/core/api/fetcher.ts:50
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/core/artifacts/loader.ts:22
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/core/channels/api.ts:29
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/core/mcp/api.ts:40
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/core/memory/api.ts:84
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/core/models/api.ts:16
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/core/skills/api.ts:7
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/core/suggestions/api.ts:9
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/core/threads/hooks.ts:1414
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/core/threads/static-demo.ts:56
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/core/uploads/api.ts:55
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — skills/public/chart-visualization/scripts/generate.js:46
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .github/copilot-instructions.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.github/copilot-instructions.md VerificationAgent instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: skills/public/bootstrap/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
skills/public/bootstrap/SKILL.md VerificationSkill file
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: skills/public/chart-visualization/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
skills/public/chart-visualization/SKILL.md VerificationSkill file
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: skills/public/data-analysis/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
skills/public/data-analysis/SKILL.md VerificationSkill file
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: skills/public/image-generation/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
skills/public/image-generation/SKILL.md VerificationSkill file
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: skills/public/music-generation/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
skills/public/music-generation/SKILL.md VerificationSkill file
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: skills/public/podcast-generation/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
skills/public/podcast-generation/SKILL.md VerificationSkill file
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: skills/public/ppt-generation/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
skills/public/ppt-generation/SKILL.md VerificationSkill file
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: skills/public/skill-creator/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
skills/public/skill-creator/SKILL.md VerificationSkill file
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: skills/public/systematic-literature-review/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
skills/public/systematic-literature-review/SKILL.md VerificationSkill file
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: skills/public/video-generation/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
skills/public/video-generation/SKILL.md VerificationSkill file
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: skills/public/web-design-guidelines/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
skills/public/web-design-guidelines/SKILL.md VerificationSkill file
medium System graph security Agent instructions conf 1.00 Agent instruction contains unpinned remote install: backend/CLAUDE.md
Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands.
backend/CLAUDE.md:342 Supply chainClaude instruction
medium System graph quality Placeholder conf 1.00 Critical user flow still appears backed by mock or placeholder data
A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded.
Mock dataCritical flowGenerated repo pattern
medium System graph security Trivy conf 1.00 CVE-2025-13465: lodash-es 4.17.21 — frontend/pnpm-lock.yaml
lodash: prototype pollution in _.unset and _.omit functions Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion o…
VulnCve 2025 13465
medium System graph security Trivy conf 1.00 CVE-2026-0540: dompurify 3.3.1 — frontend/pnpm-lock.yaml
DOMPurify: DOMPurify: Cross-site scripting vulnerability DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in commit 2726c74, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, n…
VulnCve 2026 0540
medium System graph security Trivy conf 1.00 CVE-2026-2950: lodash-es 4.17.21 — frontend/pnpm-lock.yaml
lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/…
VulnCve 2026 2950
medium System graph security Trivy conf 1.00 CVE-2026-2950: lodash-es 4.17.23 — frontend/pnpm-lock.yaml
lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/…
VulnCve 2026 2950
medium System graph security Trivy conf 1.00 CVE-2026-31860: unhead 2.1.4 — frontend/pnpm-lock.yaml
Unhead has XSS bypass in `useHeadSafe` via attribute name injection and case-sensitive protocol check Unhead is a document head and template manager. Prior to 2.1.11, useHeadSafe() can be bypassed to inject arbitrary HTML attributes, including event handlers, into SSR-rendered <head> tags. This is…
VulnCve 2026 31860
medium System graph security Trivy conf 1.00 CVE-2026-34404: nuxt-og-image 5.1.13 — frontend/pnpm-lock.yaml
Nuxt OG Image is vulnerable to Denial of Service via unbounded image dimensions Nuxt OG Image generates OG Images with Vue templates in Nuxt. Prior to version 6.2.5, the image‑generation component by the URI: /_og/d/ (and, in older versions, /og-image/) contains a Denial of Service (DoS) vulnerabi…
VulnCve 2026 34404
medium System graph security Trivy conf 1.00 CVE-2026-34405: nuxt-og-image 5.1.13 — frontend/pnpm-lock.yaml
Nuxt OG Image is vulnerable to reflected XSS via query parameter injection into HTML attributes Nuxt OG Image generates OG Images with Vue templates in Nuxt. Prior to version 6.2.5, the image‑generation component by the URI: /_og/d/ (and, in older versions, /og-image/) contains a vulnerability tha…
VulnCve 2026 34405
medium System graph security Trivy conf 1.00 CVE-2026-39315: unhead 2.1.4 — frontend/pnpm-lock.yaml
Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe() Unhead is a document head and template manager. Prior to 2.1.13, useHeadSafe() is the composable that Nuxt's own documentation explicitly recommends for rendering user-supplied content in <head> safel…
VulnCve 2026 39315
medium System graph security Trivy conf 1.00 CVE-2026-39365: vite 7.3.1 — frontend/pnpm-lock.yaml
