← Back to scan
File as GitHub Issue repo: agentforce314/clawcodex

Push this scan report to agentforce314/clawcodex

Click the green button below to open GitHub’s new-issue form, pre-filled with the report title, summary table, top findings, and an embedded score-card image. No authentication needed — you review on GitHub before submitting. Repobility is credited as the scanner.

Embedded score card image

This image will render at the top of the issue body. Hosted on Repobility, refreshes automatically after re-scans.

Repobility score card

Issue title

Missing import: `warnings` used but not imported

Curate findings to include

Pick exactly which findings appear in the issue body. By default the top 5 are included. Uncheck noise, check what matters.

Top 5 (default)
Severity Rule Title File:line
CRIT MINED107 Missing import: `stat` used but not imported src/tool_system/tools/read.py:327
CRIT MINED107 Missing import: `glob` used but not imported src/tool_system/tools/grep.py:59
CRIT MINED107 Missing import: `warnings` used but not imported src/services/mcp/doctor.py:122
CRIT MINED107 Missing import: `stat` used but not imported src/memdir/memory_scan.py:148
CRIT MINED107 Missing import: `warnings` used but not imported src/permissions/setup.py:154
CRIT MINED107 Missing import: `warnings` used but not imported src/services/session_resume.py:77
CRIT MINED107 Missing import: `stat` used but not imported src/tool_system/context.py:237
CRIT MINED107 Missing import: `queue` used but not imported src/plugins/dependency.py:74
HIGH MINED009 [MINED009] Floats For Money: Variable named price/amount/cost typed as float instead of D… src/services/pricing.py:186
HIGH SEC103 [SEC103] LDAP injection — non-constant search filter: User input concatenated into an LDA… src/utils/git.py:200
HIGH SEC103 [SEC103] LDAP injection — non-constant search filter: User input concatenated into an LDA… src/services/api/errors.py:97
HIGH MINED014 [MINED014] Disabled Tls Verify: verify=False in requests, rejectUnauthorized:false in nod… src/providers/openrouter_provider.py:65
HIGH MINED014 [MINED014] Disabled Tls Verify: verify=False in requests, rejectUnauthorized:false in nod… src/providers/openai_provider.py:43
HIGH MINED014 [MINED014] Disabled Tls Verify: verify=False in requests, rejectUnauthorized:false in nod… src/providers/deepseek_provider.py:56
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… src/hooks/exec_http_hook.py:26
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… src/bridge/work_secret.py:95
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… src/auth/oauth.py:134
HIGH MINED001 [MINED001] Bare Except Pass: except: pass or except Exception: pass — silently swallows e… src/auth/auth.py:85
HIGH MINED001 [MINED001] Bare Except Pass: except: pass or except Exception: pass — silently swallows e… src/agent/foreground_promotion.py:194
HIGH MINED001 [MINED001] Bare Except Pass: except: pass or except Exception: pass — silently swallows e… src/agent/agent_tool_utils.py:292
HIGH MINED006 [MINED006] Overcatch Baseexception: except BaseException: ... — prevents Ctrl+C and Syste… src/tool_system/registry.py:169
HIGH MINED006 [MINED006] Overcatch Baseexception: except BaseException: ... — prevents Ctrl+C and Syste… src/entrypoints/tui.py:149
HIGH MINED006 [MINED006] Overcatch Baseexception: except BaseException: ... — prevents Ctrl+C and Syste… scripts/diagnose_keys.py:96
HIGH SEC128 [SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call … src/agent/resume_agent.py:124
HIGH SEC128 [SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call … src/agent/foreground_promotion.py:75
HIGH SEC128 [SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call … demos/linkedin-app/src/context/LinkedIn…:136
HIGH MINED108 `self.all` used but never assigned in __init__ src/task_registry.py:114
HIGH MINED108 `self.save_project` used but never assigned in __init__ src/config.py:226
HIGH MINED108 `self.load_project` used but never assigned in __init__ src/config.py:224
HIGH MINED108 `self.save_global` used but never assigned in __init__ src/config.py:221
HIGH MINED108 `self.load_global` used but never assigned in __init__ src/config.py:219
HIGH MINED108 `self.get_merged` used but never assigned in __init__ src/config.py:216
HIGH MINED108 `self.load_local` used but never assigned in __init__ src/config.py:190
HIGH MINED108 `self.load_project` used but never assigned in __init__ src/config.py:189
HIGH MINED108 `self.load_global` used but never assigned in __init__ src/config.py:188
HIGH COMP001 [COMP001] High cognitive complexity: Function `main` has cognitive complexity 40 (SonarSo… eval/pick_batch.py:36
HIGH AGT002 LLM memory extraction can be prompt-injected into storing fake facts src/services/mcp/xaa_idp_login.py:1
HIGH SEC004 [SEC004] SQL Injection Risk: String interpolation in SQL execution. Allows SQL injection. src/tool_system/tools/notebook_edit.py:99
MED SEC031 [SEC031] Catastrophic Backtracking Regex (ReDoS): Regex contains nested quantifiers like … src/tool_system/tools/worktree.py:12
MED SEC136 [SEC136] AI-typical over-broad exception handler swallowing all errors: Catch-all excepti… src/services/mcp/xaa_idp_login.py:142
MED SEC136 [SEC136] AI-typical over-broad exception handler swallowing all errors: Catch-all excepti… src/services/compact/post_compact_attac…:252
MED SEC136 [SEC136] AI-typical over-broad exception handler swallowing all errors: Catch-all excepti… src/config.py:246
MED SEC015 [SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. … src/server/session_manager.py:58
MED SEC015 [SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. … src/server/direct_connect_session.py:40
MED SEC015 [SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. … src/bridge/code_session_api.py:68
MED ERR001 [ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even… src/auth/gemini.py:28
MED ERR001 [ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even… src/auth/aws.py:55
MED ERR001 [ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even… src/auth/auth.py:85
MED SEC134 [SEC134] AI scaffold leftover — Lorem ipsum / example.com / John Doe in code: Lorem ipsum… demos/crm-app/src/context/CRMContext.jsx:7
MED SEC087 [SEC087] JS: weak Math.random for crypto: Math.random() is not cryptographically secure; … demos/minecraft-app/src/utils/terrain.js:86
