Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

calesthio/OpenMontage

https://github.com/calesthio/OpenMontage · scanned 2026-07-23 19:47 UTC (1 month, 2 weeks ago)

257 raw signals (0 security + 257 graph)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 1 month, 2 weeks ago · v7 · last Δ +0.1 (diff) · 248 actionable findings from 1 signal source. 9 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
77.4
/100
Security checks
77
0 findings
System graph
77
100.0% cov · 248 findings
Critical
0
click to filter
Agents
10
0 votes
Crowd
0
reported
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 0 High 47 Medium 163 Low 35 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 248 Crowd 0 Layer: Software 16 Security 104 Quality 123 Cicd 1 Dependencies 4
Scan summary Repository scanned at 77.4/100 with 100.0% coverage. It contains 5024 nodes across 10 cross-layer flows, written primarily in mixed languages. Engine surfaced 257 findings — concentrated in quality (123), security (104), software (25). Risk profile is high: 0 critical, 47 high, 163 medium. Recommended next step: open the quality layer findings first — that's where the highest-impact wins live.

Showing 245 of 248 actionable findings. 257 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

high System graph security Agent instructions conf 1.00 Agent instruction/config may expose a secret: .claude/skills/avatar-video/references/captions.md
Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only.
.claude/skills/avatar-video/references/captions.md:138 SecretsClaude instruction
high System graph security Agent instructions conf 1.00 Agent instruction/config may expose a secret: .claude/skills/avatar-video/references/photo-avatars.md
Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only.
.claude/skills/avatar-video/references/photo-avatars.md:169 SecretsClaude instruction
high System graph security Agent instructions conf 1.00 Agent instruction/config may expose a secret: .claude/skills/bfl-api/references/api-key-setup.md
Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only.
.claude/skills/bfl-api/references/api-key-setup.md:50 SecretsClaude instruction
high System graph security Agent instructions conf 1.00 Agent instruction/config may expose a secret: .claude/skills/bfl-api/references/webhook-integration.md
Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only.
.claude/skills/bfl-api/references/webhook-integration.md:270 SecretsClaude instruction
high System graph security Agent instructions conf 1.00 Agent instruction/config may expose a secret: .claude/skills/bfl-api/SKILL.md
Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only.
.claude/skills/bfl-api/SKILL.md:163 SecretsClaude instruction
high System graph security Agent instructions conf 1.00 Agent instruction/config may expose a secret: .claude/skills/heygen/references/captions.md
Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only.
.claude/skills/heygen/references/captions.md:138 SecretsClaude instruction
high System graph security Agent instructions conf 1.00 Agent instruction/config may expose a secret: .claude/skills/heygen/references/photo-avatars.md
Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only.
.claude/skills/heygen/references/photo-avatars.md:169 SecretsClaude instruction
high System graph security Agent instructions conf 1.00 Agent instruction/config may expose a secret: .claude/skills/ltx2/SKILL.md
Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only.
.claude/skills/ltx2/SKILL.md:164 SecretsClaude instruction
high System graph security Agent instructions conf 1.00 Agent instruction/config may expose a secret: .claude/skills/threejs-materials/SKILL.md
Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only.
.claude/skills/threejs-materials/SKILL.md:505 SecretsClaude instruction
high System graph security Agent instructions conf 1.00 Agent instruction/config may expose a secret: .claude/skills/video-translate/SKILL.md
Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only.
.claude/skills/video-translate/SKILL.md:230 SecretsClaude instruction
high System graph security Agent instructions conf 1.00 Agent instruction/config may expose a secret: .claude/skills/video_toolkit/SKILL.md
Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only.
.claude/skills/video_toolkit/SKILL.md:7 SecretsClaude instruction
high System graph security Trivy conf 1.00 CVE-2026-13676: fast-uri 3.1.2 — remotion-composer/package-lock.json
fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, …
VulnCve 2026 13676
high System graph security Trivy conf 1.00 CVE-2026-16221: fast-uri 3.1.2 — remotion-composer/package-lock.json
Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x ... Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL pa…
VulnCve 2026 16221
high System graph security Skillspector conf 0.80 SkillSpector E2 (data-exfil) in .claude/skills/ai-video-gen/SKILL.md
os.environ["HEYGEN_API_KEY"] Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: ai-video-gen Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.80 Remediation: Avoid reading sensitive env vars (API keys…
.claude/skills/ai-video-gen/SKILL.md:174 Mcp skillData exfilE2
high System graph security Skillspector conf 0.80 SkillSpector E2 (data-exfil) in .claude/skills/avatar-video/references/assets.md
os.environ["HEYGEN_API_KEY"] Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: avatar-video Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.80 Remediation: Avoid reading sensitive env vars (API keys…
.claude/skills/avatar-video/references/assets.md:145 Mcp skillData exfilE2
high System graph security Skillspector conf 0.80 SkillSpector E2 (data-exfil) in .claude/skills/avatar-video/references/avatars.md
os.environ["HEYGEN_API_KEY"] Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: avatar-video Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.80 Remediation: Avoid reading sensitive env vars (API keys…
.claude/skills/avatar-video/references/avatars.md:105 Mcp skillData exfilE2
high System graph security Skillspector conf 0.80 SkillSpector E2 (data-exfil) in .claude/skills/avatar-video/references/photo-avatars.md
os.environ["HEYGEN_API_KEY"] Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: avatar-video Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.80 Remediation: Avoid reading sensitive env vars (API keys…
.claude/skills/avatar-video/references/photo-avatars.md:263 Mcp skillData exfilE2
high System graph security Skillspector conf 0.80 SkillSpector E2 (data-exfil) in .claude/skills/avatar-video/references/quota.md
os.environ["HEYGEN_API_KEY"] Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: avatar-video Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.80 Remediation: Avoid reading sensitive env vars (API keys…
.claude/skills/avatar-video/references/quota.md:46 Mcp skillData exfilE2
high System graph security Skillspector conf 0.80 SkillSpector E2 (data-exfil) in .claude/skills/avatar-video/references/templates.md
os.environ["HEYGEN_API_KEY"] Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: avatar-video Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.80 Remediation: Avoid reading sensitive env vars (API keys…
.claude/skills/avatar-video/references/templates.md:69 Mcp skillData exfilE2
high System graph security Skillspector conf 0.80 SkillSpector E2 (data-exfil) in .claude/skills/avatar-video/references/video-generation.md
os.environ["HEYGEN_API_KEY"] Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: avatar-video Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.80 Remediation: Avoid reading sensitive env vars (API keys…
.claude/skills/avatar-video/references/video-generation.md:193 Mcp skillData exfilE2
high System graph security Skillspector conf 0.80 SkillSpector E2 (data-exfil) in .claude/skills/avatar-video/references/video-status.md
os.environ["HEYGEN_API_KEY"] Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: avatar-video Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.80 Remediation: Avoid reading sensitive env vars (API keys…
.claude/skills/avatar-video/references/video-status.md:72 Mcp skillData exfilE2
high System graph security Skillspector conf 0.80 SkillSpector E2 (data-exfil) in .claude/skills/avatar-video/references/voices.md
os.environ["HEYGEN_API_KEY"] Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: avatar-video Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.80 Remediation: Avoid reading sensitive env vars (API keys…
.claude/skills/avatar-video/references/voices.md:63 Mcp skillData exfilE2
high System graph security Skillspector conf 0.70 SkillSpector E2 (data-exfil) in .claude/skills/bfl-api/references/code-examples/python-client.py
