← Back to scan
File as GitHub Issue repo: Genesis1231/Eva01

Push this scan report to Genesis1231/Eva01

Click the green button below to open GitHub’s new-issue form, pre-filled with the report title, summary table, top findings, and an embedded score-card image. No authentication needed — you review on GitHub before submitting. Repobility is credited as the scanner.

Embedded score card image

This image will render at the top of the issue body. Hosted on Repobility, refreshes automatically after re-scans.

Repobility score card

Issue title

Overcatch Baseexception

Curate findings to include

Pick exactly which findings appear in the issue body. By default the top 5 are included. Uncheck noise, check what matters.

Top 5 (default)
Severity Rule Title File:line
CRIT MINED030 [MINED030] Python Pickle Loads: pickle.loads() can execute arbitrary code via __reduce__. eva/senses/audio/speaker_identifier.py:163
CRIT SEC081 [SEC081] Python: pickle.loads / marshal.loads on untrusted data: pickle.load(s) and marsh… eva/senses/audio/speaker_identifier.py:163
CRIT MINED007 [MINED007] Sql String Concat: cursor.execute(f"... {user_input} ...") — SQL injection. eva/database/vector_index.py:34
CRIT MINED107 Missing import: `array` used but not imported eva/database/embeddings.py:79
HIGH MINED006 [MINED006] Overcatch Baseexception: except BaseException: ... — prevents Ctrl+C and Syste… main.py:13
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… frontend/src/services/WebSocketService.…:192
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… eva/tools/watch_video.py:60
HIGH MINED004 [MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums). eva/senses/audio/speaker_identifier.py:223
HIGH SEC128 [SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call … eva/subconscious/subconscious.py:119
HIGH SEC128 [SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call … eva/subconscious/_vision/detector.py:115
HIGH SEC128 [SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call … eva/core/graph.py:143
HIGH MINED001 [MINED001] Bare Except Pass: except: pass or except Exception: pass — silently swallows e… eva/core/app.py:221
HIGH MINED001 [MINED001] Bare Except Pass: except: pass or except Exception: pass — silently swallows e… eva/actions/voice/voice_actor.py:113
HIGH MINED001 [MINED001] Bare Except Pass: except: pass or except Exception: pass — silently swallows e… eva/actions/voice/model_edge.py:84
HIGH MINED108 `self._reachable` used but never assigned in __init__ eva/core/heart.py:122
HIGH MINED108 `self._reachable` used but never assigned in __init__ eva/core/heart.py:111
HIGH MINED108 `self._check_embedding` used but never assigned in __init__ eva/core/heart.py:53
HIGH MINED108 `self._check_network` used but never assigned in __init__ eva/core/heart.py:52
HIGH MINED108 `self._check_storage` used but never assigned in __init__ eva/core/heart.py:51
HIGH MINED108 `self._sweep_shots` used but never assigned in __init__ eva/core/heart.py:68
HIGH MINED108 `self._mark` used but never assigned in __init__ eva/core/heart.py:60
HIGH MINED108 `self._mark` used but never assigned in __init__ eva/core/heart.py:59
HIGH MINED108 `self._mark` used but never assigned in __init__ eva/core/heart.py:58
HIGH MINED108 `self._maintain` used but never assigned in __init__ eva/core/heart.py:41
HIGH MINED108 `self._recency` used but never assigned in __init__ eva/core/moment.py:143
HIGH MINED108 `self._recency` used but never assigned in __init__ eva/core/moment.py:114
HIGH MINED108 `self._format_row` used but never assigned in __init__ eva/core/journal.py:81
HIGH MINED108 `self.get_open` used but never assigned in __init__ eva/core/tasks.py:84
HIGH MINED108 `self._first_word_slug` used but never assigned in __init__ eva/core/tasks.py:42
HIGH MINED108 `self._tool_route` used but never assigned in __init__ eva/core/graph.py:126
HIGH MINED108 `self._route` used but never assigned in __init__ eva/core/graph.py:125
HIGH MINED108 `self._think` used but never assigned in __init__ eva/core/graph.py:118
HIGH MINED108 `self._text_content` used but never assigned in __init__ eva/core/memory.py:220
HIGH MINED108 `self._reflect_people` used but never assigned in __init__ eva/core/memory.py:202
HIGH MINED108 `self._reflect_messages` used but never assigned in __init__ eva/core/memory.py:201
