{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-f9a112aa4d2451de", "name": "Possibly dead Python function: has_user_media", "shortDescription": {"text": "Possibly dead Python function: has_user_media"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0eebf3d834f46162", "name": "Possibly dead Python function: knn", "shortDescription": {"text": "Possibly dead Python function: knn"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a5d0a886db272f89", "name": "Possibly dead Python function: check_extension_permitted", "shortDescription": {"text": "Possibly dead Python function: check_extension_permitted"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a64446202ae5ad02", "name": "Possibly dead Python function: generate_playbook", "shortDescription": {"text": "Possibly dead Python function: generate_playbook"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0c1f2c77cba98332", "name": "Possibly dead Python function: save_playbook", "shortDescription": {"text": "Possibly dead Python function: save_playbook"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-07caeb3589fdba88", "name": "Possibly dead Python function: format_ranking", "shortDescription": {"text": "Possibly dead Python function: format_ranking"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-71731fdaf3f66344", "name": "Possibly dead Python function: build_batch_prompts", "shortDescription": {"text": "Possibly dead Python function: build_batch_prompts"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-512d0c4eafde9f37", "name": "Possibly dead Python function: require_env", "shortDescription": {"text": "Possibly dead Python function: require_env"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e43353cd699de66b", "name": "Possibly dead Python function: model_info", "shortDescription": {"text": "Possibly dead Python function: model_info"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dac7b62d26647455", "name": "Possibly dead Python function: resolve_path", "shortDescription": {"text": "Possibly dead Python function: resolve_path"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3a900eb2dc33e85b", "name": "Possibly dead Python function: generate_i2i", "shortDescription": {"text": "Possibly dead Python function: generate_i2i"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b9b59ee343c35f8a", "name": "Possibly dead Python function: generate_batch", "shortDescription": {"text": "Possibly dead Python function: generate_batch"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4990efb95ce94102", "name": "Possibly dead Python function: verify_webhook_signature", "shortDescription": {"text": "Possibly dead Python function: verify_webhook_signature"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6daad0716db1d680", "name": "Possibly dead Python function: construct", "shortDescription": {"text": "Possibly dead Python function: construct"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7096210766e0bdce", "name": "Possibly dead Python function: construct", "shortDescription": {"text": "Possibly dead Python function: construct"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ec0c68a45ee12c25", "name": "Possibly dead Python function: construct", "shortDescription": {"text": "Possibly dead Python function: construct"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aca5cb5220c0d71d", "name": "Possibly dead Python function: construct", "shortDescription": {"text": "Possibly dead Python function: construct"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-11a2260f437c9ae8", "name": "Possibly dead Python function: construct", "shortDescription": {"text": "Possibly dead Python function: construct"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d74288f2d3d1f6e4", "name": "Possibly dead Python function: construct", "shortDescription": {"text": "Possibly dead Python function: construct"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f532265229376c30", "name": "Possibly dead Python function: construct", "shortDescription": {"text": "Possibly dead Python function: construct"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2be871fe9fcd6f02", "name": "Possibly dead Python function: construct", "shortDescription": {"text": "Possibly dead Python function: construct"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-27126efa838ca9a5", "name": "Possibly dead Python function: update_emb_vect", "shortDescription": {"text": "Possibly dead Python function: update_emb_vect"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6fa40e84cfc6d37f", "name": "Possibly dead Python function: construct", "shortDescription": {"text": "Possibly dead Python function: construct"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0d306e27bed006b0", "name": "Possibly dead Python function: construct", "shortDescription": {"text": "Possibly dead Python function: construct"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a450cfb326420ecf", "name": "Possibly dead Python function: construct", "shortDescription": {"text": "Possibly dead Python function: construct"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-10f5d905b00946e3", "name": "Analyzer timeout: security.semgrep", "shortDescription": {"text": "Analyzer timeout: security.semgrep"}, "fullDescription": {"text": "analyzer exceeded 60.0s wall-clock (thread mode \u2014 daemon abandoned). Bump REPOBILITY_ANALYZER_TIMEOUT_S if expected."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f65108679fd5b6cd", "name": "CVE-2026-13676: fast-uri 3.1.2 \u2014 remotion-composer/package-lock.json", "shortDescription": {"text": "CVE-2026-13676: fast-uri 3.1.2 \u2014 remotion-composer/package-lock.json"}, "fullDescription": {"text": "fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization\n\nfast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize() and equal() still return values that differ from a WHATWG-compatible URL parser. Applications that use fast-uri to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) befo\n\nPackage: fast-uri\nInstalled: 3.1.2\nFixed in: 4.0.1, 3.1.3, 2.4.2\nSeverity: HIGH\nFix: Upgrade fast-uri to 4.0.1, 3.1.3, 2.4.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-063d7035602beee7", "name": "CVE-2026-16221: fast-uri 3.1.2 \u2014 remotion-composer/package-lock.json", "shortDescription": {"text": "CVE-2026-16221: fast-uri 3.1.2 \u2014 remotion-composer/package-lock.json"}, "fullDescription": {"text": "Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x  ...\n\nImpact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the backslash to a forward slash for special schemes such as http, https, ws, wss, ftp, and file. As a result, the two parsers extract different hosts from the same input string. Applications that use f\n\nPackage: fast-uri\nInstalled: 3.1.2\nFixed in: 2.4.3, 3.1.4, 4.1.1\nSeverity: HIGH\nFix: Upgrade fast-uri to 2.4.3, 3.1.4, 4.1.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4f32c59a1f90902f", "name": "Agent authority lacks a verifier contract: .claude/commands/backlot.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/backlot.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7598788a494d0b05", "name": "Agent authority lacks a verifier contract: .claude/commands/animated-drawing.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/animated-drawing.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-624d54724482b6db", "name": "Agent authority lacks a verifier contract: .claude/skills/ai-video-gen/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/ai-video-gen/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1ca50ef4047a1626", "name": "Agent authority lacks a verifier contract: .claude/skills/web-design-guidelines/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/web-design-guidelines/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-760662b595e44ec1", "name": "Agent authority lacks a verifier contract: .claude/skills/flux-best-practices/rules/typography-text.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/flux-best-practices/rules/typography-text.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c3703048deaf20b4", "name": "Agent authority lacks a verifier contract: .claude/skills/text-to-speech/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/text-to-speech/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3440a3ea40b01c36", "name": "Agent authority lacks a verifier contract: .claude/skills/elevenlabs/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/elevenlabs/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-891b16a127a62c16", "name": "Agent authority lacks a verifier contract: .claude/skills/heygen/references/assets.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/heygen/references/assets.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-054c0972e03f5257", "name": "Agent instruction/config may expose a secret: .claude/skills/heygen/references/photo-avatars.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/skills/heygen/references/photo-avatars.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-27cfbf8a1a6328c5", "name": "Agent authority lacks a verifier contract: .claude/skills/heygen/references/photo-avatars.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/heygen/references/photo-avatars.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-755bee30b603578c", "name": "Agent authority lacks a verifier contract: .claude/skills/heygen/references/video-agent.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/heygen/references/video-agent.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-90fca9142ab06bcc", "name": "Agent instruction/config may expose a secret: .claude/skills/heygen/references/captions.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/skills/heygen/references/captions.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2f6f4317b9a94097", "name": "Agent authority lacks a verifier contract: .claude/skills/heygen/references/dimensions.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/heygen/references/dimensions.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8f583772382ec5f6", "name": "Agent authority lacks a verifier contract: .claude/skills/heygen/references/prompt-optimizer.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/heygen/references/prompt-optimizer.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b1e8ca09ec67c3e8", "name": "Agent authority lacks a verifier contract: .claude/skills/heygen/references/visual-styles.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/heygen/references/visual-styles.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bb243d34a9057641", "name": "Agent authority lacks a verifier contract: .claude/skills/heygen/references/authentication.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/heygen/references/authentication.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ddaab6092b58042d", "name": "Agent authority lacks a verifier contract: .claude/skills/video-understand/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/video-understand/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-80e0d194169ae92b", "name": "Agent authority lacks a verifier contract: .claude/skills/video-edit/references/operations.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/video-edit/references/operations.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-463871eec7d41c38", "name": "Agent authority lacks a verifier contract: .claude/skills/create-video/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/create-video/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-87a0c55a943a03a7", "name": "Agent authority lacks a verifier contract: .claude/skills/create-video/references/assets.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/create-video/references/assets.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-624a74a0419ce8c3", "name": "Agent authority lacks a verifier contract: .claude/skills/create-video/references/video-agent.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/create-video/references/video-agent.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e646b93a6b1fb038", "name": "Agent authority lacks a verifier contract: .claude/skills/create-video/references/dimensions.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/create-video/references/dimensions.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ed9d32bae6c42253", "name": "Agent authority lacks a verifier contract: .claude/skills/create-video/references/prompt-optimizer.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/create-video/references/prompt-optimizer.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-47274a5b90ca4d5f", "name": "Agent authority lacks a verifier contract: .claude/skills/create-video/references/visual-styles.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/create-video/references/visual-styles.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-de4fababee7f907d", "name": "Agent authority lacks a verifier contract: .claude/skills/faceswap/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/faceswap/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-956d661f15aa5cc4", "name": "Agent authority lacks a verifier contract: .claude/skills/playwright-recording/reference.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/playwright-recording/reference.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0a451b397286d983", "name": "Agent authority lacks a verifier contract: .claude/skills/remotion/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/remotion/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e35b7c474c11200c", "name": "Agent instruction/config may expose a secret: .claude/skills/threejs-materials/SKILL.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/skills/threejs-materials/SKILL.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-35596cacf6493702", "name": "Agent authority lacks a verifier contract: .claude/skills/visual-style/references/gallery/game-boy-color.visual-style.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/visual-style/references/gallery/game-boy-color.visual-style.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-575f1cee4374b172", "name": "Agent authority lacks a verifier contract: .claude/skills/video-download/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/video-download/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c78613fcb6ea3a7e", "name": "Agent instruction/config may expose a secret: .claude/skills/bfl-api/SKILL.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/skills/bfl-api/SKILL.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-81e579b375ab4a09", "name": "Agent instruction/config may expose a secret: .claude/skills/bfl-api/references/api-key-setup.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/skills/bfl-api/references/api-key-setup.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8d4dfa97f9759017", "name": "Agent instruction/config may expose a secret: .claude/skills/bfl-api/references/webhook-integration.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/skills/bfl-api/references/webhook-integration.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3062d6d09edface6", "name": "Agent authority lacks a verifier contract: .claude/skills/speech-to-text/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/speech-to-text/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bd8fb130c009dc6f", "name": "Agent authority lacks a verifier contract: .claude/skills/speech-to-text/references/realtime-server-side.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/speech-to-text/references/realtime-server-side.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dcbdbb65bf06fdd8", "name": "Agent authority lacks a verifier contract: .claude/skills/speech-to-text/references/installation.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/speech-to-text/references/installation.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a6fb85512e6a9eb4", "name": "Agent authority lacks a verifier contract: .claude/skills/speech-to-text/references/transcription-options.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/speech-to-text/references/transcription-options.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bf468caff31ce42e", "name": "Agent authority lacks a verifier contract: .claude/skills/speech-to-text/references/realtime-client-side.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/speech-to-text/references/realtime-client-side.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4488709831c5165b", "name": "Agent instruction contains unpinned remote install: .claude/skills/agents/SKILL.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: .claude/skills/agents/SKILL.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-16787a94a70ec5c6", "name": "Agent instruction contains unpinned remote install: .claude/skills/agents/references/installation.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: .claude/skills/agents/references/installation.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-92013cb0f145e51d", "name": "Agent instruction/config may expose a secret: .claude/skills/video_toolkit/SKILL.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/skills/video_toolkit/SKILL.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6b5ee1188931558e", "name": "Agent authority lacks a verifier contract: .claude/skills/video_toolkit/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/video_toolkit/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-43f2a8b7876a21b1", "name": "Agent authority lacks a verifier contract: .claude/skills/avatar-video/references/assets.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/avatar-video/references/assets.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d929d1d33e964e0c", "name": "Agent instruction/config may expose a secret: .claude/skills/avatar-video/references/photo-avatars.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/skills/avatar-video/references/photo-avatars.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ac45e07617120dab", "name": "Agent authority lacks a verifier contract: .claude/skills/avatar-video/references/photo-avatars.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/avatar-video/references/photo-avatars.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-16b278533827d034", "name": "Agent instruction/config may expose a secret: .claude/skills/avatar-video/references/captions.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/skills/avatar-video/references/captions.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-569e29762e1f9410", "name": "Agent authority lacks a verifier contract: .claude/skills/avatar-video/references/dimensions.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/avatar-video/references/dimensions.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b0454bfb0fc2489e", "name": "Agent authority lacks a verifier contract: .claude/skills/ffmpeg/reference.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/ffmpeg/reference.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5735910028b3b679", "name": "Agent authority lacks a verifier contract: .claude/skills/ffmpeg/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/ffmpeg/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4579662bed0468a8", "name": "Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e1ba68a6fe684767", "name": "Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/rules/interactive.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/rules/interactive.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ce811a3656a04710", "name": "Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/rules/scenes.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/rules/scenes.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cd20ae734211da8b", "name": "Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/references/spring_mass_system.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/references/spring_mass_system.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bf15e3b3201fc627", "name": "Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/references/equation_transforms.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/references/equation_transforms.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-873509dbc4e88cd5", "name": "Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/references/transit_animation.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/references/transit_animation.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cefcbd8759b6b97a", "name": "Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/references/parallax_starfield.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/references/parallax_starfield.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bafa2996bc997b6c", "name": "Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/references/three_d_surfaces.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/references/three_d_surfaces.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9c85c5bf833fdb20", "name": "Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/references/rotating_exponentials.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/references/rotating_exponentials.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1eba4372d00b0871", "name": "Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/references/vector_fields.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/references/vector_fields.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-22eb8e5240c736fa", "name": "Agent instruction/config may expose a secret: .claude/skills/video-translate/SKILL.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/skills/video-translate/SKILL.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-775c9c73397aeb9b", "name": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/display-captions.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/display-captions.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3d4595a7c564317e", "name": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/gifs.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/gifs.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d1839dd48325ef51", "name": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/transitions.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/transitions.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-88471abe159d2c3b", "name": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/ffmpeg.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/ffmpeg.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d8d56ba5901e3de6", "name": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/maps.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/maps.