vite: Vite: Information disclosure via path traversal in dev server's .map request handling Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, the dev server’s handling of .map requests for optimized dependencies resolves file paths and calls readFil…
VulnCve 2026 39365
medium System graph security Trivy conf 1.00 CVE-2026-40190: langsmith 0.5.2 — frontend/pnpm-lock.yaml
LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set()` LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to 0.5.18, the LangSmith JavaScript/TypeScript SDK (langsmith) contains an incomplete pr…
VulnCve 2026 40190
medium System graph security Trivy conf 1.00 CVE-2026-41148: mermaid 11.12.2 — frontend/pnpm-lock.yaml
mermaid: Mermaid: CSS injection vulnerability allows page defacement and information disclosure Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Versions 10.9.5 and prior, in addition to 11.0.0-alpha.1 through 11.12.0 are vulnerable to CSS inj…
VulnCve 2026 41148
medium System graph security Trivy conf 1.00 CVE-2026-41149: mermaid 11.12.2 — frontend/pnpm-lock.yaml
mermaid: Mermaid: HTML injection via classDef directive in state diagrams Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Versions 10.9.5 and earlier, as well as 11.0.0-alpha.1 through 11.14.0, are vulnerable to HTML injection under the defau…
VulnCve 2026 41149
medium System graph security Trivy conf 1.00 CVE-2026-41150: mermaid 11.12.2 — frontend/pnpm-lock.yaml
mermaid: Mermaid: Denial of Service via specially crafted gantt charts Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.6 and 11.15.0, there is a denial-of-service attack when rendering gantt charts, if they use the excludes attr…
VulnCve 2026 41150
medium System graph security Trivy conf 1.00 CVE-2026-41159: mermaid 11.12.2 — frontend/pnpm-lock.yaml
mermaid: Mermaid: Information disclosure and page defacement via CSS injection Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.6 and 11.15.0, Mermaid's default configuration allows injecting CSS that applies outside of the Merm…
VulnCve 2026 41159
medium System graph security Trivy conf 1.00 CVE-2026-41182: langsmith 0.5.2 — frontend/pnpm-lock.yaml
LangSmith SDK: Streaming token events bypass output redaction LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to version 0.5.19 of the JavaScript SDK and version 0.7.31 of the Python SDK, the LangSmith SDK's output redaction controls (hideOutputs in JS, hide_…
VulnCve 2026 41182
medium System graph security Trivy conf 1.00 CVE-2026-41238: dompurify 3.3.1 — frontend/pnpm-lock.yaml
DOMPurify: DOMPurify: Cross-Site Scripting bypass via prototype pollution DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions 3.0.1 through 3.3.3 are vulnerable to a prototype pollution-based XSS bypass. When an application uses `DOMPurify.sanitize()` with th…
VulnCve 2026 41238
medium System graph security Trivy conf 1.00 CVE-2026-41239: dompurify 3.3.1 — frontend/pnpm-lock.yaml
DOMPurify: Vue 2: DOMPurify: Cross-site scripting due to incomplete sanitization of template expressions DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Starting in version 1.0.10 and prior to version 3.4.0, `SAFE_FOR_TEMPLATES` strips `{{...}}` expressions from u…
VulnCve 2026 41239
medium System graph security Trivy conf 1.00 CVE-2026-41240: dompurify 3.3.1 — frontend/pnpm-lock.yaml
DOMPurify: DOMPurify: Cross-Site Scripting (XSS) via inconsistent tag sanitization DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions prior to 3.4.0 have an inconsistency between FORBID_TAGS and FORBID_ATTR handling when function-based ADD_TAGS is used. Comm…
VulnCve 2026 41240
medium System graph security Trivy conf 1.00 CVE-2026-41305: postcss 8.4.31 — frontend/pnpm-lock.yaml
postcss: PostCSS: Cross-Site Scripting (XSS) via improper escaping of style closing tags PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `</style>` sequences when stringifyin…
VulnCve 2026 41305
medium System graph security Trivy conf 1.00 CVE-2026-41907: uuid 10.0.0 — frontend/pnpm-lock.yaml
uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silen…
VulnCve 2026 41907
medium System graph security Trivy conf 1.00 CVE-2026-41907: uuid 11.1.0 — frontend/pnpm-lock.yaml
uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silen…
VulnCve 2026 41907
medium System graph security Trivy conf 1.00 CVE-2026-41907: uuid 13.0.0 — frontend/pnpm-lock.yaml
uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silen…
VulnCve 2026 41907
medium System graph security Trivy conf 1.00 CVE-2026-45149: brace-expansion 5.0.5 — frontend/pnpm-lock.yaml
brace-expansion: brace-expansion: Denial of Service due to excessive memory allocation when expanding large numeric ranges The brace-expansion library generates arbitrary strings containing a common prefix and suffix. From 5.0.0 to before 5.0.6, the max option was being applied too late. When expa…
VulnCve 2026 45149
medium System graph security Trivy conf 1.00 CVE-2026-49458: dompurify 3.3.1 — frontend/pnpm-lock.yaml
DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks # Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks **CWE**: CWE-79 (XSS — Improper Neutralization of Input During Web Page Generati…
VulnCve 2026 49458
medium System graph security Trivy conf 1.00 CVE-2026-49459: dompurify 3.3.1 — frontend/pnpm-lock.yaml
DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM # IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM **CWE**: CWE-79 (XSS — Improper Neutralization of Input During W…
VulnCve 2026 49459
medium System graph security Trivy conf 1.00 CVE-2026-49978: dompurify 3.3.1 — frontend/pnpm-lock.yaml
DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content If the HTML you give it contains a <template> element, and inside that template there's an element with a shadow DOM attached to it, DOMPurify quietly skips over the shadow contents. Whatever the attacker put…
VulnCve 2026 49978
medium System graph security Trivy conf 1.00 CVE-2026-53632: vite 7.3.1 — frontend/pnpm-lock.yaml
launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automati…
VulnCve 2026 53632
medium System graph hardware Security conf 1.00 Dockerfile runs as root: backend/Dockerfile
No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.
Container
medium System graph hardware Security conf 1.00 Dockerfile runs as root: docker/provisioner/Dockerfile
No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.
Container
medium System graph hardware Security conf 1.00 Dockerfile runs as root: frontend/Dockerfile
No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.
