{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-20c894e5f6b2f935", "name": "TODO/FIXME marker in shipping code \u2014 packages/ai/test/tokens.test.ts:239", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 packages/ai/test/tokens.test.ts:239"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-87208b4c70242301", "name": "TODO/FIXME marker in shipping code \u2014 packages/ai/test/image-tool-result.test.ts:321", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 packages/ai/test/image-tool-result.test.ts:321"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-77e0268ee53edcb1", "name": "TODO/FIXME marker in shipping code \u2014 packages/ai/src/api/openai-codex-responses.ts:919", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 packages/ai/src/api/openai-codex-responses.ts:919"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-d9d30c659932aadd", "name": "var in script tag \u2014 packages/coding-agent/src/core/export-html/template.html:42", "shortDescription": {"text": "var in script tag \u2014 packages/coding-agent/src/core/export-html/template.html:42"}, "fullDescription": {"text": "Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of a script tag). Alternatively, use a JavaScript-specific encoder, such as the one available in OWASP ESAPI. For Django, you may also consider using the 'json_script' template tag and retrieving the data in your script by using the element ID (e.g., `document.getElementById`).\n\nRule: generic.html-templates.security.var-in-script-tag.var-in-script-tag\nSeverity: WARNING\nOWASP: A07:2017 - Cross-Site Scripting (XSS), A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-721bd367be61579a", "name": "detect child process \u2014 packages/coding-agent/src/core/resolve-config-value.ts:187", "shortDescription": {"text": "detect child process \u2014 packages/coding-agent/src/core/resolve-config-value.ts:187"}, "fullDescription": {"text": "Detected calls to child_process from a function argument `command`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed.\n\nRule: javascript.lang.security.detect-child-process.detect-child-process\nSeverity: ERROR\nOWASP: A01:2017 - Injection, A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-af2ffd92f6c75aa3", "name": "detect child process \u2014 packages/coding-agent/src/core/tools/bash.ts:97", "shortDescription": {"text": "detect child process \u2014 packages/coding-agent/src/core/tools/bash.ts:97"}, "fullDescription": {"text": "Detected calls to child_process from a function argument `options`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed.\n\nRule: javascript.lang.security.detect-child-process.detect-child-process\nSeverity: ERROR\nOWASP: A01:2017 - Injection, A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-b3fc51bf05a91adb", "name": "detect child process \u2014 packages/coding-agent/src/utils/clipboard-image.ts:97", "shortDescription": {"text": "detect child process \u2014 packages/coding-agent/src/utils/clipboard-image.ts:97"}, "fullDescription": {"text": "Detected calls to child_process from a function argument `command`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed.\n\nRule: javascript.lang.security.detect-child-process.detect-child-process\nSeverity: ERROR\nOWASP: A01:2017 - Injection, A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-6d9a2973abc88440", "name": "detect child process \u2014 packages/coding-agent/src/utils/tools-manager.ts:76", "shortDescription": {"text": "detect child process \u2014 packages/coding-agent/src/utils/tools-manager.ts:76"}, "fullDescription": {"text": "Detected calls to child_process from a function argument `cmd`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed.\n\nRule: javascript.lang.security.detect-child-process.detect-child-process\nSeverity: ERROR\nOWASP: A01:2017 - Injection, A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-fdbae39dd81020e7", "name": "detect child process \u2014 packages/tui/src/autocomplete.ts:164", "shortDescription": {"text": "detect child process \u2014 packages/tui/src/autocomplete.ts:164"}, "fullDescription": {"text": "Detected calls to child_process from a function argument `fdPath`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed.\n\nRule: javascript.lang.security.detect-child-process.detect-child-process\nSeverity: ERROR\nOWASP: A01:2017 - Injection, A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-382e4c9b06555799", "name": "CVE-2026-59877: protobufjs 7.6.4 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-59877: protobufjs 7.6.4 \u2014 package-lock.json"}, "fullDescription": {"text": "protobufjs: protobufjs: Denial of Service via crafted .proto schema\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing through schema tokens until reaching an = token without checking for end of input, so a crafted .proto schema that opens an option declaration and ends prematurely can cause parse, Root.load, or Root.loadSync to loop indefinitely. This issue is fixed in versions 7.6.5 and 8.6.6.\n\nPackage: protobufjs\nInstalled: 7.6.4\nFixed in: 7.6.5, 8.6.6\nSeverity: MEDIUM\nFix: Upgrade protobufjs to 7.6.5, 8.6.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fdbda6c219e1c15f", "name": "CVE-2026-13311: shell-quote 1.8.4 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-13311: shell-quote 1.8.4 \u2014 package-lock.json"}, "fullDescription": {"text": "shell-quote: shell-quote/parse: shell-quote: Denial of Service due to inefficient input parsing\n\nshell-quote prior to 1.8.5 finalizes parsed tokens in parse() using Array.prototype.concat as a reduce accumulator, which reallocates and copies the entire growing array on every iteration. As a result parse() runs in O(n^2) time relative to the number of input tokens. An attacker who can supply an attacker-controlled string to any code path that calls parse() (no shell metacharacters are required; plain space-separated words suffice) can block the single-threaded Node.js event loop for an exten\n\nPackage: shell-quote\nInstalled: 1.8.4\nFixed in: 1.9.0\nSeverity: HIGH\nFix: Upgrade shell-quote to 1.9.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f5a3c8b13ad812a9", "name": "CVE-2026-12151: undici 6.26.0 \u2014 packages/coding-agent/examples/extensions/gondolin/package-lock.json", "shortDescription": {"text": "CVE-2026-12151: undici 6.26.0 \u2014 packages/coding-agent/examples/extensions/gondolin/package-lock.json"}, "fullDescription": {"text": "undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames\n\nImpact:\nThe undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service.\n\nAffected applications are those using the undici WebSocket client\n\nPackage: undici\nInstalled: 6.26.0\nFixed in: 6.27.0, 7.28.0, 8.5.0\nSeverity: HIGH\nFix: Upgrade undici to 6.27.0, 7.28.0, 8.5.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7ac062b1376ed2d0", "name": "CVE-2026-9679: undici 6.26.0 \u2014 packages/coding-agent/examples/extensions/gondolin/package-lock.json", "shortDescription": {"text": "CVE-2026-9679: undici 6.26.0 \u2014 packages/coding-agent/examples/extensions/gondolin/package-lock.json"}, "fullDescription": {"text": "undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding\n\nImpact:\nundici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into their literal byte equivalents. RFC 6265 \u00a75.4 does not specify any decoding and browsers do not decode either.\n\nApplications that parse a Set-Cookie header and then forward the parsed value into a response header (proxies, middleware, SSR frameworks) become vulnerable to HTTP response header injection: an attacker-controlled upstream can inj\n\nPackage: undici\nInstalled: 6.26.0\nFixed in: 6.27.0, 7.28.0, 8.5.0\nSeverity: MEDIUM\nFix: Upgrade undici to 6.27.0, 7.28.0, 8.5.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c0913f5ff768d464", "name": "CVE-2026-11525: undici 6.26.0 \u2014 packages/coding-agent/examples/extensions/gondolin/package-lock.json", "shortDescription": {"text": "CVE-2026-11525: undici 6.26.0 \u2014 packages/coding-agent/examples/extensions/gondolin/package-lock.json"}, "fullDescription": {"text": "undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header\n\nImpact:\nWhen undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the three standard tokens. For example, SameSite=NoneOfYourBusiness is parsed as None (the most permissive setting), and SameSite=StrictLax is parsed as Lax (a downgrade from Strict).\n\nAffected applications are those that consume Set-Cookie header\n\nPackage: undici\nInstalled: 6.26.0\nFixed in: 6.27.0, 7.28.0, 8.5.0\nSeverity: LOW\nFix: Upgrade undici to 6.27.0, 7.28.0, 8.5.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-13f7f1cf7ddd3cf2", "name": "CVE-2026-6733: undici 6.26.0 \u2014 packages/coding-agent/examples/extensions/gondolin/package-lock.json", "shortDescription": {"text": "CVE-2026-6733: undici 6.26.0 \u2014 packages/coding-agent/examples/extensions/gondolin/package-lock.json"}, "fullDescription": {"text": "undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery.\n\nImpact:\nUndici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after a request completes. When the client dispatches the next request on that socket, it associates the injected response with the new request, causing responses to be delivered to the wrong requests.\n\nThis requires an attacker-controlled or compromised upstream HTTP/1.1 server and keep-ali\n\nPackage: undici\nInstalled: 6.26.0\nFixed in: 6.27.0, 7.28.0, 8.5.0\nSeverity: LOW\nFix: Upgrade undici to 6.27.0, 7.28.0, 8.5.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5a0bc643f221717b", "name": "CVE-2026-9277: shell-quote 1.8.3 \u2014 packages/coding-agent/examples/extensions/sandbox/package-lock.json", "shortDescription": {"text": "CVE-2026-9277: shell-quote 1.8.3 \u2014 packages/coding-agent/examples/extensions/sandbox/package-lock.json"}, "fullDescription": {"text": "shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators\n\nshell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which in JavaScript does not match line terminators (\\n, \\r, U+2028, U+2029). A line terminator in `.op` therefore passed through unescaped into the output; POSIX shells treat a literal newline as a command separator, so any content after it would execute as a second command. The vulnerable code path is re\n\nPackage: shell-quote\nInstalled: 1.8.3\nFixed in: 1.8.4\nSeverity: CRITICAL\nFix: Upgrade shell-quote to 1.8.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-9e6ac7214c75ccb3", "name": "CVE-2026-13311: shell-quote 1.8.3 \u2014 packages/coding-agent/examples/extensions/sandbox/package-lock.json", "shortDescription": {"text": "CVE-2026-13311: shell-quote 1.8.3 \u2014 packages/coding-agent/examples/extensions/sandbox/package-lock.json"}, "fullDescription": {"text": "shell-quote: shell-quote/parse: shell-quote: Denial of Service due to inefficient input parsing\n\nshell-quote prior to 1.8.5 finalizes parsed tokens in parse() using Array.prototype.concat as a reduce accumulator, which reallocates and copies the entire growing array on every iteration. As a result parse() runs in O(n^2) time relative to the number of input tokens. An attacker who can supply an attacker-controlled string to any code path that calls parse() (no shell metacharacters are required; plain space-separated words suffice) can block the single-threaded Node.js event loop for an exten\n\nPackage: shell-quote\nInstalled: 1.8.3\nFixed in: 1.9.0\nSeverity: HIGH\nFix: Upgrade shell-quote to 1.9.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4bc64905d42a4660", "name": "CVE-2026-59877: protobufjs 7.6.4 \u2014 packages/coding-agent/install-lock/package-lock.json", "shortDescription": {"text": "CVE-2026-59877: protobufjs 7.6.4 \u2014 packages/coding-agent/install-lock/package-lock.json"}, "fullDescription": {"text": "protobufjs: protobufjs: Denial of Service via crafted .proto schema\n\nprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing through schema tokens until reaching an = token without checking for end of input, so a crafted .proto schema that opens an option declaration and ends prematurely can cause parse, Root.load, or Root.loadSync to loop indefinitely. This issue is fixed in versions 7.6.5 and 8.6.6.\n\nPackage: protobufjs\nInstalled: 7.6.4\nFixed in: 7.6.5, 8.6.6\nSeverity: MEDIUM\nFix: Upgrade protobufjs to 7.6.5, 8.6.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2679282aa1c484b5", "name": "Agent authority lacks a verifier contract: AGENTS.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: AGENTS.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e637c415447867e4", "name": "Run SkillSpector's LLM-backed analysis in your own pipeline", "shortDescription": {"text": "Run SkillSpector's LLM-backed analysis in your own pipeline"}, "fullDescription": {"text": "Repobility ran SkillSpector's static rules server-side. The deeper LLM-backed analyzers \u2014 tool-poisoning (TP*), semantic security discovery (SSD*), developer-intent mismatch (SDI*) \u2014 are meant to run on YOUR machine with YOUR model; repobility never sends your code to an LLM. Recipe:\n\n# 1. Install SkillSpector in your own isolated env\npipx install \"skillspector @ git+https://github.com/NVIDIA/SkillSpector.git\"\n\n# 2. Point it at YOUR LLM pipeline (pick one) - your code stays on your machine\nexport SKILLSPECTOR_PROVIDER=anthropic && export ANTHROPIC_API_KEY=sk-ant-...\n# export SKILLSPECTOR_PROVIDER=openai   && export OPENAI_API_KEY=sk-...\n# export SKILLSPECTOR_PROVIDER=openai OPENAI_API_KEY=ollama OPENAI_BASE_URL=http://localhost:11434/v1 SKILLSPECTOR_MODEL=llama3.1:8b\n# export SKILLSPECTOR_PROVIDER=nv_build && export NVIDIA_INFERENCE_KEY=nvapi-...