os.environ.get("BFL_API_KEY Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: bfl-api Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.70 Remediation: Avoid reading sensitive env vars (API keys, toke…
.claude/skills/bfl-api/references/code-examples/python-client.py:456 Mcp skillData exfilE2
high System graph security Skillspector conf 0.80 SkillSpector E2 (data-exfil) in .claude/skills/create-video/references/assets.md
os.environ["HEYGEN_API_KEY"] Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: create-video Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.80 Remediation: Avoid reading sensitive env vars (API keys…
.claude/skills/create-video/references/assets.md:145 Mcp skillData exfilE2
high System graph security Skillspector conf 0.80 SkillSpector E2 (data-exfil) in .claude/skills/create-video/references/quota.md
os.environ["HEYGEN_API_KEY"] Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: create-video Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.80 Remediation: Avoid reading sensitive env vars (API keys…
.claude/skills/create-video/references/quota.md:46 Mcp skillData exfilE2
high System graph security Skillspector conf 0.80 SkillSpector E2 (data-exfil) in .claude/skills/create-video/references/video-agent.md
os.environ["HEYGEN_API_KEY"] Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: create-video Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.80 Remediation: Avoid reading sensitive env vars (API keys…
.claude/skills/create-video/references/video-agent.md:192 Mcp skillData exfilE2
high System graph security Skillspector conf 0.80 SkillSpector E2 (data-exfil) in .claude/skills/create-video/references/video-status.md
os.environ["HEYGEN_API_KEY"] Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: create-video Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.80 Remediation: Avoid reading sensitive env vars (API keys…
.claude/skills/create-video/references/video-status.md:72 Mcp skillData exfilE2
high System graph security Skillspector conf 0.80 SkillSpector E2 (data-exfil) in .claude/skills/faceswap/SKILL.md
os.environ["HEYGEN_API_KEY"] Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: faceswap Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.80 Remediation: Avoid reading sensitive env vars (API keys, to…
.claude/skills/faceswap/SKILL.md:116 Mcp skillData exfilE2
high System graph security Skillspector conf 0.80 SkillSpector E2 (data-exfil) in .claude/skills/heygen/references/assets.md
os.environ["HEYGEN_API_KEY"] Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: heygen Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.80 Remediation: Avoid reading sensitive env vars (API keys, toke…
.claude/skills/heygen/references/assets.md:145 Mcp skillData exfilE2
high System graph security Skillspector conf 0.80 SkillSpector E2 (data-exfil) in .claude/skills/heygen/references/authentication.md
os.environ["HEYGEN_API_KEY"] Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: heygen Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.80 Remediation: Avoid reading sensitive env vars (API keys, toke…
.claude/skills/heygen/references/authentication.md:73 Mcp skillData exfilE2
high System graph security Skillspector conf 0.80 SkillSpector E2 (data-exfil) in .claude/skills/heygen/references/avatars.md
os.environ["HEYGEN_API_KEY"] Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: heygen Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.80 Remediation: Avoid reading sensitive env vars (API keys, toke…
.claude/skills/heygen/references/avatars.md:105 Mcp skillData exfilE2
high System graph security Skillspector conf 0.80 SkillSpector E2 (data-exfil) in .claude/skills/heygen/references/photo-avatars.md
os.environ["HEYGEN_API_KEY"] Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: heygen Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.80 Remediation: Avoid reading sensitive env vars (API keys, toke…
.claude/skills/heygen/references/photo-avatars.md:263 Mcp skillData exfilE2
high System graph security Skillspector conf 0.80 SkillSpector E2 (data-exfil) in .claude/skills/heygen/references/quota.md
os.environ["HEYGEN_API_KEY"] Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: heygen Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.80 Remediation: Avoid reading sensitive env vars (API keys, toke…
.claude/skills/heygen/references/quota.md:46 Mcp skillData exfilE2
high System graph security Skillspector conf 0.80 SkillSpector E2 (data-exfil) in .claude/skills/heygen/references/templates.md
os.environ["HEYGEN_API_KEY"] Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: heygen Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.80 Remediation: Avoid reading sensitive env vars (API keys, toke…
.claude/skills/heygen/references/templates.md:69 Mcp skillData exfilE2
high System graph security Skillspector conf 0.80 SkillSpector E2 (data-exfil) in .claude/skills/heygen/references/video-agent.md
os.environ["HEYGEN_API_KEY"] Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: heygen Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.80 Remediation: Avoid reading sensitive env vars (API keys, toke…
.claude/skills/heygen/references/video-agent.md:192 Mcp skillData exfilE2
high System graph security Skillspector conf 0.80 SkillSpector E2 (data-exfil) in .claude/skills/heygen/references/video-generation.md
os.environ["HEYGEN_API_KEY"] Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: heygen Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.80 Remediation: Avoid reading sensitive env vars (API keys, toke…
.claude/skills/heygen/references/video-generation.md:193 Mcp skillData exfilE2
high System graph security Skillspector conf 0.80 SkillSpector E2 (data-exfil) in .claude/skills/heygen/references/video-status.md
os.environ["HEYGEN_API_KEY"] Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: heygen Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.80 Remediation: Avoid reading sensitive env vars (API keys, toke…
.claude/skills/heygen/references/video-status.md:72 Mcp skillData exfilE2
high System graph security Skillspector conf 0.80 SkillSpector E2 (data-exfil) in .claude/skills/heygen/references/voices.md
os.environ["HEYGEN_API_KEY"] Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: heygen Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.80 Remediation: Avoid reading sensitive env vars (API keys, toke…
.claude/skills/heygen/references/voices.md:63 Mcp skillData exfilE2
high System graph security Skillspector conf 0.85 SkillSpector P6 (prompt-injection) in .claude/skills/create-video/references/prompt-examples.md
Output Prompt Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties. Skill: create-video Rule: P6 Category: prompt-injection Severity: HIGH Confidence: 0.85 Remediation: Remove any instructions that reveal, pr…
.claude/skills/create-video/references/prompt-examples.md:21 Mcp skillPrompt injectionP6
high System graph security Skillspector conf 0.85 SkillSpector P6 (prompt-injection) in .claude/skills/heygen/references/prompt-examples.md
Output Prompt Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties. Skill: heygen Rule: P6 Category: prompt-injection Severity: HIGH Confidence: 0.85 Remediation: Remove any instructions that reveal, print, o…
.claude/skills/heygen/references/prompt-examples.md:21 Mcp skillPrompt injectionP6
high System graph security Skillspector conf 0.60 SkillSpector PE3 (priv-esc) in .claude/skills/ltx2/SKILL.md
.env Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts. Skill: ltx2 Rule: PE3 Category: priv-esc Severity: HIGH Confidence: 0.60 Remediation: Remove references to credential paths. Use environment variables or secrets managers. For …
.claude/skills/ltx2/SKILL.md:169 Mcp skillPriv escPe3
high System graph security Skillspector conf 0.85 SkillSpector RA1 (rogue-agent) in .claude/skills/ffmpeg/SKILL.md
Update this skill Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors. Skill: ffmpeg Rule: RA1 Category: rogue-agent Severity: HIGH Confidence: 0.85 Remediatio…
.claude/skills/ffmpeg/SKILL.md:429 Mcp skillRogue agentRa1
high System graph security Skillspector conf 0.80 SkillSpector TM1 (tool-misuse) in .claude/skills/avatar-video/SKILL.md
DELETE /v2/videos/{video_id}` Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns). Skill: avatar-video Rule: TM1 Category: tool-misuse Severity: HIGH Confidence: 0.80 Remedia…
.claude/skills/avatar-video/SKILL.md:36 Mcp skillTool misuseTm1
high System graph security Skillspector conf 0.80 SkillSpector TM1 (tool-misuse) in .claude/skills/create-video/SKILL.md