Container
medium System graph security Trivy conf 1.00 3 occurrences DS-0013: 'RUN cd ...' to change directory — frontend/Dockerfile
'RUN cd ...' to change directory RUN should not be used to change directory: 'cd /app/frontend && SKIP_ENV_VALIDATION=1 pnpm build'. Use 'WORKDIR' statement instead. Rule: DS-0013 Severity: MEDIUM Target: frontend/Dockerfile
3 occurrences
repo-level (3 hits)
Misconfig
medium System graph security Semgrep conf 1.00 dynamic proxy host — docker/nginx/nginx.conf:102
The host for this proxy URL is dynamically determined. This can be dangerous if the host can be injected by an attacker because it may forcibly alter destination of the proxy. Consider hardcoding acceptable destinations and retrieving them with 'map' or something similar. Rule: generic.nginx.secur…
SecurityNginx
medium System graph security Semgrep conf 1.00 dynamic proxy host — docker/nginx/nginx.conf:113
The host for this proxy URL is dynamically determined. This can be dangerous if the host can be injected by an attacker because it may forcibly alter destination of the proxy. Consider hardcoding acceptable destinations and retrieving them with 'map' or something similar. Rule: generic.nginx.secur…
SecurityNginx
medium System graph security Semgrep conf 1.00 dynamic proxy host — docker/nginx/nginx.conf:124
The host for this proxy URL is dynamically determined. This can be dangerous if the host can be injected by an attacker because it may forcibly alter destination of the proxy. Consider hardcoding acceptable destinations and retrieving them with 'map' or something similar. Rule: generic.nginx.secur…
SecurityNginx
medium System graph security Semgrep conf 1.00 dynamic proxy host — docker/nginx/nginx.conf:140
The host for this proxy URL is dynamically determined. This can be dangerous if the host can be injected by an attacker because it may forcibly alter destination of the proxy. Consider hardcoding acceptable destinations and retrieving them with 'map' or something similar. Rule: generic.nginx.secur…
SecurityNginx
medium System graph security Semgrep conf 1.00 dynamic proxy host — docker/nginx/nginx.conf:151
The host for this proxy URL is dynamically determined. This can be dangerous if the host can be injected by an attacker because it may forcibly alter destination of the proxy. Consider hardcoding acceptable destinations and retrieving them with 'map' or something similar. Rule: generic.nginx.secur…
SecurityNginx
medium System graph security Semgrep conf 1.00 dynamic proxy host — docker/nginx/nginx.conf:162
The host for this proxy URL is dynamically determined. This can be dangerous if the host can be injected by an attacker because it may forcibly alter destination of the proxy. Consider hardcoding acceptable destinations and retrieving them with 'map' or something similar. Rule: generic.nginx.secur…
SecurityNginx
medium System graph security Semgrep conf 1.00 dynamic proxy host — docker/nginx/nginx.conf:173
The host for this proxy URL is dynamically determined. This can be dangerous if the host can be injected by an attacker because it may forcibly alter destination of the proxy. Consider hardcoding acceptable destinations and retrieving them with 'map' or something similar. Rule: generic.nginx.secur…
SecurityNginx
medium System graph security Semgrep conf 1.00 dynamic proxy host — docker/nginx/nginx.conf:184
The host for this proxy URL is dynamically determined. This can be dangerous if the host can be injected by an attacker because it may forcibly alter destination of the proxy. Consider hardcoding acceptable destinations and retrieving them with 'map' or something similar. Rule: generic.nginx.secur…
SecurityNginx
medium System graph security Semgrep conf 1.00 dynamic proxy host — docker/nginx/nginx.conf:198
The host for this proxy URL is dynamically determined. This can be dangerous if the host can be injected by an attacker because it may forcibly alter destination of the proxy. Consider hardcoding acceptable destinations and retrieving them with 'map' or something similar. Rule: generic.nginx.secur…
SecurityNginx
medium System graph security Semgrep conf 1.00 dynamic proxy host — docker/nginx/nginx.conf:210
The host for this proxy URL is dynamically determined. This can be dangerous if the host can be injected by an attacker because it may forcibly alter destination of the proxy. Consider hardcoding acceptable destinations and retrieving them with 'map' or something similar. Rule: generic.nginx.secur…
SecurityNginx
medium System graph security Semgrep conf 1.00 dynamic proxy host — docker/nginx/nginx.conf:223
The host for this proxy URL is dynamically determined. This can be dangerous if the host can be injected by an attacker because it may forcibly alter destination of the proxy. Consider hardcoding acceptable destinations and retrieving them with 'map' or something similar. Rule: generic.nginx.secur…
SecurityNginx
medium System graph security Semgrep conf 1.00 dynamic proxy host — docker/nginx/nginx.conf:45
The host for this proxy URL is dynamically determined. This can be dangerous if the host can be injected by an attacker because it may forcibly alter destination of the proxy. Consider hardcoding acceptable destinations and retrieving them with 'map' or something similar. Rule: generic.nginx.secur…
SecurityNginx
medium System graph security Semgrep conf 1.00 dynamic proxy host — docker/nginx/nginx.conf:69
The host for this proxy URL is dynamically determined. This can be dangerous if the host can be injected by an attacker because it may forcibly alter destination of the proxy. Consider hardcoding acceptable destinations and retrieving them with 'map' or something similar. Rule: generic.nginx.secur…
SecurityNginx
medium System graph security Semgrep conf 1.00 dynamic proxy host — docker/nginx/nginx.conf:80
