{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-bead75b0f9233e05", "name": "No API endpoints detected", "shortDescription": {"text": "No API endpoints detected"}, "fullDescription": {"text": "The scanner did not find FastAPI/Flask/Express/NestJS/GraphQL/gRPC routes. If this repo exposes APIs, the framework may be unsupported."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "info", "confidence": 1.0}}, {"id": "scanner-25ae54b78054dfd6", "name": "TODO/FIXME marker in shipping code \u2014 packages/mcp/src/hub-bridge.js:100", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 packages/mcp/src/hub-bridge.js:100"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-8b38cf8a4086a10f", "name": "Debug `console.log` remains in browser-facing code \u2014 packages/ui/vite.config.js:11", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 packages/ui/vite.config.js:11"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-d2438aae301bafa0", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 packages/website/src/components/HighlightSyntax.tsx:172", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 packages/website/src/components/HighlightSyntax.tsx:172"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 0.8}}, {"id": "scanner-3422abcfc405290b", "name": "Truncated text has no discoverable full-value affordance \u2014 packages/website/src/pages/home/FeaturesSection.tsx:57", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 packages/website/src/pages/home/FeaturesSection.tsx:57"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-ce4dd1d9fe3bc54b", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 packages/website/src/pages/home/HeroSection.tsx:306", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 packages/website/src/pages/home/HeroSection.tsx:306"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 0.8}}, {"id": "scanner-a146018427c24e9e", "name": "TODO/FIXME marker in shipping code \u2014 packages/page-controller/src/actions.ts:85", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 packages/page-controller/src/actions.ts:85"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-2d2fee61442b27d5", "name": "Debug `console.log` remains in browser-facing code \u2014 packages/page-controller/src/actions.ts:391", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 packages/page-controller/src/actions.ts:391"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-1265c2bdd8d4a812", "name": "Debug `console.log` remains in browser-facing code \u2014 packages/page-controller/src/PageController.ts:225", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 packages/page-controller/src/PageController.ts:225"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-4f308e968e31cfc5", "name": "TODO/FIXME marker in shipping code \u2014 packages/page-controller/src/dom/index.ts:39", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 packages/page-controller/src/dom/index.ts:39"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-743b11d31683e42b", "name": "Truncated text has no discoverable full-value affordance \u2014 packages/extension/src/components/HistoryDetail.tsx:39", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 packages/extension/src/components/HistoryDetail.tsx:39"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-a591adc0396825da", "name": "Truncated text has no discoverable full-value affordance \u2014 packages/extension/src/components/HistoryList.tsx:140", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 packages/extension/src/components/HistoryList.tsx:140"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-186568090cf30877", "name": "Debug `console.log` remains in browser-facing code \u2014 packages/extension/src/entrypoints/content.ts:28", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 packages/extension/src/entrypoints/content.ts:28"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-4554fb6c0fc78246", "name": "Debug `console.log` remains in browser-facing code \u2014 packages/extension/src/entrypoints/sidepanel/App.tsx:83", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 packages/extension/src/entrypoints/sidepanel/App.tsx:83"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-392d60fb51c36320", "name": "TODO/FIXME marker in shipping code \u2014 packages/core/src/utils/autoFixer.ts:63", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 packages/core/src/utils/autoFixer.ts:63"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-14b68829a6f8edbc", "name": "Debug `console.log` remains in browser-facing code \u2014 packages/page-agent/src/demo.ts:18", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 packages/page-agent/src/demo.ts:18"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-781a1cd7ce62b70b", "name": "react dangerouslysetinnerhtml \u2014 packages/website/src/components/HighlightSyntax.tsx:172", "shortDescription": {"text": "react dangerouslysetinnerhtml \u2014 packages/website/src/components/HighlightSyntax.tsx:172"}, "fullDescription": {"text": "Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HTML.\n\nRule: typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml\nSeverity: WARNING\nOWASP: A07:2017 - Cross-Site Scripting (XSS), A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-dea3eea0aa30fc7a", "name": "detect child process \u2014 scripts/ci.js:19", "shortDescription": {"text": "detect child process \u2014 scripts/ci.js:19"}, "fullDescription": {"text": "Detected calls to child_process from a function argument `command`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed.\n\nRule: javascript.lang.security.detect-child-process.detect-child-process\nSeverity: ERROR\nOWASP: A01:2017 - Injection, A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-e3e595e49e70a47b", "name": "GHSA-frvp-7c67-39w9: @hono/node-server 1.19.14 \u2014 package-lock.json", "shortDescription": {"text": "GHSA-frvp-7c67-39w9: @hono/node-server 1.19.14 \u2014 package-lock.json"}, "fullDescription": {"text": "Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)\n\nThe same as the `hono` core [Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)](https://github.com/honojs/hono/security/advisories/GHSA-wwfh-h76j-fc44).\n\n### Summary\n\nOn Windows hosts, an encoded backslash (`%5C`) in the request path decodes to `\\`, which the Windows path resolver treats as a separator. `serve-static` then resolves a single URL segment such as `admin\\secret.txt` into a nested file under the root and serves it, letting an attacker read static files meant t\n\nPackage: @hono/node-server\nInstalled: 1.19.14\nFixed in: 2.0.5\nSeverity: MEDIUM\nFix: Upgrade @hono/node-server to 2.0.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2679282aa1c484b5", "name": "Agent authority lacks a verifier contract: AGENTS.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: AGENTS.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e725d2ab884fbd49", "name": "Multiple root agent instruction files without precedence", "shortDescription": {"text": "Multiple root agent instruction files without precedence"}, "fullDescription": {"text": "The repo has multiple top-level AI-coder instruction files. Without precedence rules, different agents may follow different policies."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-173b294d31b8cf91", "name": "SkillSpector E1 (data-exfil) in docs/developer-guide.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in docs/developer-guide.md"}, "fullDescription": {"text": "https://api.your-llm-provider.com/\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: unknown\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.50\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.5}}, {"id": "scanner-eb032d208ba2e8d2", "name": "SkillSpector E1 (data-exfil) in packages/extension/docs/extension_api.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in packages/extension/docs/extension_api.md"}, "fullDescription": {"text": "https://api.openai.com/\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: unknown\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.50\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.5}}, {"id": "scanner-658d9107d8bcb9c5", "name": "SkillSpector E1 (data-exfil) in packages/extension/src/components/ConfigPanel.tsx", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in packages/extension/src/components/ConfigPanel.tsx"}, "fullDescription": {"text": "https://api.openai.com/\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: unknown\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.50\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.5}}, {"id": "scanner-142c77e944dfd90a", "name": "SkillSpector E1 (data-exfil) in packages/website/src/pages/docs/advanced/custom-ui/page.tsx", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in packages/website/src/pages/docs/advanced/custom-ui/page.tsx"}, "fullDescription": {"text": "https://api.openai.com/\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: unknown\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.50\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.5}}, {"id": "scanner-e7c99897fc727928", "name": "SkillSpector E1 (data-exfil) in packages/website/src/pages/docs/advanced/page-agent-core/page.tsx", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in packages/website/src/pages/docs/advanced/page-agent-core/page.tsx"}, "fullDescription": {"text": "https://api.openai.com/\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: unknown\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.50\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.5}}, {"id": "scanner-cf70e64675087cdd", "name": "SkillSpector E1 (data-exfil) in packages/website/src/pages/docs/advanced/page-agent/page.tsx", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in packages/website/src/pages/docs/advanced/page-agent/page.tsx"}, "fullDescription": {"text": "https://api.openai.com/\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: unknown\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.50\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.5}}, {"id": "scanner-56473851be37c434", "name": "SkillSpector