DELETE /v2/videos/{video_id}` Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns). Skill: create-video Rule: TM1 Category: tool-misuse Severity: HIGH Confidence: 0.80 Remedia…
.claude/skills/create-video/SKILL.md:39 Mcp skillTool misuseTm1
high System graph security Skillspector conf 0.80 SkillSpector TM1 (tool-misuse) in .claude/skills/heygen/SKILL.md
DELETE /v2/videos/{video_id}` Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns). Skill: heygen Rule: TM1 Category: tool-misuse Severity: HIGH Confidence: 0.80 Remediation: …
.claude/skills/heygen/SKILL.md:36 Mcp skillTool misuseTm1
high System graph dependencies dependencies conf 0.90 Vulnerable dependency fast-uri 3.1.2: GHSA-4c8g-83qw-93j6
OSV.dev reports `fast-uri` at version `3.1.2` (resolved in `remotion-composer/package-lock.json`) is affected by GHSA-4c8g-83qw-93j6 (aka CVE-2026-13676). Note: `fast-uri` is a transitive dependency — pulled in by another package, not declared directly in a manifest. fast-uri vulnerable to host co…
remotion-composer/package-lock.json ScaOsvGhsa 4c8g 83qw 93j6
high System graph dependencies dependencies conf 0.90 Vulnerable dependency fast-uri 3.1.2: GHSA-v2hh-gcrm-f6hx
OSV.dev reports `fast-uri` at version `3.1.2` (resolved in `remotion-composer/package-lock.json`) is affected by GHSA-v2hh-gcrm-f6hx (aka CVE-2026-16221). Note: `fast-uri` is a transitive dependency — pulled in by another package, not declared directly in a manifest. fast-uri vulnerable to host co…
remotion-composer/package-lock.json ScaOsvGhsa v2hh gcrm f6hx
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/commands/animated-drawing.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/commands/animated-drawing.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/commands/backlot.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/commands/backlot.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/ai-video-gen/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/ai-video-gen/SKILL.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/avatar-video/references/assets.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/avatar-video/references/assets.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/avatar-video/references/dimensions.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/avatar-video/references/dimensions.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/avatar-video/references/photo-avatars.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/avatar-video/references/photo-avatars.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/create-video/references/assets.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/create-video/references/assets.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/create-video/references/dimensions.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/create-video/references/dimensions.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/create-video/references/prompt-optimizer.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/create-video/references/prompt-optimizer.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/create-video/references/video-agent.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/create-video/references/video-agent.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/create-video/references/visual-styles.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/create-video/references/visual-styles.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/create-video/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/create-video/SKILL.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/elevenlabs/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/elevenlabs/SKILL.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/faceswap/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/faceswap/SKILL.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/ffmpeg/reference.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/ffmpeg/reference.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/ffmpeg/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/ffmpeg/SKILL.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/flux-best-practices/rules/typography-text.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/flux-best-practices/rules/typography-text.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/heygen/references/assets.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/heygen/references/assets.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/heygen/references/authentication.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/heygen/references/authentication.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/heygen/references/dimensions.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/heygen/references/dimensions.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/heygen/references/photo-avatars.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/heygen/references/photo-avatars.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/heygen/references/prompt-optimizer.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/heygen/references/prompt-optimizer.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/heygen/references/video-agent.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/heygen/references/video-agent.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/heygen/references/visual-styles.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/heygen/references/visual-styles.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/manimce-best-practices/rules/cli.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/manimce-best-practices/rules/cli.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/manimce-best-practices/rules/config.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/manimce-best-practices/rules/config.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/manimce-best-practices/rules/scenes.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/manimce-best-practices/rules/scenes.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/manimce-best-practices/rules/text-animations.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/manimce-best-practices/rules/text-animations.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/references/equation_transforms.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/manimgl-best-practices/references/equation_transforms.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/references/parallax_starfield.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/manimgl-best-practices/references/parallax_starfield.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/references/rotating_exponentials.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/manimgl-best-practices/references/rotating_exponentials.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/references/spring_mass_system.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/manimgl-best-practices/references/spring_mass_system.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/references/three_d_surfaces.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/manimgl-best-practices/references/three_d_surfaces.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/references/transit_animation.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/manimgl-best-practices/references/transit_animation.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/references/vector_fields.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/manimgl-best-practices/references/vector_fields.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/rules/interactive.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/manimgl-best-practices/rules/interactive.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/rules/scenes.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/manimgl-best-practices/rules/scenes.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/manimgl-best-practices/SKILL.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/music/references/api_reference.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/music/references/api_reference.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/music/references/installation.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/music/references/installation.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/music/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/music/SKILL.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/playwright-recording/reference.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/playwright-recording/reference.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/3d.