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-46ce95048bd5e096", "name": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/lottie.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/lottie.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c861cfe5d597f1b3", "name": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/light-leaks.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/light-leaks.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4e620720cae22567", "name": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/charts.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/charts.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f2da3ec3a9182762", "name": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/parameters.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/parameters.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-631305131c84e990", "name": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/import-srt-captions.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/import-srt-captions.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-949fc886050db1e7", "name": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/fonts.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/fonts.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-271e89668934a3a0", "name": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/voiceover.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/voiceover.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a014170c5b9783a2", "name": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/3d.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/3d.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7351a220651792c7", "name": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/transparent-videos.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/transparent-videos.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-24e29eafe1b30dbb", "name": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/videos.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/videos.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7f85281f72c8c8b9", "name": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/audio.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/audio.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fe020b1424694e86", "name": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/transcribe-captions.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/transcribe-captions.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c5d540c405dfdf28", "name": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/audio-visualization.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/audio-visualization.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-83405dca7aa9e59b", "name": "Agent instruction/config may expose a secret: .claude/skills/ltx2/SKILL.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/skills/ltx2/SKILL.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-dcae3de084232e81", "name": "Agent authority lacks a verifier contract: .claude/skills/sound-effects/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/sound-effects/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c6bf8900369d3efa", "name": "Agent authority lacks a verifier contract: .claude/skills/sound-effects/references/installation.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/sound-effects/references/installation.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a38338ad31ff9fff", "name": "Agent authority lacks a verifier contract: .claude/skills/vercel-composition-patterns/AGENTS.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/vercel-composition-patterns/AGENTS.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ed7b10d414a686b3", "name": "Agent authority lacks a verifier contract: .claude/skills/vercel-composition-patterns/rules/patterns-explicit-variants.m", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/vercel-composition-patterns/rules/patterns-explicit-variants.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8d5ee4ad6db1e39a", "name": "Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/advanced-init-once.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/advanced-init-once.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3be63d58ae2f512c", "name": "Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/server-hoist-static-io.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/server-hoist-static-io.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-06de946f8492faed", "name": "Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/server-cache-react.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/server-cache-react.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7b19df7e602bc140", "name": "Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/server-parallel-fetching.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/server-parallel-fetching.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8de3286afcf087b1", "name": "Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/server-after-nonblocking.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/server-after-nonblocking.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-42fccc8975005dd9", "name": "Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/rendering-resource-hints.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/rendering-resource-hints.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-85f39657dd05c44d", "name": "Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/rerender-split-combined-hook", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/rerender-split-combined-hooks.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-994972a56f1f53b5", "name": "Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/async-dependencies.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/async-dependencies.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f50ad04d10a70b78", "name": "Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/async-parallel.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/async-parallel.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5ca1e1b649775b91", "name": "Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/js-length-check-first.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/js-length-check-first.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b4fc1de90442c5a3", "name": "Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/rendering-svg-precision.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/rendering-svg-precision.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-97137f602936ba76", "name": "Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/rerender-move-effect-to-even", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/rerender-move-effect-to-event.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1c3a19753d9b3b47", "name": "Agent authority lacks a verifier contract: .claude/skills/music/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/music/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d5cc68f68d92d770", "name": "Agent authority lacks a verifier contract: .claude/skills/music/references/api_reference.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/music/references/api_reference.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e0f035af831af975", "name": "Agent authority lacks a verifier contract: .claude/skills/music/references/installation.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/music/references/installation.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-addf1ec5fd6fe69d", "name": "Agent authority lacks a verifier contract: .claude/skills/manimce-best-practices/rules/cli.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/manimce-best-practices/rules/cli.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5333911a8299b94d", "name": "Agent authority lacks a verifier contract: .claude/skills/manimce-best-practices/rules/text-animations.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/manimce-best-practices/rules/text-animations.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-158e52086bceb75d", "name": "Agent authority lacks a verifier contract: .claude/skills/manimce-best-practices/rules/scenes.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/manimce-best-practices/rules/scenes.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dfab911a0b94a04a", "name": "Agent authority lacks a verifier contract: .claude/skills/manimce-best-practices/rules/config.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/manimce-best-practices/rules/config.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-692c96ccea82c181", "name": "Agent authority lacks a verifier contract: .codex/prompts/README.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .codex/prompts/README.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-de2979271207c300", "name": "Agent authority lacks a verifier contract: .codex/prompts/backlot.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .codex/prompts/backlot.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-af4497861279e2ee", "name": "Agent authority lacks a verifier contract: .codex/prompts/animated-drawing.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .codex/prompts/animated-drawing.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-de56c33fc140355f", "name": "Agent authority lacks a verifier contract: .cursor/commands/backlot.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .cursor/commands/backlot.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a0b91b0935f943ee", "name": "Agent authority lacks a verifier contract: .cursor/commands/animated-drawing.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .cursor/commands/animated-drawing.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e725d2ab884fbd49", "name": "Multiple root agent instruction files without precedence", "shortDescription": {"text": "Multiple root agent instruction files without precedence"}, "fullDescription": {"text": "The repo has multiple top-level AI-coder instruction files. Without precedence rules, different agents may follow different policies."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-89021a0c26f5b99f", "name": "SkillSpector E1 (data-exfil) in .claude/skills/agents/SKILL.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/agents/SKILL.md"}, "fullDescription": {"text": "cURL\n\n```bash\ncurl -X POST \"https://api.elevenlabs.io/v1/convai/agents/create?enable_versioning=true\" \\\n  -H \"xi-api-key: $ELEVENLABS_API_KEY\" -H \"Content-Type: application/json\" \\\n  -d\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: agents\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-45d8cc26bfe528f6", "name": "SkillSpector E1 (data-exfil) in .claude/skills/agents/references/agent-configuration.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/agents/references/agent-configuration.md"}, "fullDescription": {"text": "curl -X GET \"https://api.elevenlabs.io/v1/convai/agents\" -H \"xi-api-key: $ELEVENLABS_API_KEY\"\n```\n\n### SDK: Get Agent\n\n```python\nagent = client.conversational_ai.agents.get(agent_id=\"your-agent-id\")\n`\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: agents\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-caf0ab3cb9bdbd6d", "name": "SkillSpector E1 (data-exfil) in .claude/skills/agents/references/client-tools.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/agents/references/client-tools.md"}, "fullDescription": {"text": "https://api.example.com/\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: agents\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.50\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.5}}, {"id": "scanner-a9a133528af2ac87", "name": "SkillSpector E1 (data-exfil) in .claude/skills/agents/references/installation.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/agents/references/installation.md"}, "fullDescription": {"text": "cURL / REST API\n\nSet your API key as an environment variable:\n\n```bash\nexport ELEVENLABS_API_KEY=\"your-api-key\"\n```\n\nInclude in requests via the `xi-api-key` header:\n\n```bash\ncurl -X POST \"https://api\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: agents\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-d7c666c90b421549", "name": "SkillSpector RA2 (rogue-agent) in .claude/skills/agents/references/installation.md", "shortDescription": {"text": "SkillSpector RA2 (rogue-agent) in .claude/skills/agents/references/installation.md"}, "fullDescription": {"text": "create and manage agents:\n\n```bash\nnpm install -g @elevenlabs/cli\n# or\npnpm add -g @elevenlabs/cli\n# or\nyarn global add @elevenlabs/cli\n```\n\nRequires Node.js 16.0.0 or higher.\n\n### Authentication\n\n```\n\nSkill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.\n\nSkill: agents\nRule: RA2  Category: rogue-agent\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-f469f5dc8eedf756", "name": "SkillSpector E1 (data-exfil) in .claude/skills/ai-video-gen/SKILL.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/ai-video-gen/SKILL.md"}, "fullDescription": {"text": "requests.post(\n        \"https://\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: ai-video-gen\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-0f268f917cd8db8f", "name": "SkillSpector E2 (data-exfil) in .claude/skills/ai-video-gen/SKILL.md", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in .claude/skills/ai-video-gen/SKILL.md"}, "fullDescription": {"text": "os.environ[\"HEYGEN_API_KEY\"]\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: ai-video-gen\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.80\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.8}}, {"id": "scanner-60525ca59de6ac36", "name": "SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/SKILL.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/SKILL.md"}, "fullDescription": {"text": "https://api.heygen.com/\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: avatar-video\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.50\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.5}}, {"id": "scanner-c588de12c9e6af3b", "name": "SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/assets.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/assets.md"}, "fullDescription": {"text": "requests.post(\n            \"https://\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: avatar-video\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-78fd04cfaf7c74b2", "name": "SkillSpector E2 (data-exfil) in .claude/skills/avatar-video/references/assets.md", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in .claude/skills/avatar-video/references/assets.md"}, "fullDescription": {"text": "os.environ[\"HEYGEN_API_KEY\"]\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: avatar-video\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.80\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.8}}, {"id": "scanner-b74a940f314993f1", "name": "SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/avatars.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/avatars.md"}, "fullDescription": {"text": "https://api.heygen.com/\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: avatar-video\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.50\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.5}}, {"id": "scanner-5db1ff398a60cbb9", "name": "SkillSpector E2 (data-exfil) in .claude/skills/avatar-video/references/avatars.md", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in .claude/skills/avatar-video/references/avatars.md"}, "fullDescription": {"text": "os.environ[\"HEYGEN_API_KEY\"]\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: avatar-video\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.80\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.8}}, {"id": "scanner-e9391af054e477d8", "name": "SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/dimensions.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/dimensions.md"}, "fullDescription": {"text": "curl\n\n```bash\n# Landscape 1080p\ncurl -X POST \"https://api.heygen.com/v2/video/generate\" \\\n  -H \"X-Api-Key: $HEYGEN_API_KEY\" \\\n  -H \"Content-Type: application/json\" \\\n  -d\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: avatar-video\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-41cdb11c0ceadd9f", "name": "SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/photo-avatars.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/photo-avatars.md"}, "fullDescription": {"text": "requests.post(\n            \"https://\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: avatar-video\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-768ef27a94a0ba37", "name": "SkillSpector E2 (data-exfil) in .claude/skills/avatar-video/references/photo-avatars.md", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in .claude/skills/avatar-video/references/photo-avatars.md"}, "fullDescription": {"text": "os.environ[\"HEYGEN_API_KEY\"]\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: avatar-video\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.80\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.8}}, {"id": "scanner-ddc60adb41a631c6", "name": "SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/quota.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/quota.md"}, "fullDescription": {"text": "https://api.heygen.com/\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: avatar-video\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.50\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.5}}, {"id": "scanner-a0b739ded33479b5", "name": "SkillSpector E2 (data-exfil) in .claude/skills/avatar-video/references/quota.md", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in .claude/skills/avatar-video/references/quota.md"}, "fullDescription": {"text": "os.environ[\"HEYGEN_API_KEY\"]\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: avatar-video\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.80\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.8}}, {"id": "scanner-ca61c53e22a00663", "name": "SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/remotion-integration.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/remotion-integration.md"}, "fullDescription": {"text": "fetch(\"https://api.heygen.com/v2/video/generate\", {\n    method: \"POST\"\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: avatar-video\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-6bf48736ea9d18f4", "name": "SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/templates.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/templates.md"}, "fullDescription": {"text": "requests.post(\n        f\"https://api.heygen.com/v2/template/{template_id}/generate\",\n        headers={\n            \"X-Api-Key\": os.environ[\"HEYGEN_API_KEY\"],\n            \"Content-Type\": \"application/j\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: avatar-video\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.70\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-3ab7056dae0cec6f", "name": "SkillSpector E2 (data-exfil) in .claude/skills/avatar-video/references/templates.md", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in .claude/skills/avatar-video/references/templates.md"}, "fullDescription": {"text": "os.environ[\"HEYGEN_API_KEY\"]\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: avatar-video\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.80\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.8}}, {"id": "scanner-ef0921ae06456456", "name": "SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/video-generation.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/video-generation.md"}, "fullDescription": {"text": "requests.post(\n        \"https://\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: avatar-video\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-510298ca8a7d4cbc", "name": "SkillSpector E2 (data-exfil) in .claude/skills/avatar-video/references/video-generation.md", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in .claude/skills/avatar-video/references/video-generation.md"}, "fullDescription": {"text": "os.environ[\"HEYGEN_API_KEY\"]\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: avatar-video\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.80\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.8}}, {"id": "scanner-cf80320227675339", "name": "SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/video-status.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/video-status.md"}, "fullDescription": {"text": "fetch(\n    \"https://api.heygen.com/v2/video/generate\",\n    {\n      method: \"POST\"\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: avatar-video\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-147f3b2d297b7494", "name": "SkillSpector E2 (data-exfil) in .claude/skills/avatar-video/references/video-status.md", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in .claude/skills/avatar-video/references/video-status.md"}, "fullDescription": {"text": "os.environ[\"HEYGEN_API_KEY\"]\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: avatar-video\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.80\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.8}}, {"id": "scanner-c7096c653671fb31", "name": "SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/voices.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/voices.md"}, "fullDescription": {"text": "https://api.heygen.com/\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: avatar-video\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.50\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.5}}, {"id": "scanner-57147193429c0883", "name": "SkillSpector E2 (data-exfil) in .claude/skills/avatar-video/references/voices.md", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in .claude/skills/avatar-video/references/voices.md"}, "fullDescription": {"text": "os.environ[\"HEYGEN_API_KEY\"]\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: avatar-video\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.80\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.8}}, {"id": "scanner-6c748d5fe7344377", "name": "SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/webhooks.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/webhooks.md"}, "fullDescription": {"text": "fetch(\"https://api.heygen.com/v1/webhook/endpoint.add\", {\n    method: \"POST\"\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: avatar-video\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-a563a6e3837a7f35", "name": "SkillSpector RA2 (rogue-agent) in .claude/skills/avatar-video/references/avatars.md", "shortDescription": {"text": "SkillSpector RA2 (rogue-agent) in .claude/skills/avatar-video/references/avatars.md"}, "fullDescription": {"text": "pList\n\nSkill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.