E1 (data-exfil) in packages/website/src/pages/docs/advanced/page-controller/page.tsx", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in packages/website/src/pages/docs/advanced/page-controller/page.tsx"}, "fullDescription": {"text": "https://api.openai.com/\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: unknown\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.50\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.5}}, {"id": "scanner-db8254ddb84d38c6", "name": "SkillSpector E1 (data-exfil) in packages/website/src/pages/docs/features/chrome-extension/page.tsx", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in packages/website/src/pages/docs/features/chrome-extension/page.tsx"}, "fullDescription": {"text": "https://api.openai.com/\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: unknown\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.50\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.5}}, {"id": "scanner-08e33abd54329d9e", "name": "SkillSpector E1 (data-exfil) in packages/website/src/pages/docs/features/mcp-server/page.tsx", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in packages/website/src/pages/docs/features/mcp-server/page.tsx"}, "fullDescription": {"text": "https://api.openai.com/\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: unknown\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.50\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.5}}, {"id": "scanner-d3988df48e3c87ca", "name": "SkillSpector EA2 (excessive-agency) in .agents/skills/pre-impl-discussion/SKILL.md", "shortDescription": {"text": "SkillSpector EA2 (excessive-agency) in .agents/skills/pre-impl-discussion/SKILL.md"}, "fullDescription": {"text": "without checking\n\nSkill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.\n\nSkill: unknown\nRule: EA2  Category: excessive-agency\nSeverity: MEDIUM  Confidence: 0.75\n\nRemediation: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.75}}, {"id": "scanner-f3321f3de07fb846", "name": "SkillSpector EA3 (excessive-agency) in LICENSE", "shortDescription": {"text": "SkillSpector EA3 (excessive-agency) in LICENSE"}, "fullDescription": {"text": "NOT LIMITED TO\n\nSkill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.\n\nSkill: unknown\nRule: EA3  Category: excessive-agency\nSeverity: LOW  Confidence: 0.70\n\nRemediation: Limit the skill's scope to its documented purpose. Remove instructions that enable the agent to perform actions outside its stated functionality."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.7}}, {"id": "scanner-4fb881ae6770e008", "name": "SkillSpector EA2 (excessive-agency) in packages/core/src/types.ts", "shortDescription": {"text": "SkillSpector EA2 (excessive-agency) in packages/core/src/types.ts"}, "fullDescription": {"text": "never ask user\n\nSkill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.\n\nSkill: unknown\nRule: EA2  Category: excessive-agency\nSeverity: MEDIUM  Confidence: 0.80\n\nRemediation: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.8}}, {"id": "scanner-f64976cf9612339c", "name": "SkillSpector EA1 (excessive-agency) in packages/core/src/utils/autoFixer.ts", "shortDescription": {"text": "SkillSpector EA1 (excessive-agency) in packages/core/src/utils/autoFixer.ts"}, "fullDescription": {"text": "tools:\n *\n\nSkill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.\n\nSkill: unknown\nRule: EA1  Category: excessive-agency\nSeverity: MEDIUM  Confidence: 0.85\n\nRemediation: Restrict tool access to only the tools required for the skill's stated purpose. Use an explicit allowlist rather than granting blanket access."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-43109dfc2afdfef9", "name": "SkillSpector EA2 (excessive-agency) in packages/extension/src/entrypoints/hub/App.tsx", "shortDescription": {"text": "SkillSpector EA2 (excessive-agency) in packages/extension/src/entrypoints/hub/App.tsx"}, "fullDescription": {"text": "Auto-approve\n\nSkill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.\n\nSkill: unknown\nRule: EA2  Category: excessive-agency\nSeverity: MEDIUM  Confidence: 0.85\n\nRemediation: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-b4381fda944e0153", "name": "SkillSpector MP3 (memory-poisoning) in packages/extension/src/components/HistoryList.tsx", "shortDescription": {"text": "SkillSpector MP3 (memory-poisoning) in packages/extension/src/components/HistoryList.tsx"}, "fullDescription": {"text": "Delete history\n\nSkill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.\n\nSkill: unknown\nRule: MP3  Category: memory-poisoning\nSeverity: HIGH  Confidence: 0.80\n\nRemediation: Protect agent memory and state from modification by untrusted content. Use read-only memory for critical instructions and validate all state changes."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.8}}, {"id": "scanner-64a880a34a45632c", "name": "SkillSpector MP3 (memory-poisoning) in packages/page-controller/src/dom/index.ts", "shortDescription": {"text": "SkillSpector MP3 (memory-poisoning) in packages/page-controller/src/dom/index.ts"}, "fullDescription": {"text": "clear context\n\nSkill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.\n\nSkill: unknown\nRule: MP3  Category: memory-poisoning\nSeverity: HIGH  Confidence: 0.80\n\nRemediation: Protect agent memory and state from modification by untrusted content. Use read-only memory for critical instructions and validate all state changes."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.8}}, {"id": "scanner-1644fc0149606f13", "name": "SkillSpector MP3 (memory-poisoning) in packages/ui/src/panel/Panel.ts", "shortDescription": {"text": "SkillSpector MP3 (memory-poisoning) in packages/ui/src/panel/Panel.ts"}, "fullDescription": {"text": "Reset state\n\nSkill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.\n\nSkill: unknown\nRule: MP3  Category: memory-poisoning\nSeverity: HIGH  Confidence: 0.80\n\nRemediation: Protect agent memory and state from modification by untrusted content. Use read-only memory for critical instructions and validate all state changes."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.8}}, {"id": "scanner-b9bcf74013e3c3d0", "name": "SkillSpector OH1 (output-handling) in packages/website/src/components/HighlightSyntax.tsx", "shortDescription": {"text": "SkillSpector OH1 (output-handling) in packages/website/src/components/HighlightSyntax.tsx"}, "fullDescription": {"text": "dangerouslySetInnerHTML={\n\nModel output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.\n\nSkill: unknown\nRule: OH1  Category: output-handling\nSeverity: HIGH  Confidence: 0.65\n\nRemediation: Validate and sanitize all model output before using it in downstream contexts. Use parameterized queries for SQL, shell quoting for commands, and HTML encoding for web output."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.65}}, {"id": "scanner-3805836deb22b475", "name": "SkillSpector OH1 (output-handling) in packages/website/src/pages/home/HeroSection.tsx", "shortDescription": {"text": "SkillSpector OH1 (output-handling) in packages/website/src/pages/home/HeroSection.tsx"}, "fullDescription": {"text": "dangerouslySetInnerHTML={\n\nModel output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.\n\nSkill: unknown\nRule: OH1  Category: output-handling\nSeverity: HIGH  Confidence: 0.65\n\nRemediation: Validate and sanitize all model output before using it in downstream contexts. Use parameterized queries for SQL, shell quoting for commands, and HTML encoding for web output."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.65}}, {"id": "scanner-bf87f6bb3d30fdde", "name": "SkillSpector PE3 (priv-esc) in .agents/skills/submit-pr-from-current-changes/SKILL.md", "shortDescription": {"text": "SkillSpector PE3 (priv-esc) in .agents/skills/submit-pr-from-current-changes/SKILL.md"}, "fullDescription": {"text": "keyring\n\nCode accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.\n\nSkill: unknown\nRule: PE3  Category: priv-esc\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-229f707a83cf092b", "name": "SkillSpector PE3 (priv-esc) in packages/llms/src/models.live.test.ts", "shortDescription": {"text": "SkillSpector PE3 (priv-esc) in packages/llms/src/models.live.test.ts"}, "fullDescription": {"text": ".env'\n\nCode accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.\n\nSkill: unknown\nRule: PE3  Category: priv-esc\nSeverity: HIGH  Confidence: 0.60\n\nRemediation: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.6}}, {"id": "scanner-7c93a954e14c6bea", "name": "SkillSpector PE3 (priv-esc) in packages/mcp/src/index.js", "shortDescription": {"text": "SkillSpector PE3 (priv-esc) in packages/mcp/src/index.js"}, "fullDescription": {"text": ".env\n\nCode accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.\n\nSkill: unknown\nRule: PE3  Category: priv-esc\nSeverity: HIGH  Confidence: 0.60\n\nRemediation: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.6}}, {"id": "scanner-341dd5f4c88b84b1", "name": "SkillSpector PE3 (priv-esc) in packages/page-agent/vite.iife.config.js", "shortDescription": {"text": "SkillSpector PE3 (priv-esc) in packages/page-agent/vite.iife.config.js"}, "fullDescription": {"text": ".env\n\nCode accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.\n\nSkill: unknown\nRule: PE3  Category: priv-esc\nSeverity: HIGH  Confidence: 0.60\n\nRemediation: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.6}}, {"id": "scanner-e365f31893c5b5b4", "name": "SkillSpector PE3 (priv-esc) in packages/website/vite.config.js", "shortDescription": {"text": "SkillSpector PE3 (priv-esc) in packages/website/vite.config.js"}, "fullDescription": {"text": ".env\n\nCode accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.\n\nSkill: unknown\nRule: PE3  Category: priv-esc\nSeverity: HIGH  Confidence: 0.60\n\nRemediation: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.6}}, {"id": "scanner-2d8990f170e3c57f", "name": "SkillSpector P2 (prompt-injection) in README.md", "shortDescription": {"text": "SkillSpector P2 (prompt-injection) in README.md"}, "fullDescription": {"text": "<!