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/3d.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/audio-visualization.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/audio-visualization.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/audio.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/audio.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/charts.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/charts.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/display-captions.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/display-captions.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/ffmpeg.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/ffmpeg.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/fonts.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/fonts.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/gifs.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/gifs.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/import-srt-captions.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/import-srt-captions.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/light-leaks.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/light-leaks.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/lottie.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/lottie.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/maps.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/maps.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/parameters.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/parameters.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/transcribe-captions.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/transcribe-captions.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/transitions.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/transitions.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/transparent-videos.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/transparent-videos.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/videos.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/videos.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/voiceover.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion-best-practices/rules/voiceover.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/remotion/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/remotion/SKILL.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/sound-effects/references/installation.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/sound-effects/references/installation.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/sound-effects/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/sound-effects/SKILL.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/speech-to-text/references/installation.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/speech-to-text/references/installation.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/speech-to-text/references/realtime-client-side.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/speech-to-text/references/realtime-client-side.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/speech-to-text/references/realtime-server-side.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/speech-to-text/references/realtime-server-side.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/speech-to-text/references/transcription-options.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/speech-to-text/references/transcription-options.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/speech-to-text/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/speech-to-text/SKILL.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/text-to-speech/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/text-to-speech/SKILL.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/vercel-composition-patterns/AGENTS.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/vercel-composition-patterns/AGENTS.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/vercel-composition-patterns/rules/patterns-explicit-variants.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/vercel-composition-patterns/rules/patterns-explicit-variants.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/advanced-init-once.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/vercel-react-best-practices/rules/advanced-init-once.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/async-dependencies.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/vercel-react-best-practices/rules/async-dependencies.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/async-parallel.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/vercel-react-best-practices/rules/async-parallel.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/js-length-check-first.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/vercel-react-best-practices/rules/js-length-check-first.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/rendering-resource-hints.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/vercel-react-best-practices/rules/rendering-resource-hints.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/rendering-svg-precision.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/vercel-react-best-practices/rules/rendering-svg-precision.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/rerender-move-effect-to-event.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/vercel-react-best-practices/rules/rerender-move-effect-to-event.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/rerender-split-combined-hooks.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/vercel-react-best-practices/rules/rerender-split-combined-hooks.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/server-after-nonblocking.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/vercel-react-best-practices/rules/server-after-nonblocking.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/server-cache-react.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/vercel-react-best-practices/rules/server-cache-react.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/server-hoist-static-io.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/vercel-react-best-practices/rules/server-hoist-static-io.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/server-parallel-fetching.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/vercel-react-best-practices/rules/server-parallel-fetching.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/video-download/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/video-download/SKILL.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/video-edit/references/operations.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/video-edit/references/operations.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/video-understand/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/video-understand/SKILL.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/video_toolkit/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/video_toolkit/SKILL.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/visual-style/references/gallery/game-boy-color.visual-style.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/visual-style/references/gallery/game-boy-color.visual-style.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/web-design-guidelines/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/web-design-guidelines/SKILL.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .codex/prompts/animated-drawing.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.codex/prompts/animated-drawing.md VerificationCodex instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .codex/prompts/backlot.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.codex/prompts/backlot.md VerificationCodex instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .codex/prompts/README.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.codex/prompts/README.md VerificationCodex instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .cursor/commands/animated-drawing.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.cursor/commands/animated-drawing.md VerificationCursor rule
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .cursor/commands/backlot.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.cursor/commands/backlot.md VerificationCursor rule
medium System graph security Agent instructions conf 1.00 Agent instruction contains unpinned remote install: .claude/skills/agents/references/installation.md
Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands.