The host for this proxy URL is dynamically determined. This can be dangerous if the host can be injected by an attacker because it may forcibly alter destination of the proxy. Consider hardcoding acceptable destinations and retrieving them with 'map' or something similar. Rule: generic.nginx.secur…
SecurityNginx
medium System graph security Semgrep conf 1.00 dynamic proxy host — docker/nginx/nginx.conf:91
The host for this proxy URL is dynamically determined. This can be dangerous if the host can be injected by an attacker because it may forcibly alter destination of the proxy. Consider hardcoding acceptable destinations and retrieving them with 'map' or something similar. Rule: generic.nginx.secur…
SecurityNginx
medium System graph security Semgrep conf 1.00 dynamic urllib use detected — skills/public/github-deep-research/scripts/github_api.py:43
Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. R…
SecurityPython
medium System graph security Semgrep conf 1.00 dynamic urllib use detected — skills/public/systematic-literature-review/scripts/arxiv_search.py:83
Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. R…
SecurityPython
medium System graph security Trivy conf 1.00 GHSA-39q2-94rc-95cp: dompurify 3.3.1 — frontend/pnpm-lock.yaml
DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation ## Summary In `src/purify.ts:1117-1123`, `ADD_TAGS` as a function (via `EXTRA_ELEMENT_HANDLING.tagCheck`) bypasses `FORBID_TAGS` due to short-circuit evaluation. The condition: ``` !(tagCheck(tagName)) && (!AL…
VulnGhsa 39q2 94rc 95cp
medium System graph security Trivy conf 1.00 GHSA-4hxc-9384-m385: h3 1.15.5 — frontend/pnpm-lock.yaml
h3: SSE Event Injection via Unsanitized Carriage Return (`\r`) in EventStream Data and Comment Fields (Bypass of CVE Fix) ## Summary The `EventStream` class in h3 fails to sanitize carriage return (`\r`) characters in `data` and `comment` fields. Per the SSE specification, `\r` is a valid line te…
VulnGhsa 4hxc 9384 m385
medium System graph security Trivy conf 1.00 GHSA-72gr-qfp7-vwhw: h3 1.15.5 — frontend/pnpm-lock.yaml
h3: Double Decoding in `serveStatic` Bypasses `resolveDotSegments` Path Traversal Protection via `%252e%252e` ## Summary The `serveStatic` utility in h3 applies a redundant `decodeURI()` call to the request pathname after `H3Event` has already performed percent-decoding with `%25` preservation. T…
VulnGhsa 72gr qfp7 vwhw
medium System graph security Trivy conf 1.00 GHSA-76mc-f452-cxcm: dompurify 3.3.1 — frontend/pnpm-lock.yaml
DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR` # Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR` **CWE**: CWE-501 (Tr…
VulnGhsa 76mc f452 cxcm
medium System graph security Trivy conf 1.00 GHSA-cj63-jhhr-wcxv: dompurify 3.3.1 — frontend/pnpm-lock.yaml
DOMPurify USE_PROFILES prototype pollution allows event handlers ## Summary When `USE_PROFILES` is enabled, DOMPurify rebuilds `ALLOWED_ATTR` as a plain array before populating it with the requested allowlists. Because the sanitizer still looks up attributes via `ALLOWED_ATTR[lcName]`, any `Array.…
VulnGhsa cj63 jhhr wcxv
medium System graph security Trivy conf 1.00 GHSA-cjmm-f4jc-qw8r: dompurify 3.3.1 — frontend/pnpm-lock.yaml
DOMPurify ADD_ATTR predicate skips URI validation ## Summary DOMPurify allows `ADD_ATTR` to be provided as a predicate function via `EXTRA_ELEMENT_HANDLING.attributeCheck`. When the predicate returns `true`, `_isValidAttribute` short-circuits the attribute check before URI-safe validation runs. An…
VulnGhsa cjmm f4jc qw8r
medium System graph security Trivy conf 1.00 GHSA-cmwh-pvxp-8882: dompurify 3.3.1 — frontend/pnpm-lock.yaml
DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch) ## Summary DOMPurify 3.4.7 shipped a security fix ("permanent hook pollution") that makes a registered `uponSanitizeAttribute` hook's mutation of `data…
VulnGhsa cmwh pvxp 8882
medium System graph security Trivy conf 1.00 GHSA-gr75-jv2w-4656: langchain 1.2.15 — backend/uv.lock
LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders ## Summary Several LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the *resolved* path to the intended root directory. Affected behaviors include: …
VulnGhsa gr75 jv2w 4656
medium System graph security Trivy conf 1.00 GHSA-gr75-jv2w-4656: langchain-anthropic 1.4.1 — backend/uv.lock
LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders ## Summary Several LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the *resolved* path to the intended root directory. Affected behaviors include: …
VulnGhsa gr75 jv2w 4656
medium System graph security Trivy conf 1.00 GHSA-h8r8-wccr-v5f2: dompurify 3.3.1 — frontend/pnpm-lock.yaml
DOMPurify is vulnerable to mutation-XSS via Re-Contextualization ## Description A mutation-XSS (mXSS) condition was confirmed when sanitized HTML is reinserted into a new parsing context using `innerHTML` and special wrappers. The vulnerable wrappers confirmed in browser behavior are `script`, `…
VulnGhsa h8r8 wccr v5f2
medium System graph security Trivy conf 1.00 GHSA-pqhr-mp3f-hrpp: nuxt-og-image 5.1.13 — frontend/pnpm-lock.yaml
Nuxt OG Image vulnerable to Server-Side Request Forgery via user-controlled parameters **Product:** Nuxt OG Image **Version:** < 6.2.5 **CWE-ID:** [CWE-918](https://cwe.mitre.org/data/definitions/918.html): Server-Side Request Forgery ## Description The image generation endpoint (`/_og/d/`) acce…
VulnGhsa pqhr mp3f hrpp
medium System graph security Trivy conf 1.00 GHSA-wr4h-v87w-p3r7: h3 1.15.5 — frontend/pnpm-lock.yaml
h3 has a Path Traversal via Percent-Encoded Dot Segments in serveStatic Allows Arbitrary File Read ## Summary `serveStatic()` in h3 is vulnerable to path traversal via percent-encoded dot segments (`%2e%2e`), allowing an unauthenticated attacker to read arbitrary files outside the intended static…
VulnGhsa wr4h v87w p3r7
medium System graph cicd CI/CD security conf 1.00 GitHub Actions workflow grants broad write permissions
CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions.