-- demo video -->\n\n[![Watch the demo](https://page-agent.github.io/assets/readme/poster.jpg)](https://github.com/user-attachments/assets/a1f2eae2-13fb-4aae-98cf-a3fc1620a6c2)\n\n---\n\n## \u2728 Features\n\n-\n\nHidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.\n\nSkill: unknown\nRule: P2  Category: prompt-injection\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-1474af525032cfbf", "name": "SkillSpector SC1 (supply-chain) in package.json", "shortDescription": {"text": "SkillSpector SC1 (supply-chain) in package.json"}, "fullDescription": {"text": "\"npm\": \"^11.6.3\"\n\nDependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.\n\nSkill: unknown\nRule: SC1  Category: supply-chain\nSeverity: LOW  Confidence: 0.40\n\nRemediation: Pin all dependency versions in requirements.txt or pyproject.toml. Use exact versions (==) or compatible ranges. Run pip-audit regularly."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.4}}, {"id": "scanner-1d21f6184c0f0117", "name": "SkillSpector SC1 (supply-chain) in packages/core/package.json", "shortDescription": {"text": "SkillSpector SC1 (supply-chain) in packages/core/package.json"}, "fullDescription": {"text": "\"chalk\": \"^5.6.2\"\n\nDependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.\n\nSkill: unknown\nRule: SC1  Category: supply-chain\nSeverity: LOW  Confidence: 0.40\n\nRemediation: Pin all dependency versions in requirements.txt or pyproject.toml. Use exact versions (==) or compatible ranges. Run pip-audit regularly."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.4}}, {"id": "scanner-3e965a72f527e217", "name": "SkillSpector SC1 (supply-chain) in packages/extension/package.json", "shortDescription": {"text": "SkillSpector SC1 (supply-chain) in packages/extension/package.json"}, "fullDescription": {"text": "\"@radix-ui/react-hover-card\": \"^1.1.20\"\n\nDependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.\n\nSkill: unknown\nRule: SC1  Category: supply-chain\nSeverity: LOW  Confidence: 0.40\n\nRemediation: Pin all dependency versions in requirements.txt or pyproject.toml. Use exact versions (==) or compatible ranges. Run pip-audit regularly."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.4}}, {"id": "scanner-611655fab6744d2c", "name": "SkillSpector SC3 (supply-chain) in packages/extension/wxt.config.js", "shortDescription": {"text": "SkillSpector SC3 (supply-chain) in packages/extension/wxt.config.js"}, "fullDescription": {"text": "'MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqbzT0iTYeYlnCvDJIGDnGU8oarJgZILDzSfLi/ufuSxXEPDKuMyD892GhvrMCZNVHS11Sh6NYUOc/PcUOhtaR2urHtcNkrpSJNV10zUamY7fxBdVEkOucfyLu8INVy+teis62MoRWYPaUPkfZUjrLGW8MsZ\n\nCode contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.\n\nSkill: unknown\nRule: SC3  Category: supply-chain\nSeverity: HIGH  Confidence: 0.50\n\nRemediation: Remove obfuscated code. Use plain, readable implementations. Obfuscation hinders security review and raises trust concerns."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.5}}, {"id": "scanner-d340acce748939b5", "name": "SkillSpector SC1 (supply-chain) in packages/llms/package.json", "shortDescription": {"text": "SkillSpector SC1 (supply-chain) in packages/llms/package.json"}, "fullDescription": {"text": "\"chalk\": \"^5.6.2\"\n\nDependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.\n\nSkill: unknown\nRule: SC1  Category: supply-chain\nSeverity: LOW  Confidence: 0.40\n\nRemediation: Pin all dependency versions in requirements.txt or pyproject.toml. Use exact versions (==) or compatible ranges. Run pip-audit regularly."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.4}}, {"id": "scanner-502c4764eb98c339", "name": "SkillSpector SC1 (supply-chain) in packages/mcp/package.json", "shortDescription": {"text": "SkillSpector SC1 (supply-chain) in packages/mcp/package.json"}, "fullDescription": {"text": "\"@modelcontextprotocol/sdk\": \"^1.29.0\"\n\nDependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.\n\nSkill: unknown\nRule: SC1  Category: supply-chain\nSeverity: LOW  Confidence: 0.40\n\nRemediation: Pin all dependency versions in requirements.txt or pyproject.toml. Use exact versions (==) or compatible ranges. Run pip-audit regularly."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.4}}, {"id": "scanner-e63dda75152b7dab", "name": "SkillSpector SC1 (supply-chain) in packages/page-agent/package.json", "shortDescription": {"text": "SkillSpector SC1 (supply-chain) in packages/page-agent/package.json"}, "fullDescription": {"text": "\"chalk\": \"^5.6.2\"\n\nDependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.\n\nSkill: unknown\nRule: SC1  Category: supply-chain\nSeverity: LOW  Confidence: 0.40\n\nRemediation: Pin all dependency versions in requirements.txt or pyproject.toml. Use exact versions (==) or compatible ranges. Run pip-audit regularly."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.4}}, {"id": "scanner-83eee600dabdd0a7", "name": "SkillSpector SC1 (supply-chain) in packages/page-controller/package.json", "shortDescription": {"text": "SkillSpector SC1 (supply-chain) in packages/page-controller/package.json"}, "fullDescription": {"text": "\"ai-motion\": \"^0.4.8\"\n\nDependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.\n\nSkill: unknown\nRule: SC1  Category: supply-chain\nSeverity: LOW  Confidence: 0.40\n\nRemediation: Pin all dependency versions in requirements.txt or pyproject.toml. Use exact versions (==) or compatible ranges. Run pip-audit regularly."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.4}}, {"id": "scanner-ba424746a730457c", "name": "SkillSpector SC1 (supply-chain) in packages/website/package.json", "shortDescription": {"text": "SkillSpector SC1 (supply-chain) in packages/website/package.json"}, "fullDescription": {"text": "\"@radix-ui/react-icons\": \"^1.3.2\"\n\nDependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.\n\nSkill: unknown\nRule: SC1  Category: supply-chain\nSeverity: LOW  Confidence: 0.40\n\nRemediation: Pin all dependency versions in requirements.txt or pyproject.toml. Use exact versions (==) or compatible ranges. Run pip-audit regularly."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.4}}, {"id": "scanner-c48d54072d7b9202", "name": "SkillSpector SC6 (supply-chain) in package.json", "shortDescription": {"text": "SkillSpector SC6 (supply-chain) in package.json"}, "fullDescription": {"text": "vite\n\nPackage name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.\n\nSkill: unknown\nRule: SC6  Category: supply-chain\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Verify the package name is correct and not a typosquatting variant. Compare against the official package name on PyPI or npm."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-a5ccf6898289f2e2", "name": "SkillSpector SC6 (supply-chain) in packages/extension/package.json", "shortDescription": {"text": "SkillSpector SC6 (supply-chain) in packages/extension/package.json"}, "fullDescription": {"text": "wxt\n\nPackage name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.\n\nSkill: unknown\nRule: SC6  Category: supply-chain\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Verify the package name is correct and not a typosquatting variant. Compare against the official package name on PyPI or npm."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-a13ae2f2507d2fc5", "name": "SkillSpector P6 (prompt-injection) in packages/core/src/PageAgentCore.ts", "shortDescription": {"text": "SkillSpector P6 (prompt-injection) in packages/core/src/PageAgentCore.ts"}, "fullDescription": {"text": "return prompt\n\nSkill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.\n\nSkill: unknown\nRule: P6  Category: prompt-injection\nSeverity: HIGH  Confidence: 0.85\n\nRemediation: Remove any instructions that reveal, print, or output system prompts or internal rules. System instructions should never be exposed to end users."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.85}}, {"id": "scanner-0320fd7907296091", "name": "SkillSpector P6 (prompt-injection) in packages/website/src/components/JSConsole.tsx", "shortDescription": {"text": "SkillSpector P6 (prompt-injection) in packages/website/src/components/JSConsole.tsx"}, "fullDescription": {"text": "return prompt\n\nSkill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.\n\nSkill: unknown\nRule: P6  Category: prompt-injection\nSeverity: HIGH  Confidence: 0.85\n\nRemediation: Remove any instructions that reveal, print, or output system prompts or internal rules. System instructions should never be exposed to end users."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.85}}, {"id": "scanner-30f40fe66cf31409", "name": "SkillSpector TM1 (tool-misuse) in .husky/pre-commit", "shortDescription": {"text": "SkillSpector TM1 (tool-misuse) in .husky/pre-commit"}, "fullDescription": {"text": "--allow-empty\n\nTool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).\n\nSkill: unknown\nRule: TM1  Category: tool-misuse\nSeverity: HIGH  Confidence: 0.65\n\nRemediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.65}}, {"id": "scanner-7cbbdcade7d3ae01", "name": "SkillSpector TM1 (tool-misuse) in package-lock.json", "shortDescription": {"text": "SkillSpector TM1 (tool-misuse) in package-lock.json"}, "fullDescription": {"text": "RMtmw0iFkeR4YV+fUOSucriAQNb9g8zFR52MWCtl+cCZOFRNL6zeB395vPzFhEjjn4fMxXudmELnl/KF/\n\nTool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).\n\nSkill: unknown\nRule: TM1  Category: tool-misuse\nSeverity: HIGH  Confidence: 0.85\n\nRemediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.85}}, {"id": "scanner-41c2d611910e2f24", "name": "SkillSpector TM1 (tool-misuse) in package.json", "shortDescription": {"text": "SkillSpector TM1 (tool-misuse) in package.json"}, "fullDescription": {"text": "rm -rf packages/*/dist && rm -rf packages/*/\n\nTool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).