.claude/skills/agents/references/installation.md:8 Supply chainClaude instruction
medium System graph security Agent instructions conf 1.00 Agent instruction contains unpinned remote install: .claude/skills/agents/SKILL.md
Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands.
.claude/skills/agents/SKILL.md:21 Supply chainClaude instruction
medium System graph security Analyzer error conf 1.00 Analyzer timeout: security.semgrep
analyzer exceeded 60.0s wall-clock (thread mode — daemon abandoned). Bump REPOBILITY_ANALYZER_TIMEOUT_S if expected.
Timeout
medium System graph quality Placeholder conf 1.00 Critical user flow still appears backed by mock or placeholder data
A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded.
Mock dataCritical flowGenerated repo pattern
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — .claude/skills/manimgl-best-practices/templates/3d_scene.py:258
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
.claude/skills/manimgl-best-practices/templates/3d_scene.py:258 runtime safetyRobustness
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — .claude/skills/manimgl-best-practices/templates/basic_scene.py:134
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
.claude/skills/manimgl-best-practices/templates/basic_scene.py:134 runtime safetyRobustness
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — .claude/skills/manimgl-best-practices/templates/math_scene.py:333
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
.claude/skills/manimgl-best-practices/templates/math_scene.py:333 runtime safetyRobustness
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — .claude/skills/video-understand/scripts/understand_video.py:67
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
.claude/skills/video-understand/scripts/understand_video.py:67 runtime safetyRobustness
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — render_demo.py:63
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
render_demo.py:63 runtime safetyRobustness
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — scripts/backlot_visual_eval.py:121
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
scripts/backlot_visual_eval.py:121 runtime safetyRobustness
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — scripts/backlot_watch_captures.py:104
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
scripts/backlot_watch_captures.py:104 runtime safetyRobustness
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — tools/audio/elevenlabs_tts.py:175
`requests.post(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
tools/audio/elevenlabs_tts.py:175 runtime safetyRobustness
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — tools/audio/piper_tts.py:123
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
tools/audio/piper_tts.py:123 runtime safetyRobustness
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — tools/character/character_animation.py:104
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
tools/character/character_animation.py:104 runtime safetyRobustness
medium System graph quality Placeholder conf 1.00 Placeholder or mock-heavy implementation detected
Found 19 placeholder/mock markers across 14 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data.
Mock dataIncompleteGenerated repo pattern
medium System graph security Skillspector conf 0.60 SkillSpector AST4 (behavioral-ast) in .claude/skills/manimgl-best-practices/templates/3d_scene.py
subprocess.run(["manimgl", __file__, "ThreeDSceneTemplate"]) subprocess module calls execute external commands. Without careful input validation, this enables command injection. Skill: manimgl-best-practices Rule: AST4 Category: behavioral-ast Severity: MEDIUM Confidence: 0.60 Remediation: Use…
.claude/skills/manimgl-best-practices/templates/3d_scene.py:258 Mcp skillBehavioral astAst4
medium System graph security Skillspector conf 0.60 SkillSpector AST4 (behavioral-ast) in .claude/skills/manimgl-best-practices/templates/basic_scene.py
subprocess.run(["manimgl", __file__, "BasicSceneTemplate"]) subprocess module calls execute external commands. Without careful input validation, this enables command injection. Skill: manimgl-best-practices Rule: AST4 Category: behavioral-ast Severity: MEDIUM Confidence: 0.60 Remediation: Use …
.claude/skills/manimgl-best-practices/templates/basic_scene.py:134 Mcp skillBehavioral astAst4
medium System graph security Skillspector conf 0.60 SkillSpector AST4 (behavioral-ast) in .claude/skills/manimgl-best-practices/templates/math_scene.py
subprocess.run(["manimgl", __file__, "MathSceneTemplate"]) subprocess module calls execute external commands. Without careful input validation, this enables command injection. Skill: manimgl-best-practices Rule: AST4 Category: behavioral-ast Severity: MEDIUM Confidence: 0.60 Remediation: Use s…
.claude/skills/manimgl-best-practices/templates/math_scene.py:333 Mcp skillBehavioral astAst4
medium System graph security Skillspector conf 0.60 SkillSpector E1 (data-exfil) in .claude/skills/agents/references/agent-configuration.md
curl -X GET "https://api.elevenlabs.io/v1/convai/agents" -H "xi-api-key: $ELEVENLABS_API_KEY" ``` ### SDK: Get Agent ```python agent = client.conversational_ai.agents.get(agent_id="your-agent-id") ` Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. M…
.claude/skills/agents/references/agent-configuration.md:450 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.50 SkillSpector E1 (data-exfil) in .claude/skills/agents/references/client-tools.md
https://api.example.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: agents Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trusted and necessary.…
.claude/skills/agents/references/client-tools.md:49 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 SkillSpector E1 (data-exfil) in .claude/skills/agents/references/installation.md
cURL / REST API Set your API key as an environment variable: ```bash export ELEVENLABS_API_KEY="your-api-key" ``` Include in requests via the `xi-api-key` header: ```bash curl -X POST "https://api Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. M…
.claude/skills/agents/references/installation.md:101 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 SkillSpector E1 (data-exfil) in .claude/skills/agents/SKILL.md
cURL ```bash curl -X POST "https://api.elevenlabs.io/v1/convai/agents/create?enable_versioning=true" \ -H "xi-api-key: $ELEVENLABS_API_KEY" -H "Content-Type: application/json" \ -d Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is…
.claude/skills/agents/SKILL.md:83 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 SkillSpector E1 (data-exfil) in .claude/skills/ai-video-gen/SKILL.md
requests.post( "https:// Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: ai-video-gen Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.60 Remediation: Verify the destination URL is trusted …
.claude/skills/ai-video-gen/SKILL.md:171 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/assets.md
requests.post( "https:// Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: avatar-video Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.60 Remediation: Verify the destination URL is trus…
.claude/skills/avatar-video/references/assets.md:142 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.50 SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/avatars.md
https://api.heygen.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: avatar-video Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trusted and neces…
.claude/skills/avatar-video/references/avatars.md:18 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/dimensions.md
curl ```bash # Landscape 1080p curl -X POST "https://api.heygen.com/v2/video/generate" \ -H "X-Api-Key: $HEYGEN_API_KEY" \ -H "Content-Type: application/json" \ -d Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. …
.claude/skills/avatar-video/references/dimensions.md:66 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/photo-avatars.md
requests.post( "https:// Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: avatar-video Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.60 Remediation: Verify the destination URL is trus…
