Misaka-blog/chromego_merge

Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.

5 of your 10 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.

Upstream (GitHub) caused delay on this scan — not Repobility.

GitHub API rate-limited (HTTP 403) — preflight skipped, fell back to direct git clone.
Clone from GitHub took 47.8s for a 63.8 MB repo slow.
Repobility's analysis ran in 0.11s after the clone landed.

https://github.com/Misaka-blog/chromego_merge · scanned 2026-06-05 15:07 UTC (5 days, 1 hour ago) · 10 languages

73 raw signals (9 security + 64 graph) 11/13 scanners ran 85th percentile · Python · tiny (<2K LoC)

File as issue Image

UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 5 days, 1 hour ago · v2 · 37 actionable findings from 2 signal sources. 4 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON

77.8% cov · 29 findings

Score breakdown â 2026-05-18-v5

Component	Sub-score	Weight	Contribution
`structure_score`	55.0	0.15	8.25
`security_score`	100.0	0.25	25.00
`testing_score`	70.0	0.20	14.00
`documentation_score`	60.0	0.15	9.00
`practices_score`	72.0	0.15	10.80
`code_quality`	69.0	0.10	6.90
Overall		1.00	74.0

security_score may be inflated — optional security scanners were skipped on this fast scan

Severity distribution — click a segment to filter

Active filters: excluding tests × Reset all

Severity: Critical 0 High 0 Medium 14 Low 18 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 8 System graph 29 Crowd 0 Layer: Software 16 Quality 7 Cicd 1 Api 1 Network 10 Frontend 1 Security 1

Exclude dismissed / FP Exclude test files

Scan summary Quality grade B (74/100). Dimensions: security 100, maintainability 55. 9 findings (3 security). 734 lines analyzed.

Showing 32 of 37 actionable findings. 41 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

low Security checks cicd CI/CD security conf 0.90 ✓ Repobility 4 occurrences GitHub Action is tag-pinned rather than SHA-pinned

[MINED115] Action `actions/checkout` pinned to mutable ref `@v2`: `uses: actions/checkout@v2` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lo…

lines 16, 19

.github/workflows/merge.yml:16, 19 (4 hits)

CI/CD securitySupply chainGitHub Actions

medium Security checks software dependencies conf 0.90 ✓ Repobility [MINED124] requirements.txt: `geoip2` has no version pin: Unpinned pip requirement means every fresh install may resolve a different version. Newer releases can introduce malicious code (typosquats, account compromises). Reproducible installs need exact pins.

Replace `geoip2` with `geoip2==<version>` and manage upgrades through PRs / Dependabot.

requirements.txt:2

low Security checks quality Error handling conf 0.55 ✓ Repobility Broad exception handler needs review

This handler catches Exception/BaseException. It is actionable when it swallows errors without logging, re-raising, or returning a structured error. Handlers that intentionally convert exceptions into typed error results should not be treated as high risk.

merge.py:387 Error handlingquality

medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — sing-box.py:9

`requests.get(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

runtime safetyRobustness

medium System graph security Coverage conf 1.00 No auth library detected

The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). Either auth lives in custom code, in a separate service, or is missing.

auth

medium System graph network Security conf 1.00 Privileged port 180 in use

Port 180 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.

sub/merged_proxies_new.yaml Ports

medium System graph network Security conf 1.00 Privileged port 81 in use

Port 81 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.

sub/merged_proxies_new.yaml Ports

medium System graph network Security conf 1.00 Privileged port 82 in use

Port 82 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.

sub/merged_proxies_new.yaml Ports

medium System graph network Security conf 1.00 Privileged port 83 in use

Port 83 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.

sub/merged_proxies_new.yaml Ports

medium System graph network Security conf 1.00 Privileged port 84 in use

Port 84 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.

sub/merged_proxies_new.yaml Ports

medium System graph network Security conf 1.00 Privileged port 85 in use

Port 85 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.

sub/merged_proxies_new.yaml Ports

medium System graph network Security conf 1.00 Privileged port 86 in use

Port 86 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.

sub/merged_proxies_new.yaml Ports

medium System graph network Security conf 1.00 Privileged port 87 in use

Port 87 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.

sub/merged_proxies_new.yaml Ports

medium System graph network Security conf 1.00 Privileged port 88 in use

Port 88 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.

sub/merged_proxies_new.yaml Ports

medium System graph network Security conf 1.00 Privileged port 89 in use

Port 89 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.

sub/merged_proxies_new.yaml Ports

medium System graph quality Tests conf 1.00 Very low test-to-source ratio

0 test file(s) for 3 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths.

Coverage

low Security checks software Race condition conf 1.00 [SEC124] TOCTOU file access (os.access then open): Check-then-use file pattern (access/exists then open) lets an attacker swap the file between check and use (symlink attack). `mktemp` is deprecated for the same reason.

Use `os.open(path, os.O_CREAT | os.O_EXCL | os.O_WRONLY)` for atomic create-only. Use `tempfile.NamedTemporaryFile()` (not `mktemp`). For locking, use `fcntl.flock`.

sing-box.py:15

low Security checks quality Quality conf 0.60 Duplicated implementation block across source files

Duplicate implementation blocks are maintenance debt. Keep them visible, but they are not a high-severity defect unless the duplicated logic is security-sensitive or drifting.

meta_merge.py:4 duplicationquality

low System graph software Dead code candidate conf 1.00 File has no detected symbols: sing-box.py

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph quality Integrity conf 1.00 2 occurrences Near-duplicate function bodies in 2 places

Functions with the same first-5-line body hash: merge.py:process_urls, meta_merge.py:process_urls This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate.

2 occurrences

repo-level (2 hits)

duplicatesduplication

low System graph software Dead code conf 1.00 Possibly dead Python function: process_clash