\n\nSkill: unknown\nRule: TM1  Category: tool-misuse\nSeverity: HIGH  Confidence: 0.85\n\nRemediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.85}}, {"id": "scanner-a3004f92aa51c8a1", "name": "SkillSpector TM2 (tool-misuse) in package.json", "shortDescription": {"text": "SkillSpector TM2 (tool-misuse) in package.json"}, "fullDescription": {"text": "&& rm -\n\nTool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.\n\nSkill: unknown\nRule: TM2  Category: tool-misuse\nSeverity: HIGH  Confidence: 0.75\n\nRemediation: Limit tool chaining depth and validate the output of each tool before passing it to the next. Require explicit user approval for multi-step chains."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.75}}, {"id": "scanner-e637c415447867e4", "name": "Run SkillSpector's LLM-backed analysis in your own pipeline", "shortDescription": {"text": "Run SkillSpector's LLM-backed analysis in your own pipeline"}, "fullDescription": {"text": "Repobility ran SkillSpector's static rules server-side. The deeper LLM-backed analyzers \u2014 tool-poisoning (TP*), semantic security discovery (SSD*), developer-intent mismatch (SDI*) \u2014 are meant to run on YOUR machine with YOUR model; repobility never sends your code to an LLM. Recipe:\n\n# 1. Install SkillSpector in your own isolated env\npipx install \"skillspector @ git+https://github.com/NVIDIA/SkillSpector.git\"\n\n# 2. Point it at YOUR LLM pipeline (pick one) - your code stays on your machine\nexport SKILLSPECTOR_PROVIDER=anthropic && export ANTHROPIC_API_KEY=sk-ant-...\n# export SKILLSPECTOR_PROVIDER=openai   && export OPENAI_API_KEY=sk-...\n# export SKILLSPECTOR_PROVIDER=openai OPENAI_API_KEY=ollama OPENAI_BASE_URL=http://localhost:11434/v1 SKILLSPECTOR_MODEL=llama3.1:8b\n# export SKILLSPECTOR_PROVIDER=nv_build && export NVIDIA_INFERENCE_KEY=nvapi-...\n\n# 3. Run the LLM-backed scan per skill (omit --no-llm to enable the LLM analyzers)\nskillspector scan . --format sarif --output skillspector-"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "info", "confidence": 1.0}}, {"id": "scanner-672915cf0507cfcc", "name": "Insecure pattern 'node_child_process' in scripts/build.js:12", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/build.js:12"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.9}}, {"id": "scanner-52a367c33e69a6f3", "name": "Insecure pattern 'node_child_process' in scripts/ci.js:10", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/ci.js:10"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.9}}, {"id": "scanner-1d411d1857000e22", "name": "Insecure pattern 'exec_used' in packages/mcp/src/index.js:29", "shortDescription": {"text": "Insecure pattern 'exec_used' in packages/mcp/src/index.js:29"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d6ff20c102c3cc1c", "name": "Insecure pattern 'node_child_process' in packages/mcp/src/index.js:4", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/mcp/src/index.js:4"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.9}}, {"id": "scanner-06023fa1d81a2961", "name": "Insecure pattern 'direct_innerhtml_assignment' in packages/ui/src/panel/Panel.ts:189", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/ui/src/panel/Panel.ts:189"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-610bd70b9bf5f709", "name": "Insecure pattern 'dangerous_innerhtml' in packages/website/src/components/HighlightSyntax.tsx:172", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in packages/website/src/components/HighlightSyntax.tsx:172"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-3dff100223fc3880", "name": "Insecure pattern 'local_storage_auth_token' in packages/website/src/pages/docs/features/chrome-extension/page.tsx:139", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in packages/website/src/pages/docs/features/chrome-extension/page.tsx:139"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-06d039dac555c66f", "name": "Insecure pattern 'dangerous_innerhtml' in packages/website/src/pages/home/HeroSection.tsx:306", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in packages/website/src/pages/home/HeroSection.tsx:306"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-7b497ccd66a7dfeb", "name": "Insecure pattern 'eval_used' in packages/page-controller/src/PageController.ts:386", "shortDescription": {"text": "Insecure pattern 'eval_used' in packages/page-controller/src/PageController.ts:386"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-419c7fcdf11fc660", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-node@v7 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-24a2353e77881d9e", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-27924aa79fa4a517", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-node@v7 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-46c644c6227e4d4a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-node@v7 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1838a141491ce38c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-02ea9e90ec48ace2", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-node@v7 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cb639d9a10a47b23", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6ffd0f1b169b3329", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d15cd4bdc03cc667", "name": "Very large file: packages/page-controller/src/dom/dom_tree/index.js (1745 lines)", "shortDescription": {"text": "Very large file: packages/page-controller/src/dom/dom_tree/index.js (1745 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "11 test file(s) for 161 source file(s) (ratio 0.07). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-be458b5a9a2261bf", "name": "Node manifest has dependencies but no lockfile: packages/mcp/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/mcp/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e64712e0d1193b1b", "name": "Node manifest has dependencies but no lockfile: packages/website/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/website/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-247b8440e5a536f0", "name": "Node manifest has dependencies but no lockfile: packages/page-controller/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/page-controller/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9278027b2f2e8fc8", "name": "Node manifest has dependencies but no lockfile: packages/extension/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/extension/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1ada30b496643aab", "name": "Node manifest has dependencies but no lockfile: packages/core/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/core/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2b89474a90d1b455", "name": "Node manifest has dependencies but no lockfile: packages/llms/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/llms/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7c858f7cf523640a", "name": "Node manifest has dependencies but no lockfile: packages/page-agent/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/page-agent/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 85 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 21 placeholder/mock markers across 9 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-94ac68206bfbb847", "name": "Commented-code block (9 lines) in packages/page-controller/src/dom/dom_tree/index.js:149", "shortDescription": {"text": "Commented-code block (9 lines) in packages/page-controller/src/dom/dom_tree/index.js:149"}, "fullDescription": {"text": "6 of 9 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-8adf94825f00c1aa", "name": "Frontend route `/docs` has no Link/navigate to it \u2014 packages/website/src/pages/docs/index.tsx", "shortDescription": {"text": "Frontend route `/docs` has no Link/navigate to it \u2014 packages/website/src/pages/docs/index.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-868c087497539807", "name": "Vulnerable dependency @hono/node-server 1.19.14: GHSA-frvp-7c67-39w9", "shortDescription": {"text": "Vulnerable dependency @hono/node-server 1.19.14: GHSA-frvp-7c67-39w9"}, "fullDescription": {"text": "OSV.dev reports `@hono/node-server` at version `1.19.14` (resolved in `package-lock.json`) is affected by GHSA-frvp-7c67-39w9.\nNote: `@hono/node-server` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNode.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)\n\nAdvisory: https://osv.dev/vulnerability/GHSA-frvp-7c67-39w9\nFix: upgrade `@hono/node-server` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-03d84de05eda74f4", "name": "Vulnerable dependency brace-expansion 2.1.1: GHSA-3jxr-9vmj-r5cp", "shortDescription": {"text": "Vulnerable dependency brace-expansion 2.1.1: GHSA-3jxr-9vmj-r5cp"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `2.1.1` (resolved in `package-lock.json`) is affected by GHSA-3jxr-9vmj-r5cp (aka CVE-2026-13149).\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nbrace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups\n\nAliases: CVE-2026-13149\nAdvisory: https://osv.dev/vulnerability/GHSA-3jxr-9vmj-r5cp\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-c433d679c67c1c40", "name": "Vulnerable dependency adm-zip 0.5.17: GHSA-xcpc-8h2w-3j85", "shortDescription": {"text": "Vulnerable dependency adm-zip 0.5.17: GHSA-xcpc-8h2w-3j85"}, "fullDescription": {"text": "OSV.dev reports `adm-zip` at version `0.5.17` (resolved in `package-lock.json`) is affected by GHSA-xcpc-8h2w-3j85 (aka CVE-2026-39244).\nNote: `adm-zip` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nadm-zip: Crafted ZIP file triggers 4GB memory allocation\n\nAliases: CVE-2026-39244\nAdvisory: https://osv.dev/vulnerability/GHSA-xcpc-8h2w-3j85\nFix: upgrade `adm-zip` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-1ed9daf865defd13", "name": "Vulnerable dependency brace-expansion 5.0.6: GHSA-3jxr-9vmj-r5cp", "shortDescription": {"text": "Vulnerable dependency brace-expansion 5.0.6: GHSA-3jxr-9vmj-r5cp"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `5.0.6` (resolved in `package-lock.json`) is affected by GHSA-3jxr-9vmj-r5cp (aka CVE-2026-13149).