\n\nSkill: avatar-video\nRule: RA2  Category: rogue-agent\nSeverity: MEDIUM  Confidence: 0.75\n\nRemediation: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.75}}, {"id": "scanner-0f9b2839abf9b565", "name": "SkillSpector TM1 (tool-misuse) in .claude/skills/avatar-video/SKILL.md", "shortDescription": {"text": "SkillSpector TM1 (tool-misuse) in .claude/skills/avatar-video/SKILL.md"}, "fullDescription": {"text": "DELETE /v2/videos/{video_id}`\n\nTool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).\n\nSkill: avatar-video\nRule: TM1  Category: tool-misuse\nSeverity: HIGH  Confidence: 0.80\n\nRemediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.8}}, {"id": "scanner-14b33b465807036c", "name": "SkillSpector LP3 (mcp-least-priv) in .claude/skills/bfl-api/SKILL.md", "shortDescription": {"text": "SkillSpector LP3 (mcp-least-priv) in .claude/skills/bfl-api/SKILL.md"}, "fullDescription": {"text": "MCP Least Privilege\n\nWithout declared permissions the skill's intent is opaque and cannot be validated.\n\nSkill: bfl-api\nRule: LP3  Category: mcp-least-priv\nSeverity: MEDIUM  Confidence: 0.70\n\nRemediation: Add a 'permissions' field to SKILL.md listing the capabilities this skill requires."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-ff235b294b7d43ab", "name": "SkillSpector E1 (data-exfil) in .claude/skills/bfl-api/SKILL.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/bfl-api/SKILL.md"}, "fullDescription": {"text": "curl -X POST \"https://api.bfl.ai/v1/flux-2-pro\" \\\n  -H \"x-key: $BFL_API_KEY\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"prompt\": \"Change the background to a sunset\",\n    \"input_image\": \"ht\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: bfl-api\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-bbcd33090433ee40", "name": "SkillSpector E1 (data-exfil) in .claude/skills/bfl-api/references/code-examples/curl-examples.sh", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/bfl-api/references/code-examples/curl-examples.sh"}, "fullDescription": {"text": "curl -s -X POST \"${BASE_URL}/v1/flux-2-pro\" \\\n  -H \"x-key: ${API_KEY}\" \\\n  -H \"Content-Type: application/json\" \\\n  -d\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: bfl-api\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.70\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-b351bd38e363d9e9", "name": "SkillSpector E2 (data-exfil) in .claude/skills/bfl-api/references/code-examples/python-client.py", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in .claude/skills/bfl-api/references/code-examples/python-client.py"}, "fullDescription": {"text": "os.environ.get(\"BFL_API_KEY\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: bfl-api\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-b794d37239533263", "name": "SkillSpector E1 (data-exfil) in .claude/skills/bfl-api/references/endpoints.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/bfl-api/references/endpoints.md"}, "fullDescription": {"text": "curl -X POST \"https://api.bfl.ai/v1/flux-2-pro\" \\\n  -H \"x-key: YOUR_API_KEY\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"prompt\": \"A serene mountain landscape at golden hour\",\n    \"width\":\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: bfl-api\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-5eb35734beb91aa5", "name": "SkillSpector E1 (data-exfil) in .claude/skills/bfl-api/references/polling-patterns.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/bfl-api/references/polling-patterns.md"}, "fullDescription": {"text": "requests.post(endpoint, headers=self.headers, json=\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: bfl-api\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.70\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-5f66758f8d9bfe8b", "name": "SkillSpector E1 (data-exfil) in .claude/skills/bfl-api/references/rate-limiting.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/bfl-api/references/rate-limiting.md"}, "fullDescription": {"text": "requests.post(endpoint, json=\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: bfl-api\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.70\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-60aa147b62ca9963", "name": "SkillSpector E1 (data-exfil) in .claude/skills/bfl-api/references/webhook-integration.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/bfl-api/references/webhook-integration.md"}, "fullDescription": {"text": "requests.post(\n            \"https://\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: bfl-api\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-7f0b47efb70c573d", "name": "SkillSpector E1 (data-exfil) in .claude/skills/create-video/SKILL.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/create-video/SKILL.md"}, "fullDescription": {"text": "curl -X POST \"https://api.heygen.com/v1/video_agent/generate\" \\\n  -H \"X-Api-Key: $HEYGEN_API_KEY\" \\\n  -H \"Content-Type: application/json\" \\\n  -d\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: create-video\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-0c345119256ff58d", "name": "SkillSpector E1 (data-exfil) in .claude/skills/create-video/references/assets.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/create-video/references/assets.md"}, "fullDescription": {"text": "requests.post(\n            \"https://\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: create-video\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-90ff48811a834b03", "name": "SkillSpector E2 (data-exfil) in .claude/skills/create-video/references/assets.md", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in .claude/skills/create-video/references/assets.md"}, "fullDescription": {"text": "os.environ[\"HEYGEN_API_KEY\"]\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: create-video\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.80\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.8}}, {"id": "scanner-56bc8265fbcfee7e", "name": "SkillSpector E1 (data-exfil) in .claude/skills/create-video/references/dimensions.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/create-video/references/dimensions.md"}, "fullDescription": {"text": "curl\n\n```bash\n# Landscape 1080p\ncurl -X POST \"https://api.heygen.com/v2/video/generate\" \\\n  -H \"X-Api-Key: $HEYGEN_API_KEY\" \\\n  -H \"Content-Type: application/json\" \\\n  -d\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: create-video\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-773a4f8de85a0b82", "name": "SkillSpector E1 (data-exfil) in .claude/skills/create-video/references/quota.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/create-video/references/quota.md"}, "fullDescription": {"text": "https://api.heygen.com/\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: create-video\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.50\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.5}}, {"id": "scanner-906175a892e08b50", "name": "SkillSpector E2 (data-exfil) in .claude/skills/create-video/references/quota.md", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in .claude/skills/create-video/references/quota.md"}, "fullDescription": {"text": "os.environ[\"HEYGEN_API_KEY\"]\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: create-video\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.80\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.8}}, {"id": "scanner-55fc0060d9078207", "name": "SkillSpector E1 (data-exfil) in .claude/skills/create-video/references/video-agent.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/create-video/references/video-agent.md"}, "fullDescription": {"text": "requests.post(\n        \"https://\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: create-video\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-711262c1f6db71fd", "name": "SkillSpector E2 (data-exfil) in .claude/skills/create-video/references/video-agent.md", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in .claude/skills/create-video/references/video-agent.md"}, "fullDescription": {"text": "os.environ[\"HEYGEN_API_KEY\"]\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: create-video\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.80\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.8}}, {"id": "scanner-e3e2e8c84bde58c9", "name": "SkillSpector E1 (data-exfil) in .claude/skills/create-video/references/video-status.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/create-video/references/video-status.md"}, "fullDescription": {"text": "fetch(\n    \"https://api.heygen.com/v2/video/generate\",\n    {\n      method: \"POST\"\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: create-video\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-fa6e9e4f923a1e7c", "name": "SkillSpector E2 (data-exfil) in .claude/skills/create-video/references/video-status.md", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in .claude/skills/create-video/references/video-status.md"}, "fullDescription": {"text": "os.environ[\"HEYGEN_API_KEY\"]\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: create-video\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.80\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.8}}, {"id": "scanner-d90d0ea2efb0eeb2", "name": "SkillSpector E1 (data-exfil) in .claude/skills/create-video/references/webhooks.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/create-video/references/webhooks.md"}, "fullDescription": {"text": "fetch(\"https://api.heygen.com/v1/webhook/endpoint.add\", {\n    method: \"POST\"\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: create-video\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-ae92756523b2c519", "name": "SkillSpector EA1 (excessive-agency) in .claude/skills/create-video/SKILL.md", "shortDescription": {"text": "SkillSpector EA1 (excessive-agency) in .claude/skills/create-video/SKILL.md"}, "fullDescription": {"text": "tools:*\n\nSkill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.\n\nSkill: create-video\nRule: EA1  Category: excessive-agency\nSeverity: MEDIUM  Confidence: 0.85\n\nRemediation: Restrict tool access to only the tools required for the skill's stated purpose. Use an explicit allowlist rather than granting blanket access."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-86bd7067ac10abde", "name": "SkillSpector P6 (prompt-injection) in .claude/skills/create-video/references/prompt-examples.md", "shortDescription": {"text": "SkillSpector P6 (prompt-injection) in .claude/skills/create-video/references/prompt-examples.md"}, "fullDescription": {"text": "Output Prompt\n\nSkill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.\n\nSkill: create-video\nRule: P6  Category: prompt-injection\nSeverity: HIGH  Confidence: 0.85\n\nRemediation: Remove any instructions that reveal, print, or output system prompts or internal rules. System instructions should never be exposed to end users."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.85}}, {"id": "scanner-af234b36d2b3ffbc", "name": "SkillSpector TM1 (tool-misuse) in .claude/skills/create-video/SKILL.md", "shortDescription": {"text": "SkillSpector TM1 (tool-misuse) in .claude/skills/create-video/SKILL.md"}, "fullDescription": {"text": "DELETE /v2/videos/{video_id}`\n\nTool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).\n\nSkill: create-video\nRule: TM1  Category: tool-misuse\nSeverity: HIGH  Confidence: 0.80\n\nRemediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.8}}, {"id": "scanner-52309c1d72d8715d", "name": "SkillSpector E1 (data-exfil) in .claude/skills/faceswap/SKILL.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/faceswap/SKILL.md"}, "fullDescription": {"text": "requests.post(\n        \"https://\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: faceswap\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-604cfef72311531a", "name": "SkillSpector E2 (data-exfil) in .claude/skills/faceswap/SKILL.md", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in .claude/skills/faceswap/SKILL.md"}, "fullDescription": {"text": "os.environ[\"HEYGEN_API_KEY\"]\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: faceswap\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.80\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.8}}, {"id": "scanner-85964c4afdbca854", "name": "SkillSpector RA1 (rogue-agent) in .claude/skills/ffmpeg/SKILL.md", "shortDescription": {"text": "SkillSpector RA1 (rogue-agent) in .claude/skills/ffmpeg/SKILL.md"}, "fullDescription": {"text": "Update this skill\n\nSkill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.\n\nSkill: ffmpeg\nRule: RA1  Category: rogue-agent\nSeverity: HIGH  Confidence: 0.85\n\nRemediation: Prevent the skill from modifying its own code, SKILL.md, or configuration files. Treat skill files as read-only at runtime."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.85}}, {"id": "scanner-d21184934e59c281", "name": "SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/assets.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/assets.md"}, "fullDescription": {"text": "requests.post(\n            \"https://\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: heygen\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-96c5cfd6733d11bd", "name": "SkillSpector E2 (data-exfil) in .claude/skills/heygen/references/assets.md", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in .claude/skills/heygen/references/assets.md"}, "fullDescription": {"text": "os.environ[\"HEYGEN_API_KEY\"]\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: heygen\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.80\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.8}}, {"id": "scanner-d1c80cfe7ee0d6cf", "name": "SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/authentication.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/authentication.md"}, "fullDescription": {"text": "https://api.heygen.com/\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: heygen\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.50\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.5}}, {"id": "scanner-d06f82cdb3b90421", "name": "SkillSpector E2 (data-exfil) in .claude/skills/heygen/references/authentication.md", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in .claude/skills/heygen/references/authentication.md"}, "fullDescription": {"text": "os.environ[\"HEYGEN_API_KEY\"]\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: heygen\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.80\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.8}}, {"id": "scanner-7081042c7567dc0a", "name": "SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/avatars.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/avatars.md"}, "fullDescription": {"text": "https://api.heygen.com/\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: heygen\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.50\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.5}}, {"id": "scanner-dcf0a8e29126a8b9", "name": "SkillSpector E2 (data-exfil) in .claude/skills/heygen/references/avatars.md", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in .claude/skills/heygen/references/avatars.md"}, "fullDescription": {"text": "os.environ[\"HEYGEN_API_KEY\"]\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: heygen\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.80\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.8}}, {"id": "scanner-925bd942fa751f1f", "name": "SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/dimensions.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/dimensions.md"}, "fullDescription": {"text": "curl\n\n```bash\n# Landscape 1080p\ncurl -X POST \"https://api.heygen.com/v2/video/generate\" \\\n  -H \"X-Api-Key: $HEYGEN_API_KEY\" \\\n  -H \"Content-Type: application/json\" \\\n  -d\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: heygen\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-a0a2258c1d2ece4f", "name": "SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/photo-avatars.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/photo-avatars.md"}, "fullDescription": {"text": "requests.post(\n            \"https://\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: heygen\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-c24a2b4d8c1abdf8", "name": "SkillSpector E2 (data-exfil) in .claude/skills/heygen/references/photo-avatars.md", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in .claude/skills/heygen/references/photo-avatars.md"}, "fullDescription": {"text": "os.environ[\"HEYGEN_API_KEY\"]\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: heygen\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.80\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.8}}, {"id": "scanner-1db14256232189c2", "name": "SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/quota.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/quota.md"}, "fullDescription": {"text": "https://api.heygen.com/\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: heygen\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.50\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.5}}, {"id": "scanner-b47000321a8ce600", "name": "SkillSpector E2 (data-exfil) in .claude/skills/heygen/references/quota.md", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in .claude/skills/heygen/references/quota.md"}, "fullDescription": {"text": "os.environ[\"HEYGEN_API_KEY\"]\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: heygen\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.80\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.8}}, {"id": "scanner-2e014cbc71571754", "name": "SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/remotion-integration.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/remotion-integration.md"}, "fullDescription": {"text": "fetch(\"https://api.heygen.com/v2/video/generate\", {\n    method: \"POST\"\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: heygen\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-5901dbf205169269", "name": "SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/templates.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/templates.md"}, "fullDescription": {"text": "requests.post(\n        f\"https://api.heygen.com/v2/template/{template_id}/generate\",\n        headers={\n            \"X-Api-Key\": os.environ[\"HEYGEN_API_KEY\"],\n            \"Content-Type\": \"application/j\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: heygen\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.70\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-e1c220710990a8c7", "name": "SkillSpector E2 (data-exfil) in .claude/skills/heygen/references/templates.md", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in .claude/skills/heygen/references/templates.md"}, "fullDescription": {"text": "os.environ[\"HEYGEN_API_KEY\"]\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: heygen\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.80\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.8}}, {"id": "scanner-22230a2a775ae989", "name": "SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/video-agent.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/video-agent.md"}, "fullDescription": {"text": "requests.post(\n        \"https://\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: heygen\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-b27e61f54644a84a", "name": "SkillSpector E2 (data-exfil) in .claude/skills/heygen/references/video-agent.md", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in .claude/skills/heygen/references/video-agent.md"}, "fullDescription": {"text": "os.environ[\"HEYGEN_API_KEY\"]\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: heygen\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.80\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.8}}, {"id": "scanner-04ce0266d7d3a6f0", "name": "SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/video-generation.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/video-generation.md"}, "fullDescription": {"text": "requests.post(\n        \"https://\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: heygen\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-56f155b3b09448ca", "name": "SkillSpector E2 (data-exfil) in .claude/skills/heygen/references/video-generation.md", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in .claude/skills/heygen/references/video-generation.md"}, "fullDescription": {"text": "os.environ[\"HEYGEN_API_KEY\"]\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: heygen\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.80\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.8}}, {"id": "scanner-2ee448bb4dc53679", "name": "SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/video-status.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/video-status.md"}, "fullDescription": {"text": "fetch(\n    \"https://api.heygen.com/v2/video/generate\",\n    {\n      method: \"POST\"\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: heygen\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-f2503df547350481", "name": "SkillSpector E2 (data-exfil) in .claude/skills/heygen/references/video-status.md", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in .claude/skills/heygen/references/video-status.md"}, "fullDescription": {"text": "os.environ[\"HEYGEN_API_KEY\"]\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: heygen\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.80\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.8}}, {"id": "scanner-31ce4b1b601a0f0c", "name": "SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/voices.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/voices.md"}, "fullDescription": {"text": "https://api.heygen.com/\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: heygen\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.50\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.5}}, {"id": "scanner-46bb51f4e538f81d", "name": "SkillSpector E2 (data-exfil) in .claude/skills/heygen/references/voices.md", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in .claude/skills/heygen/references/voices.md"}, "fullDescription": {"text": "os.environ[\"HEYGEN_API_KEY\"]\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: heygen\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.80\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.8}}, {"id": "scanner-247ae11c9b052dda", "name": "SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/webhooks.