\n\n# 3. Run the LLM-backed scan per skill (omit --no-llm to enable the LLM analyzers)\nskillspector scan packages/coding-agent/examples/extensio"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "info", "confidence": 1.0}}, {"id": "scanner-132ae653955024d8", "name": "Insecure pattern 'node_child_process' in scripts/diff-model-catalog.mjs:6", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/diff-model-catalog.mjs:6"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.8}}, {"id": "scanner-bce5324550fa6f45", "name": "Insecure pattern 'node_child_process' in scripts/release.mjs:21", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/release.mjs:21"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.9}}, {"id": "scanner-2860edf552efdceb", "name": "Insecure pattern 'node_child_process' in packages/tui/src/terminal-image.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/tui/src/terminal-image.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.9}}, {"id": "scanner-a8afb557567b452c", "name": "Insecure pattern 'exec_used' in packages/agent/src/harness/types.ts:364", "shortDescription": {"text": "Insecure pattern 'exec_used' in packages/agent/src/harness/types.ts:364"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0d4183e1f499e90c", "name": "Insecure pattern 'node_child_process' in packages/coding-agent/src/utils/clipboard.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/coding-agent/src/utils/clipboard.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.9}}, {"id": "scanner-1f5c952dd4f52ea9", "name": "Insecure pattern 'node_child_process' in packages/coding-agent/src/core/resolve-config-value.ts:6", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/coding-agent/src/core/resolve-config-value.ts:6"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.9}}, {"id": "scanner-aa34b4b441034ac8", "name": "Insecure pattern 'exec_used' in packages/coding-agent/src/core/extensions/loader.ts:334", "shortDescription": {"text": "Insecure pattern 'exec_used' in packages/coding-agent/src/core/extensions/loader.ts:334"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fa90a69c41975e26", "name": "Insecure pattern 'exec_used' in packages/coding-agent/src/core/extensions/types.ts:1306", "shortDescription": {"text": "Insecure pattern 'exec_used' in packages/coding-agent/src/core/extensions/types.ts:1306"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6e4b8d1bf6575cfd", "name": "Insecure pattern 'exec_used' in packages/storage/sqlite-node/src/index.ts:55", "shortDescription": {"text": "Insecure pattern 'exec_used' in packages/storage/sqlite-node/src/index.ts:55"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-398089fc42a9d7a8", "name": "Insecure pattern 'exec_used' in packages/storage/sqlite-node/src/sqlite/types.ts:20", "shortDescription": {"text": "Insecure pattern 'exec_used' in packages/storage/sqlite-node/src/sqlite/types.ts:20"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e4d7dc1816f5e82b", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e4d042c6ae3bf770", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cb639d9a10a47b23", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c58e6b4d13b240d6", "name": "Very large file: packages/ai/test/openai-codex-stream.test.ts (2286 lines)", "shortDescription": {"text": "Very large file: packages/ai/test/openai-codex-stream.test.ts (2286 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0947dbc83f8897b4", "name": "Very large file: packages/ai/test/stream.test.ts (1691 lines)", "shortDescription": {"text": "Very large file: packages/ai/test/stream.test.ts (1691 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6a134a2582cf29fd", "name": "Very large file: packages/ai/scripts/generate-models.ts (2645 lines)", "shortDescription": {"text": "Very large file: packages/ai/scripts/generate-models.ts (2645 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-249406ab360f61f4", "name": "Very large file: packages/ai/src/api/openai-codex-responses.ts (1590 lines)", "shortDescription": {"text": "Very large file: packages/ai/src/api/openai-codex-responses.ts (1590 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2fd1a4bf9f018cd4", "name": "Very large file: packages/tui/test/editor.test.ts (4151 lines)", "shortDescription": {"text": "Very large file: packages/tui/test/editor.test.ts (4151 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-90a7b166fc11156a", "name": "Very large file: packages/tui/test/markdown.test.ts (1442 lines)", "shortDescription": {"text": "Very large file: packages/tui/test/markdown.test.ts (1442 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-898d34ae509572fe", "name": "Very