\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nbrace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups\n\nAliases: CVE-2026-13149\nAdvisory: https://osv.dev/vulnerability/GHSA-3jxr-9vmj-r5cp\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-f2dd7d7b26227e5a", "name": "Vulnerable dependency shell-quote 1.7.3: GHSA-395f-4hp3-45gv", "shortDescription": {"text": "Vulnerable dependency shell-quote 1.7.3: GHSA-395f-4hp3-45gv"}, "fullDescription": {"text": "OSV.dev reports `shell-quote` at version `1.7.3` (resolved in `package-lock.json`) is affected by GHSA-395f-4hp3-45gv (aka CVE-2026-13311).\nNote: `shell-quote` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nshell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)\n\nAliases: CVE-2026-13311\nAdvisory: https://osv.dev/vulnerability/GHSA-395f-4hp3-45gv\nFix: upgrade `shell-quote` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-b5d517bc71cdf6f7", "name": "Vulnerable dependency shell-quote 1.7.3: GHSA-w7jw-789q-3m8p", "shortDescription": {"text": "Vulnerable dependency shell-quote 1.7.3: GHSA-w7jw-789q-3m8p"}, "fullDescription": {"text": "OSV.dev reports `shell-quote` at version `1.7.3` (resolved in `package-lock.json`) is affected by GHSA-w7jw-789q-3m8p (aka CVE-2026-9277).\nNote: `shell-quote` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nshell-quote quote() does not escape newlines in object .op values\n\nAliases: CVE-2026-9277\nAdvisory: https://osv.dev/vulnerability/GHSA-w7jw-789q-3m8p\nFix: upgrade `shell-quote` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}]}}, "automationDetails": {"id": "repobility/30780"}, "properties": {"repository": "alibaba/page-agent", "repoUrl": "https://github.com/alibaba/page-agent", "branch": "main"}, "results": [{"ruleId": "scanner-bead75b0f9233e05", "level": "none", "message": {"text": "No API endpoints detected"}, "properties": {"repobilityId": "0f8bb852027c38f8", "scanner": "scanner-primary", "fingerprint": "bead75b0f9233e05", "layer": "api", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-25ae54b78054dfd6", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 packages/mcp/src/hub-bridge.js:100"}, "properties": {"repobilityId": "6730e754fdae9a8f", "scanner": "scanner-primary", "fingerprint": "25ae54b78054dfd6", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/mcp/src/hub-bridge.js"}, "region": {"startLine": 100}}}]}, {"ruleId": "scanner-8b38cf8a4086a10f", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 packages/ui/vite.config.js:11"}, "properties": {"repobilityId": "15a490fa427bfa44", "scanner": "scanner-primary", "fingerprint": "8b38cf8a4086a10f", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/ui/vite.config.js"}, "region": {"startLine": 11}}}]}, {"ruleId": "scanner-d2438aae301bafa0", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 packages/website/src/components/HighlightSyntax.tsx:172"}, "properties": {"repobilityId": "518e284479ab5a2a", "scanner": "scanner-primary", "fingerprint": "d2438aae301bafa0", "layer": "frontend", "severity": "medium", "confidence": 0.8, "tags": ["frontend-quality", "fq.dangerous-html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/website/src/components/HighlightSyntax.tsx"}, "region": {"startLine": 172}}}]}, {"ruleId": "scanner-3422abcfc405290b", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 packages/website/src/pages/home/FeaturesSection.tsx:57"}, "properties": {"repobilityId": "419408cd50cd7300", "scanner": "scanner-primary", "fingerprint": "3422abcfc405290b", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/website/src/pages/home/FeaturesSection.tsx"}, "region": {"startLine": 57}}}]}, {"ruleId": "scanner-ce4dd1d9fe3bc54b", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 packages/website/src/pages/home/HeroSection.tsx:306"}, "properties": {"repobilityId": "d73314c5b67d0979", "scanner": "scanner-primary", "fingerprint": "ce4dd1d9fe3bc54b", "layer": "frontend", "severity": "medium", "confidence": 0.8, "tags": ["frontend-quality", "fq.dangerous-html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/website/src/pages/home/HeroSection.tsx"}, "region": {"startLine": 306}}}]}, {"ruleId": "scanner-a146018427c24e9e", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 packages/page-controller/src/actions.ts:85"}, "properties": {"repobilityId": "0a9d4930d5fdb1e2", "scanner": "scanner-primary", "fingerprint": "a146018427c24e9e", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/page-controller/src/actions.ts"}, "region": {"startLine": 85}}}]}, {"ruleId": "scanner-2d2fee61442b27d5", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 packages/page-controller/src/actions.ts:391"}, "properties": {"repobilityId": "6997133f449bd382", "scanner": "scanner-primary", "fingerprint": "2d2fee61442b27d5", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/page-controller/src/actions.ts"}, "region": {"startLine": 391}}}]}, {"ruleId": "scanner-1265c2bdd8d4a812", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 packages/page-controller/src/PageController.ts:225"}, "properties": {"repobilityId": "bb0fa1f9f9f4739d", "scanner": "scanner-primary", "fingerprint": "1265c2bdd8d4a812", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/page-controller/src/PageController.ts"}, "region": {"startLine": 225}}}]}, {"ruleId": "scanner-4f308e968e31cfc5", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 packages/page-controller/src/dom/index.ts:39"}, "properties": {"repobilityId": "da378f5aa0b97ed1", "scanner": "scanner-primary", "fingerprint": "4f308e968e31cfc5", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/page-controller/src/dom/index.ts"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-743b11d31683e42b", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 packages/extension/src/components/HistoryDetail.tsx:39"}, "properties": {"repobilityId": "16dde63970d685ca", "scanner": "scanner-primary", "fingerprint": "743b11d31683e42b", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/extension/src/components/HistoryDetail.tsx"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-a591adc0396825da", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 packages/extension/src/components/HistoryList.tsx:140"}, "properties": {"repobilityId": "dbc697dc5aec40a4", "scanner": "scanner-primary", "fingerprint": "a591adc0396825da", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/extension/src/components/HistoryList.tsx"}, "region": {"startLine": 140}}}]}, {"ruleId": "scanner-186568090cf30877", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 packages/extension/src/entrypoints/content.ts:28"}, "properties": {"repobilityId": "98cd441f3b97a2bf", "scanner": "scanner-primary", "fingerprint": "186568090cf30877", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/extension/src/entrypoints/content.ts"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-4554fb6c0fc78246", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 packages/extension/src/entrypoints/sidepanel/App.tsx:83"}, "properties": {"repobilityId": "40f6106ada6437c0", "scanner": "scanner-primary", "fingerprint": "4554fb6c0fc78246", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/extension/src/entrypoints/sidepanel/App.tsx"}, "region": {"startLine": 83}}}]}, {"ruleId": "scanner-392d60fb51c36320", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 packages/core/src/utils/autoFixer.ts:63"}, "properties": {"repobilityId": "9d10fcd194d7b075", "scanner": "scanner-primary", "fingerprint": "392d60fb51c36320", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/core/src/utils/autoFixer.ts"}, "region": {"startLine": 63}}}]}, {"ruleId": "scanner-14b68829a6f8edbc", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 packages/page-agent/src/demo.ts:18"}, "properties": {"repobilityId": "10fc03572b16b931", "scanner": "scanner-primary", "fingerprint": "14b68829a6f8edbc", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/page-agent/src/demo.ts"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-781a1cd7ce62b70b", "level": "warning", "message": {"text": "react dangerouslysetinnerhtml \u2014 packages/website/src/components/HighlightSyntax.tsx:172"}, "properties": {"repobilityId": "ffcf949c439970e8", "scanner": "scanner-primary", "fingerprint": "781a1cd7ce62b70b", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["semgrep", "security", "react"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/website/src/components/HighlightSyntax.tsx"}, "region": {"startLine": 172}}}]}, {"ruleId": "scanner-dea3eea0aa30fc7a", "level": "warning", "message": {"text": "detect child process \u2014 scripts/ci.js:19"}, "properties": {"repobilityId": "fbc749d74d1b327c", "scanner": "scanner-primary", "fingerprint": "dea3eea0aa30fc7a", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "javascript"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/ci.js"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-e3e595e49e70a47b", "level": "warning", "message": {"text": "GHSA-frvp-7c67-39w9: @hono/node-server 1.19.14 \u2014 package-lock.json"}, "properties": {"repobilityId": "30050d81e6c53f93", "scanner": "scanner-primary", "fingerprint": "e3e595e49e70a47b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-frvp-7c67-39w9"]}}, {"ruleId": "scanner-2679282aa1c484b5", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: AGENTS.md"}, "properties": {"repobilityId": "27d579812e6be614", "scanner": "scanner-primary", "fingerprint": "2679282aa1c484b5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "agents_md"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "AGENTS.