.github/workflows/container.yaml CI/CD securitySupply chainGithub actions
medium System graph security Semgrep conf 1.00 insecure hash algorithm sha1 — backend/packages/harness/deerflow/config/paths.py:59
Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. Rule: python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 Severity: WARNING OWASP: A03:2017 - Se…
SecurityPython
medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in frontend/src/components/ai-elements/code-block.tsx:115
Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.
frontend/src/components/ai-elements/code-block.tsx:115 Dangerous innerhtml
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in frontend/public/demo/threads/5aa47db1-d0cb-4eb9-aea5-3dac1b371c5a/thread.json:471
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
frontend/public/demo/threads/5aa47db1-d0cb-4eb9-aea5-3dac1b371c5a/thread.json:471 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in frontend/public/demo/threads/5aa47db1-d0cb-4eb9-aea5-3dac1b371c5a/user-data/outputs/jiangsu-football/js/main.js:151
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
frontend/public/demo/threads/5aa47db1-d0cb-4eb9-aea5-3dac1b371c5a/user-data/outputs/jiangsu-football/js/main.js:151 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in skills/public/skill-creator/assets/eval_review.html:69
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
skills/public/skill-creator/assets/eval_review.html:69 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in skills/public/skill-creator/eval-viewer/viewer.html:766
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
skills/public/skill-creator/eval-viewer/viewer.html:766 Direct innerhtml assignment
medium System graph security Semgrep conf 1.00 missing internal — docker/nginx/nginx.conf:102
This location block contains a 'proxy_pass' directive but does not contain the 'internal' directive. The 'internal' directive restricts access to this location to internal requests. Without 'internal', an attacker could use your server for server-side request forgeries (SSRF). Include the 'internal…
SecurityNginx
medium System graph security Semgrep conf 1.00 missing internal — docker/nginx/nginx.conf:113
This location block contains a 'proxy_pass' directive but does not contain the 'internal' directive. The 'internal' directive restricts access to this location to internal requests. Without 'internal', an attacker could use your server for server-side request forgeries (SSRF). Include the 'internal…
SecurityNginx
medium System graph security Semgrep conf 1.00 missing internal — docker/nginx/nginx.conf:124
This location block contains a 'proxy_pass' directive but does not contain the 'internal' directive. The 'internal' directive restricts access to this location to internal requests. Without 'internal', an attacker could use your server for server-side request forgeries (SSRF). Include the 'internal…
SecurityNginx
medium System graph security Semgrep conf 1.00 missing internal — docker/nginx/nginx.conf:140
This location block contains a 'proxy_pass' directive but does not contain the 'internal' directive. The 'internal' directive restricts access to this location to internal requests. Without 'internal', an attacker could use your server for server-side request forgeries (SSRF). Include the 'internal…
SecurityNginx
medium System graph security Semgrep conf 1.00 missing internal — docker/nginx/nginx.conf:151
This location block contains a 'proxy_pass' directive but does not contain the 'internal' directive. The 'internal' directive restricts access to this location to internal requests. Without 'internal', an attacker could use your server for server-side request forgeries (SSRF). Include the 'internal…
SecurityNginx
medium System graph security Semgrep conf 1.00 missing internal — docker/nginx/nginx.conf:162
This location block contains a 'proxy_pass' directive but does not contain the 'internal' directive. The 'internal' directive restricts access to this location to internal requests. Without 'internal', an attacker could use your server for server-side request forgeries (SSRF). Include the 'internal…
SecurityNginx
medium System graph security Semgrep conf 1.00 missing internal — docker/nginx/nginx.conf:173
This location block contains a 'proxy_pass' directive but does not contain the 'internal' directive. The 'internal' directive restricts access to this location to internal requests. Without 'internal', an attacker could use your server for server-side request forgeries (SSRF). Include the 'internal…
SecurityNginx
medium System graph security Semgrep conf 1.00 missing internal — docker/nginx/nginx.conf:184
This location block contains a 'proxy_pass' directive but does not contain the 'internal' directive. The 'internal' directive restricts access to this location to internal requests. Without 'internal', an attacker could use your server for server-side request forgeries (SSRF). Include the 'internal…
SecurityNginx
medium System graph security Semgrep conf 1.00 missing internal — docker/nginx/nginx.conf:198
This location block contains a 'proxy_pass' directive but does not contain the 'internal' directive. The 'internal' directive restricts access to this location to internal requests. Without 'internal', an attacker could use your server for server-side request forgeries (SSRF). Include the 'internal…
SecurityNginx
medium System graph security Semgrep conf 1.00 missing internal — docker/nginx/nginx.conf:210
This location block contains a 'proxy_pass' directive but does not contain the 'internal' directive. The 'internal' directive restricts access to this location to internal requests. Without 'internal', an attacker could use your server for server-side request forgeries (SSRF). Include the 'internal…
SecurityNginx
medium System graph security Semgrep conf 1.00 missing internal — docker/nginx/nginx.conf:223
This location block contains a 'proxy_pass' directive but does not contain the 'internal' directive. The 'internal' directive restricts access to this location to internal requests. Without 'internal', an attacker could use your server for server-side request forgeries (SSRF). Include the 'internal…
SecurityNginx
medium System graph security Semgrep conf 1.00 missing internal — docker/nginx/nginx.conf:45
This location block contains a 'proxy_pass' directive but does not contain the 'internal' directive. The 'internal' directive restricts access to this location to internal requests. Without 'internal', an attacker could use your server for server-side request forgeries (SSRF). Include the 'internal…
SecurityNginx
medium System graph security Semgrep conf 1.00 missing internal — docker/nginx/nginx.conf:69
This location block contains a 'proxy_pass' directive but does not contain the 'internal' directive. The 'internal' directive restricts access to this location to internal requests. Without 'internal', an attacker could use your server for server-side request forgeries (SSRF). Include the 'internal…
SecurityNginx
medium System graph security Semgrep conf 1.00 missing internal — docker/nginx/nginx.conf:80
This location block contains a 'proxy_pass' directive but does not contain the 'internal' directive. The 'internal' directive restricts access to this location to internal requests. Without 'internal', an attacker could use your server for server-side request forgeries (SSRF). Include the 'internal…
SecurityNginx
medium System graph security Semgrep conf 1.00 missing internal — docker/nginx/nginx.conf:91
This location block contains a 'proxy_pass' directive but does not contain the 'internal' directive. The 'internal' directive restricts access to this location to internal requests. Without 'internal', an attacker could use your server for server-side request forgeries (SSRF). Include the 'internal…
SecurityNginx
medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — backend/packages/harness/deerflow/community/infoquest/infoquest_client.py:167
`requests.post(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — scripts/sync_labels.py:59
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — skills/public/image-generation/scripts/generate.py:173
`requests.post(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — skills/public/skill-creator/scripts/run_eval.py:85
`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
runtime safetyRobustness
medium System graph quality Placeholder conf 1.00 Placeholder or mock-heavy implementation detected
Found 78 placeholder/mock markers across 39 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data.
