high System graph security Agent instructions conf 1.00 Agent instruction/config may expose a secret: zebra-tasks/AGENTS.md

Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only.

zebra-tasks/AGENTS.md:94 SecretsAgents md

high System graph api Wiring conf 1.00 Dangling fetch: GET /api/runs/${this.runId}/diagram/ (zebra-agent-web/static/js/workflow-diagram.js:76)

`zebra-agent-web/static/js/workflow-diagram.js:76` calls `GET /api/runs/${this.runId}/diagram/` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/runs/<p>/diagram` If this points at an external API, prefix it with `htt…

Dangling fetchFetch

high System graph security security conf 1.00 Insecure pattern 'exec_used' in zebra-tasks/zebra_tasks/compute/python_exec.py:172

Found a known-risky pattern (exec_used). Review and replace if possible.

zebra-tasks/zebra_tasks/compute/python_exec.py:172 Exec used

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — zebra-agent-web/static/js/webauthn.js:44

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/commands/cicd.md

This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.

.claude/commands/cicd.md VerificationClaude instruction

medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/commands/opsx/apply.md

This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.

.claude/commands/opsx/apply.md VerificationClaude instruction

medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/commands/opsx/archive.md

This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.

.claude/commands/opsx/archive.md VerificationClaude instruction

medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/commands/opsx/propose.md

This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.

.claude/commands/opsx/propose.md VerificationClaude instruction

medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: AGENTS.md

This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.

AGENTS.md VerificationAgents md

medium System graph quality Placeholder conf 1.00 Critical user flow still appears backed by mock or placeholder data

A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded.

Mock dataCritical flowGenerated repo pattern

medium System graph security auth conf 1.00 Django view `begin_authenticate` may be unauthenticated — zebra-agent-web/zebra_agent_web/api/auth_views.py:175