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e725d2ab884fbd49", "level": "note", "message": {"text": "Multiple root agent instruction files without precedence"}, "properties": {"repobilityId": "1953db6c89508d22", "scanner": "scanner-primary", "fingerprint": "e725d2ab884fbd49", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["agent-instructions", "governance"]}}, {"ruleId": "scanner-173b294d31b8cf91", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in docs/developer-guide.md"}, "properties": {"repobilityId": "e8a34b7691db95f5", "scanner": "scanner-primary", "fingerprint": "173b294d31b8cf91", "layer": "security", "severity": "medium", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/developer-guide.md"}, "region": {"startLine": 58}}}]}, {"ruleId": "scanner-eb032d208ba2e8d2", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in packages/extension/docs/extension_api.md"}, "properties": {"repobilityId": "c326e69287f0f717", "scanner": "scanner-primary", "fingerprint": "eb032d208ba2e8d2", "layer": "security", "severity": "medium", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/extension/docs/extension_api.md"}, "region": {"startLine": 60}}}]}, {"ruleId": "scanner-658d9107d8bcb9c5", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in packages/extension/src/components/ConfigPanel.tsx"}, "properties": {"repobilityId": "30f1a05864afd67e", "scanner": "scanner-primary", "fingerprint": "658d9107d8bcb9c5", "layer": "security", "severity": "medium", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/extension/src/components/ConfigPanel.tsx"}, "region": {"startLine": 197}}}]}, {"ruleId": "scanner-142c77e944dfd90a", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in packages/website/src/pages/docs/advanced/custom-ui/page.tsx"}, "properties": {"repobilityId": "4620547d1a328591", "scanner": "scanner-primary", "fingerprint": "142c77e944dfd90a", "layer": "security", "severity": "medium", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/website/src/pages/docs/advanced/custom-ui/page.tsx"}, "region": {"startLine": 250}}}]}, {"ruleId": "scanner-e7c99897fc727928", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in packages/website/src/pages/docs/advanced/page-agent-core/page.tsx"}, "properties": {"repobilityId": "79a34aa91345c981", "scanner": "scanner-primary", "fingerprint": "e7c99897fc727928", "layer": "security", "severity": "medium", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/website/src/pages/docs/advanced/page-agent-core/page.tsx"}, "region": {"startLine": 52}}}]}, {"ruleId": "scanner-cf70e64675087cdd", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in packages/website/src/pages/docs/advanced/page-agent/page.tsx"}, "properties": {"repobilityId": "7a6c07187cfa57c2", "scanner": "scanner-primary", "fingerprint": "cf70e64675087cdd", "layer": "security", "severity": "medium", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/website/src/pages/docs/advanced/page-agent/page.tsx"}, "region": {"startLine": 58}}}]}, {"ruleId": "scanner-56473851be37c434", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in packages/website/src/pages/docs/advanced/page-controller/page.tsx"}, "properties": {"repobilityId": "ebbf4a3c306bb52d", "scanner": "scanner-primary", "fingerprint": "56473851be37c434", "layer": "security", "severity": "medium", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/website/src/pages/docs/advanced/page-controller/page.tsx"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-db8254ddb84d38c6", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in packages/website/src/pages/docs/features/chrome-extension/page.tsx"}, "properties": {"repobilityId": "04ea12fd546f7a19", "scanner": "scanner-primary", "fingerprint": "db8254ddb84d38c6", "layer": "security", "severity": "medium", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/website/src/pages/docs/features/chrome-extension/page.tsx"}, "region": {"startLine": 234}}}]}, {"ruleId": "scanner-08e33abd54329d9e", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in packages/website/src/pages/docs/features/mcp-server/page.tsx"}, "properties": {"repobilityId": "3209d0d0388635e9", "scanner": "scanner-primary", "fingerprint": "08e33abd54329d9e", "layer": "security", "severity": "medium", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/website/src/pages/docs/features/mcp-server/page.tsx"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-d3988df48e3c87ca", "level": "warning", "message": {"text": "SkillSpector EA2 (excessive-agency) in .agents/skills/pre-impl-discussion/SKILL.md"}, "properties": {"repobilityId": "109c3069b94b7450", "scanner": "scanner-primary", "fingerprint": "d3988df48e3c87ca", "layer": "security", "severity": "medium", "confidence": 0.75, "tags": ["skillspector", "mcp-skill", "excessive-agency", "EA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".agents/skills/pre-impl-discussion/SKILL.md"}, "region": {"startLine": 44}}}]}, {"ruleId": "scanner-f3321f3de07fb846", "level": "note", "message": {"text": "SkillSpector EA3 (excessive-agency) in LICENSE"}, "properties": {"repobilityId": "1b29968a80e56e5c", "scanner": "scanner-primary", "fingerprint": "f3321f3de07fb846", "layer": "security", "severity": "low", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "excessive-agency", "EA3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "LICENSE"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-4fb881ae6770e008", "level": "warning", "message": {"text": "SkillSpector EA2 (excessive-agency) in packages/core/src/types.ts"}, "properties": {"repobilityId": "a2c4bbbffe7ba1aa", "scanner": "scanner-primary", "fingerprint": "4fb881ae6770e008", "layer": "security", "severity": "medium", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "excessive-agency", "EA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/core/src/types.ts"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-f64976cf9612339c", "level": "warning", "message": {"text": "SkillSpector EA1 (excessive-agency) in packages/core/src/utils/autoFixer.ts"}, "properties": {"repobilityId": "561ceccf8d3305d8", "scanner": "scanner-primary", "fingerprint": "f64976cf9612339c", "layer": "security", "severity": "medium", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "excessive-agency", "EA1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/core/src/utils/autoFixer.ts"}, "region": {"startLine": 127}}}]}, {"ruleId": "scanner-43109dfc2afdfef9", "level": "warning", "message": {"text": "SkillSpector EA2 (excessive-agency) in packages/extension/src/entrypoints/hub/App.tsx"}, "properties": {"repobilityId": "718462698b417acd", "scanner": "scanner-primary", "fingerprint": "43109dfc2afdfef9", "layer": "security", "severity": "medium", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "excessive-agency", "EA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/extension/src/entrypoints/hub/App.tsx"}, "region": {"startLine": 169}}}]}, {"ruleId": "scanner-b4381fda944e0153", "level": "error", "message": {"text": "SkillSpector MP3 (memory-poisoning) in packages/extension/src/components/HistoryList.tsx"}, "properties": {"repobilityId": "8b56fff0afc14df1", "scanner": "scanner-primary", "fingerprint": "b4381fda944e0153", "layer": "security", "severity": "high", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "memory-poisoning", "MP3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/extension/src/components/HistoryList.tsx"}, "region": {"startLine": 168}}}]}, {"ruleId": "scanner-64a880a34a45632c", "level": "error", "message": {"text": "SkillSpector MP3 (memory-poisoning) in packages/page-controller/src/dom/index.ts"}, "properties": {"repobilityId": "3786513878b91d3c", "scanner": "scanner-primary", "fingerprint": "64a880a34a45632c", "layer": "security", "severity": "high", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "memory-poisoning", "MP3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/page-controller/src/dom/index.ts"}, "region": {"startLine": 420}}}]}, {"ruleId": "scanner-1644fc0149606f13", "level": "error", "message": {"text": "SkillSpector MP3 (memory-poisoning) in packages/ui/src/panel/Panel.ts"}, "properties": {"repobilityId": "b04f29b7a9833ffb", "scanner": "scanner-primary", "fingerprint": "1644fc0149606f13", "layer": "security", "severity": "high", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "memory-poisoning", "MP3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/ui/src/panel/Panel.ts"}, "region": {"startLine": 335}}}]}, {"ruleId": "scanner-b9bcf74013e3c3d0", "level": "error", "message": {"text": "SkillSpector OH1 (output-handling) in packages/website/src/components/HighlightSyntax.tsx"}, "properties": {"repobilityId": "9b4da1e5fbec540a", "scanner": "scanner-primary", "fingerprint": "b9bcf74013e3c3d0", "layer": "security", "severity": "high", "confidence": 0.65, "tags": ["skillspector", "mcp-skill", "output-handling", "OH1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/website/src/components/HighlightSyntax.tsx"}, "region": {"startLine": 172}}}]}, {"ruleId": "scanner-3805836deb22b475", "level": "error", "message": {"text": "SkillSpector OH1 (output-handling) in packages/website/src/pages/home/HeroSection.tsx"}, "properties": {"repobilityId": "bb737a4474a95ec0", "scanner": "scanner-primary", "fingerprint": "3805836deb22b475", "layer": "security", "severity": "high", "confidence": 0.65, "tags": ["skillspector", "mcp-skill", "output-handling", "OH1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/website/src/pages/home/HeroSection.tsx"}, "region": {"startLine": 306}}}]}, {"ruleId": "scanner-bf87f6bb3d30fdde", "level": "error", "message": {"text": "SkillSpector PE3 (priv-esc) in .agents/skills/submit-pr-from-current-changes/SKILL.md"}, "properties": {"repobilityId": "c110e36630ddb81d", "scanner": "scanner-primary", "fingerprint": "bf87f6bb3d30fdde", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "priv-esc", "PE3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".agents/skills/submit-pr-from-current-changes/SKILL.md"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-229f707a83cf092b", "level": "error", "message": {"text": "SkillSpector PE3 (priv-esc) in packages/llms/src/models.live.test.ts"}, "properties": {"repobilityId": "8d8941bb3001aa5c", "scanner": "scanner-primary", "fingerprint": "229f707a83cf092b", "layer": "security", "severity": "high", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "priv-esc", "PE3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/llms/src/models.live.test.ts"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-7c93a954e14c6bea", "level": "error", "message": {"text": "SkillSpector PE3 (priv-esc) in