MED SEC087 [SEC087] JS: weak Math.random for crypto: Math.random() is not cryptographically secure; … demos/adopt-me-app/src/pages/Trade.jsx:31
MED MINED111 Bare except continues silently src/tool_system/renderers.py:95
MED MINED111 Bare except continues silently src/tool_system/renderers.py:71
MED MINED111 Bare except continues silently src/tool_system/registry.py:169
MED MINED111 Bare except continues silently src/skills/loader.py:1174
MED MINED111 Bare except continues silently src/skills/loader.py:563
MED MINED111 Bare except continues silently src/skills/loader.py:1168
MED MINED111 Bare except continues silently src/skills/loader.py:273
MED MINED111 Bare except continues silently src/skills/loader.py:168
MED MINED111 Bare except continues silently src/skills/argument_substitution.py:13
MED MINED111 Bare except continues silently src/bridge/session_runner.py:810
MED MINED111 Bare except continues silently src/bridge/session_runner.py:739
MED MINED111 Bare except continues silently src/bridge/session_runner.py:795
MED MINED111 Bare except continues silently src/bridge/debug_utils.py:109
MED MINED111 Bare except continues silently src/plugins/loader.py:46
MED MINED111 Bare except continues silently eval/run_compare.py:324
MED MINED111 Bare except continues silently eval/run_compare.py:254
MED MINED111 Bare except continues silently src/cli.py:537
MED MINED111 Bare except continues silently src/token_estimation.py:252
MED MINED111 Bare except continues silently src/token_estimation.py:394
MED MINED111 Bare except continues silently src/token_estimation.py:36
MED MINED111 Bare except continues silently src/config.py:255
MED MINED111 Bare except continues silently src/config.py:137
MED MINED111 Bare except continues silently src/__init__.py:10
MED SEC014 [SEC014] SSL Verification Disabled: SSL certificate verification is disabled, allowing ma… src/providers/openrouter_provider.py:65
MED SEC014 [SEC014] SSL Verification Disabled: SSL certificate verification is disabled, allowing ma… src/providers/openai_provider.py:43
MED SEC014 [SEC014] SSL Verification Disabled: SSL certificate verification is disabled, allowing ma… src/providers/deepseek_provider.py:56
MED COMP001 [COMP001] High cognitive complexity: Function `main` has cognitive complexity 18 (SonarSo… eval/_clear_infra_errors.py:38
MED AUC001 [AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks… —
MED AGT016 Codex session log reader may expose prompts or tool-call content src/services/session_storage.py:1
MED AGT015 Remote install command pipes network code directly to a shell claude-code-wiki/raw/claude-code-source…:21
MED AGT013 Agent auto-approve or skip-permissions mode is easy to enable src/entrypoints/headless.py:18
MED AGT013 Agent auto-approve or skip-permissions mode is easy to enable src/permissions/modes.py:93
MED AGT013 Agent auto-approve or skip-permissions mode is easy to enable src/entrypoints/tui.py:38
MED CORE_NO_CI No CI/CD configuration found —
LOW COMP001 [COMP001] High cognitive complexity: Function `repair` has cognitive complexity 13 (Sonar… eval/repair_preds.py:25
LOW AIC003 Duplicated implementation block across source files src/tool_system/tools/grep.py:11
LOW AIC003 Duplicated implementation block across source files src/providers/minimax_provider.py:46
LOW AIC003 Duplicated implementation block across source files src/providers/base.py:43
LOW AIC003 Duplicated implementation block across source files src/providers/anthropic_provider.py:305
LOW AIC003 Duplicated implementation block across source files src/providers/openrouter_provider.py:60
LOW AIC003 Duplicated implementation block across source files src/providers/openai_provider.py:41
LOW AIC003 Duplicated implementation block across source files src/memdir/team_mem_prompts.py:109
LOW AIC003 Duplicated implementation block across source files src/hooks/registry.py:125
LOW AIC003 Duplicated implementation block across source files src/entrypoints/tui.py:49
INFO MINED072 [MINED072] Python Pass Only Class: class Foo: pass — stub waiting to be filled in. src/tui/widgets/select_list.py:98
INFO MINED072 [MINED072] Python Pass Only Class: class Foo: pass — stub waiting to be filled in. src/tool_system/utils/ripgrep.py:49
INFO MINED072 [MINED072] Python Pass Only Class: class Foo: pass — stub waiting to be filled in. src/tool_system/errors.py:4
INFO MINED077 [MINED077] Python Open No Context: fp = open(path) outside with-block leaks file handles. src/tool_system/tools/bash/background.py:63
INFO MINED077 [MINED077] Python Open No Context: fp = open(path) outside with-block leaks file handles. src/services/swarm/mailbox.py:219
INFO MINED043 [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle cr… src/services/mcp/oauth_callback_server.…:73
INFO MINED043 [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle cr… src/services/mcp/doctor.py:148
INFO MINED043 [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle cr… src/bridge/work_secret.py:109
INFO MINED050 [MINED050] Stub Only Function: Function declared but body is just pass, return None, rais… src/auth/aws.py:56
INFO MINED050 [MINED050] Stub Only Function: Function declared but body is just pass, return None, rais… src/auth/auth.py:86
INFO MINED050 [MINED050] Stub Only Function: Function declared but body is just pass, return None, rais… src/agent/foreground_promotion.py:176
INFO MINED064 [MINED064] Python Input Call: input() blocks for stdin. Inappropriate in services. src/tool_system/tools/mcp.py:48
INFO MINED064 [MINED064] Python Input Call: input() blocks for stdin. Inappropriate in services. src/command_system/engine.py:109
INFO MINED064 [MINED064] Python Input Call: input() blocks for stdin. Inappropriate in services. scripts/audit/legacy_cli_repl.py:246
INFO MINED062 [MINED062] Python Dataclass No Fields: @dataclass over an empty class — unfinished model. src/agent/agent_definitions.py:16
INFO MINED062 [MINED062] Python Dataclass No Fields: @dataclass over an empty class — unfinished model. scripts/audit/architecture_stats.py:56
INFO MINED062 [MINED062] Python Dataclass No Fields: @dataclass over an empty class — unfinished model. eval/compare_results.py:29
INFO MINED056 [MINED056] React Key As Index: key={index} in map() — re-renders the wrong elements on re… demos/linkedin-app/src/pages/Profile.jsx:33
Reset to top 5 113 findings available (after auto-suppression of test files + won't-fix)