Mock dataIncompleteGenerated repo pattern
medium System graph security Skillspector conf 0.60 2 occurrences SkillSpector AST4 (behavioral-ast) in skills/public/data-analysis/scripts/analyze.py
subprocess.run([sys.executable, "-m", "pip", "install", "duckdb", "openpyxl", "-q"], check=True) subprocess module calls execute external commands. Without careful input validation, this enables command injection. Skill: data-analysis Rule: AST4 Category: behavioral-ast Severity: MEDIUM Confide…
lines 25, 31
skills/public/data-analysis/scripts/analyze.py:25, 31 (2 hits)
Mcp skillBehavioral astAst4
medium System graph security Skillspector conf 0.60 SkillSpector AST4 (behavioral-ast) in skills/public/skill-creator/eval-viewer/generate_review.py
result = subprocess.run( ["lsof", "-ti", f":{port}"], capture_output=True, text=True, timeout=5, ) subprocess module calls execute external commands. Without careful input validation, this enables command injection. Skill: skill-creator Rule: AST4 Category: behavi…
skills/public/skill-creator/eval-viewer/generate_review.py:291 Mcp skillBehavioral astAst4
medium System graph security Skillspector conf 0.60 SkillSpector AST4 (behavioral-ast) in skills/public/skill-creator/scripts/improve_description.py
result = subprocess.run( cmd, input=prompt, capture_output=True, text=True, env=env, timeout=timeout, ) subprocess module calls execute external commands. Without careful input validation, this enables command injection. Skill: skill-creator Rul…
skills/public/skill-creator/scripts/improve_description.py:35 Mcp skillBehavioral astAst4
medium System graph security Skillspector conf 0.60 SkillSpector AST4 (behavioral-ast) in skills/public/skill-creator/scripts/run_eval.py
process = subprocess.Popen( cmd, stdout=subprocess.PIPE, stderr=subprocess.DEVNULL, cwd=project_root, env=env, ) subprocess module calls execute external commands. Without careful input validation, this enables command injection. …
skills/public/skill-creator/scripts/run_eval.py:85 Mcp skillBehavioral astAst4
medium System graph security Skillspector conf 0.70 2 occurrences SkillSpector E1 (data-exfil) in skills/public/claude-to-deerflow/scripts/chat.sh
curl -s -X POST "${LANGGRAPH_URL}/threads" \ -H "Content-Type: application/json" \ -d Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: claude-to-deerflow Rule: E1 Category: data-exfil Severity: MEDIUM Co…
lines 36, 97
skills/public/claude-to-deerflow/scripts/chat.sh:36, 97 (2 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.70 SkillSpector E1 (data-exfil) in skills/public/claude-to-deerflow/scripts/status.sh
curl -s -X POST "${LANGGRAPH_URL}/threads/search" \ -H "Content-Type: application/json" \ -d Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: claude-to-deerflow Rule: E1 Category: data-exfil Severity:…
skills/public/claude-to-deerflow/scripts/status.sh:50 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 SkillSpector E1 (data-exfil) in skills/public/claude-to-deerflow/SKILL.md
curl calls, always resolve the URL like this: ```bash # Resolve base URLs from env (do this FIRST before any API call) DEERFLOW_URL="${DEERFLOW_URL:-http://localhost:2026}" DEERFLOW_GATEWAY_URL="${DE Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. M…
skills/public/claude-to-deerflow/SKILL.md:30 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.70 2 occurrences SkillSpector E1 (data-exfil) in skills/public/image-generation/scripts/generate.py
requests.post( "https:// Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: image-generation Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.70 Remediation: Verify the destination URL is trus…
lines 173
skills/public/image-generation/scripts/generate.py:173 (2 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.80 SkillSpector E1 (data-exfil) in skills/public/music-generation/scripts/generate.py
requests.post( f"{host}/v1/music_generation", headers={"Authorization": f"Bearer {api_key}", "Content-Type": "application/json"}, json= Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: musi…
skills/public/music-generation/scripts/generate.py:51 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.80 2 occurrences SkillSpector E1 (data-exfil) in skills/public/podcast-generation/scripts/generate.py
requests.post(url, json= Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: podcast-generation Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.80 Remediation: Verify the destination URL is trusted an…
lines 133, 185
skills/public/podcast-generation/scripts/generate.py:133, 185 (2 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.80 3 occurrences SkillSpector E1 (data-exfil) in skills/public/video-generation/scripts/generate.py
requests.post( f"{host}/v1/video_generation", headers={"Authorization": auth, "Content-Type": "application/json"}, json= Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: video-generation Ru…
lines 118, 162
skills/public/video-generation/scripts/generate.py:118, 162 (3 hits)
Mcp skillData exfilE1
medium System graph security Skillspector conf 0.85 SkillSpector EA1 (excessive-agency) in skills/public/image-generation/SKILL.md
tool:* Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution. Skill: image-generation Rule: EA1 Category: excessive-agency Severity: MEDIUM Confi…
skills/public/image-generation/SKILL.md:165 Mcp skillExcessive agencyEa1
medium System graph security Skillspector conf 0.80 SkillSpector EA1 (excessive-agency) in skills/public/systematic-literature-review/SKILL.md
Use any tool Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution. Skill: systematic-literature-review Rule: EA1 Category: excessive-agency Sever…
skills/public/systematic-literature-review/SKILL.md:97 Mcp skillExcessive agencyEa1
medium System graph security Skillspector conf 0.70 SkillSpector LP3 (mcp-least-priv) in skills/public/chart-visualization/SKILL.md
MCP Least Privilege Without declared permissions the skill's intent is opaque and cannot be validated. Skill: chart-visualization Rule: LP3 Category: mcp-least-priv Severity: MEDIUM Confidence: 0.70 Remediation: Add a 'permissions' field to SKILL.md listing the capabilities this skill requires.