packages/mcp/src/index.js"}, "properties": {"repobilityId": "94ae3325b45d9aeb", "scanner": "scanner-primary", "fingerprint": "7c93a954e14c6bea", "layer": "security", "severity": "high", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "priv-esc", "PE3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/mcp/src/index.js"}, "region": {"startLine": 11}}}]}, {"ruleId": "scanner-341dd5f4c88b84b1", "level": "error", "message": {"text": "SkillSpector PE3 (priv-esc) in packages/page-agent/vite.iife.config.js"}, "properties": {"repobilityId": "3c4dc360b2b7379a", "scanner": "scanner-primary", "fingerprint": "341dd5f4c88b84b1", "layer": "security", "severity": "high", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "priv-esc", "PE3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/page-agent/vite.iife.config.js"}, "region": {"startLine": 10}}}]}, {"ruleId": "scanner-e365f31893c5b5b4", "level": "error", "message": {"text": "SkillSpector PE3 (priv-esc) in packages/website/vite.config.js"}, "properties": {"repobilityId": "15b59251e2a521eb", "scanner": "scanner-primary", "fingerprint": "e365f31893c5b5b4", "layer": "security", "severity": "high", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "priv-esc", "PE3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/website/vite.config.js"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-2d8990f170e3c57f", "level": "error", "message": {"text": "SkillSpector P2 (prompt-injection) in README.md"}, "properties": {"repobilityId": "c144b55076257324", "scanner": "scanner-primary", "fingerprint": "2d8990f170e3c57f", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "prompt-injection", "P2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "README.md"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-1474af525032cfbf", "level": "note", "message": {"text": "SkillSpector SC1 (supply-chain) in package.json"}, "properties": {"repobilityId": "3383129e33c8e7f0", "scanner": "scanner-primary", "fingerprint": "1474af525032cfbf", "layer": "security", "severity": "low", "confidence": 0.4, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-1d21f6184c0f0117", "level": "note", "message": {"text": "SkillSpector SC1 (supply-chain) in packages/core/package.json"}, "properties": {"repobilityId": "4611601a809dff81", "scanner": "scanner-primary", "fingerprint": "1d21f6184c0f0117", "layer": "security", "severity": "low", "confidence": 0.4, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/core/package.json"}, "region": {"startLine": 57}}}]}, {"ruleId": "scanner-3e965a72f527e217", "level": "note", "message": {"text": "SkillSpector SC1 (supply-chain) in packages/extension/package.json"}, "properties": {"repobilityId": "b7c85e269e7f9ca3", "scanner": "scanner-primary", "fingerprint": "3e965a72f527e217", "layer": "security", "severity": "low", "confidence": 0.4, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/extension/package.json"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-611655fab6744d2c", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in packages/extension/wxt.config.js"}, "properties": {"repobilityId": "2de32d1ad467973d", "scanner": "scanner-primary", "fingerprint": "611655fab6744d2c", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/extension/wxt.config.js"}, "region": {"startLine": 43}}}]}, {"ruleId": "scanner-d340acce748939b5", "level": "note", "message": {"text": "SkillSpector SC1 (supply-chain) in packages/llms/package.json"}, "properties": {"repobilityId": "8ac412dfdeca9ec9", "scanner": "scanner-primary", "fingerprint": "d340acce748939b5", "layer": "security", "severity": "low", "confidence": 0.4, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/llms/package.json"}, "region": {"startLine": 52}}}]}, {"ruleId": "scanner-502c4764eb98c339", "level": "note", "message": {"text": "SkillSpector SC1 (supply-chain) in packages/mcp/package.json"}, "properties": {"repobilityId": "5f594f9a4004953b", "scanner": "scanner-primary", "fingerprint": "502c4764eb98c339", "layer": "security", "severity": "low", "confidence": 0.4, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/mcp/package.json"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-e63dda75152b7dab", "level": "note", "message": {"text": "SkillSpector SC1 (supply-chain) in packages/page-agent/package.json"}, "properties": {"repobilityId": "2e081eb4e671b9ea", "scanner": "scanner-primary", "fingerprint": "e63dda75152b7dab", "layer": "security", "severity": "low", "confidence": 0.4, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/page-agent/package.json"}, "region": {"startLine": 61}}}]}, {"ruleId": "scanner-83eee600dabdd0a7", "level": "note", "message": {"text": "SkillSpector SC1 (supply-chain) in packages/page-controller/package.json"}, "properties": {"repobilityId": "c87fb2bea49685e9", "scanner": "scanner-primary", "fingerprint": "83eee600dabdd0a7", "layer": "security", "severity": "low", "confidence": 0.4, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/page-controller/package.json"}, "region": {"startLine": 50}}}]}, {"ruleId": "scanner-ba424746a730457c", "level": "note", "message": {"text": "SkillSpector SC1 (supply-chain) in packages/website/package.json"}, "properties": {"repobilityId": "3c21744c005fb019", "scanner": "scanner-primary", "fingerprint": "ba424746a730457c", "layer": "security", "severity": "low", "confidence": 0.4, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/website/package.json"}, "region": {"startLine": 12}}}]}, {"ruleId": "scanner-c48d54072d7b9202", "level": "error", "message": {"text": "SkillSpector SC6 (supply-chain) in package.json"}, "properties": {"repobilityId": "0898d2a6b27a3a5c", "scanner": "scanner-primary", "fingerprint": "c48d54072d7b9202", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC6"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 68}}}]}, {"ruleId": "scanner-a5ccf6898289f2e2", "level": "error", "message": {"text": "SkillSpector SC6 (supply-chain) in packages/extension/package.json"}, "properties": {"repobilityId": "a75da971755052c6", "scanner": "scanner-primary", "fingerprint": "a5ccf6898289f2e2", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC6"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/extension/package.json"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-a13ae2f2507d2fc5", "level": "error", "message": {"text": "SkillSpector P6 (prompt-injection) in packages/core/src/PageAgentCore.ts"}, "properties": {"repobilityId": "2deb5fb54a26b71a", "scanner": "scanner-primary", "fingerprint": "a13ae2f2507d2fc5", "layer": "security", "severity": "high", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "prompt-injection", "P6"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/core/src/PageAgentCore.ts"}, "region": {"startLine": 646}}}]}, {"ruleId": "scanner-0320fd7907296091", "level": "error", "message": {"text": "SkillSpector P6 (prompt-injection) in packages/website/src/components/JSConsole.tsx"}, "properties": {"repobilityId": "22dbc25198121eff", "scanner": "scanner-primary", "fingerprint": "0320fd7907296091", "layer": "security", "severity": "high", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "prompt-injection", "P6"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/website/src/components/JSConsole.tsx"}, "region": {"startLine": 327}}}]}, {"ruleId": "scanner-30f40fe66cf31409", "level": "error", "message": {"text": "SkillSpector TM1 (tool-misuse) in .husky/pre-commit"}, "properties": {"repobilityId": "331a748467bf3186", "scanner": "scanner-primary", "fingerprint": "30f40fe66cf31409", "layer": "security", "severity": "high", "confidence": 0.65, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".husky/pre-commit"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7cbbdcade7d3ae01", "level": "error", "message": {"text": "SkillSpector TM1 (tool-misuse) in package-lock.json"}, "properties": {"repobilityId": "aa03d253b8eee8af", "scanner": "scanner-primary", "fingerprint": "7cbbdcade7d3ae01", "layer": "security", "severity": "high", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 7720}}}]}, {"ruleId": "scanner-41c2d611910e2f24", "level": "error", "message": {"text": "SkillSpector TM1 (tool-misuse) in package.json"}, "properties": {"repobilityId": "a2e706cd5ea2522a", "scanner": "scanner-primary", "fingerprint": "41c2d611910e2f24", "layer": "security", "severity": "high", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 43}}}]}, {"ruleId": "scanner-a3004f92aa51c8a1", "level": "error", "message": {"text": "SkillSpector TM2 (tool-misuse) in package.json"}, "properties": {"repobilityId": "a5c84063d6fedd7e", "scanner": "scanner-primary", "fingerprint": "a3004f92aa51c8a1", "layer": "security", "severity": "high", "confidence": 0.75, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 43}}}]}, {"ruleId": "scanner-e637c415447867e4", "level": "none", "message": {"text": "Run SkillSpector's LLM-backed analysis in your own pipeline"}, "properties": {"repobilityId": "1936f198ff5212bf", "scanner": "scanner-primary", "fingerprint": "e637c415447867e4", "layer": "security", "severity": "info", "confidence": 1.0, "tags": ["skillspector", "mcp-skill", "llm-advisory", "ai-coder"]}}, {"ruleId": "scanner-672915cf0507cfcc", "level": "error", "message": {"text": "Insecure pattern 'node_child_process' in scripts/build.js:12"}, "properties": {"repobilityId": "92d9ca3cb748b2da", "scanner": "scanner-primary", "fingerprint": "672915cf0507cfcc", "layer": "security", "severity": "high", "confidence": 0.9, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/build.js"}, "region": {"startLine": 12}}}]}, {"ruleId": "scanner-52a367c33e69a6f3", "level": "error", "message": {"text": "Insecure pattern 'node_child_process' in scripts/ci.js:10"}, "properties": {"repobilityId": "a66f55fc4dafa692", "scanner": "scanner-primary", "fingerprint": "52a367c33e69a6f3", "layer": "security", "severity": "high", "confidence": 0.9, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/ci.js"}, "region": {"startLine": 10}}}]}, {"ruleId": "scanner-1d411d1857000e22", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in