.claude/skills/avatar-video/references/photo-avatars.md:267 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.50 SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/quota.md
https://api.heygen.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: avatar-video Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trusted and neces…
.claude/skills/avatar-video/references/quota.md:15 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/remotion-integration.md
fetch("https://api.heygen.com/v2/video/generate", { method: "POST" Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: avatar-video Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.60 Remediation: …
.claude/skills/avatar-video/references/remotion-integration.md:96 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.70 SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/templates.md
requests.post( f"https://api.heygen.com/v2/template/{template_id}/generate", headers={ "X-Api-Key": os.environ["HEYGEN_API_KEY"], "Content-Type": "application/j Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. M…
.claude/skills/avatar-video/references/templates.md:223 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/video-generation.md
requests.post( "https:// Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: avatar-video Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.60 Remediation: Verify the destination URL is trusted …
.claude/skills/avatar-video/references/video-generation.md:190 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/video-status.md
fetch( "https://api.heygen.com/v2/video/generate", { method: "POST" Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: avatar-video Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.60 Re…
.claude/skills/avatar-video/references/video-status.md:354 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.50 SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/voices.md
https://api.heygen.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: avatar-video Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trusted and neces…
.claude/skills/avatar-video/references/voices.md:15 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/webhooks.md
fetch("https://api.heygen.com/v1/webhook/endpoint.add", { method: "POST" Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: avatar-video Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.60 Remedia…
.claude/skills/avatar-video/references/webhooks.md:205 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.50 SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/SKILL.md
https://api.heygen.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: avatar-video Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trusted and neces…
.claude/skills/avatar-video/SKILL.md:24 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.70 SkillSpector E1 (data-exfil) in .claude/skills/bfl-api/references/code-examples/curl-examples.sh
curl -s -X POST "${BASE_URL}/v1/flux-2-pro" \ -H "x-key: ${API_KEY}" \ -H "Content-Type: application/json" \ -d Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: bfl-api Rule: E1 Category: data-exfil Severit…
.claude/skills/bfl-api/references/code-examples/curl-examples.sh:34 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 SkillSpector E1 (data-exfil) in .claude/skills/bfl-api/references/endpoints.md
curl -X POST "https://api.bfl.ai/v1/flux-2-pro" \ -H "x-key: YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "prompt": "A serene mountain landscape at golden hour", "width": Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Ma…
.claude/skills/bfl-api/references/endpoints.md:157 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.70 SkillSpector E1 (data-exfil) in .claude/skills/bfl-api/references/polling-patterns.md
requests.post(endpoint, headers=self.headers, json= Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: bfl-api Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.70 Remediation: Verify the destination U…
.claude/skills/bfl-api/references/polling-patterns.md:137 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.70 SkillSpector E1 (data-exfil) in .claude/skills/bfl-api/references/rate-limiting.md
requests.post(endpoint, json= Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: bfl-api Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.70 Remediation: Verify the destination URL is trusted and nece…
.claude/skills/bfl-api/references/rate-limiting.md:75 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 SkillSpector E1 (data-exfil) in .claude/skills/bfl-api/references/webhook-integration.md
requests.post( "https:// Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: bfl-api Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.60 Remediation: Verify the destination URL is trusted a…
.claude/skills/bfl-api/references/webhook-integration.md:289 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 SkillSpector E1 (data-exfil) in .claude/skills/bfl-api/SKILL.md
curl -X POST "https://api.bfl.ai/v1/flux-2-pro" \ -H "x-key: $BFL_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "prompt": "Change the background to a sunset", "input_image": "ht Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. M…
.claude/skills/bfl-api/SKILL.md:84 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 SkillSpector E1 (data-exfil) in .claude/skills/create-video/references/assets.md
requests.post( "https:// Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: create-video Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.60 Remediation: Verify the destination URL is trus…
.claude/skills/create-video/references/assets.md:142 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 SkillSpector E1 (data-exfil) in .claude/skills/create-video/references/dimensions.md
curl ```bash # Landscape 1080p curl -X POST "https://api.heygen.com/v2/video/generate" \ -H "X-Api-Key: $HEYGEN_API_KEY" \ -H "Content-Type: application/json" \ -d Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. …
.claude/skills/create-video/references/dimensions.md:66 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.50 SkillSpector E1 (data-exfil) in .claude/skills/create-video/references/quota.md
https://api.heygen.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: create-video Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trusted and neces…
.claude/skills/create-video/references/quota.md:15 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 SkillSpector E1 (data-exfil) in .claude/skills/create-video/references/video-agent.md
requests.post( "https:// Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: create-video Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.60 Remediation: Verify the destination URL is trusted …
.claude/skills/create-video/references/video-agent.md:189 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 SkillSpector E1 (data-exfil) in .claude/skills/create-video/references/video-status.md
fetch( "https://api.heygen.com/v2/video/generate", { method: "POST" Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: create-video Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.60 Re…
.claude/skills/create-video/references/video-status.md:354 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 SkillSpector E1 (data-exfil) in .claude/skills/create-video/references/webhooks.md
fetch("https://api.heygen.com/v1/webhook/endpoint.add", { method: "POST" Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: create-video Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.60 Remedia…
.claude/skills/create-video/references/webhooks.md:205 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 SkillSpector E1 (data-exfil) in .claude/skills/create-video/SKILL.md
curl -X POST "https://api.heygen.com/v1/video_agent/generate" \ -H "X-Api-Key: $HEYGEN_API_KEY" \ -H "Content-Type: application/json" \ -d Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: create-video Rule: …
.claude/skills/create-video/SKILL.md:24 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 SkillSpector E1 (data-exfil) in .claude/skills/faceswap/SKILL.md