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/webhooks.md"}, "fullDescription": {"text": "fetch(\"https://api.heygen.com/v1/webhook/endpoint.add\", {\n    method: \"POST\"\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: heygen\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-af1684e8770445cb", "name": "SkillSpector EA1 (excessive-agency) in .claude/skills/heygen/SKILL.md", "shortDescription": {"text": "SkillSpector EA1 (excessive-agency) in .claude/skills/heygen/SKILL.md"}, "fullDescription": {"text": "tools:*\n\nSkill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.\n\nSkill: heygen\nRule: EA1  Category: excessive-agency\nSeverity: MEDIUM  Confidence: 0.85\n\nRemediation: Restrict tool access to only the tools required for the skill's stated purpose. Use an explicit allowlist rather than granting blanket access."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-d8c8b8618fbeb317", "name": "SkillSpector RA2 (rogue-agent) in .claude/skills/heygen/references/avatars.md", "shortDescription": {"text": "SkillSpector RA2 (rogue-agent) in .claude/skills/heygen/references/avatars.md"}, "fullDescription": {"text": "pList\n\nSkill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.\n\nSkill: heygen\nRule: RA2  Category: rogue-agent\nSeverity: MEDIUM  Confidence: 0.75\n\nRemediation: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.75}}, {"id": "scanner-aa9bdc38ef504bbd", "name": "SkillSpector P6 (prompt-injection) in .claude/skills/heygen/references/prompt-examples.md", "shortDescription": {"text": "SkillSpector P6 (prompt-injection) in .claude/skills/heygen/references/prompt-examples.md"}, "fullDescription": {"text": "Output Prompt\n\nSkill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.\n\nSkill: heygen\nRule: P6  Category: prompt-injection\nSeverity: HIGH  Confidence: 0.85\n\nRemediation: Remove any instructions that reveal, print, or output system prompts or internal rules. System instructions should never be exposed to end users."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.85}}, {"id": "scanner-1737e89ac4dfd1a3", "name": "SkillSpector TM1 (tool-misuse) in .claude/skills/heygen/SKILL.md", "shortDescription": {"text": "SkillSpector TM1 (tool-misuse) in .claude/skills/heygen/SKILL.md"}, "fullDescription": {"text": "DELETE /v2/videos/{video_id}`\n\nTool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).\n\nSkill: heygen\nRule: TM1  Category: tool-misuse\nSeverity: HIGH  Confidence: 0.80\n\nRemediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.8}}, {"id": "scanner-9a64d348a618945e", "name": "SkillSpector PE3 (priv-esc) in .claude/skills/ltx2/SKILL.md", "shortDescription": {"text": "SkillSpector PE3 (priv-esc) in .claude/skills/ltx2/SKILL.md"}, "fullDescription": {"text": ".env\n\nCode accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.\n\nSkill: ltx2\nRule: PE3  Category: priv-esc\nSeverity: HIGH  Confidence: 0.60\n\nRemediation: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.6}}, {"id": "scanner-6b1da4c5acc1ab00", "name": "SkillSpector EA3 (excessive-agency) in .claude/skills/manimce-best-practices/LICENSE.txt", "shortDescription": {"text": "SkillSpector EA3 (excessive-agency) in .claude/skills/manimce-best-practices/LICENSE.txt"}, "fullDescription": {"text": "NOT LIMITED TO\n\nSkill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.\n\nSkill: manimce-best-practices\nRule: EA3  Category: excessive-agency\nSeverity: LOW  Confidence: 0.70\n\nRemediation: Limit the skill's scope to its documented purpose. Remove instructions that enable the agent to perform actions outside its stated functionality."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.7}}, {"id": "scanner-609b9355646cbbe1", "name": "SkillSpector AST4 (behavioral-ast) in .claude/skills/manimgl-best-practices/templates/3d_scene.py", "shortDescription": {"text": "SkillSpector AST4 (behavioral-ast) in .claude/skills/manimgl-best-practices/templates/3d_scene.py"}, "fullDescription": {"text": "subprocess.run([\"manimgl\", __file__, \"ThreeDSceneTemplate\"])\n\nsubprocess module calls execute external commands. Without careful input validation, this enables command injection.\n\nSkill: manimgl-best-practices\nRule: AST4  Category: behavioral-ast\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Use subprocess.run() with shell=False and an explicit argument list. Validate all inputs and avoid passing user-controlled data to commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-ce1f213c53bbbe92", "name": "SkillSpector AST4 (behavioral-ast) in .claude/skills/manimgl-best-practices/templates/basic_scene.py", "shortDescription": {"text": "SkillSpector AST4 (behavioral-ast) in .claude/skills/manimgl-best-practices/templates/basic_scene.py"}, "fullDescription": {"text": "subprocess.run([\"manimgl\", __file__, \"BasicSceneTemplate\"])\n\nsubprocess module calls execute external commands. Without careful input validation, this enables command injection.\n\nSkill: manimgl-best-practices\nRule: AST4  Category: behavioral-ast\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Use subprocess.run() with shell=False and an explicit argument list. Validate all inputs and avoid passing user-controlled data to commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-bc3e63ecc078b3a7", "name": "SkillSpector AST4 (behavioral-ast) in .claude/skills/manimgl-best-practices/templates/math_scene.py", "shortDescription": {"text": "SkillSpector AST4 (behavioral-ast) in .claude/skills/manimgl-best-practices/templates/math_scene.py"}, "fullDescription": {"text": "subprocess.run([\"manimgl\", __file__, \"MathSceneTemplate\"])\n\nsubprocess module calls execute external commands. Without careful input validation, this enables command injection.\n\nSkill: manimgl-best-practices\nRule: AST4  Category: behavioral-ast\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Use subprocess.run() with shell=False and an explicit argument list. Validate all inputs and avoid passing user-controlled data to commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-8b149611af4b72ee", "name": "SkillSpector LP3 (mcp-least-priv) in .claude/skills/manimgl-best-practices/SKILL.md", "shortDescription": {"text": "SkillSpector LP3 (mcp-least-priv) in .claude/skills/manimgl-best-practices/SKILL.md"}, "fullDescription": {"text": "MCP Least Privilege\n\nWithout declared permissions the skill's intent is opaque and cannot be validated.\n\nSkill: manimgl-best-practices\nRule: LP3  Category: mcp-least-priv\nSeverity: MEDIUM  Confidence: 0.70\n\nRemediation: Add a 'permissions' field to SKILL.md listing the capabilities this skill requires."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-e637c415447867e4", "name": "Run SkillSpector's LLM-backed analysis in your own pipeline", "shortDescription": {"text": "Run SkillSpector's LLM-backed analysis in your own pipeline"}, "fullDescription": {"text": "Repobility ran SkillSpector's static rules server-side. The deeper LLM-backed analyzers \u2014 tool-poisoning (TP*), semantic security discovery (SSD*), developer-intent mismatch (SDI*) \u2014 are meant to run on YOUR machine with YOUR model; repobility never sends your code to an LLM. Recipe:\n\n# 1. Install SkillSpector in your own isolated env\npipx install \"skillspector @ git+https://github.com/NVIDIA/SkillSpector.git\"\n\n# 2. Point it at YOUR LLM pipeline (pick one) - your code stays on your machine\nexport SKILLSPECTOR_PROVIDER=anthropic && export ANTHROPIC_API_KEY=sk-ant-...\n# export SKILLSPECTOR_PROVIDER=openai   && export OPENAI_API_KEY=sk-...\n# export SKILLSPECTOR_PROVIDER=openai OPENAI_API_KEY=ollama OPENAI_BASE_URL=http://localhost:11434/v1 SKILLSPECTOR_MODEL=llama3.1:8b\n# export SKILLSPECTOR_PROVIDER=nv_build && export NVIDIA_INFERENCE_KEY=nvapi-...\n\n# 3. Run the LLM-backed scan per skill (omit --no-llm to enable the LLM analyzers)\nskillspector scan .claude/skills/acestep --format sarif -"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "info", "confidence": 1.0}}, {"id": "scanner-27924aa79fa4a517", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-48c56aeb89b544a1", "name": "Very large file: tests/tools/test_hyperframes_compose.py (1315 lines)", "shortDescription": {"text": "Very large file: tests/tools/test_hyperframes_compose.py (1315 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5d14f04e8972f304", "name": "Very large file: tools/video/video_compose.py (2634 lines)", "shortDescription": {"text": "Very large file: tools/video/video_compose.py (2634 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "78 tests / 326 src (ratio 0.24)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 85 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 19 placeholder/mock markers across 14 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dfbeabf5c52c6063", "name": "Network/subprocess call without timeout or try/except \u2014 render_demo.py:63", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 render_demo.py:63"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-4605eaf2c8f327d1", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/backlot_watch_captures.py:104", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/backlot_watch_captures.py:104"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-0d7f424e5160921b", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/backlot_visual_eval.py:121", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/backlot_visual_eval.py:121"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-9c2c32f0a69c74f4", "name": "Network/subprocess call without timeout or try/except \u2014 .claude/skills/video-understand/scripts/understand_video.py:67", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 .claude/skills/video-understand/scripts/understand_video.py:67"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-ddcfcb36f16bd123", "name": "Network/subprocess call without timeout or try/except \u2014 .claude/skills/manimgl-best-practices/templates/basic_scene.py:1", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 .claude/skills/manimgl-best-practices/templates/basic_scene.py:134"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-14916de003c78593", "name": "Network/subprocess call without timeout or try/except \u2014 .claude/skills/manimgl-best-practices/templates/3d_scene.py:258", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 .claude/skills/manimgl-best-practices/templates/3d_scene.py:258"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-6fbcdfb93ba6fd11", "name": "Network/subprocess call without timeout or try/except \u2014 .claude/skills/manimgl-best-practices/templates/math_scene.py:33", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 .claude/skills/manimgl-best-practices/templates/math_scene.py:333"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-b596f8830a6608d2", "name": "Legacy-named symbol `inp_copy` in .claude/skills/manimgl-best-practices/examples/mlp_relu_visualization.py:160", "shortDescription": {"text": "Legacy-named symbol `inp_copy` in .claude/skills/manimgl-best-practices/examples/mlp_relu_visualization.py:160"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cf843c0f30e15cb0", "name": "Legacy-named symbol `text_copy` in .claude/skills/manimgl-best-practices/examples/llm_prediction_pipeline.py:97", "shortDescription": {"text": "Legacy-named symbol `text_copy` in .claude/skills/manimgl-best-practices/examples/llm_prediction_pipeline.py:97"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-86e85cb4c47be014", "name": "Legacy-named symbol `text_copy` in .claude/skills/manimgl-best-practices/examples/autoregressive_flow.py:77", "shortDescription": {"text": "Legacy-named symbol `text_copy` in .claude/skills/manimgl-best-practices/examples/autoregressive_flow.py:77"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c93506a5e152910f", "name": "Network/subprocess call without timeout or try/except \u2014 tools/audio/piper_tts.py:123", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/audio/piper_tts.py:123"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-4a62407b5c85fd43", "name": "Legacy-named symbol `eleven_multilingual_v2` in tools/audio/elevenlabs_tts.py:78", "shortDescription": {"text": "Legacy-named symbol `eleven_multilingual_v2` in tools/audio/elevenlabs_tts.py:78"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c465db7a4c6a1fdb", "name": "Network/subprocess call without timeout or try/except \u2014 tools/audio/elevenlabs_tts.py:175", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/audio/elevenlabs_tts.py:175"}, "fullDescription": {"text": "`requests.post(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-78ac1dd3d1f84eca", "name": "Legacy-named symbol `eleven_multilingual_v2` in tools/audio/tts_selector.py:61", "shortDescription": {"text": "Legacy-named symbol `eleven_multilingual_v2` in tools/audio/tts_selector.py:61"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-891341aee93603d1", "name": "Legacy-named symbol `2_t2v_lightx2v_4steps_lora_v1` in tools/_comfyui/metadata.py:98", "shortDescription": {"text": "Legacy-named symbol `2_t2v_lightx2v_4steps_lora_v1` in tools/_comfyui/metadata.py:98"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-565019671747b3e7", "name": "Network/subprocess call without timeout or try/except \u2014 tools/character/character_animation.py:104", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/character/character_animation.py:104"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-0b96e80f1867bf5a", "name": "Legacy-named symbol `2_t2v_lightx2v_4steps_lora_v1` in tools/video/comfyui_video.py:61", "shortDescription": {"text": "Legacy-named symbol `2_t2v_lightx2v_4steps_lora_v1` in tools/video/comfyui_video.py:61"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8177bb2e5ee54340", "name": "Legacy-named symbol `kling_v2` in tools/video/_shared.py:22", "shortDescription": {"text": "Legacy-named symbol `kling_v2` in tools/video/_shared.py:22"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-890b3088219397ee", "name": "Legacy-named symbol `_link_or_copy` in tools/video/clip_cache.py:354", "shortDescription": {"text": "Legacy-named symbol `_link_or_copy` in tools/video/clip_cache.py:354"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b0b7578dd2a289b6", "name": "26 env vars used in code but missing from .env.example", "shortDescription": {"text": "26 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `APPDATA`, `AZURE_SPEECH_ENDPOINT`, `BACKLOT_PORT`, `BFL_API_KEY`, `COMFYUI_SERVER_URL`, `COVERR_API_KEY`, `DISPLAY`, `FREESOUND_API_KEY` + 18 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same substantial AST body hash:\ntools/video/stock_sources/pond5_pd.py:174:download, tools/video/stock_sources/loc.py:219:download, tools/video/stock_sources/nara.py:183:download\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same substantial AST body hash:\ntools/video/stock_sources/nasa.py:115:download, tools/video/stock_sources/archive_org.py:182:download\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c78d6f4a10d15e1a", "name": "Vulnerable dependency fast-uri 3.1.2: GHSA-4c8g-83qw-93j6", "shortDescription": {"text": "Vulnerable dependency fast-uri 3.1.2: GHSA-4c8g-83qw-93j6"}, "fullDescription": {"text": "OSV.dev reports `fast-uri` at version `3.1.2` (resolved in `remotion-composer/package-lock.json`) is affected by GHSA-4c8g-83qw-93j6 (aka CVE-2026-13676).\nNote: `fast-uri` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nfast-uri vulnerable to host confusion via failed IDN canonicalization\n\nAliases: CVE-2026-13676\nAdvisory: https://osv.dev/vulnerability/GHSA-4c8g-83qw-93j6\nFix: upgrade `fast-uri` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-c1346ca60500d8e9", "name": "Vulnerable dependency fast-uri 3.1.2: GHSA-v2hh-gcrm-f6hx", "shortDescription": {"text": "Vulnerable dependency fast-uri 3.1.2: GHSA-v2hh-gcrm-f6hx"}, "fullDescription": {"text": "OSV.dev reports `fast-uri` at version `3.1.2` (resolved in `remotion-composer/package-lock.json`) is affected by GHSA-v2hh-gcrm-f6hx (aka CVE-2026-16221).\nNote: `fast-uri` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nfast-uri vulnerable to host confusion via literal backslash authority delimiter\n\nAliases: CVE-2026-16221\nAdvisory: https://osv.dev/vulnerability/GHSA-v2hh-gcrm-f6hx\nFix: upgrade `fast-uri` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-cdb69d41e7ebe492", "name": "Dependency react-dom is a major version behind", "shortDescription": {"text": "Dependency react-dom is a major version behind"}, "fullDescription": {"text": "`react-dom` is pinned at `18.2.0` in `remotion-composer/package.json` while the latest release on the npm registry is `19.2.8` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `react-dom` to `19.2.8`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-dcb57d6fbd94a8b7", "name": "Dependency react is a major version behind", "shortDescription": {"text": "Dependency react is a major version behind"}, "fullDescription": {"text": "`react` is pinned at `18.2.0` in `remotion-composer/package.json` while the latest release on the npm registry is `19.2.8` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `react` to `19.2.8`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}]}}, "automationDetails": {"id": "repobility/30777"}, "properties": {"repository": "calesthio/OpenMontage", "repoUrl": "https://github.com/calesthio/OpenMontage", "branch": "main"}, "results": [{"ruleId": "scanner-f9a112aa4d2451de", "level": "note", "message": {"text": "Possibly dead Python function: has_user_media"}, "properties": {"repobilityId": "ecfd5fef8e2b6e5b", "scanner": "scanner-primary", "fingerprint": "f9a112aa4d2451de", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lib/source_media_review.py:387"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0eebf3d834f46162", "level": "note", "message": {"text": "Possibly dead Python function: knn"}, "properties": {"repobilityId": "dfe6491f1f9bf207", "scanner": "scanner-primary", "fingerprint": "0eebf3d834f46162", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lib/corpus.py:288"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a5d0a886db272f89", "level": "note", "message": {"text": "Possibly dead Python function: check_extension_permitted"}, "properties": {"repobilityId": "fd3891cb8c5e718c", "scanner": "scanner-primary", "fingerprint": "a5d0a886db272f89", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lib/pipeline_loader.py:201"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a64446202ae5ad02", "level": "note", "message": {"text": "Possibly dead Python function: generate_playbook"}, "properties": {"repobilityId": "7d3890f9075e7d62", "scanner": "scanner-primary", "fingerprint": "a64446202ae5ad02", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lib/playbook_generator.py:52"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0c1f2c77cba98332", "level": "note", "message": {"text": "Possibly dead Python function: save_playbook"}, "properties": {"repobilityId": "a865e0eb70f3f336", "scanner": "scanner-primary", "fingerprint": "0c1f2c77cba98332", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lib/playbook_generator.py:200"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-07caeb3589fdba88", "level": "note", "message": {"text": "Possibly dead Python function: format_ranking"}, "properties": {"repobilityId": "04ed6b5a504fba71", "scanner": "scanner-primary", "fingerprint": "07caeb3589fdba88", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lib/scoring.py:545"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-71731fdaf3f66344", "level": "note", "message": {"text": "Possibly dead Python function: build_batch_prompts"}, "properties": {"repobilityId": "1ccb7e926571eb90", "scanner": "scanner-primary", "fingerprint": "71731fdaf3f66344", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lib/shot_prompt_builder.py:146"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-512d0c4eafde9f37", "level": "note", "message": {"text": "Possibly dead Python function: require_env"}, "properties": {"repobilityId": "f856dd845d12fb74", "scanner": "scanner-primary", "fingerprint": "512d0c4eafde9f37", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lib/env_loader.py:29"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e43353cd699de66b", "level": "note", "message": {"text": "Possibly dead Python function: model_info"}, "properties": {"repobilityId": "c47e7df8e5238843", "scanner": "scanner-primary", "fingerprint": "e43353cd699de66b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lib/clip_embedder.py:55"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dac7b62d26647455", "level": "note", "message": {"text": "Possibly dead Python function: resolve_path"}, "properties": {"repobilityId": "087cfc9f0fa6981c", "scanner": "scanner-primary", "fingerprint": "dac7b62d26647455", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lib/config_model.py:87"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3a900eb2dc33e85b", "level": "note", "message": {"text": "Possibly dead Python function: generate_i2i"}, "properties": {"repobilityId": "0dbb3f4bbab88d3d", "scanner": "scanner-primary", "fingerprint": "3a900eb2dc33e85b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/bfl-api/references/code-examples/python-client.py:196"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b9b59ee343c35f8a", "level": "note", "message": {"text": "Possibly dead Python function: generate_batch"}, "properties": {"repobilityId": "484370700d73a6e4", "scanner": "scanner-primary", "fingerprint": "b9b59ee343c35f8a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/bfl-api/references/code-examples/python-client.py:241"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4990efb95ce94102", "level": "note", "message": {"text": "Possibly dead Python function: verify_webhook_signature"}, "properties": {"repobilityId": "291c7fe00a98654c", "scanner": "scanner-primary", "fingerprint": "4990efb95ce94102", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/bfl-api/references/code-examples/python-client.py:426"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6daad0716db1d680", "level": "note", "message": {"text": "Possibly dead Python function: construct"}, "properties": {"repobilityId": "495aa6ceaa730f6f", "scanner": "scanner-primary", "fingerprint": "6daad0716db1d680", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/manimgl-best-practices/templates/interactive_scene.py:36"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7096210766e0bdce", "level": "note", "message": {"text": "Possibly dead Python function: construct"}, "properties": {"repobilityId": "495aa6ceaa730f6f", "scanner": "scanner-primary", "fingerprint": "7096210766e0bdce", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/manimgl-best-practices/templates/basic_scene.py:97"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ec0c68a45ee12c25", "level": "note", "message": {"text": "Possibly dead Python function: construct"}, "properties": {"repobilityId": "495aa6ceaa730f6f", "scanner": "scanner-primary", "fingerprint": "ec0c68a45ee12c25", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/manimgl-best-practices/templates/3d_scene.py:228"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-aca5cb5220c0d71d", "level": "note", "message": {"text": "Possibly dead Python function: construct"}, "properties": {"repobilityId": "495aa6ceaa730f6f", "scanner": "scanner-primary", "fingerprint": "aca5cb5220c0d71d", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/manimgl-best-practices/templates/math_scene.py:292"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-11a2260f437c9ae8", "level": "note", "message": {"text": "Possibly dead Python function: construct"}, "properties": {"repobilityId": "495aa6ceaa730f6f", "scanner": "scanner-primary", "fingerprint": "11a2260f437c9ae8", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/manimgl-best-practices/examples/spring_mass_system.py:276"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d74288f2d3d1f6e4", "level": "note", "message": {"text": "Possibly dead Python function: construct"}, "properties": {"repobilityId": "495aa6ceaa730f6f", "scanner": "scanner-primary", "fingerprint": "d74288f2d3d1f6e4", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/manimgl-best-practices/examples/multi_head_attention.py:229"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f532265229376c30", "level": "note", "message": {"text": "Possibly dead Python function: construct"}, "properties": {"repobilityId": "495aa6ceaa730f6f", "scanner": "scanner-primary", "fingerprint": "f532265229376c30", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/manimgl-best-practices/examples/attention_pattern_dots.py:21"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2be871fe9fcd6f02", "level": "note", "message": {"text": "Possibly dead Python function: construct"}, "properties": {"repobilityId": "495aa6ceaa730f6f", "scanner": "scanner-primary", "fingerprint": "2be871fe9fcd6f02", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/manimgl-best-practices/examples/mlp_vector_space.py:156"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-27126efa838ca9a5", "level": "note", "message": {"text": "Possibly dead Python function: update_emb_vect"}, "properties": {"repobilityId": "4094561467999e77", "scanner": "scanner-primary", "fingerprint": "27126efa838ca9a5", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/manimgl-best-practices/examples/mlp_vector_space.py:114"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6fa40e84cfc6d37f", "level": "note", "message": {"text": "Possibly dead Python function: construct"}, "properties": {"repobilityId": "495aa6ceaa730f6f", "scanner": "scanner-primary", "fingerprint": "6fa40e84cfc6d37f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/manimgl-best-practices/examples/query_key_space_mapping.py:12"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0d306e27bed006b0", "level": "note", "message": {"text": "Possibly dead Python function: construct"}, "properties": {"repobilityId": "495aa6ceaa730f6f", "scanner": "scanner-primary", "fingerprint": "0d306e27bed006b0", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/manimgl-best-practices/examples/mlp_relu_visualization.py:97"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a450cfb326420ecf", "level": "note", "message": {"text": "Possibly dead Python function: construct"}, "properties": {"repobilityId": "495aa6ceaa730f6f", "scanner": "scanner-primary", "fingerprint": "a450cfb326420ecf", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/manimgl-best-practices/examples/quantum_gates.py:234"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-10f5d905b00946e3", "level": "warning", "message": {"text": "Analyzer timeout: security.semgrep"}, "properties": {"repobilityId": "err::timeout::security.semgrep", "scanner": "scanner-primary", "fingerprint": "10f5d905b00946e3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["analyzer-error", "timeout"]}}, {"ruleId": "scanner-f65108679fd5b6cd", "level": "error", "message": {"text": "CVE-2026-13676: fast-uri 3.1.2 \u2014 remotion-composer/package-lock.json"}, "properties": {"repobilityId": "8d12a358827e83b3", "scanner": "scanner-primary", "fingerprint": "f65108679fd5b6cd", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-13676"]}}, {"ruleId": "scanner-063d7035602beee7", "level": "error", "message": {"text": "CVE-2026-16221: fast-uri 3.1.2 \u2014 remotion-composer/package-lock.json"}, "properties": {"repobilityId": "bae11e8bf056ab38", "scanner": "scanner-primary", "fingerprint": "063d7035602beee7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-16221"]}}, {"ruleId": "scanner-4f32c59a1f90902f", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/backlot.md"}, "properties": {"repobilityId": "d4e0ca73b2657817", "scanner": "scanner-primary", "fingerprint": "4f32c59a1f90902f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/backlot.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7598788a494d0b05", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/animated-drawing.md"}, "properties": {"repobilityId": "3ad7e51646bc83a1", "scanner": "scanner-primary", "fingerprint": "7598788a494d0b05", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/animated-drawing.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-624d54724482b6db", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/ai-video-gen/SKILL.md"}, "properties": {"repobilityId": "6b1dfd3232d0e5aa", "scanner": "scanner-primary", "fingerprint": "624d54724482b6db", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/ai-video-gen/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1ca50ef4047a1626", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/web-design-guidelines/SKILL.md"}, "properties": {"repobilityId": "f2451fa9a31e4611", "scanner": "scanner-primary", "fingerprint": "1ca50ef4047a1626", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/web-design-guidelines/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-760662b595e44ec1", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/flux-best-practices/rules/typography-text.md"}, "properties": {"repobilityId": "197a6b0701f7b134", "scanner": "scanner-primary", "fingerprint": "760662b595e44ec1", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/flux-best-practices/rules/typography-text.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c3703048deaf20b4", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/text-to-speech/SKILL.md"}, "properties": {"repobilityId": "95dc013042d68254", "scanner": "scanner-primary", "fingerprint": "c3703048deaf20b4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/text-to-speech/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3440a3ea40b01c36", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/elevenlabs/SKILL.md"}, "properties": {"repobilityId": "1eb787577c135275", "scanner": "scanner-primary", "fingerprint": "3440a3ea40b01c36", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/elevenlabs/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-891b16a127a62c16", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/heygen/references/assets.md"}, "properties": {"repobilityId": "1ced7a399a7ff0dd", "scanner": "scanner-primary", "fingerprint": "891b16a127a62c16", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/heygen/references/assets.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-054c0972e03f5257", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/skills/heygen/references/photo-avatars.md"}, "properties": {"repobilityId": "ed0ae2266b50be64", "scanner": "scanner-primary", "fingerprint": "054c0972e03f5257", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/heygen/references/photo-avatars.md"}, "region": {"startLine": 169}}}]}, {"ruleId": "scanner-27cfbf8a1a6328c5", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/heygen/references/photo-avatars.md"}, "properties": {"repobilityId": "63f65d53106b619c", "scanner": "scanner-primary", "fingerprint": "27cfbf8a1a6328c5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/heygen/references/photo-avatars.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-755bee30b603578c", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/heygen/references/video-agent.md"}, "properties": {"repobilityId": "f3fbe656cc16e328", "scanner": "scanner-primary", "fingerprint": "755bee30b603578c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/heygen/references/video-agent.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-90fca9142ab06bcc", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/skills/heygen/references/captions.md"}, "properties": {"repobilityId": "38bfd8248c5d118b", "scanner": "scanner-primary", "fingerprint": "90fca9142ab06bcc", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/heygen/references/captions.md"}, "region": {"startLine": 138}}}]}, {"ruleId": "scanner-2f6f4317b9a94097", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/heygen/references/dimensions.md"}, "properties": {"repobilityId": "e03766811db3897e", "scanner": "scanner-primary", "fingerprint": "2f6f4317b9a94097", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/heygen/references/dimensions.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8f583772382ec5f6", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/heygen/references/prompt-optimizer.md"}, "properties": {"repobilityId": "10d46dac897fb306", "scanner": "scanner-primary", "fingerprint": "8f583772382ec5f6", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/heygen/references/prompt-optimizer.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b1e8ca09ec67c3e8", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/heygen/references/visual-styles.md"}, "properties": {"repobilityId": "56266cb5963cea20", "scanner": "scanner-primary", "fingerprint": "b1e8ca09ec67c3e8", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/heygen/references/visual-styles.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bb243d34a9057641", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/heygen/references/authentication.md"}, "properties": {"repobilityId": "5be245aedb8e8e7e", "scanner": "scanner-primary", "fingerprint": "bb243d34a9057641", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/heygen/references/authentication.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ddaab6092b58042d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/video-understand/SKILL.md"}, "properties": {"repobilityId": "323e77392a794749", "scanner": "scanner-primary", "fingerprint": "ddaab6092b58042d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/video-understand/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-80e0d194169ae92b", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/video-edit/references/operations.md"}, "properties": {"repobilityId": "20575ec6fc4e447b", "scanner": "scanner-primary", "fingerprint": "80e0d194169ae92b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/video-edit/references/operations.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-463871eec7d41c38", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/create-video/SKILL.md"}, "properties": {"repobilityId": "6d0bb21532c5a401", "scanner": "scanner-primary", "fingerprint": "463871eec7d41c38", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/create-video/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-87a0c55a943a03a7", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/create-video/references/assets.md"}, "properties": {"repobilityId": "f59f7ab84e3bb306", "scanner": "scanner-primary", "fingerprint": "87a0c55a943a03a7", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/create-video/references/assets.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-624a74a0419ce8c3", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/create-video/references/video-agent.md"}, "properties": {"repobilityId": "17416c43134f933b", "scanner": "scanner-primary", "fingerprint": "624a74a0419ce8c3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/create-video/references/video-agent.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e646b93a6b1fb038", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/create-video/references/dimensions.md"}, "properties": {"repobilityId": "caecb9b51c28f74f", "scanner": "scanner-primary", "fingerprint": "e646b93a6b1fb038", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/create-video/references/dimensions.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ed9d32bae6c42253", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/create-video/references/prompt-optimizer.md"}, "properties": {"repobilityId": "940817dc28e67543", "scanner": "scanner-primary", "fingerprint": "ed9d32bae6c42253", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/create-video/references/prompt-optimizer.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-47274a5b90ca4d5f", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/create-video/references/visual-styles.md"}, "properties": {"repobilityId": "7f3d95034b13ad49", "scanner": "scanner-primary", "fingerprint": "47274a5b90ca4d5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/create-video/references/visual-styles.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-de4fababee7f907d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/faceswap/SKILL.md"}, "properties": {"repobilityId": "36b5359dbf85dc1b", "scanner": "scanner-primary", "fingerprint": "de4fababee7f907d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/faceswap/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-956d661f15aa5cc4", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/playwright-recording/reference.md"}, "properties": {"repobilityId": "4ab0c02bf5bee689", "scanner": "scanner-primary", "fingerprint": "956d661f15aa5cc4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/playwright-recording/reference.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0a451b397286d983", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/remotion/SKILL.md"}, "properties": {"repobilityId": "f197ae18b093fb16", "scanner": "scanner-primary", "fingerprint": "0a451b397286d983", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/remotion/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e35b7c474c11200c", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/skills/threejs-materials/SKILL.md"}, "properties": {"repobilityId": "2bb2e7cc95b6b75e", "scanner": "scanner-primary", "fingerprint": "e35b7c474c11200c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/threejs-materials/SKILL.md"}, "region": {"startLine": 505}}}]}, {"ruleId": "scanner-35596cacf6493702", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/visual-style/references/gallery/game-boy-color.visual-style.md"}, "properties": {"repobilityId": "658a0ec5da8414f6", "scanner": "scanner-primary", "fingerprint": "35596cacf6493702", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/visual-style/references/gallery/game-boy-color.visual-style.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-575f1cee4374b172", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/video-download/SKILL.md"}, "properties": {"repobilityId": "ade6ea82dbc07e0d", "scanner": "scanner-primary", "fingerprint": "575f1cee4374b172", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/video-download/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c78613fcb6ea3a7e", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/skills/bfl-api/SKILL.md"}, "properties": {"repobilityId": "e30f6d8e2ac39b4c", "scanner": "scanner-primary", "fingerprint": "c78613fcb6ea3a7e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/bfl-api/SKILL.md"}, "region": {"startLine": 163}}}]}, {"ruleId": "scanner-81e579b375ab4a09", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/skills/bfl-api/references/api-key-setup.md"}, "properties": {"repobilityId": "2b3b43eec03c4da1", "scanner": "scanner-primary", "fingerprint": "81e579b375ab4a09", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/bfl-api/references/api-key-setup.md"}, "region": {"startLine": 50}}}]}, {"ruleId": "scanner-8d4dfa97f9759017", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/skills/bfl-api/references/webhook-integration.md"}, "properties": {"repobilityId": "c99755745ec2ebb9", "scanner": "scanner-primary", "fingerprint": "8d4dfa97f9759017", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/bfl-api/references/webhook-integration.md"}, "region": {"startLine": 270}}}]}, {"ruleId": "scanner-3062d6d09edface6", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/speech-to-text/SKILL.md"}, "properties": {"repobilityId": "5720931341cb8f18", "scanner": "scanner-primary", "fingerprint": "3062d6d09edface6", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/speech-to-text/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bd8fb130c009dc6f", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/speech-to-text/references/realtime-server-side.md"}, "properties": {"repobilityId": "1bf2329448da625c", "scanner": "scanner-primary", "fingerprint": "bd8fb130c009dc6f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/speech-to-text/references/realtime-server-side.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dcbdbb65bf06fdd8", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/speech-to-text/references/installation.md"}, "properties": {"repobilityId": "01b21c9213b45cdd", "scanner": "scanner-primary", "fingerprint": "dcbdbb65bf06fdd8", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/speech-to-text/references/installation.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a6fb85512e6a9eb4", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/speech-to-text/references/transcription-options.md"}, "properties": {"repobilityId": "a4c46543c58f3d08", "scanner": "scanner-primary", "fingerprint": "a6fb85512e6a9eb4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/speech-to-text/references/transcription-options.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bf468caff31ce42e", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/speech-to-text/references/realtime-client-side.md"}, "properties": {"repobilityId": "3ce5199ceb97aaad", "scanner": "scanner-primary", "fingerprint": "bf468caff31ce42e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/speech-to-text/references/realtime-client-side.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4488709831c5165b", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: .claude/skills/agents/SKILL.md"}, "properties": {"repobilityId": "3833c7e067a32e46", "scanner": "scanner-primary", "fingerprint": "4488709831c5165b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/agents/SKILL.md"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-16787a94a70ec5c6", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: .claude/skills/agents/references/installation.md"}, "properties": {"repobilityId": "ce202a018ff1c7e4", "scanner": "scanner-primary", "fingerprint": "16787a94a70ec5c6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/agents/references/installation.md"}, "region": {"startLine": 8}}}]}, {"ruleId": "scanner-92013cb0f145e51d", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/skills/video_toolkit/SKILL.md"}, "properties": {"repobilityId": "c3762d3f3d30c334", "scanner": "scanner-primary", "fingerprint": "92013cb0f145e51d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/video_toolkit/SKILL.md"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-6b5ee1188931558e", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/video_toolkit/SKILL.md"}, "properties": {"repobilityId": "bdc7ec336e92f9b8", "scanner": "scanner-primary", "fingerprint": "6b5ee1188931558e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/video_toolkit/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-43f2a8b7876a21b1", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/avatar-video/references/assets.md"}, "properties": {"repobilityId": "875ed3218e94cc8d", "scanner": "scanner-primary", "fingerprint": "43f2a8b7876a21b1", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/avatar-video/references/assets.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d929d1d33e964e0c", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/skills/avatar-video/references/photo-avatars.md"}, "properties": {"repobilityId": "b9f48511d42fe82f", "scanner": "scanner-primary", "fingerprint": "d929d1d33e964e0c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/avatar-video/references/photo-avatars.md"}, "region": {"startLine": 169}}}]}, {"ruleId": "scanner-ac45e07617120dab", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/avatar-video/references/photo-avatars.md"}, "properties": {"repobilityId": "91dcdeff3ba8ae31", "scanner": "scanner-primary", "fingerprint": "ac45e07617120dab", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/avatar-video/references/photo-avatars.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-16b278533827d034", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/skills/avatar-video/references/captions.md"}, "properties": {"repobilityId": "7cb2d134e3a94bed", "scanner": "scanner-primary", "fingerprint": "16b278533827d034", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/avatar-video/references/captions.md"}, "region": {"startLine": 138}}}]}, {"ruleId": "scanner-569e29762e1f9410", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/avatar-video/references/dimensions.md"}, "properties": {"repobilityId": "a18fbf8e8a86de50", "scanner": "scanner-primary", "fingerprint": "569e29762e1f9410", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/avatar-video/references/dimensions.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b0454bfb0fc2489e", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/ffmpeg/reference.md"}, "properties": {"repobilityId": "67a145f6a2dcbe2d", "scanner": "scanner-primary", "fingerprint": "b0454bfb0fc2489e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/ffmpeg/reference.