packages/mcp/src/index.js:29"}, "properties": {"repobilityId": "be8b0bce3f19d7ca", "scanner": "scanner-primary", "fingerprint": "1d411d1857000e22", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/mcp/src/index.js"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-d6ff20c102c3cc1c", "level": "error", "message": {"text": "Insecure pattern 'node_child_process' in packages/mcp/src/index.js:4"}, "properties": {"repobilityId": "ca4301fdfced1ac7", "scanner": "scanner-primary", "fingerprint": "d6ff20c102c3cc1c", "layer": "security", "severity": "high", "confidence": 0.9, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/mcp/src/index.js"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-06023fa1d81a2961", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/ui/src/panel/Panel.ts:189"}, "properties": {"repobilityId": "e43891dae21fe7cf", "scanner": "scanner-primary", "fingerprint": "06023fa1d81a2961", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/ui/src/panel/Panel.ts"}, "region": {"startLine": 189}}}]}, {"ruleId": "scanner-610bd70b9bf5f709", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in packages/website/src/components/HighlightSyntax.tsx:172"}, "properties": {"repobilityId": "ad8ae4b0be604871", "scanner": "scanner-primary", "fingerprint": "610bd70b9bf5f709", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/website/src/components/HighlightSyntax.tsx"}, "region": {"startLine": 172}}}]}, {"ruleId": "scanner-3dff100223fc3880", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in packages/website/src/pages/docs/features/chrome-extension/page.tsx:139"}, "properties": {"repobilityId": "91f176fdff548530", "scanner": "scanner-primary", "fingerprint": "3dff100223fc3880", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/website/src/pages/docs/features/chrome-extension/page.tsx"}, "region": {"startLine": 139}}}]}, {"ruleId": "scanner-06d039dac555c66f", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in packages/website/src/pages/home/HeroSection.tsx:306"}, "properties": {"repobilityId": "3e77ec266cbcc3a2", "scanner": "scanner-primary", "fingerprint": "06d039dac555c66f", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/website/src/pages/home/HeroSection.tsx"}, "region": {"startLine": 306}}}]}, {"ruleId": "scanner-7b497ccd66a7dfeb", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in packages/page-controller/src/PageController.ts:386"}, "properties": {"repobilityId": "c344735b667453da", "scanner": "scanner-primary", "fingerprint": "7b497ccd66a7dfeb", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/page-controller/src/PageController.ts"}, "region": {"startLine": 386}}}]}, {"ruleId": "scanner-419c7fcdf11fc660", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "da87bce4e0720f4b", "scanner": "scanner-primary", "fingerprint": "419c7fcdf11fc660", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy-website.yml"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-24a2353e77881d9e", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "f80a287fd6f6b355", "scanner": "scanner-primary", "fingerprint": "24a2353e77881d9e", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy-website.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c8949102f96dd46d", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1bfc4da84cf53307", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-1838a141491ce38c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b8fd4f5048f96576", "scanner": "scanner-primary", "fingerprint": "1838a141491ce38c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-02ea9e90ec48ace2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6875f3ab96ca56c2", "scanner": "scanner-primary", "fingerprint": "02ea9e90ec48ace2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/main-ci.yml"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-cb639d9a10a47b23", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "b86179956da3a4a8", "scanner": "scanner-primary", "fingerprint": "cb639d9a10a47b23", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6ffd0f1b169b3329", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "7e20af7617f6eec9", "scanner": "scanner-primary", "fingerprint": "6ffd0f1b169b3329", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/extension/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d15cd4bdc03cc667", "level": "note", "message": {"text": "Very large file: packages/page-controller/src/dom/dom_tree/index.js (1745 lines)"}, "properties": {"repobilityId": "f7cf4ead2a74cbec", "scanner": "scanner-primary", "fingerprint": "d15cd4bdc03cc667", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-be458b5a9a2261bf", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/mcp/package.json"}, "properties": {"repobilityId": "7b57a55f1ea73746", "scanner": "scanner-primary", "fingerprint": "be458b5a9a2261bf", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/mcp/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e64712e0d1193b1b", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/website/package.json"}, "properties": {"repobilityId": "252ed66afa65626f", "scanner": "scanner-primary", "fingerprint": "e64712e0d1193b1b", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/website/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-247b8440e5a536f0", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/page-controller/package.json"}, "properties": {"repobilityId": "5e325400f57a785b", "scanner": "scanner-primary", "fingerprint": "247b8440e5a536f0", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/page-controller/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9278027b2f2e8fc8", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/extension/package.json"}, "properties": {"repobilityId": "f373d1f818beebe5", "scanner": "scanner-primary", "fingerprint": "9278027b2f2e8fc8", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/extension/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1ada30b496643aab", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/core/package.json"}, "properties": {"repobilityId": "8640e46be7e3f9b2", "scanner": "scanner-primary", "fingerprint": "1ada30b496643aab", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/core/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2b89474a90d1b455", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/llms/package.json"}, "properties": {"repobilityId": "b5b8889d4397ba96", "scanner": "scanner-primary", "fingerprint": "2b89474a90d1b455", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/llms/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7c858f7cf523640a", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/page-agent/package.json"}, "properties": {"repobilityId": "d0f4efa994313896", "scanner": "scanner-primary", "fingerprint": "7c858f7cf523640a", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/page-agent/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "75d4e167da54a01c", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "549bf6729b16bd59", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "3378d639840f0ac6", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "aa1c640e0ef22886", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-94ac68206bfbb847", "level": "none", "message": {"text": "Commented-code block (9 lines) in packages/page-controller/src/dom/dom_tree/index.js:149"}, "properties": {"repobilityId": "f9cc2c72a08b5a79", "scanner": "scanner-primary", "fingerprint": "94ac68206bfbb847", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/page-controller/src/dom/dom_tree/index.js"}, "region": {"startLine": 149}}}]}, {"ruleId": "scanner-8adf94825f00c1aa", "level": "warning", "message": {"text": "Frontend route `/docs` has no Link/navigate to it \u2014 packages/website/src/pages/docs/index.tsx"}, "properties": {"repobilityId": "08fcc76cd8b869e0", "scanner": "scanner-primary", "fingerprint": "8adf94825f00c1aa", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-868c087497539807", "level": "warning", "message": {"text": "Vulnerable dependency @hono/node-server 1.19.14: GHSA-frvp-7c67-39w9"}, "properties": {"repobilityId": "e20a828d2748b708", "scanner": "scanner-primary", "fingerprint": "868c087497539807", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-frvp-7c67-39w9", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-03d84de05eda74f4", "level": "error", "message": {"text": "Vulnerable dependency brace-expansion 2.1.1: GHSA-3jxr-9vmj-r5cp"}, "properties": {"repobilityId": "91dc449d0086dea5", "scanner": "scanner-primary", "fingerprint": "03d84de05eda74f4", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-3jxr-9vmj-r5cp", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c433d679c67c1c40", "level": "error", "message": {"text": "Vulnerable dependency adm-zip 0.5.17: GHSA-xcpc-8h2w-3j85"}, "properties": {"repobilityId": "d43aee87dba3eb6a", "scanner": "scanner-primary", "fingerprint": "c433d679c67c1c40", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-xcpc-8h2w-3j85", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1ed9daf865defd13", "level": "error", "message": {"text": "Vulnerable dependency brace-expansion 5.0.6: GHSA-3jxr-9vmj-r5cp"}, "properties": {"repobilityId": "d33b0db2b7d6b674", "scanner": "scanner-primary", "fingerprint": "1ed9daf865defd13", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-3jxr-9vmj-r5cp", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f2dd7d7b26227e5a", "level": "error", "message": {"text": "Vulnerable dependency shell-quote 1.7.3: GHSA-395f-4hp3-45gv"}, "properties": {"repobilityId": "70658a593e59d847", "scanner": "scanner-primary", "fingerprint": "f2dd7d7b26227e5a", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-395f-4hp3-45gv", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b5d517bc71cdf6f7", "level": "error", "message": {"text": "Vulnerable dependency shell-quote 1.7.3: GHSA-w7jw-789q-3m8p"}, "properties": {"repobilityId": "e3fa34da17efc179", "scanner": "scanner-primary", "fingerprint": "b5d517bc71cdf6f7", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-w7jw-789q-3m8p", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}]}]}