large file: packages/tui/src/tui.ts (1719 lines)", "shortDescription": {"text": "Very large file: packages/tui/src/tui.ts (1719 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e85f1fd01bf113bb", "name": "Very large file: packages/tui/src/components/editor.ts (2351 lines)", "shortDescription": {"text": "Very large file: packages/tui/src/components/editor.ts (2351 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6efa939dfd49df0e", "name": "Very large file: packages/coding-agent/test/package-manager.test.ts (2512 lines)", "shortDescription": {"text": "Very large file: packages/coding-agent/test/package-manager.test.ts (2512 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4d918f8f335820bc", "name": "Very large file: packages/coding-agent/test/model-registry.test.ts (1934 lines)", "shortDescription": {"text": "Very large file: packages/coding-agent/test/model-registry.test.ts (1934 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-51f1ec6a5bc8f1c7", "name": "Very large file: packages/coding-agent/src/modes/interactive/interactive-mode.ts (6009 lines)", "shortDescription": {"text": "Very large file: packages/coding-agent/src/modes/interactive/interactive-mode.ts (6009 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5b399eaeb1905eb3", "name": "Very large file: packages/coding-agent/src/core/session-manager.ts (1712 lines)", "shortDescription": {"text": "Very large file: packages/coding-agent/src/core/session-manager.ts (1712 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1af29da02ba378c6", "name": "Very large file: packages/coding-agent/src/core/agent-session.ts (3328 lines)", "shortDescription": {"text": "Very large file: packages/coding-agent/src/core/agent-session.ts (3328 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-05a6644ae97b267f", "name": "Very large file: packages/coding-agent/src/core/package-manager.ts (2650 lines)", "shortDescription": {"text": "Very large file: packages/coding-agent/src/core/package-manager.ts (2650 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b76f2aa25ee449a7", "name": "Very large file: packages/coding-agent/src/core/extensions/types.ts (1689 lines)", "shortDescription": {"text": "Very large file: packages/coding-agent/src/core/extensions/types.ts (1689 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a60b9cc4e8397caa", "name": "Very large file: packages/coding-agent/src/core/export-html/template.js (1864 lines)", "shortDescription": {"text": "Very large file: packages/coding-agent/src/core/export-html/template.js (1864 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7d95ce09bbf81c6f", "name": "Node manifest has dependencies but no lockfile: packages/ai/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/ai/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b8fb65ca83f2101f", "name": "Node manifest has dependencies but no lockfile: packages/tui/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/tui/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d6dff449a76fd5a", "name": "Node manifest has dependencies but no lockfile: packages/agent/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/agent/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3d70367860be13de", "name": "Node manifest has dependencies but no lockfile: packages/server/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/server/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-df973504bb434091", "name": "Node manifest has dependencies but no lockfile: packages/storage/sqlite-node/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/storage/sqlite-node/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 369 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 47 placeholder/mock markers across 26 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a7494fb1d207a4c9", "name": "Commented-code block (7 lines) in packages/coding-agent/examples/sdk/11-sessions.ts:46", "shortDescription": {"text": "Commented-code block (7 lines) in packages/coding-agent/examples/sdk/11-sessions.ts:46"}, "fullDescription": {"text": "5 of 7 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-642c4be3a370f23e", "name": "Vulnerable dependency undici 6.26.0: GHSA-35p6-xmwp-9g52", "shortDescription": {"text": "Vulnerable dependency undici 6.26.0: GHSA-35p6-xmwp-9g52"}, "fullDescription": {"text": "OSV.dev reports `undici` at version `6.26.0` (resolved in `packages/coding-agent/examples/extensions/gondolin/package-lock.json`) is affected by GHSA-35p6-xmwp-9g52 (aka CVE-2026-6733).