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5735910028b3b679", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/ffmpeg/SKILL.md"}, "properties": {"repobilityId": "68b278008e96323a", "scanner": "scanner-primary", "fingerprint": "5735910028b3b679", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/ffmpeg/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4579662bed0468a8", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/SKILL.md"}, "properties": {"repobilityId": "b71708c769aac7c2", "scanner": "scanner-primary", "fingerprint": "4579662bed0468a8", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/manimgl-best-practices/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e1ba68a6fe684767", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/rules/interactive.md"}, "properties": {"repobilityId": "f3ca5c1049abe612", "scanner": "scanner-primary", "fingerprint": "e1ba68a6fe684767", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/manimgl-best-practices/rules/interactive.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ce811a3656a04710", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/rules/scenes.md"}, "properties": {"repobilityId": "056077440265be4b", "scanner": "scanner-primary", "fingerprint": "ce811a3656a04710", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/manimgl-best-practices/rules/scenes.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cd20ae734211da8b", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/references/spring_mass_system.md"}, "properties": {"repobilityId": "35aaae4bc8a41f29", "scanner": "scanner-primary", "fingerprint": "cd20ae734211da8b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/manimgl-best-practices/references/spring_mass_system.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bf15e3b3201fc627", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/references/equation_transforms.md"}, "properties": {"repobilityId": "e94503b623df807c", "scanner": "scanner-primary", "fingerprint": "bf15e3b3201fc627", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/manimgl-best-practices/references/equation_transforms.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-873509dbc4e88cd5", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/references/transit_animation.md"}, "properties": {"repobilityId": "09941f82714bc754", "scanner": "scanner-primary", "fingerprint": "873509dbc4e88cd5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/manimgl-best-practices/references/transit_animation.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cefcbd8759b6b97a", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/references/parallax_starfield.md"}, "properties": {"repobilityId": "97c4635e4c273249", "scanner": "scanner-primary", "fingerprint": "cefcbd8759b6b97a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/manimgl-best-practices/references/parallax_starfield.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bafa2996bc997b6c", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/references/three_d_surfaces.md"}, "properties": {"repobilityId": "c6231b1fbc3951e8", "scanner": "scanner-primary", "fingerprint": "bafa2996bc997b6c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/manimgl-best-practices/references/three_d_surfaces.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9c85c5bf833fdb20", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/references/rotating_exponentials.md"}, "properties": {"repobilityId": "d627126e5b0131e5", "scanner": "scanner-primary", "fingerprint": "9c85c5bf833fdb20", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/manimgl-best-practices/references/rotating_exponentials.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1eba4372d00b0871", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/manimgl-best-practices/references/vector_fields.md"}, "properties": {"repobilityId": "49a59f9f2956afc2", "scanner": "scanner-primary", "fingerprint": "1eba4372d00b0871", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/manimgl-best-practices/references/vector_fields.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-22eb8e5240c736fa", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/skills/video-translate/SKILL.md"}, "properties": {"repobilityId": "207e6c3fc7133b44", "scanner": "scanner-primary", "fingerprint": "22eb8e5240c736fa", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/video-translate/SKILL.md"}, "region": {"startLine": 230}}}]}, {"ruleId": "scanner-775c9c73397aeb9b", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/display-captions.md"}, "properties": {"repobilityId": "309437e5beb04896", "scanner": "scanner-primary", "fingerprint": "775c9c73397aeb9b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/remotion-best-practices/rules/display-captions.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3d4595a7c564317e", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/gifs.md"}, "properties": {"repobilityId": "bb98db22fbf89edf", "scanner": "scanner-primary", "fingerprint": "3d4595a7c564317e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/remotion-best-practices/rules/gifs.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d1839dd48325ef51", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/transitions.md"}, "properties": {"repobilityId": "faa4c5c5e4bce374", "scanner": "scanner-primary", "fingerprint": "d1839dd48325ef51", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/remotion-best-practices/rules/transitions.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-88471abe159d2c3b", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/ffmpeg.md"}, "properties": {"repobilityId": "61a4975f290a3701", "scanner": "scanner-primary", "fingerprint": "88471abe159d2c3b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/remotion-best-practices/rules/ffmpeg.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d8d56ba5901e3de6", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/maps.md"}, "properties": {"repobilityId": "5eb0be35fc5deb08", "scanner": "scanner-primary", "fingerprint": "d8d56ba5901e3de6", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/remotion-best-practices/rules/maps.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-46ce95048bd5e096", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/lottie.md"}, "properties": {"repobilityId": "c21bb9de750aab4c", "scanner": "scanner-primary", "fingerprint": "46ce95048bd5e096", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/remotion-best-practices/rules/lottie.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c861cfe5d597f1b3", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/light-leaks.md"}, "properties": {"repobilityId": "33b5da1bf571d19c", "scanner": "scanner-primary", "fingerprint": "c861cfe5d597f1b3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/remotion-best-practices/rules/light-leaks.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4e620720cae22567", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/charts.md"}, "properties": {"repobilityId": "ae69aefc3398e1e4", "scanner": "scanner-primary", "fingerprint": "4e620720cae22567", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/remotion-best-practices/rules/charts.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f2da3ec3a9182762", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/parameters.md"}, "properties": {"repobilityId": "0131a0cf4f85d39a", "scanner": "scanner-primary", "fingerprint": "f2da3ec3a9182762", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/remotion-best-practices/rules/parameters.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-631305131c84e990", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/import-srt-captions.md"}, "properties": {"repobilityId": "ff9a80ff9d98d633", "scanner": "scanner-primary", "fingerprint": "631305131c84e990", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/remotion-best-practices/rules/import-srt-captions.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-949fc886050db1e7", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/fonts.md"}, "properties": {"repobilityId": "5c03b18fc30f0394", "scanner": "scanner-primary", "fingerprint": "949fc886050db1e7", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/remotion-best-practices/rules/fonts.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-271e89668934a3a0", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/voiceover.md"}, "properties": {"repobilityId": "e2873fba71b4fac8", "scanner": "scanner-primary", "fingerprint": "271e89668934a3a0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/remotion-best-practices/rules/voiceover.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a014170c5b9783a2", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/3d.md"}, "properties": {"repobilityId": "6da610b2a0481fcb", "scanner": "scanner-primary", "fingerprint": "a014170c5b9783a2", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/remotion-best-practices/rules/3d.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7351a220651792c7", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/transparent-videos.md"}, "properties": {"repobilityId": "5383ccaa0b4e130d", "scanner": "scanner-primary", "fingerprint": "7351a220651792c7", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/remotion-best-practices/rules/transparent-videos.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-24e29eafe1b30dbb", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/videos.md"}, "properties": {"repobilityId": "e123de08dc319aa0", "scanner": "scanner-primary", "fingerprint": "24e29eafe1b30dbb", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/remotion-best-practices/rules/videos.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7f85281f72c8c8b9", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/audio.md"}, "properties": {"repobilityId": "7c3dbf68d806c61d", "scanner": "scanner-primary", "fingerprint": "7f85281f72c8c8b9", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/remotion-best-practices/rules/audio.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fe020b1424694e86", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/transcribe-captions.md"}, "properties": {"repobilityId": "849f8ba6a69e5c9b", "scanner": "scanner-primary", "fingerprint": "fe020b1424694e86", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/remotion-best-practices/rules/transcribe-captions.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c5d540c405dfdf28", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/remotion-best-practices/rules/audio-visualization.md"}, "properties": {"repobilityId": "7469ac1e2d841431", "scanner": "scanner-primary", "fingerprint": "c5d540c405dfdf28", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/remotion-best-practices/rules/audio-visualization.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-83405dca7aa9e59b", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/skills/ltx2/SKILL.md"}, "properties": {"repobilityId": "dd71cc2125c93d11", "scanner": "scanner-primary", "fingerprint": "83405dca7aa9e59b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/ltx2/SKILL.md"}, "region": {"startLine": 164}}}]}, {"ruleId": "scanner-dcae3de084232e81", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/sound-effects/SKILL.md"}, "properties": {"repobilityId": "319186ff0a3d4960", "scanner": "scanner-primary", "fingerprint": "dcae3de084232e81", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/sound-effects/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c6bf8900369d3efa", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/sound-effects/references/installation.md"}, "properties": {"repobilityId": "ca7c06674670f77f", "scanner": "scanner-primary", "fingerprint": "c6bf8900369d3efa", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/sound-effects/references/installation.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a38338ad31ff9fff", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/vercel-composition-patterns/AGENTS.md"}, "properties": {"repobilityId": "5b0f997a392e82f3", "scanner": "scanner-primary", "fingerprint": "a38338ad31ff9fff", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/vercel-composition-patterns/AGENTS.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ed7b10d414a686b3", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/vercel-composition-patterns/rules/patterns-explicit-variants.md"}, "properties": {"repobilityId": "3ac011d7f5f0db0d", "scanner": "scanner-primary", "fingerprint": "ed7b10d414a686b3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/vercel-composition-patterns/rules/patterns-explicit-variants.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8d5ee4ad6db1e39a", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/advanced-init-once.md"}, "properties": {"repobilityId": "9db1328a1676e0f4", "scanner": "scanner-primary", "fingerprint": "8d5ee4ad6db1e39a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/vercel-react-best-practices/rules/advanced-init-once.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3be63d58ae2f512c", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/server-hoist-static-io.md"}, "properties": {"repobilityId": "74f9988a13b78c80", "scanner": "scanner-primary", "fingerprint": "3be63d58ae2f512c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/vercel-react-best-practices/rules/server-hoist-static-io.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-06de946f8492faed", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/server-cache-react.md"}, "properties": {"repobilityId": "3ce5e08f493a39a7", "scanner": "scanner-primary", "fingerprint": "06de946f8492faed", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/vercel-react-best-practices/rules/server-cache-react.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7b19df7e602bc140", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/server-parallel-fetching.md"}, "properties": {"repobilityId": "bc129d0a1901861d", "scanner": "scanner-primary", "fingerprint": "7b19df7e602bc140", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/vercel-react-best-practices/rules/server-parallel-fetching.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8de3286afcf087b1", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/server-after-nonblocking.md"}, "properties": {"repobilityId": "b1a52c31b241f98e", "scanner": "scanner-primary", "fingerprint": "8de3286afcf087b1", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/vercel-react-best-practices/rules/server-after-nonblocking.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-42fccc8975005dd9", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/rendering-resource-hints.md"}, "properties": {"repobilityId": "1109af041dfcb18d", "scanner": "scanner-primary", "fingerprint": "42fccc8975005dd9", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/vercel-react-best-practices/rules/rendering-resource-hints.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-85f39657dd05c44d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/rerender-split-combined-hooks.md"}, "properties": {"repobilityId": "b7dc45f1f8059b32", "scanner": "scanner-primary", "fingerprint": "85f39657dd05c44d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/vercel-react-best-practices/rules/rerender-split-combined-hooks.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-994972a56f1f53b5", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/async-dependencies.md"}, "properties": {"repobilityId": "04d0ba896db63996", "scanner": "scanner-primary", "fingerprint": "994972a56f1f53b5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/vercel-react-best-practices/rules/async-dependencies.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f50ad04d10a70b78", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/async-parallel.md"}, "properties": {"repobilityId": "4ba81d4382f5dfd6", "scanner": "scanner-primary", "fingerprint": "f50ad04d10a70b78", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/vercel-react-best-practices/rules/async-parallel.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5ca1e1b649775b91", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/js-length-check-first.md"}, "properties": {"repobilityId": "9cdfdcf1c77a3caa", "scanner": "scanner-primary", "fingerprint": "5ca1e1b649775b91", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/vercel-react-best-practices/rules/js-length-check-first.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b4fc1de90442c5a3", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/rendering-svg-precision.md"}, "properties": {"repobilityId": "442c1b09c5840b4d", "scanner": "scanner-primary", "fingerprint": "b4fc1de90442c5a3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/vercel-react-best-practices/rules/rendering-svg-precision.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-97137f602936ba76", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/vercel-react-best-practices/rules/rerender-move-effect-to-event.md"}, "properties": {"repobilityId": "e92629638c3acc4c", "scanner": "scanner-primary", "fingerprint": "97137f602936ba76", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/vercel-react-best-practices/rules/rerender-move-effect-to-event.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1c3a19753d9b3b47", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/music/SKILL.md"}, "properties": {"repobilityId": "1219f77fdbaba447", "scanner": "scanner-primary", "fingerprint": "1c3a19753d9b3b47", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/music/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d5cc68f68d92d770", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/music/references/api_reference.md"}, "properties": {"repobilityId": "d49d7566537de9d4", "scanner": "scanner-primary", "fingerprint": "d5cc68f68d92d770", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/music/references/api_reference.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e0f035af831af975", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/music/references/installation.md"}, "properties": {"repobilityId": "7afccea26617c197", "scanner": "scanner-primary", "fingerprint": "e0f035af831af975", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/music/references/installation.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-addf1ec5fd6fe69d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/manimce-best-practices/rules/cli.md"}, "properties": {"repobilityId": "5a527b2e4fc205a2", "scanner": "scanner-primary", "fingerprint": "addf1ec5fd6fe69d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/manimce-best-practices/rules/cli.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5333911a8299b94d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/manimce-best-practices/rules/text-animations.md"}, "properties": {"repobilityId": "faa7be66c4541a5f", "scanner": "scanner-primary", "fingerprint": "5333911a8299b94d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/manimce-best-practices/rules/text-animations.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-158e52086bceb75d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/manimce-best-practices/rules/scenes.md"}, "properties": {"repobilityId": "f50042ae9b0abebd", "scanner": "scanner-primary", "fingerprint": "158e52086bceb75d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/manimce-best-practices/rules/scenes.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dfab911a0b94a04a", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/manimce-best-practices/rules/config.md"}, "properties": {"repobilityId": "2de78d1d7b5c4073", "scanner": "scanner-primary", "fingerprint": "dfab911a0b94a04a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/manimce-best-practices/rules/config.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-692c96ccea82c181", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .codex/prompts/README.md"}, "properties": {"repobilityId": "f423f587222f2f0b", "scanner": "scanner-primary", "fingerprint": "692c96ccea82c181", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "codex_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".codex/prompts/README.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-de2979271207c300", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .codex/prompts/backlot.md"}, "properties": {"repobilityId": "75b66cbb6fefc5de", "scanner": "scanner-primary", "fingerprint": "de2979271207c300", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "codex_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".codex/prompts/backlot.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-af4497861279e2ee", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .codex/prompts/animated-drawing.md"}, "properties": {"repobilityId": "7408141ab8e451c7", "scanner": "scanner-primary", "fingerprint": "af4497861279e2ee", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "codex_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".codex/prompts/animated-drawing.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-de56c33fc140355f", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .cursor/commands/backlot.md"}, "properties": {"repobilityId": "c18454854fd7be04", "scanner": "scanner-primary", "fingerprint": "de56c33fc140355f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "cursor_rule"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".cursor/commands/backlot.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a0b91b0935f943ee", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .cursor/commands/animated-drawing.md"}, "properties": {"repobilityId": "2240b8affe8ee0d3", "scanner": "scanner-primary", "fingerprint": "a0b91b0935f943ee", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "cursor_rule"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".cursor/commands/animated-drawing.