requests.post( "https:// Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: faceswap Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.60 Remediation: Verify the destination URL is trusted and …
.claude/skills/faceswap/SKILL.md:113 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/assets.md
requests.post( "https:// Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: heygen Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.60 Remediation: Verify the destination URL is trusted an…
.claude/skills/heygen/references/assets.md:142 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.50 SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/authentication.md
https://api.heygen.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: heygen Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trusted and necessary. …
.claude/skills/heygen/references/authentication.md:35 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.50 SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/avatars.md
https://api.heygen.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: heygen Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trusted and necessary. …
.claude/skills/heygen/references/avatars.md:18 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/dimensions.md
curl ```bash # Landscape 1080p curl -X POST "https://api.heygen.com/v2/video/generate" \ -H "X-Api-Key: $HEYGEN_API_KEY" \ -H "Content-Type: application/json" \ -d Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. …
.claude/skills/heygen/references/dimensions.md:66 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/photo-avatars.md
requests.post( "https:// Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: heygen Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.60 Remediation: Verify the destination URL is trusted an…
.claude/skills/heygen/references/photo-avatars.md:267 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.50 SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/quota.md
https://api.heygen.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: heygen Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trusted and necessary. …
.claude/skills/heygen/references/quota.md:15 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/remotion-integration.md
fetch("https://api.heygen.com/v2/video/generate", { method: "POST" Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: heygen Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.60 Remediation: Verify…
.claude/skills/heygen/references/remotion-integration.md:96 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.70 SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/templates.md
requests.post( f"https://api.heygen.com/v2/template/{template_id}/generate", headers={ "X-Api-Key": os.environ["HEYGEN_API_KEY"], "Content-Type": "application/j Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. M…
.claude/skills/heygen/references/templates.md:223 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/video-agent.md
requests.post( "https:// Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: heygen Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.60 Remediation: Verify the destination URL is trusted and ne…
.claude/skills/heygen/references/video-agent.md:189 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/video-generation.md
requests.post( "https:// Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: heygen Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.60 Remediation: Verify the destination URL is trusted and ne…
.claude/skills/heygen/references/video-generation.md:190 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/video-status.md
fetch( "https://api.heygen.com/v2/video/generate", { method: "POST" Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: heygen Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.60 Remediat…
.claude/skills/heygen/references/video-status.md:354 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.50 SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/voices.md
https://api.heygen.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: heygen Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trusted and necessary. …
.claude/skills/heygen/references/voices.md:15 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.60 SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/webhooks.md
fetch("https://api.heygen.com/v1/webhook/endpoint.add", { method: "POST" Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: heygen Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.60 Remediation: …
.claude/skills/heygen/references/webhooks.md:205 Mcp skillData exfilE1
medium System graph security Skillspector conf 0.85 SkillSpector EA1 (excessive-agency) in .claude/skills/create-video/SKILL.md
tools:* Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution. Skill: create-video Rule: EA1 Category: excessive-agency Severity: MEDIUM Confiden…
.claude/skills/create-video/SKILL.md:47 Mcp skillExcessive agencyEa1
medium System graph security Skillspector conf 0.85 SkillSpector EA1 (excessive-agency) in .claude/skills/heygen/SKILL.md
tools:* Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution. Skill: heygen Rule: EA1 Category: excessive-agency Severity: MEDIUM Confidence: 0.…
.claude/skills/heygen/SKILL.md:45 Mcp skillExcessive agencyEa1
medium System graph security Skillspector conf 0.70 SkillSpector LP3 (mcp-least-priv) in .claude/skills/bfl-api/SKILL.md
MCP Least Privilege Without declared permissions the skill's intent is opaque and cannot be validated. Skill: bfl-api Rule: LP3 Category: mcp-least-priv Severity: MEDIUM Confidence: 0.70 Remediation: Add a 'permissions' field to SKILL.md listing the capabilities this skill requires.
.claude/skills/bfl-api/SKILL.md:1 Mcp skillMcp least privLp3
medium System graph security Skillspector conf 0.70 SkillSpector LP3 (mcp-least-priv) in .claude/skills/manimgl-best-practices/SKILL.md
MCP Least Privilege Without declared permissions the skill's intent is opaque and cannot be validated. Skill: manimgl-best-practices Rule: LP3 Category: mcp-least-priv Severity: MEDIUM Confidence: 0.70 Remediation: Add a 'permissions' field to SKILL.md listing the capabilities this skill requi…
.claude/skills/manimgl-best-practices/SKILL.md:1 Mcp skillMcp least privLp3
medium System graph security Skillspector conf 0.60 SkillSpector RA2 (rogue-agent) in .claude/skills/agents/references/installation.md
create and manage agents: ```bash npm install -g @elevenlabs/cli # or pnpm add -g @elevenlabs/cli # or yarn global add @elevenlabs/cli ``` Requires Node.js 16.0.0 or higher. ### Authentication ``` Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or sta…
.claude/skills/agents/references/installation.md:5 Mcp skillRogue agentRa2
medium System graph security Skillspector conf 0.75 SkillSpector RA2 (rogue-agent) in .claude/skills/avatar-video/references/avatars.md
pList Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction. Skill: avatar-video Rule: RA2 Category: rogue-agent Severity: MEDIUM Confidence: 0.75 Remed…
.claude/skills/avatar-video/references/avatars.md:282 Mcp skillRogue agentRa2
medium System graph security Skillspector conf 0.75 SkillSpector RA2 (rogue-agent) in .claude/skills/heygen/references/avatars.md
pList Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction. Skill: heygen Rule: RA2 Category: rogue-agent Severity: MEDIUM Confidence: 0.75 Remediation…
.claude/skills/heygen/references/avatars.md:282 Mcp skillRogue agentRa2
low System graph quality Integrity conf 1.00 26 env vars used in code but missing from .env.example
Drift between code and config docs. The first few: `APPDATA`, `AZURE_SPEECH_ENDPOINT`, `BACKLOT_PORT`, `BFL_API_KEY`, `COMFYUI_SERVER_URL`, `COVERR_API_KEY`, `DISPLAY`, `FREESOUND_API_KEY` + 18 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break.
config drift
low System graph quality Debug conf 1.00 Debug logging residue appears in source files
Found 85 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup.