\n\nundici vulnerable to HTTP response queue poisoning via keep-alive socket reuse\n\nAliases: CVE-2026-6733\nAdvisory: https://osv.dev/vulnerability/GHSA-35p6-xmwp-9g52\nFix: upgrade `undici` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4e052885edacc0ef", "name": "Vulnerable dependency undici 6.26.0: GHSA-g8m3-5g58-fq7m", "shortDescription": {"text": "Vulnerable dependency undici 6.26.0: GHSA-g8m3-5g58-fq7m"}, "fullDescription": {"text": "OSV.dev reports `undici` at version `6.26.0` (resolved in `packages/coding-agent/examples/extensions/gondolin/package-lock.json`) is affected by GHSA-g8m3-5g58-fq7m (aka CVE-2026-11525).\n\nundici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching\n\nAliases: CVE-2026-11525\nAdvisory: https://osv.dev/vulnerability/GHSA-g8m3-5g58-fq7m\nFix: upgrade `undici` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a103d7c4a8070fc", "name": "Vulnerable dependency undici 6.26.0: GHSA-p88m-4jfj-68fv", "shortDescription": {"text": "Vulnerable dependency undici 6.26.0: GHSA-p88m-4jfj-68fv"}, "fullDescription": {"text": "OSV.dev reports `undici` at version `6.26.0` (resolved in `packages/coding-agent/examples/extensions/gondolin/package-lock.json`) is affected by GHSA-p88m-4jfj-68fv (aka CVE-2026-9679).\n\nundici vulnerable to HTTP header injection via Set-Cookie percent-decoding\n\nAliases: CVE-2026-9679\nAdvisory: https://osv.dev/vulnerability/GHSA-p88m-4jfj-68fv\nFix: upgrade `undici` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-567f0311b221c9e6", "name": "Vulnerable dependency undici 6.26.0: GHSA-vxpw-j846-p89q", "shortDescription": {"text": "Vulnerable dependency undici 6.26.0: GHSA-vxpw-j846-p89q"}, "fullDescription": {"text": "OSV.dev reports `undici` at version `6.26.0` (resolved in `packages/coding-agent/examples/extensions/gondolin/package-lock.json`) is affected by GHSA-vxpw-j846-p89q (aka CVE-2026-12151).\n\nundici WebSocket client vulnerable to denial of service via fragment count bypass\n\nAliases: CVE-2026-12151\nAdvisory: https://osv.dev/vulnerability/GHSA-vxpw-j846-p89q\nFix: upgrade `undici` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d140df2e88197d8d", "name": "Vulnerable dependency protobufjs 7.6.4: GHSA-j3f2-48v5-ccww", "shortDescription": {"text": "Vulnerable dependency protobufjs 7.6.4: GHSA-j3f2-48v5-ccww"}, "fullDescription": {"text": "OSV.dev reports `protobufjs` at version `7.6.4` (resolved in `package-lock.json`) is affected by GHSA-j3f2-48v5-ccww (aka CVE-2026-59877).\nNote: `protobufjs` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nprotobufjs: Denial of Service via infinite loop in .proto option parsing\n\nAliases: CVE-2026-59877\nAdvisory: https://osv.dev/vulnerability/GHSA-j3f2-48v5-ccww\nFix: upgrade `protobufjs` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-6a12020002cf91e8", "name": "Vulnerable dependency shell-quote 1.8.4: GHSA-395f-4hp3-45gv", "shortDescription": {"text": "Vulnerable dependency shell-quote 1.8.4: GHSA-395f-4hp3-45gv"}, "fullDescription": {"text": "OSV.dev reports `shell-quote` at version `1.8.4` (resolved in `package-lock.json`) is affected by GHSA-395f-4hp3-45gv (aka CVE-2026-13311).\nNote: `shell-quote` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nshell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)\n\nAliases: CVE-2026-13311\nAdvisory: https://osv.dev/vulnerability/GHSA-395f-4hp3-45gv\nFix: upgrade `shell-quote` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-173dd4cbf3a2b654", "name": "Vulnerable dependency shell-quote 1.8.3: GHSA-395f-4hp3-45gv", "shortDescription": {"text": "Vulnerable dependency shell-quote 1.8.3: GHSA-395f-4hp3-45gv"}, "fullDescription": {"text": "OSV.dev reports `shell-quote` at version `1.8.3` (resolved in `packages/coding-agent/examples/extensions/sandbox/package-lock.json`) is affected by GHSA-395f-4hp3-45gv (aka CVE-2026-13311).\nNote: `shell-quote` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nshell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)\n\nAliases: CVE-2026-13311\nAdvisory: https://osv.dev/vulnerability/GHSA-395f-4hp3-45gv\nFix: upgrade `shell-quote` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-32a66b40c1ed4f72", "name": "Vulnerable dependency shell-quote 1.8.3: GHSA-w7jw-789q-3m8p", "shortDescription": {"text": "Vulnerable dependency shell-quote 1.8.3: GHSA-w7jw-789q-3m8p"}, "fullDescription": {"text": "OSV.dev reports `shell-quote` at version `1.8.3` (resolved in `packages/coding-agent/examples/extensions/sandbox/package-lock.json`) is affected by GHSA-w7jw-789q-3m8p (aka CVE-2026-9277).