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e725d2ab884fbd49", "level": "note", "message": {"text": "Multiple root agent instruction files without precedence"}, "properties": {"repobilityId": "1953db6c89508d22", "scanner": "scanner-primary", "fingerprint": "e725d2ab884fbd49", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["agent-instructions", "governance"]}}, {"ruleId": "scanner-89021a0c26f5b99f", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/agents/SKILL.md"}, "properties": {"repobilityId": "c1e95be0ac9ca627", "scanner": "scanner-primary", "fingerprint": "89021a0c26f5b99f", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/agents/SKILL.md"}, "region": {"startLine": 83}}}]}, {"ruleId": "scanner-45d8cc26bfe528f6", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/agents/references/agent-configuration.md"}, "properties": {"repobilityId": "e92109075ddb2cbe", "scanner": "scanner-primary", "fingerprint": "45d8cc26bfe528f6", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/agents/references/agent-configuration.md"}, "region": {"startLine": 450}}}]}, {"ruleId": "scanner-caf0ab3cb9bdbd6d", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/agents/references/client-tools.md"}, "properties": {"repobilityId": "c44a192f93e9f9b5", "scanner": "scanner-primary", "fingerprint": "caf0ab3cb9bdbd6d", "layer": "security", "severity": "medium", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/agents/references/client-tools.md"}, "region": {"startLine": 49}}}]}, {"ruleId": "scanner-a9a133528af2ac87", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/agents/references/installation.md"}, "properties": {"repobilityId": "b6b3560e1b44f798", "scanner": "scanner-primary", "fingerprint": "a9a133528af2ac87", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/agents/references/installation.md"}, "region": {"startLine": 101}}}]}, {"ruleId": "scanner-d7c666c90b421549", "level": "warning", "message": {"text": "SkillSpector RA2 (rogue-agent) in .claude/skills/agents/references/installation.md"}, "properties": {"repobilityId": "ff0339786df26dee", "scanner": "scanner-primary", "fingerprint": "d7c666c90b421549", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "rogue-agent", "RA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/agents/references/installation.md"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-f469f5dc8eedf756", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/ai-video-gen/SKILL.md"}, "properties": {"repobilityId": "9d0d99fd08126d95", "scanner": "scanner-primary", "fingerprint": "f469f5dc8eedf756", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/ai-video-gen/SKILL.md"}, "region": {"startLine": 171}}}]}, {"ruleId": "scanner-0f268f917cd8db8f", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in .claude/skills/ai-video-gen/SKILL.md"}, "properties": {"repobilityId": "eae57a14ab24af28", "scanner": "scanner-primary", "fingerprint": "0f268f917cd8db8f", "layer": "security", "severity": "high", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/ai-video-gen/SKILL.md"}, "region": {"startLine": 174}}}]}, {"ruleId": "scanner-60525ca59de6ac36", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/SKILL.md"}, "properties": {"repobilityId": "dbd726c23949072d", "scanner": "scanner-primary", "fingerprint": "60525ca59de6ac36", "layer": "security", "severity": "medium", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/avatar-video/SKILL.md"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-c588de12c9e6af3b", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/assets.md"}, "properties": {"repobilityId": "fc015c4fef731298", "scanner": "scanner-primary", "fingerprint": "c588de12c9e6af3b", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/avatar-video/references/assets.md"}, "region": {"startLine": 142}}}]}, {"ruleId": "scanner-78fd04cfaf7c74b2", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in .claude/skills/avatar-video/references/assets.md"}, "properties": {"repobilityId": "1d2aa99507c8184f", "scanner": "scanner-primary", "fingerprint": "78fd04cfaf7c74b2", "layer": "security", "severity": "high", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/avatar-video/references/assets.md"}, "region": {"startLine": 145}}}]}, {"ruleId": "scanner-b74a940f314993f1", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/avatars.md"}, "properties": {"repobilityId": "3ae04829606ed051", "scanner": "scanner-primary", "fingerprint": "b74a940f314993f1", "layer": "security", "severity": "medium", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/avatar-video/references/avatars.md"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-5db1ff398a60cbb9", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in .claude/skills/avatar-video/references/avatars.md"}, "properties": {"repobilityId": "6b7495563e60b776", "scanner": "scanner-primary", "fingerprint": "5db1ff398a60cbb9", "layer": "security", "severity": "high", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/avatar-video/references/avatars.md"}, "region": {"startLine": 105}}}]}, {"ruleId": "scanner-e9391af054e477d8", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/dimensions.md"}, "properties": {"repobilityId": "755f4eb05a6e90b4", "scanner": "scanner-primary", "fingerprint": "e9391af054e477d8", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/avatar-video/references/dimensions.md"}, "region": {"startLine": 66}}}]}, {"ruleId": "scanner-41cdb11c0ceadd9f", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/photo-avatars.md"}, "properties": {"repobilityId": "5380ed9b13ea59be", "scanner": "scanner-primary", "fingerprint": "41cdb11c0ceadd9f", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/avatar-video/references/photo-avatars.md"}, "region": {"startLine": 267}}}]}, {"ruleId": "scanner-768ef27a94a0ba37", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in .claude/skills/avatar-video/references/photo-avatars.md"}, "properties": {"repobilityId": "a60e50340768bc1f", "scanner": "scanner-primary", "fingerprint": "768ef27a94a0ba37", "layer": "security", "severity": "high", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/avatar-video/references/photo-avatars.md"}, "region": {"startLine": 263}}}]}, {"ruleId": "scanner-ddc60adb41a631c6", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/quota.md"}, "properties": {"repobilityId": "69adfffe23b4971f", "scanner": "scanner-primary", "fingerprint": "ddc60adb41a631c6", "layer": "security", "severity": "medium", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/avatar-video/references/quota.md"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-a0b739ded33479b5", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in .claude/skills/avatar-video/references/quota.md"}, "properties": {"repobilityId": "3d0c07604675c570", "scanner": "scanner-primary", "fingerprint": "a0b739ded33479b5", "layer": "security", "severity": "high", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/avatar-video/references/quota.md"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-ca61c53e22a00663", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/remotion-integration.md"}, "properties": {"repobilityId": "5b001fc56fcfed9c", "scanner": "scanner-primary", "fingerprint": "ca61c53e22a00663", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/avatar-video/references/remotion-integration.md"}, "region": {"startLine": 96}}}]}, {"ruleId": "scanner-6bf48736ea9d18f4", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/templates.md"}, "properties": {"repobilityId": "51d7d3dd1a04d1a5", "scanner": "scanner-primary", "fingerprint": "6bf48736ea9d18f4", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/avatar-video/references/templates.md"}, "region": {"startLine": 223}}}]}, {"ruleId": "scanner-3ab7056dae0cec6f", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in .claude/skills/avatar-video/references/templates.md"}, "properties": {"repobilityId": "aca1e801a5ac960a", "scanner": "scanner-primary", "fingerprint": "3ab7056dae0cec6f", "layer": "security", "severity": "high", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/avatar-video/references/templates.md"}, "region": {"startLine": 69}}}]}, {"ruleId": "scanner-ef0921ae06456456", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/video-generation.md"}, "properties": {"repobilityId": "3e271cf0ba3896f8", "scanner": "scanner-primary", "fingerprint": "ef0921ae06456456", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/avatar-video/references/video-generation.md"}, "region": {"startLine": 190}}}]}, {"ruleId": "scanner-510298ca8a7d4cbc", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in .claude/skills/avatar-video/references/video-generation.md"}, "properties": {"repobilityId": "e0d546e816f64d23", "scanner": "scanner-primary", "fingerprint": "510298ca8a7d4cbc", "layer": "security", "severity": "high", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/avatar-video/references/video-generation.md"}, "region": {"startLine": 193}}}]}, {"ruleId": "scanner-cf80320227675339", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/video-status.md"}, "properties": {"repobilityId": "bda7f4f900ac3a82", "scanner": "scanner-primary", "fingerprint": "cf80320227675339", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/avatar-video/references/video-status.md"}, "region": {"startLine": 354}}}]}, {"ruleId": "scanner-147f3b2d297b7494", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in .claude/skills/avatar-video/references/video-status.md"}, "properties": {"repobilityId": "11bd990e25dd0295", "scanner": "scanner-primary", "fingerprint": "147f3b2d297b7494", "layer": "security", "severity": "high", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/avatar-video/references/video-status.md"}, "region": {"startLine": 72}}}]}, {"ruleId": "scanner-c7096c653671fb31", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/voices.md"}, "properties": {"repobilityId": "4d1c7f0a394d7177", "scanner": "scanner-primary", "fingerprint": "c7096c653671fb31", "layer": "security", "severity": "medium", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/avatar-video/references/voices.md"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-57147193429c0883", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in .claude/skills/avatar-video/references/voices.md"}, "properties": {"repobilityId": "292cbcb1337f6de2", "scanner": "scanner-primary", "fingerprint": "57147193429c0883", "layer": "security", "severity": "high", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/avatar-video/references/voices.md"}, "region": {"startLine": 63}}}]}, {"ruleId": "scanner-6c748d5fe7344377", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/avatar-video/references/webhooks.md"}, "properties": {"repobilityId": "14d9a3d69d5e9ca8", "scanner": "scanner-primary", "fingerprint": "6c748d5fe7344377", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/avatar-video/references/webhooks.md"}, "region": {"startLine": 205}}}]}, {"ruleId": "scanner-a563a6e3837a7f35", "level": "warning", "message": {"text": "SkillSpector RA2 (rogue-agent) in .claude/skills/avatar-video/references/avatars.md"}, "properties": {"repobilityId": "227c113f6c0f733f", "scanner": "scanner-primary", "fingerprint": "a563a6e3837a7f35", "layer": "security", "severity": "medium", "confidence": 0.75, "tags": ["skillspector", "mcp-skill", "rogue-agent", "RA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/avatar-video/references/avatars.md"}, "region": {"startLine": 282}}}]}, {"ruleId": "scanner-0f9b2839abf9b565", "level": "error", "message": {"text": "SkillSpector TM1 (tool-misuse) in .claude/skills/avatar-video/SKILL.md"}, "properties": {"repobilityId": "a1cf0028778dd5be", "scanner": "scanner-primary", "fingerprint": "0f9b2839abf9b565", "layer": "security", "severity": "high", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/avatar-video/SKILL.md"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-14b33b465807036c", "level": "warning", "message": {"text": "SkillSpector LP3 (mcp-least-priv) in .claude/skills/bfl-api/SKILL.md"}, "properties": {"repobilityId": "a8f9a0d37b5a22cf", "scanner": "scanner-primary", "fingerprint": "14b33b465807036c", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "mcp-least-priv", "LP3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/bfl-api/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ff235b294b7d43ab", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/bfl-api/SKILL.md"}, "properties": {"repobilityId": "e835062d662531a4", "scanner": "scanner-primary", "fingerprint": "ff235b294b7d43ab", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/bfl-api/SKILL.md"}, "region": {"startLine": 84}}}]}, {"ruleId": "scanner-bbcd33090433ee40", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/bfl-api/references/code-examples/curl-examples.sh"}, "properties": {"repobilityId": "ec82ff2eec8a54ce", "scanner": "scanner-primary", "fingerprint": "bbcd33090433ee40", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/bfl-api/references/code-examples/curl-examples.sh"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-b351bd38e363d9e9", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in .claude/skills/bfl-api/references/code-examples/python-client.py"}, "properties": {"repobilityId": "e4c62951217d10b8", "scanner": "scanner-primary", "fingerprint": "b351bd38e363d9e9", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/bfl-api/references/code-examples/python-client.py"}, "region": {"startLine": 456}}}]}, {"ruleId": "scanner-b794d37239533263", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/bfl-api/references/endpoints.md"}, "properties": {"repobilityId": "20d5bf782a12b382", "scanner": "scanner-primary", "fingerprint": "b794d37239533263", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/bfl-api/references/endpoints.md"}, "region": {"startLine": 157}}}]}, {"ruleId": "scanner-5eb35734beb91aa5", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/bfl-api/references/polling-patterns.md"}, "properties": {"repobilityId": "ba78b5f0709decdb", "scanner": "scanner-primary", "fingerprint": "5eb35734beb91aa5", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/bfl-api/references/polling-patterns.md"}, "region": {"startLine": 137}}}]}, {"ruleId": "scanner-5f66758f8d9bfe8b", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/bfl-api/references/rate-limiting.md"}, "properties": {"repobilityId": "f2433d08b3c7c02a", "scanner": "scanner-primary", "fingerprint": "5f66758f8d9bfe8b", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/bfl-api/references/rate-limiting.md"}, "region": {"startLine": 75}}}]}, {"ruleId": "scanner-60aa147b62ca9963", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/bfl-api/references/webhook-integration.md"}, "properties": {"repobilityId": "4da0cd64cb6f4524", "scanner": "scanner-primary", "fingerprint": "60aa147b62ca9963", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/bfl-api/references/webhook-integration.md"}, "region": {"startLine": 289}}}]}, {"ruleId": "scanner-7f0b47efb70c573d", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/create-video/SKILL.md"}, "properties": {"repobilityId": "898d87edc491400d", "scanner": "scanner-primary", "fingerprint": "7f0b47efb70c573d", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/create-video/SKILL.md"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-0c345119256ff58d", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/create-video/references/assets.md"}, "properties": {"repobilityId": "eb918842fa943f45", "scanner": "scanner-primary", "fingerprint": "0c345119256ff58d", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/create-video/references/assets.md"}, "region": {"startLine": 142}}}]}, {"ruleId": "scanner-90ff48811a834b03", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in .claude/skills/create-video/references/assets.md"}, "properties": {"repobilityId": "8283f42ccb87968d", "scanner": "scanner-primary", "fingerprint": "90ff48811a834b03", "layer": "security", "severity": "high", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/create-video/references/assets.md"}, "region": {"startLine": 145}}}]}, {"ruleId": "scanner-56bc8265fbcfee7e", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/create-video/references/dimensions.md"}, "properties": {"repobilityId": "edb8dc63ae459dcf", "scanner": "scanner-primary", "fingerprint": "56bc8265fbcfee7e", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/create-video/references/dimensions.md"}, "region": {"startLine": 66}}}]}, {"ruleId": "scanner-773a4f8de85a0b82", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/create-video/references/quota.md"}, "properties": {"repobilityId": "a917018295ec0690", "scanner": "scanner-primary", "fingerprint": "773a4f8de85a0b82", "layer": "security", "severity": "medium", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/create-video/references/quota.md"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-906175a892e08b50", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in .claude/skills/create-video/references/quota.md"}, "properties": {"repobilityId": "ec535b94554afdd4", "scanner": "scanner-primary", "fingerprint": "906175a892e08b50", "layer": "security", "severity": "high", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/create-video/references/quota.md"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-55fc0060d9078207", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/create-video/references/video-agent.md"}, "properties": {"repobilityId": "e30efaa2fdd7929b", "scanner": "scanner-primary", "fingerprint": "55fc0060d9078207", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/create-video/references/video-agent.md"}, "region": {"startLine": 189}}}]}, {"ruleId": "scanner-711262c1f6db71fd", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in .claude/skills/create-video/references/video-agent.md"}, "properties": {"repobilityId": "9a7cdda15c2d5a50", "scanner": "scanner-primary", "fingerprint": "711262c1f6db71fd", "layer": "security", "severity": "high", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/create-video/references/video-agent.md"}, "region": {"startLine": 192}}}]}, {"ruleId": "scanner-e3e2e8c84bde58c9", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/create-video/references/video-status.md"}, "properties": {"repobilityId": "1e26387c411eaa44", "scanner": "scanner-primary", "fingerprint": "e3e2e8c84bde58c9", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/create-video/references/video-status.md"}, "region": {"startLine": 354}}}]}, {"ruleId": "scanner-fa6e9e4f923a1e7c", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in .claude/skills/create-video/references/video-status.md"}, "properties": {"repobilityId": "acf1b3e3c04b0947", "scanner": "scanner-primary", "fingerprint": "fa6e9e4f923a1e7c", "layer": "security", "severity": "high", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/create-video/references/video-status.md"}, "region": {"startLine": 72}}}]}, {"ruleId": "scanner-d90d0ea2efb0eeb2", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/create-video/references/webhooks.md"}, "properties": {"repobilityId": "fbafea954a626195", "scanner": "scanner-primary", "fingerprint": "d90d0ea2efb0eeb2", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/create-video/references/webhooks.md"}, "region": {"startLine": 205}}}]}, {"ruleId": "scanner-ae92756523b2c519", "level": "warning", "message": {"text": "SkillSpector EA1 (excessive-agency) in .claude/skills/create-video/SKILL.md"}, "properties": {"repobilityId": "b7e7d85f9a2dab82", "scanner": "scanner-primary", "fingerprint": "ae92756523b2c519", "layer": "security", "severity": "medium", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "excessive-agency", "EA1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/create-video/SKILL.md"}, "region": {"startLine": 47}}}]}, {"ruleId": "scanner-86bd7067ac10abde", "level": "error", "message": {"text": "SkillSpector P6 (prompt-injection) in .claude/skills/create-video/references/prompt-examples.md"}, "properties": {"repobilityId": "d3dd9e5b6c80e191", "scanner": "scanner-primary", "fingerprint": "86bd7067ac10abde", "layer": "security", "severity": "high", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "prompt-injection", "P6"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/create-video/references/prompt-examples.md"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-af234b36d2b3ffbc", "level": "error", "message": {"text": "SkillSpector TM1 (tool-misuse) in .claude/skills/create-video/SKILL.md"}, "properties": {"repobilityId": "0f3621b5de9540d6", "scanner": "scanner-primary", "fingerprint": "af234b36d2b3ffbc", "layer": "security", "severity": "high", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/create-video/SKILL.md"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-52309c1d72d8715d", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/faceswap/SKILL.md"}, "properties": {"repobilityId": "2a3be706ce250ecc", "scanner": "scanner-primary", "fingerprint": "52309c1d72d8715d", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/faceswap/SKILL.md"}, "region": {"startLine": 113}}}]}, {"ruleId": "scanner-604cfef72311531a", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in .claude/skills/faceswap/SKILL.md"}, "properties": {"repobilityId": "db3b4e609c1dd86e", "scanner": "scanner-primary", "fingerprint": "604cfef72311531a", "layer": "security", "severity": "high", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/faceswap/SKILL.md"}, "region": {"startLine": 116}}}]}, {"ruleId": "scanner-85964c4afdbca854", "level": "error", "message": {"text": "SkillSpector RA1 (rogue-agent) in .claude/skills/ffmpeg/SKILL.md"}, "properties": {"repobilityId": "f0c68b4459aeb5d7", "scanner": "scanner-primary", "fingerprint": "85964c4afdbca854", "layer": "security", "severity": "high", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "rogue-agent", "RA1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/ffmpeg/SKILL.md"}, "region": {"startLine": 429}}}]}, {"ruleId": "scanner-d21184934e59c281", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/assets.md"}, "properties": {"repobilityId": "9b872fdb082c37ef", "scanner": "scanner-primary", "fingerprint": "d21184934e59c281", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/heygen/references/assets.md"}, "region": {"startLine": 142}}}]}, {"ruleId": "scanner-96c5cfd6733d11bd", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in .claude/skills/heygen/references/assets.md"}, "properties": {"repobilityId": "dd840b9e7e69998b", "scanner": "scanner-primary", "fingerprint": "96c5cfd6733d11bd", "layer": "security", "severity": "high", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/heygen/references/assets.md"}, "region": {"startLine": 145}}}]}, {"ruleId": "scanner-d1c80cfe7ee0d6cf", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/authentication.md"}, "properties": {"repobilityId": "05b130ce82f7ae58", "scanner": "scanner-primary", "fingerprint": "d1c80cfe7ee0d6cf", "layer": "security", "severity": "medium", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/heygen/references/authentication.md"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-d06f82cdb3b90421", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in .claude/skills/heygen/references/authentication.md"}, "properties": {"repobilityId": "6ba525b39a3d1ce8", "scanner": "scanner-primary", "fingerprint": "d06f82cdb3b90421", "layer": "security", "severity": "high", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/heygen/references/authentication.md"}, "region": {"startLine": 73}}}]}, {"ruleId": "scanner-7081042c7567dc0a", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/avatars.md"}, "properties": {"repobilityId": "62e0ab60976c7baa", "scanner": "scanner-primary", "fingerprint": "7081042c7567dc0a", "layer": "security", "severity": "medium", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/heygen/references/avatars.md"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-dcf0a8e29126a8b9", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in .claude/skills/heygen/references/avatars.md"}, "properties": {"repobilityId": "fb726fdf27115db0", "scanner": "scanner-primary", "fingerprint": "dcf0a8e29126a8b9", "layer": "security", "severity": "high", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/heygen/references/avatars.md"}, "region": {"startLine": 105}}}]}, {"ruleId": "scanner-925bd942fa751f1f", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/dimensions.md"}, "properties": {"repobilityId": "19bcce4d3972e4cf", "scanner": "scanner-primary", "fingerprint": "925bd942fa751f1f", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/heygen/references/dimensions.md"}, "region": {"startLine": 66}}}]}, {"ruleId": "scanner-a0a2258c1d2ece4f", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/photo-avatars.md"}, "properties": {"repobilityId": "f307f668f1a78fea", "scanner": "scanner-primary", "fingerprint": "a0a2258c1d2ece4f", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/heygen/references/photo-avatars.md"}, "region": {"startLine": 267}}}]}, {"ruleId": "scanner-c24a2b4d8c1abdf8", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in .claude/skills/heygen/references/photo-avatars.md"}, "properties": {"repobilityId": "1df2f1ca2c2d79bb", "scanner": "scanner-primary", "fingerprint": "c24a2b4d8c1abdf8", "layer": "security", "severity": "high", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/heygen/references/photo-avatars.md"}, "region": {"startLine": 263}}}]}, {"ruleId": "scanner-1db14256232189c2", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/quota.md"}, "properties": {"repobilityId": "70704bd74b05d936", "scanner": "scanner-primary", "fingerprint": "1db14256232189c2", "layer": "security", "severity": "medium", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/heygen/references/quota.md"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-b47000321a8ce600", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in .claude/skills/heygen/references/quota.md"}, "properties": {"repobilityId": "ff2649248c028eed", "scanner": "scanner-primary", "fingerprint": "b47000321a8ce600", "layer": "security", "severity": "high", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/heygen/references/quota.md"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-2e014cbc71571754", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/remotion-integration.md"}, "properties": {"repobilityId": "7aafd5a5d562d83d", "scanner": "scanner-primary", "fingerprint": "2e014cbc71571754", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/heygen/references/remotion-integration.md"}, "region": {"startLine": 96}}}]}, {"ruleId": "scanner-5901dbf205169269", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/templates.md"}, "properties": {"repobilityId": "f8d8deccea1f70d8", "scanner": "scanner-primary", "fingerprint": "5901dbf205169269", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/heygen/references/templates.md"}, "region": {"startLine": 223}}}]}, {"ruleId": "scanner-e1c220710990a8c7", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in .claude/skills/heygen/references/templates.md"}, "properties": {"repobilityId": "ad70981ae29b6efe", "scanner": "scanner-primary", "fingerprint": "e1c220710990a8c7", "layer": "security", "severity": "high", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/heygen/references/templates.md"}, "region": {"startLine": 69}}}]}, {"ruleId": "scanner-22230a2a775ae989", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/video-agent.md"}, "properties": {"repobilityId": "71dacb735a367a2d", "scanner": "scanner-primary", "fingerprint": "22230a2a775ae989", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/heygen/references/video-agent.md"}, "region": {"startLine": 189}}}]}, {"ruleId": "scanner-b27e61f54644a84a", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in .claude/skills/heygen/references/video-agent.md"}, "properties": {"repobilityId": "a248dcf21abb81f6", "scanner": "scanner-primary", "fingerprint": "b27e61f54644a84a", "layer": "security", "severity": "high", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/heygen/references/video-agent.md"}, "region": {"startLine": 192}}}]}, {"ruleId": "scanner-04ce0266d7d3a6f0", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/video-generation.md"}, "properties": {"repobilityId": "40e4278420c430f3", "scanner": "scanner-primary", "fingerprint": "04ce0266d7d3a6f0", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/heygen/references/video-generation.md"}, "region": {"startLine": 190}}}]}, {"ruleId": "scanner-56f155b3b09448ca", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in .claude/skills/heygen/references/video-generation.md"}, "properties": {"repobilityId": "d0e22ed339263e5b", "scanner": "scanner-primary", "fingerprint": "56f155b3b09448ca", "layer": "security", "severity": "high", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/heygen/references/video-generation.md"}, "region": {"startLine": 193}}}]}, {"ruleId": "scanner-2ee448bb4dc53679", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/video-status.md"}, "properties": {"repobilityId": "f158c3d9e7b51bf5", "scanner": "scanner-primary", "fingerprint": "2ee448bb4dc53679", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/heygen/references/video-status.md"}, "region": {"startLine": 354}}}]}, {"ruleId": "scanner-f2503df547350481", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in .claude/skills/heygen/references/video-status.md"}, "properties": {"repobilityId": "3161b2a723155bea", "scanner": "scanner-primary", "fingerprint": "f2503df547350481", "layer": "security", "severity": "high", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/heygen/references/video-status.md"}, "region": {"startLine": 72}}}]}, {"ruleId": "scanner-31ce4b1b601a0f0c", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/voices.md"}, "properties": {"repobilityId": "735c2d28819e5b15", "scanner": "scanner-primary", "fingerprint": "31ce4b1b601a0f0c", "layer": "security", "severity": "medium", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/heygen/references/voices.md"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-46bb51f4e538f81d", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in .claude/skills/heygen/references/voices.md"}, "properties": {"repobilityId": "9c5f73d36c763a81", "scanner": "scanner-primary", "fingerprint": "46bb51f4e538f81d", "layer": "security", "severity": "high", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/heygen/references/voices.md"}, "region": {"startLine": 63}}}]}, {"ruleId": "scanner-247ae11c9b052dda", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in .claude/skills/heygen/references/webhooks.md"}, "properties": {"repobilityId": "c09090c39b91cca0", "scanner": "scanner-primary", "fingerprint": "247ae11c9b052dda", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/heygen/references/webhooks.md"}, "region": {"startLine": 205}}}]}, {"ruleId": "scanner-af1684e8770445cb", "level": "warning", "message": {"text": "SkillSpector EA1 (excessive-agency) in .claude/skills/heygen/SKILL.md"}, "properties": {"repobilityId": "df708f339c24f87b", "scanner": "scanner-primary", "fingerprint": "af1684e8770445cb", "layer": "security", "severity": "medium", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "excessive-agency", "EA1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/heygen/SKILL.md"}, "region": {"startLine": 45}}}]}, {"ruleId": "scanner-d8c8b8618fbeb317", "level": "warning", "message": {"text": "SkillSpector RA2 (rogue-agent) in .claude/skills/heygen/references/avatars.md"}, "properties": {"repobilityId": "57e48f531108446f", "scanner": "scanner-primary", "fingerprint": "d8c8b8618fbeb317", "layer": "security", "severity": "medium", "confidence": 0.75, "tags": ["skillspector", "mcp-skill", "rogue-agent", "RA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/heygen/references/avatars.md"}, "region": {"startLine": 282}}}]}, {"ruleId": "scanner-aa9bdc38ef504bbd", "level": "error", "message": {"text": "SkillSpector P6 (prompt-injection) in .claude/skills/heygen/references/prompt-examples.md"}, "properties": {"repobilityId": "ee623abd22fbd0a1", "scanner": "scanner-primary", "fingerprint": "aa9bdc38ef504bbd", "layer": "security", "severity": "high", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "prompt-injection", "P6"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/heygen/references/prompt-examples.md"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-1737e89ac4dfd1a3", "level": "error", "message": {"text": "SkillSpector TM1 (tool-misuse) in .claude/skills/heygen/SKILL.md"}, "properties": {"repobilityId": "5d356bb31e594add", "scanner": "scanner-primary", "fingerprint": "1737e89ac4dfd1a3", "layer": "security", "severity": "high", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/heygen/SKILL.md"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-9a64d348a618945e", "level": "error", "message": {"text": "SkillSpector PE3 (priv-esc) in .claude/skills/ltx2/SKILL.md"}, "properties": {"repobilityId": "b5f09359aa579493", "scanner": "scanner-primary", "fingerprint": "9a64d348a618945e", "layer": "security", "severity": "high", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "priv-esc", "PE3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/ltx2/SKILL.md"}, "region": {"startLine": 169}}}]}, {"ruleId": "scanner-6b1da4c5acc1ab00", "level": "note", "message": {"text": "SkillSpector EA3 (excessive-agency) in .claude/skills/manimce-best-practices/LICENSE.txt"}, "properties": {"repobilityId": "ad56a2659b35f9f7", "scanner": "scanner-primary", "fingerprint": "6b1da4c5acc1ab00", "layer": "security", "severity": "low", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "excessive-agency", "EA3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/manimce-best-practices/LICENSE.txt"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-609b9355646cbbe1", "level": "warning", "message": {"text": "SkillSpector AST4 (behavioral-ast) in .claude/skills/manimgl-best-practices/templates/3d_scene.py"}, "properties": {"repobilityId": "50e1e9487fd2dcda", "scanner": "scanner-primary", "fingerprint": "609b9355646cbbe1", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST4", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/manimgl-best-practices/templates/3d_scene.py"}, "region": {"startLine": 258}}}]}, {"ruleId": "scanner-ce1f213c53bbbe92", "level": "warning", "message": {"text": "SkillSpector AST4 (behavioral-ast) in .claude/skills/manimgl-best-practices/templates/basic_scene.py"}, "properties": {"repobilityId": "6f4980bc35e6b19e", "scanner": "scanner-primary", "fingerprint": "ce1f213c53bbbe92", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST4", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/manimgl-best-practices/templates/basic_scene.py"}, "region": {"startLine": 134}}}]}, {"ruleId": "scanner-bc3e63ecc078b3a7", "level": "warning", "message": {"text": "SkillSpector AST4 (behavioral-ast) in .claude/skills/manimgl-best-practices/templates/math_scene.py"}, "properties": {"repobilityId": "5369c36d4f552072", "scanner": "scanner-primary", "fingerprint": "bc3e63ecc078b3a7", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST4", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/manimgl-best-practices/templates/math_scene.py"}, "region": {"startLine": 333}}}]}, {"ruleId": "scanner-8b149611af4b72ee", "level": "warning", "message": {"text": "SkillSpector LP3 (mcp-least-priv) in .claude/skills/manimgl-best-practices/SKILL.md"}, "properties": {"repobilityId": "6ec67d46262134c8", "scanner": "scanner-primary", "fingerprint": "8b149611af4b72ee", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "mcp-least-priv", "LP3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/manimgl-best-practices/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e637c415447867e4", "level": "none", "message": {"text": "Run SkillSpector's LLM-backed analysis in your own pipeline"}, "properties": {"repobilityId": "1936f198ff5212bf", "scanner": "scanner-primary", "fingerprint": "e637c415447867e4", "layer": "security", "severity": "info", "confidence": 1.0, "tags": ["skillspector", "mcp-skill", "llm-advisory", "ai-coder"]}}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ae16880318b99912", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-48c56aeb89b544a1", "level": "note", "message": {"text": "Very large file: tests/tools/test_hyperframes_compose.py (1315 lines)"}, "properties": {"repobilityId": "c9f6873071c0fb1d", "scanner": "scanner-primary", "fingerprint": "48c56aeb89b544a1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-5d14f04e8972f304", "level": "note", "message": {"text": "Very large file: tools/video/video_compose.py (2634 lines)"}, "properties": {"repobilityId": "99c43ae852830ea5", "scanner": "scanner-primary", "fingerprint": "5d14f04e8972f304", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "2c884cb1143bfe16", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "de9f3f74bba93e05", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "560bf04657c6e1ef", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-dfbeabf5c52c6063", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 render_demo.py:63"}, "properties": {"repobilityId": "04f53983cb9f78f5", "scanner": "scanner-primary", "fingerprint": "dfbeabf5c52c6063", "layer": "quality", "severity": "medium", "confidence": 0.85, "tags": ["integrity", "fragile-runtime", "robustness"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "render_demo.py"}, "region": {"startLine": 63}}}]}, {"ruleId": "scanner-4605eaf2c8f327d1", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/backlot_watch_captures.py:104"}, "properties": {"repobilityId": "f5f1df9442bcafcb", "scanner": "scanner-primary", "fingerprint": "4605eaf2c8f327d1", "layer": "quality", "severity": "medium", "confidence": 0.85, "tags": ["integrity", "fragile-runtime", "robustness"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/backlot_watch_captures.py"}, "region": {"startLine": 104}}}]}, {"ruleId": "scanner-0d7f424e5160921b", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/backlot_visual_eval.py:121"}, "properties": {"repobilityId": "45b9a25a2d9ca746", "scanner": "scanner-primary", "fingerprint": "0d7f424e5160921b", "layer": "quality", "severity": "medium", "confidence": 0.85, "tags": ["integrity", "fragile-runtime", "robustness"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/backlot_visual_eval.py"}, "region": {"startLine": 121}}}]}, {"ruleId": "scanner-9c2c32f0a69c74f4", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 .claude/skills/video-understand/scripts/understand_video.py:67"}, "properties": {"repobilityId": "1a1165cd96a60da9", "scanner": "scanner-primary", "fingerprint": "9c2c32f0a69c74f4", "layer": "quality", "severity": "medium", "confidence": 0.85, "tags": ["integrity", "fragile-runtime", "robustness"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/video-understand/scripts/understand_video.py"}, "region": {"startLine": 67}}}]}, {"ruleId": "scanner-ddcfcb36f16bd123", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 .claude/skills/manimgl-best-practices/templates/basic_scene.py:134"}, "properties": {"repobilityId": "3853b2219da23847", "scanner": "scanner-primary", "fingerprint": "ddcfcb36f16bd123", "layer": "quality", "severity": "medium", "confidence": 0.85, "tags": ["integrity", "fragile-runtime", "robustness"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/manimgl-best-practices/templates/basic_scene.py"}, "region": {"startLine": 134}}}]}, {"ruleId": "scanner-14916de003c78593", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 .claude/skills/manimgl-best-practices/templates/3d_scene.py:258"}, "properties": {"repobilityId": "4bfa578dd49f03a5", "scanner": "scanner-primary", "fingerprint": "14916de003c78593", "layer": "quality", "severity": "medium", "confidence": 0.85, "tags": ["integrity", "fragile-runtime", "robustness"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/manimgl-best-practices/templates/3d_scene.py"}, "region": {"startLine": 258}}}]}, {"ruleId": "scanner-6fbcdfb93ba6fd11", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 .claude/skills/manimgl-best-practices/templates/math_scene.py:333"}, "properties": {"repobilityId": "e5ec079bffdea7ca", "scanner": "scanner-primary", "fingerprint": "6fbcdfb93ba6fd11", "layer": "quality", "severity": "medium", "confidence": 0.85, "tags": ["integrity", "fragile-runtime", "robustness"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/manimgl-best-practices/templates/math_scene.py"}, "region": {"startLine": 333}}}]}, {"ruleId": "scanner-b596f8830a6608d2", "level": "note", "message": {"text": "Legacy-named symbol `inp_copy` in .claude/skills/manimgl-best-practices/examples/mlp_relu_visualization.py:160"}, "properties": {"repobilityId": "47fe91eff3747050", "scanner": "scanner-primary", "fingerprint": "b596f8830a6608d2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-cf843c0f30e15cb0", "level": "note", "message": {"text": "Legacy-named symbol `text_copy` in .claude/skills/manimgl-best-practices/examples/llm_prediction_pipeline.py:97"}, "properties": {"repobilityId": "2cbfd899b1f19fff", "scanner": "scanner-primary", "fingerprint": "cf843c0f30e15cb0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-86e85cb4c47be014", "level": "note", "message": {"text": "Legacy-named symbol `text_copy` in .claude/skills/manimgl-best-practices/examples/autoregressive_flow.py:77"}, "properties": {"repobilityId": "fee861d8eb891e2a", "scanner": "scanner-primary", "fingerprint": "86e85cb4c47be014", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-c93506a5e152910f", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/audio/piper_tts.py:123"}, "properties": {"repobilityId": "8814f843df669e9c", "scanner": "scanner-primary", "fingerprint": "c93506a5e152910f", "layer": "quality", "severity": "medium", "confidence": 0.85, "tags": ["integrity", "fragile-runtime", "robustness"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/audio/piper_tts.py"}, "region": {"startLine": 123}}}]}, {"ruleId": "scanner-4a62407b5c85fd43", "level": "note", "message": {"text": "Legacy-named symbol `eleven_multilingual_v2` in tools/audio/elevenlabs_tts.py:78"}, "properties": {"repobilityId": "eec1cf6c2722d429", "scanner": "scanner-primary", "fingerprint": "4a62407b5c85fd43", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-c465db7a4c6a1fdb", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/audio/elevenlabs_tts.py:175"}, "properties": {"repobilityId": "f61897bb0ca58391", "scanner": "scanner-primary", "fingerprint": "c465db7a4c6a1fdb", "layer": "quality", "severity": "medium", "confidence": 0.85, "tags": ["integrity", "fragile-runtime", "robustness"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/audio/elevenlabs_tts.py"}, "region": {"startLine": 175}}}]}, {"ruleId": "scanner-78ac1dd3d1f84eca", "level": "note", "message": {"text": "Legacy-named symbol `eleven_multilingual_v2` in tools/audio/tts_selector.py:61"}, "properties": {"repobilityId": "d09938ccab1f3df1", "scanner": "scanner-primary", "fingerprint": "78ac1dd3d1f84eca", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-891341aee93603d1", "level": "note", "message": {"text": "Legacy-named symbol `2_t2v_lightx2v_4steps_lora_v1` in tools/_comfyui/metadata.py:98"}, "properties": {"repobilityId": "7f055c6a4a49b8b9", "scanner": "scanner-primary", "fingerprint": "891341aee93603d1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-565019671747b3e7", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/character/character_animation.py:104"}, "properties": {"repobilityId": "920ce6bedacca173", "scanner": "scanner-primary", "fingerprint": "565019671747b3e7", "layer": "quality", "severity": "medium", "confidence": 0.85, "tags": ["integrity", "fragile-runtime", "robustness"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/character/character_animation.py"}, "region": {"startLine": 104}}}]}, {"ruleId": "scanner-0b96e80f1867bf5a", "level": "note", "message": {"text": "Legacy-named symbol `2_t2v_lightx2v_4steps_lora_v1` in tools/video/comfyui_video.py:61"}, "properties": {"repobilityId": "f556c912a2b43b0f", "scanner": "scanner-primary", "fingerprint": "0b96e80f1867bf5a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-8177bb2e5ee54340", "level": "note", "message": {"text": "Legacy-named symbol `kling_v2` in tools/video/_shared.py:22"}, "properties": {"repobilityId": "758381d5b4b17f48", "scanner": "scanner-primary", "fingerprint": "8177bb2e5ee54340", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-890b3088219397ee", "level": "note", "message": {"text": "Legacy-named symbol `_link_or_copy` in tools/video/clip_cache.py:354"}, "properties": {"repobilityId": "ff2c64b85c8b0ba5", "scanner": "scanner-primary", "fingerprint": "890b3088219397ee", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-b0b7578dd2a289b6", "level": "note", "message": {"text": "26 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "8099a5c5713d37b9", "scanner": "scanner-primary", "fingerprint": "b0b7578dd2a289b6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "7b0533999dbb8a2c", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "8891c91cc1697e5f", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-c78d6f4a10d15e1a", "level": "error", "message": {"text": "Vulnerable dependency fast-uri 3.1.2: GHSA-4c8g-83qw-93j6"}, "properties": {"repobilityId": "b415b1056beb5b08", "scanner": "scanner-primary", "fingerprint": "c78d6f4a10d15e1a", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-4c8g-83qw-93j6", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "remotion-composer/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c1346ca60500d8e9", "level": "error", "message": {"text": "Vulnerable dependency fast-uri 3.1.2: GHSA-v2hh-gcrm-f6hx"}, "properties": {"repobilityId": "963ee1409fedeb90", "scanner": "scanner-primary", "fingerprint": "c1346ca60500d8e9", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-v2hh-gcrm-f6hx", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "remotion-composer/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cdb69d41e7ebe492", "level": "note", "message": {"text": "Dependency react-dom is a major version behind"}, "properties": {"repobilityId": "833ee64f006dd69a", "scanner": "scanner-primary", "fingerprint": "cdb69d41e7ebe492", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "remotion-composer/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dcb57d6fbd94a8b7", "level": "note", "message": {"text": "Dependency react is a major version behind"}, "properties": {"repobilityId": "79c67ed3a7686c4e", "scanner": "scanner-primary", "fingerprint": "dcb57d6fbd94a8b7", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "remotion-composer/package.json"}, "region": {"startLine": 1}}}]}]}]}