HIGH MINED108 `self._text_content` used but never assigned in __init__ eva/core/memory.py:184
HIGH MINED108 `self.distill` used but never assigned in __init__ eva/core/memory.py:179
HIGH MINED108 `self.distill` used but never assigned in __init__ eva/core/memory.py:146
HIGH MINED108 `self.put` used but never assigned in __init__ eva/actions/action_buffer.py:119
HIGH MINED110 Blocking call `input` inside async function `run_cli` idconfig.py:213
HIGH MINED110 Blocking call `input` inside async function `_delete` idconfig.py:190
HIGH MINED110 Blocking call `input` inside async function `_delete` idconfig.py:184
HIGH MINED110 Blocking call `input` inside async function `_register` idconfig.py:159
HIGH MINED110 Blocking call `input` inside async function `_register` idconfig.py:134
HIGH SEC016 [SEC016] LLM Prompt Injection — User Input in AI Prompt: User-supplied text is interpolat… eva/tools/_shared/video_analyzer.py:106
HIGH SEC016 [SEC016] LLM Prompt Injection — User Input in AI Prompt: User-supplied text is interpolat… eva/senses/vision/describer.py:69
HIGH SEC016 [SEC016] LLM Prompt Injection — User Input in AI Prompt: User-supplied text is interpolat… eva/agent/llm.py:67
HIGH MINED115 Action `actions/deploy-pages` pinned to mutable ref `@v4` .github/workflows/pages.yml:31
HIGH MINED115 Action `actions/upload-pages-artifact` pinned to mutable ref `@v3` .github/workflows/pages.yml:27
HIGH MINED115 Action `actions/configure-pages` pinned to mutable ref `@v5` .github/workflows/pages.yml:26
HIGH MINED115 Action `actions/checkout` pinned to mutable ref `@v4` .github/workflows/pages.yml:25
HIGH GHSA-4f3f-g24h-fr8m keras: GHSA-4f3f-g24h-fr8m uv.lock
HIGH PYSEC-2026-73 keras: PYSEC-2026-73 uv.lock
HIGH PYSEC-2026-76 langchain-openai: PYSEC-2026-76 requirements.txt
HIGH GHSA-qh6h-p6c9-ff54 langchain-core: GHSA-qh6h-p6c9-ff54 requirements.txt
HIGH GHSA-pjwx-r37v-7724 langchain-core: GHSA-pjwx-r37v-7724 requirements.txt
HIGH SEC004 [SEC004] SQL Injection Risk: String interpolation in SQL execution. Allows SQL injection. eva/database/vector_index.py:57
HIGH CORE_NO_TESTS No test files found —
MED CFG006 [CFG006] Missing .gitignore: No .gitignore file. Risk of committing secrets and build art… —
MED SEC007 [SEC007] Unsafe Deserialization: Unsafe deserialization can execute arbitrary code. eva/senses/audio/speaker_identifier.py:163
MED ERR001 [ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even… eva/senses/vision/face_identifier.py:153
MED ERR001 [ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even… eva/actions/voice/model_edge.py:84
MED MINED111 Bare except continues silently eva/core/heart.py:135
MED MINED111 Bare except continues silently eva/core/moment.py:155
MED MINED111 Bare except continues silently eva/core/journal.py:31
MED COMP001 [COMP001] High cognitive complexity: Function `start_loop` has cognitive complexity 15 (S… eva/actions/action_buffer.py:113
MED AUC001 [AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks… —
MED DEPCUR-NPM npm package `@vitejs/plugin-react` is 1 major version(s) behind (5.2.0 -> 6.0.2) frontend/package.json
MED DEPCUR-PY Python package `groq` is 1 major version(s) behind (0.37.1 -> 1.4.0) requirements.txt:92
MED GHSA-mf9w-mj56-hr94 python-dotenv: GHSA-mf9w-mj56-hr94 requirements.txt
MED GHSA-6w46-j5rx-g56g pytest: GHSA-6w46-j5rx-g56g requirements.txt
MED GHSA-926x-3r5x-gfhw langchain-core: GHSA-926x-3r5x-gfhw requirements.txt
MED GHSA-jg22-mg44-37j8 aiohttp: GHSA-jg22-mg44-37j8 requirements.txt
MED GHSA-hg6j-4rv6-33pg aiohttp: GHSA-hg6j-4rv6-33pg requirements.txt
MED GHSA-2g4f-4pwh-qvx6 ajv: GHSA-2g4f-4pwh-qvx6 frontend/package-lock.json
MED SEC017 [SEC017] Unbounded Input to LLM/External API: User input is passed to an LLM or external … eva/tools/_shared/video_analyzer.py:106
MED SEC017 [SEC017] Unbounded Input to LLM/External API: User input is passed to an LLM or external … eva/senses/vision/describer.py:69
MED WEB003 Public web service has no security.txt .well-known/security.txt
LOW COMP001 [COMP001] High cognitive complexity: Function `record_one` has cognitive complexity 9 (So… config/record_void.py:63
LOW COMP001 [COMP001] High cognitive complexity: Function `main` has cognitive complexity 12 (SonarSo… config/record_void.py:128
LOW DEPCUR-PY Python package `onnxruntime` is minor version(s) behind (1.23.2 -> 1.26.0) requirements.txt:219
