{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-8eb40ccf2194ecc8", "name": "dynamic urllib use detected \u2014 agent_reach/channels/bilibili.py:28", "shortDescription": {"text": "dynamic urllib use detected \u2014 agent_reach/channels/bilibili.py:28"}, "fullDescription": {"text": "Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.\n\nRule: python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected\nSeverity: WARNING\nOWASP: A01:2017 - Injection\nCWE: CWE-939: Improper Authorization in Handler for Custom URL Scheme\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-640386ebc1fc4154", "name": "dynamic urllib use detected \u2014 agent_reach/channels/v2ex.py:16", "shortDescription": {"text": "dynamic urllib use detected \u2014 agent_reach/channels/v2ex.py:16"}, "fullDescription": {"text": "Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.\n\nRule: python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected\nSeverity: WARNING\nOWASP: A01:2017 - Injection\nCWE: CWE-939: Improper Authorization in Handler for Custom URL Scheme\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-2adbc1c4c17ac73f", "name": "dynamic urllib use detected \u2014 agent_reach/channels/web.py:33", "shortDescription": {"text": "dynamic urllib use detected \u2014 agent_reach/channels/web.py:33"}, "fullDescription": {"text": "Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.\n\nRule: python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected\nSeverity: WARNING\nOWASP: A01:2017 - Injection\nCWE: CWE-939: Improper Authorization in Handler for Custom URL Scheme\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-f7265d9bec76b3ce", "name": "Agent authority lacks a verifier contract: agent_reach/skill/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: agent_reach/skill/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-50a8a16c6a1d97ad", "name": "SkillSpector TP2 (tool-poisoning) in agent_reach/skill/SKILL.md", "shortDescription": {"text": "SkillSpector TP2 (tool-poisoning) in agent_reach/skill/SKILL.md"}, "fullDescription": {"text": "MCP Tool Poisoning\n\nMixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.\n\nSkill: agent-reach\nRule: TP2  Category: tool-poisoning\nSeverity: HIGH  Confidence: 0.85\n\nRemediation: Restrict identifier fields to a single Unicode script. Prefer ASCII-only identifiers."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.85}}, {"id": "scanner-05ae2f5b35e2d160", "name": "SkillSpector E1 (data-exfil) in agent_reach/skill/references/video.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in agent_reach/skill/references/video.md"}, "fullDescription": {"text": "https://api.bilibili.com/\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: agent-reach\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.50\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.5}}, {"id": "scanner-c269f8d8ef862617", "name": "SkillSpector RA2 (rogue-agent) in agent_reach/skill/SKILL_en.md", "shortDescription": {"text": "SkillSpector RA2 (rogue-agent) in agent_reach/skill/SKILL_en.md"}, "fullDescription": {"text": "create files in the agent workspace.** Use `/tmp/` for temporary\noutput and `~/.agent-reach\n\nSkill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.\n\nSkill: agent-reach\nRule: RA2  Category: rogue-agent\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-e637c415447867e4", "name": "Run SkillSpector's LLM-backed analysis in your own pipeline", "shortDescription": {"text": "Run SkillSpector's LLM-backed analysis in your own pipeline"}, "fullDescription": {"text": "Repobility ran SkillSpector's static rules server-side. The deeper LLM-backed analyzers \u2014 tool-poisoning (TP*), semantic security discovery (SSD*), developer-intent mismatch (SDI*) \u2014 are meant to run on YOUR machine with YOUR model; repobility never sends your code to an LLM. Recipe:\n\n# 1. Install SkillSpector in your own isolated env\npipx install \"skillspector @ git+https://github.com/NVIDIA/SkillSpector.git\"\n\n# 2. Point it at YOUR LLM pipeline (pick one) - your code stays on your machine\nexport SKILLSPECTOR_PROVIDER=anthropic && export ANTHROPIC_API_KEY=sk-ant-...\n# export SKILLSPECTOR_PROVIDER=openai   && export OPENAI_API_KEY=sk-...\n# export SKILLSPECTOR_PROVIDER=openai OPENAI_API_KEY=ollama OPENAI_BASE_URL=http://localhost:11434/v1 SKILLSPECTOR_MODEL=llama3.1:8b\n# export SKILLSPECTOR_PROVIDER=nv_build && export NVIDIA_INFERENCE_KEY=nvapi-...