skills/public/chart-visualization/SKILL.md:1 Mcp skillMcp least privLp3
medium System graph security Skillspector conf 0.70 SkillSpector LP3 (mcp-least-priv) in skills/public/claude-to-deerflow/SKILL.md
MCP Least Privilege Without declared permissions the skill's intent is opaque and cannot be validated. Skill: claude-to-deerflow Rule: LP3 Category: mcp-least-priv Severity: MEDIUM Confidence: 0.70 Remediation: Add a 'permissions' field to SKILL.md listing the capabilities this skill requires.
skills/public/claude-to-deerflow/SKILL.md:1 Mcp skillMcp least privLp3
medium System graph security Skillspector conf 0.70 SkillSpector LP3 (mcp-least-priv) in skills/public/data-analysis/SKILL.md
MCP Least Privilege Without declared permissions the skill's intent is opaque and cannot be validated. Skill: data-analysis Rule: LP3 Category: mcp-least-priv Severity: MEDIUM Confidence: 0.70 Remediation: Add a 'permissions' field to SKILL.md listing the capabilities this skill requires.
skills/public/data-analysis/SKILL.md:1 Mcp skillMcp least privLp3
medium System graph security Skillspector conf 0.70 SkillSpector LP3 (mcp-least-priv) in skills/public/github-deep-research/SKILL.md
MCP Least Privilege Without declared permissions the skill's intent is opaque and cannot be validated. Skill: github-deep-research Rule: LP3 Category: mcp-least-priv Severity: MEDIUM Confidence: 0.70 Remediation: Add a 'permissions' field to SKILL.md listing the capabilities this skill require…
skills/public/github-deep-research/SKILL.md:1 Mcp skillMcp least privLp3
medium System graph security Skillspector conf 0.70 SkillSpector LP3 (mcp-least-priv) in skills/public/image-generation/SKILL.md
MCP Least Privilege Without declared permissions the skill's intent is opaque and cannot be validated. Skill: image-generation Rule: LP3 Category: mcp-least-priv Severity: MEDIUM Confidence: 0.70 Remediation: Add a 'permissions' field to SKILL.md listing the capabilities this skill requires.
skills/public/image-generation/SKILL.md:1 Mcp skillMcp least privLp3
medium System graph security Skillspector conf 0.70 SkillSpector LP3 (mcp-least-priv) in skills/public/music-generation/SKILL.md
MCP Least Privilege Without declared permissions the skill's intent is opaque and cannot be validated. Skill: music-generation Rule: LP3 Category: mcp-least-priv Severity: MEDIUM Confidence: 0.70 Remediation: Add a 'permissions' field to SKILL.md listing the capabilities this skill requires.
skills/public/music-generation/SKILL.md:1 Mcp skillMcp least privLp3
medium System graph security Skillspector conf 0.70 SkillSpector LP3 (mcp-least-priv) in skills/public/podcast-generation/SKILL.md
MCP Least Privilege Without declared permissions the skill's intent is opaque and cannot be validated. Skill: podcast-generation Rule: LP3 Category: mcp-least-priv Severity: MEDIUM Confidence: 0.70 Remediation: Add a 'permissions' field to SKILL.md listing the capabilities this skill requires.
skills/public/podcast-generation/SKILL.md:1 Mcp skillMcp least privLp3
medium System graph security Skillspector conf 0.70 SkillSpector LP3 (mcp-least-priv) in skills/public/ppt-generation/SKILL.md
MCP Least Privilege Without declared permissions the skill's intent is opaque and cannot be validated. Skill: ppt-generation Rule: LP3 Category: mcp-least-priv Severity: MEDIUM Confidence: 0.70 Remediation: Add a 'permissions' field to SKILL.md listing the capabilities this skill requires.
skills/public/ppt-generation/SKILL.md:1 Mcp skillMcp least privLp3
medium System graph security Skillspector conf 0.70 SkillSpector LP3 (mcp-least-priv) in skills/public/skill-creator/SKILL.md
MCP Least Privilege Without declared permissions the skill's intent is opaque and cannot be validated. Skill: skill-creator Rule: LP3 Category: mcp-least-priv Severity: MEDIUM Confidence: 0.70 Remediation: Add a 'permissions' field to SKILL.md listing the capabilities this skill requires.
skills/public/skill-creator/SKILL.md:1 Mcp skillMcp least privLp3
medium System graph security Skillspector conf 0.70 SkillSpector LP3 (mcp-least-priv) in skills/public/systematic-literature-review/SKILL.md
MCP Least Privilege Without declared permissions the skill's intent is opaque and cannot be validated. Skill: systematic-literature-review Rule: LP3 Category: mcp-least-priv Severity: MEDIUM Confidence: 0.70 Remediation: Add a 'permissions' field to SKILL.md listing the capabilities this skill…
skills/public/systematic-literature-review/SKILL.md:1 Mcp skillMcp least privLp3
medium System graph security Skillspector conf 0.70 SkillSpector LP3 (mcp-least-priv) in skills/public/vercel-deploy-claimable/SKILL.md
MCP Least Privilege Without declared permissions the skill's intent is opaque and cannot be validated. Skill: vercel-deploy Rule: LP3 Category: mcp-least-priv Severity: MEDIUM Confidence: 0.70 Remediation: Add a 'permissions' field to SKILL.md listing the capabilities this skill requires.