LOW DEPCUR-PY Python package `mpmath` is minor version(s) behind (1.3.0 -> 1.4.1) requirements.txt:202
LOW DEPCUR-PY Python package `langgraph-sdk` is minor version(s) behind (0.3.14 -> 0.4.2) requirements.txt:190
LOW DEPCUR-PY Python package `langgraph-prebuilt` is minor version(s) behind (1.0.8 -> 1.1.0) requirements.txt:186
LOW DEPCUR-PY Python package `langgraph-checkpoint-sqlite` is minor version(s) behind (3.0.3 -> 3.1.0) requirements.txt:184
LOW DEPCUR-PY Python package `langgraph` is minor version(s) behind (1.0.10 -> 1.2.4) requirements.txt:175
LOW DEPCUR-PY Python package `langchain-perplexity` is minor version(s) behind (1.1.0 -> 1.3.1) requirements.txt:171
LOW DEPCUR-PY Python package `langchain-openai` is minor version(s) behind (1.1.10 -> 1.2.2) requirements.txt:166
LOW DEPCUR-PY Python package `langchain-ollama` is minor version(s) behind (1.0.1 -> 1.1.0) requirements.txt:164
LOW DEPCUR-PY Python package `langchain-deepseek` is minor version(s) behind (1.0.1 -> 1.1.0) requirements.txt:158
LOW DEPCUR-PY Python package `langchain-core` is minor version(s) behind (1.2.18 -> 1.4.0) requirements.txt:143
LOW DEPCUR-PY Python package `langchain-anthropic` is minor version(s) behind (1.3.4 -> 1.4.4) requirements.txt:141
LOW DEPCUR-PY Python package `langchain` is minor version(s) behind (1.2.10 -> 1.3.4) requirements.txt:139
LOW DEPCUR-PY Python package `idna` is minor version(s) behind (3.16 -> 3.18) requirements.txt:123
LOW DEPCUR-PY Python package `huggingface-hub` is minor version(s) behind (1.16.1 -> 1.18.0) requirements.txt:117
LOW DEPCUR-PY Python package `firecrawl-py` is minor version(s) behind (4.18.1 -> 4.28.2) requirements.txt:80
LOW DEPCUR-PY Python package `fastapi` is minor version(s) behind (0.135.1 -> 0.136.3) requirements.txt:74
LOW DEPCUR-PY Python package `elevenlabs` is minor version(s) behind (2.37.0 -> 2.51.0) requirements.txt:68
LOW DEPCUR-PY Python package `anthropic` is minor version(s) behind (0.104.0 -> 0.105.2) requirements.txt:26
LOW AUC005 [AUC005] No authorization-focused tests detected: No test files with common authorization… —
INFO MINED044 [MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger … frontend/src/services/WebSocketService.…:33
INFO MINED056 [MINED056] React Key As Index: key={index} in map() — re-renders the wrong elements on re… frontend/src/components/InnerState.jsx:18
INFO MINED043 [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle cr… eva/senses/vision/webcam.py:16
INFO MINED043 [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle cr… eva/senses/vision/vision_sense.py:25
INFO MINED043 [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle cr… eva/actions/machine/browser.py:21
INFO MINED050 [MINED050] Stub Only Function: Function declared but body is just pass, return None, rais… eva/actions/voice/voice_actor.py:114
INFO MINED050 [MINED050] Stub Only Function: Function declared but body is just pass, return None, rais… eva/actions/voice/model_edge.py:85
INFO MINED050 [MINED050] Stub Only Function: Function declared but body is just pass, return None, rais… eva/actions/base.py:16
INFO MINED062 [MINED062] Python Dataclass No Fields: @dataclass over an empty class — unfinished model. eva/senses/sense_buffer.py:14
INFO MINED062 [MINED062] Python Dataclass No Fields: @dataclass over an empty class — unfinished model. eva/core/app.py:37
INFO MINED062 [MINED062] Python Dataclass No Fields: @dataclass over an empty class — unfinished model. eva/actions/action_buffer.py:21
INFO MINED064 [MINED064] Python Input Call: input() blocks for stdin. Inappropriate in services. idconfig.py:111
INFO MINED064 [MINED064] Python Input Call: input() blocks for stdin. Inappropriate in services. config/record_void.py:68
INFO DEPCUR-PY Python package `langsmith` is patch version(s) behind (0.8.5 -> 0.8.9) requirements.txt:192
INFO DEPCUR-PY Python package `langgraph-checkpoint` is patch version(s) behind (4.1.0 -> 4.1.1) requirements.txt:179
INFO DEPCUR-PY Python package `langchain-mistralai` is patch version(s) behind (1.1.1 -> 1.1.4) requirements.txt:162
INFO DEPCUR-PY Python package `filelock` is patch version(s) behind (3.29.0 -> 3.29.1) requirements.txt:78
INFO DEPCUR-PY Python package `edge-tts` is patch version(s) behind (7.2.7 -> 7.2.8) requirements.txt:66
Reset to top 5 118 findings available (after auto-suppression of test files + won't-fix)