CleanupRepo hardeningGenerated repo pattern
low System graph dependencies dependencies conf 0.90 Dependency react is a major version behind
`react` is pinned at `18.2.0` in `remotion-composer/package.json` while the latest release on the npm registry is `19.2.8` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `react` to `19.…
remotion-composer/package.json FreshnessOutdated
low System graph dependencies dependencies conf 0.90 Dependency react-dom is a major version behind
`react-dom` is pinned at `18.2.0` in `remotion-composer/package.json` while the latest release on the npm registry is `19.2.8` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `react-dom`…
remotion-composer/package.json FreshnessOutdated
low System graph cicd CI/CD security conf 1.00 GitHub Action is tag-pinned rather than SHA-pinned
actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.
.github/workflows/ci.yml:25 CI/CD securitySupply chainGithub actions
low System graph quality Tests conf 1.00 Low test-to-source ratio
78 tests / 326 src (ratio 0.24).
low System graph quality Agent instructions conf 1.00 Multiple root agent instruction files without precedence
The repo has multiple top-level AI-coder instruction files. Without precedence rules, different agents may follow different policies.
Governance
low System graph quality Integrity conf 1.00 Near-duplicate function bodies in 2 places
Functions with the same substantial AST body hash: tools/video/stock_sources/nasa.py:115:download, tools/video/stock_sources/archive_org.py:182:download This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene). Consolidate or document why th…
duplicatesduplication
low System graph quality Integrity conf 1.00 Near-duplicate function bodies in 3 places
Functions with the same substantial AST body hash: tools/video/stock_sources/pond5_pd.py:174:download, tools/video/stock_sources/loc.py:219:download, tools/video/stock_sources/nara.py:183:download This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-c…
duplicatesduplication
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `2_t2v_lightx2v_4steps_lora_v1` in tools/_comfyui/metadata.py:98
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `2_t2v_lightx2v_4steps_lora_v1` in tools/video/comfyui_video.py:61
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `_link_or_copy` in tools/video/clip_cache.py:354
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `eleven_multilingual_v2` in tools/audio/elevenlabs_tts.py:78
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `eleven_multilingual_v2` in tools/audio/tts_selector.py:61
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `inp_copy` in .claude/skills/manimgl-best-practices/examples/mlp_relu_visualization.py:160
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `kling_v2` in tools/video/_shared.py:22
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `text_copy` in .claude/skills/manimgl-best-practices/examples/autoregressive_flow.py:77
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `text_copy` in .claude/skills/manimgl-best-practices/examples/llm_prediction_pipeline.py:97
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph software Dead code conf 1.00 Possibly dead Python function: build_batch_prompts
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
lib/shot_prompt_builder.py:146
low System graph software Dead code conf 1.00 Possibly dead Python function: check_extension_permitted
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
lib/pipeline_loader.py:201
low System graph software Dead code conf 1.00 4 occurrences Possibly dead Python function: construct
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
4 files, 4 locations
.claude/skills/manimgl-best-practices/templates/3d_scene.py:228
.claude/skills/manimgl-best-practices/templates/basic_scene.py:97
.claude/skills/manimgl-best-practices/templates/interactive_scene.py:36
.claude/skills/manimgl-best-practices/templates/math_scene.py:292
low System graph software Dead code conf 1.00 Possibly dead Python function: format_ranking
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
lib/scoring.py:545
low System graph software Dead code conf 1.00 Possibly dead Python function: generate_batch
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
.claude/skills/bfl-api/references/code-examples/python-client.py:241
low System graph software Dead code conf 1.00 Possibly dead Python function: generate_i2i
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
.claude/skills/bfl-api/references/code-examples/python-client.py:196
low System graph software Dead code conf 1.00 Possibly dead Python function: generate_playbook
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
lib/playbook_generator.py:52
low System graph software Dead code conf 1.00 Possibly dead Python function: has_user_media
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
lib/source_media_review.py:387
low System graph software Dead code conf 1.00 Possibly dead Python function: knn
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
lib/corpus.py:288
low System graph software Dead code conf 1.00 Possibly dead Python function: model_info
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
lib/clip_embedder.py:55
low System graph software Dead code conf 1.00 Possibly dead Python function: require_env
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
lib/env_loader.py:29
low System graph software Dead code conf 1.00 Possibly dead Python function: resolve_path
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
lib/config_model.py:87
low System graph software Dead code conf 1.00 Possibly dead Python function: save_playbook
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
lib/playbook_generator.py:200
low System graph software Dead code conf 1.00 Possibly dead Python function: verify_webhook_signature
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
.claude/skills/bfl-api/references/code-examples/python-client.py:426
low System graph security Skillspector conf 0.70 SkillSpector EA3 (excessive-agency) in .claude/skills/manimce-best-practices/LICENSE.txt
NOT LIMITED TO Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface. Skill: manimce-best-practices Rule: EA3 Category: excessive-agency Severity: LOW Confidence:…
.claude/skills/manimce-best-practices/LICENSE.txt:16 Mcp skillExcessive agencyEa3
low System graph quality Complexity conf 1.00 Very large file: tests/tools/test_hyperframes_compose.py (1315 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: tools/video/video_compose.py (2634 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/c8aaa4fd-2e66-4204-974d-f7dfd4184b38/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/c8aaa4fd-2e66-4204-974d-f7dfd4184b38/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.