skills/public/vercel-deploy-claimable/SKILL.md:1 Mcp skillMcp least privLp3
medium System graph security Skillspector conf 0.70 SkillSpector LP3 (mcp-least-priv) in skills/public/video-generation/SKILL.md
MCP Least Privilege Without declared permissions the skill's intent is opaque and cannot be validated. Skill: video-generation Rule: LP3 Category: mcp-least-priv Severity: MEDIUM Confidence: 0.70 Remediation: Add a 'permissions' field to SKILL.md listing the capabilities this skill requires.
skills/public/video-generation/SKILL.md:1 Mcp skillMcp least privLp3
medium System graph security Skillspector conf 0.65 SkillSpector RA2 (rogue-agent) in skills/public/skill-creator/SKILL.md
nohup Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction. Skill: skill-creator Rule: RA2 Category: rogue-agent Severity: MEDIUM Confidence: 0.65 Reme…
skills/public/skill-creator/SKILL.md:238 Mcp skillRogue agentRa2
medium System graph security Skillspector conf 0.60 2 occurrences SkillSpector TT2 (taint) in skills/public/video-generation/scripts/generate.py
response = requests.get( f"{host}/v1/query/video_generation", headers={"Authorization": auth}, params={"task_id": task_id}, timeout=30, Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint fl…
lines 62, 172
skills/public/video-generation/scripts/generate.py:62, 172 (2 hits)
Mcp skillTaintTt2
low Security checks cicd CI/CD security conf 0.72 .dockerignore misses sensitive defaults
Add missing patterns such as .env, .git, private keys, certificates, dependency folders, and local databases.
.dockerignore CI/CD securitycontainers
high Security checks cicd CI/CD security conf 0.56 3 occurrences Compose service does not declare a runtime user
Set a non-root `user:` in Compose or ensure the final image stage has a non-root USER directive.
lines 45, 64, 124
docker/docker-compose.yaml:45, 64, 124 (3 hits)
CI/CD securitycontainers
high Security checks cicd CI/CD security conf 0.62 3 occurrences Compose service lacks no-new-privileges hardening
Add `security_opt: ["no-new-privileges:true"]` unless the service has a documented need for privilege escalation.
lines 45, 64, 124
docker/docker-compose.yaml:45, 64, 124 (3 hits)
CI/CD securitycontainers
low Security checks cicd CI/CD security conf 0.72 Dockerfile installs recommended OS packages
Add `--no-install-recommends` and explicitly list only packages the image needs.
backend/Dockerfile:27 CI/CD securitycontainers
low Security checks quality Quality conf 0.60 12 occurrences Duplicated implementation block across source files
Duplicate implementation blocks are maintenance debt. Keep them visible, but they are not a high-severity defect unless the duplicated logic is security-sensitive or drifting.
11 files, 12 locations
backend/packages/harness/deerflow/community/firecrawl/tools.py:23, 32 (2 hits)
backend/app/gateway/routers/thread_runs.py:358
backend/packages/harness/deerflow/agents/middlewares/todo_middleware.py:250
backend/packages/harness/deerflow/community/fastcrw/tools.py:42
backend/packages/harness/deerflow/models/patched_stepfun.py:73
backend/packages/harness/deerflow/runtime/runs/store/base.py:67
frontend/src/app/api/memory/route.ts:1
frontend/src/app/blog/tags/[tag]/page.tsx:29
duplicationquality
low Security checks cicd CI/CD security conf 0.90 ✓ Repobility 44 occurrences GitHub Action is tag-pinned rather than SHA-pinned
[MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party actio…
9 files, 44 locations
.github/workflows/container.yaml:22, 50, 69, 97 (8 hits)
.github/workflows/e2e-tests.yml:30, 33, 58 (6 hits)
.github/workflows/lint-check.yml:16, 19, 42, 45 (6 hits)
.github/workflows/triage.yml:41, 150, 195 (6 hits)
.github/workflows/backend-blocking-io-tests.yml:30, 33 (4 hits)
.github/workflows/backend-unit-tests.yml:24, 27 (4 hits)
.github/workflows/frontend-unit-tests.yml:24, 27 (4 hits)
.github/workflows/replay-e2e.yml:55, 75, 84, 101 (4 hits)
CI/CD securitySupply chainGitHub Actions
low System graph quality Maintenance conf 1.00 71 TODO/FIXME markers
High count of TODO/FIXME/HACK markers — track them as issues so they're not forgotten.
low System graph quality Integrity conf 1.00 77 env vars used in code but missing from .env.example
Drift between code and config docs. The first few: `ANTHROPIC_AUTH_TOKEN`, `ANTHROPIC_BILLING_HEADER`, `AUTH_JWT_SECRET`, `AUTH_TRUSTED_PROXIES`, `BRAVE_SEARCH_API_KEY`, `CI`, `CLAUDE_CODE_CREDENTIALS_PATH`, `CLAUDE_CODE_CUSTOM_OAUTH_URL` + 69 more. Add them (with a placeholder/comment) to .env.exa…
config drift
low System graph security Trivy conf 1.00 CVE-2026-31873: unhead 2.1.4 — frontend/pnpm-lock.yaml
Unhead Vulnerable to Bypass of URI Scheme Sanitization in makeTagSafe via Case-Sensitivity Unhead is a document head and template manager. Prior to 2.1.11, The link.href check in makeTagSafe (safe.ts) uses String.includes(), which is case-sensitive. Browsers treat URI schemes case-insensitively. D…
VulnCve 2026 31873
low System graph quality Debug conf 1.00 Debug logging residue appears in source files
Found 392 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup.
CleanupRepo hardeningGenerated repo pattern
low System graph hardware Supply chain conf 1.00 2 occurrences Docker base image is tag-pinned but not digest-pinned: node:22-alpine
Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.
lines 10, 38
frontend/Dockerfile:10, 38 (2 hits)
containersPinned dependencies

Showing first 300 of 441. Refine filters or use the findings page for deep search.

For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/807f94d4-7f47-4a02-a602-6d896352cac6/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/807f94d4-7f47-4a02-a602-6d896352cac6/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.