\n\n# 3. Run the LLM-backed scan per skill (omit --no-llm to enable the LLM analyzers)\nskillspector scan agent_reach/skill --format sarif --outp"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-51977a3899cebe53", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dc703718f19814e9", "name": "Very large file: agent_reach/cli.py (1834 lines)", "shortDescription": {"text": "Very large file: agent_reach/cli.py (1834 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 317 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/30783"}, "properties": {"repository": "Panniantong/Agent-Reach", "repoUrl": "https://github.com/Panniantong/Agent-Reach", "branch": "main"}, "results": [{"ruleId": "scanner-8eb40ccf2194ecc8", "level": "warning", "message": {"text": "dynamic urllib use detected \u2014 agent_reach/channels/bilibili.py:28"}, "properties": {"repobilityId": "af564d1c732d130b", "scanner": "scanner-primary", "fingerprint": "8eb40ccf2194ecc8", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "python"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agent_reach/channels/bilibili.py"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-640386ebc1fc4154", "level": "warning", "message": {"text": "dynamic urllib use detected \u2014 agent_reach/channels/v2ex.py:16"}, "properties": {"repobilityId": "bb77f56d218cae6a", "scanner": "scanner-primary", "fingerprint": "640386ebc1fc4154", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "python"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agent_reach/channels/v2ex.py"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-2adbc1c4c17ac73f", "level": "warning", "message": {"text": "dynamic urllib use detected \u2014 agent_reach/channels/web.py:33"}, "properties": {"repobilityId": "6e448a8d3585d371", "scanner": "scanner-primary", "fingerprint": "2adbc1c4c17ac73f", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "python"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agent_reach/channels/web.py"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-f7265d9bec76b3ce", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: agent_reach/skill/SKILL.md"}, "properties": {"repobilityId": "696dbbb0c3d1fdd0", "scanner": "scanner-primary", "fingerprint": "f7265d9bec76b3ce", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agent_reach/skill/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-50a8a16c6a1d97ad", "level": "error", "message": {"text": "SkillSpector TP2 (tool-poisoning) in agent_reach/skill/SKILL.md"}, "properties": {"repobilityId": "8caa2ea2f278a2b1", "scanner": "scanner-primary", "fingerprint": "50a8a16c6a1d97ad", "layer": "security", "severity": "high", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "tool-poisoning", "TP2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agent_reach/skill/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-05ae2f5b35e2d160", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in agent_reach/skill/references/video.md"}, "properties": {"repobilityId": "bc61570957c324a1", "scanner": "scanner-primary", "fingerprint": "05ae2f5b35e2d160", "layer": "security", "severity": "medium", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agent_reach/skill/references/video.md"}, "region": {"startLine": 92}}}]}, {"ruleId": "scanner-c269f8d8ef862617", "level": "warning", "message": {"text": "SkillSpector RA2 (rogue-agent) in agent_reach/skill/SKILL_en.md"}, "properties": {"repobilityId": "cc988484eba2be59", "scanner": "scanner-primary", "fingerprint": "c269f8d8ef862617", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "rogue-agent", "RA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agent_reach/skill/SKILL_en.md"}, "region": {"startLine": 110}}}]}, {"ruleId": "scanner-e637c415447867e4", "level": "none", "message": {"text": "Run SkillSpector's LLM-backed analysis in your own pipeline"}, "properties": {"repobilityId": "1936f198ff5212bf", "scanner": "scanner-primary", "fingerprint": "e637c415447867e4", "layer": "security", "severity": "info", "confidence": 1.0, "tags": ["skillspector", "mcp-skill", "llm-advisory", "ai-coder"]}}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-51977a3899cebe53", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "aad1116255d59209", "scanner": "scanner-primary", "fingerprint": "51977a3899cebe53", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pytest.yml"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-dc703718f19814e9", "level": "note", "message": {"text": "Very large file: agent_reach/cli.py (1834 lines)"}, "properties": {"repobilityId": "d1251ee28baa993d", "scanner": "scanner-primary", "fingerprint": "dc703718f19814e9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "e4dd3f43354fa4bf", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}]}]}