Issue body (markdown)

## Code-quality scan: `Genesis1231/Eva01`

**Score: 78/100 (C)**  ·  118 findings  ·  scanned 2026-06-05 13:23 UTC  ·  8,182 LOC

| Severity | Count |
|---|---|
| CRITICAL | 4 |
| HIGH | 54 |
| MEDIUM | 20 |
| LOW | 22 |

📊 [Full filterable report](https://repobility.com/scan/b414004c-c064-48b5-baa2-3aa625880003/)  ·  ![scorecard](https://repobility.com/scan/b414004c-c064-48b5-baa2-3aa625880003/report.png?v=1780665819-s2)

### Top findings

1. **CRITICAL** `MINED030` — Python Pickle Loads
   `eva/senses/audio/speaker_identifier.py:163` · CWE-502 · ✓ Repobility
2. **CRITICAL** `SEC081` — Python: pickle.loads / marshal.loads on untrusted data
   `eva/senses/audio/speaker_identifier.py:163` · A05:2021 Security Misconfiguration
3. **CRITICAL** `MINED007` — Sql String Concat
   `eva/database/vector_index.py:34` · CWE-89 · ✓ Repobility
4. **CRITICAL** `MINED107` — Missing import: `array` used but not imported
   `eva/database/embeddings.py:79` · ✓ Repobility
5. **HIGH** `MINED006` — Overcatch Baseexception
   `main.py:13` · CWE-705 · ✓ Repobility

---

**Security note**: this issue is public. If any flagged finding is a real, exploitable vulnerability, please redirect to your `SECURITY.md` policy or open a [private security advisory](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability) instead. We're happy to close this and re-submit privately.

---

_Filed automatically. Close this issue if not useful — we won't refile. Full report: https://repobility.com/scan/b414004c-c064-48b5-baa2-3aa625880003/_
Megaproject â high spam risk
Could not determine 'Genesis1231/Eva01' star count (GitHub API rate-limited or unreachable). When in doubt about repo size, prefer opening a focused PR or a discussion rather than an issue.
Already filed
38/125 findings (30%) on this scan are already flagged as test-file, won't-fix, or suppressed. The scan is too noisy to file as a single issue. Curate down to specific actionable findings, or address the FP source first.
I read the warnings â override Cancel

The button opens GitHubâs new-issue page in a new tab. You will see the title + body pre-filled â review, edit if you want, then click GitHubâs "Submit new issue" button. Repobility never posts anything on your behalf.

For real security findings on big repos: use the project's SECURITY.md or private advisory flow instead of a public issue.