Issue body (markdown)

## Code-quality scan: `agentforce314/clawcodex`

**Score: 85/100 (B+)**  ·  163 findings  ·  scanned 2026-05-31 01:23 UTC  ·  223,364 LOC

| Severity | Count |
|---|---|
| CRITICAL | 8 |
| HIGH | 30 |
| MEDIUM | 47 |
| LOW | 10 |

📊 [Full filterable report](https://repobility.com/scan/a323da9b-bb32-4324-b9e5-662ea243eca9/)  ·  ![scorecard](https://repobility.com/scan/a323da9b-bb32-4324-b9e5-662ea243eca9/report.png?v=1780190586-s2)

### Top findings

1. **CRITICAL** `MINED107` — Missing import: `stat` used but not imported
   `src/tool_system/tools/read.py:327` · ✓ Repobility
2. **CRITICAL** `MINED107` — Missing import: `glob` used but not imported
   `src/tool_system/tools/grep.py:59` · ✓ Repobility
3. **CRITICAL** `MINED107` — Missing import: `warnings` used but not imported
   `src/services/mcp/doctor.py:122` · ✓ Repobility
4. **CRITICAL** `MINED107` — Missing import: `stat` used but not imported
   `src/memdir/memory_scan.py:148` · ✓ Repobility
5. **CRITICAL** `MINED107` — Missing import: `warnings` used but not imported
   `src/permissions/setup.py:154` · ✓ Repobility

---

_Filed automatically. Close this issue if not useful — we won't refile. Full report: https://repobility.com/scan/a323da9b-bb32-4324-b9e5-662ea243eca9/_
Megaproject â high spam risk
Could not determine 'agentforce314/clawcodex' star count (GitHub API rate-limited or unreachable). When in doubt about repo size, prefer opening a focused PR or a discussion rather than an issue.
Open in GitHub to file this issue Cancel

The button opens GitHubâs new-issue page in a new tab. You will see the title + body pre-filled â review, edit if you want, then click GitHubâs "Submit new issue" button. Repobility never posts anything on your behalf.

For real security findings on big repos: use the project's SECURITY.md or private advisory flow instead of a public issue.