\nNote: `shell-quote` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nshell-quote quote() does not escape newlines in object .op values\n\nAliases: CVE-2026-9277\nAdvisory: https://osv.dev/vulnerability/GHSA-w7jw-789q-3m8p\nFix: upgrade `shell-quote` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "critical", "confidence": 0.9}}, {"id": "scanner-62d06b69a5c011cf", "name": "Dependency @google/genai is a major version behind", "shortDescription": {"text": "Dependency @google/genai is a major version behind"}, "fullDescription": {"text": "`@google/genai` is pinned at `1.52.0` in `packages/ai/package.json` while the latest release on the npm registry is `2.13.0` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@google/genai` to `2.13.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-66d00359008ba6a7", "name": "Dependency diff is a major version behind", "shortDescription": {"text": "Dependency diff is a major version behind"}, "fullDescription": {"text": "`diff` is pinned at `8.0.4` in `packages/agent/package.json` while the latest release on the npm registry is `9.0.0` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `diff` to `9.0.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-a8468c5605a33337", "name": "Dependency highlight.js is a major version behind", "shortDescription": {"text": "Dependency highlight.js is a major version behind"}, "fullDescription": {"text": "`highlight.js` is pinned at `10.7.3` in `packages/coding-agent/package.json` while the latest release on the npm registry is `11.11.1` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `highlight.js` to `11.11.1`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-bad5b3cd7bf3255d", "name": "Dependency hosted-git-info is a major version behind", "shortDescription": {"text": "Dependency hosted-git-info is a major version behind"}, "fullDescription": {"text": "`hosted-git-info` is pinned at `9.0.3` in `packages/coding-agent/package.json` while the latest release on the npm registry is `10.1.1` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `hosted-git-info` to `10.1.1`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-632723c8c2a7f0f7", "name": "Dependency http-proxy-agent is two or more major versions behind", "shortDescription": {"text": "Dependency http-proxy-agent is two or more major versions behind"}, "fullDescription": {"text": "`http-proxy-agent` is pinned at `7.0.2` in `packages/ai/package.json` while the latest release on the npm registry is `9.1.0` \u2014 2 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `http-proxy-agent` to `9.1.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-edf15603e0d737d1", "name": "Dependency https-proxy-agent is two or more major versions behind", "shortDescription": {"text": "Dependency https-proxy-agent is two or more major versions behind"}, "fullDescription": {"text": "`https-proxy-agent` is pinned at `7.0.6` in `packages/ai/package.json` while the latest release on the npm registry is `9.1.0` \u2014 2 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `https-proxy-agent` to `9.1.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}]}}, "automationDetails": {"id": "repobility/30770"}, "properties": {"repository": "earendil-works/pi", "repoUrl": "https://github.com/earendil-works/pi", "branch": "main"}, "results": [{"ruleId": "scanner-20c894e5f6b2f935", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 packages/ai/test/tokens.test.ts:239"}, "properties": {"repobilityId": "4087cb8f4a426190", "scanner": "scanner-primary", "fingerprint": "20c894e5f6b2f935", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/ai/test/tokens.test.ts"}, "region": {"startLine": 239}}}]}, {"ruleId": "scanner-87208b4c70242301", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 packages/ai/test/image-tool-result.test.ts:321"}, "properties": {"repobilityId": "4ef75800d42fa1ba", "scanner": "scanner-primary", "fingerprint": "87208b4c70242301", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/ai/test/image-tool-result.test.ts"}, "region": {"startLine": 321}}}]}, {"ruleId": "scanner-77e0268ee53edcb1", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 packages/ai/src/api/openai-codex-responses.ts:919"}, "properties": {"repobilityId": "62323c4e1780365e", "scanner": "scanner-primary", "fingerprint": "77e0268ee53edcb1", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/ai/src/api/openai-codex-responses.ts"}, "region": {"startLine": 919}}}]}, {"ruleId": "scanner-d9d30c659932aadd", "level": "warning", "message": {"text": "var in script tag \u2014 packages/coding-agent/src/core/export-html/template.html:42"}, "properties": {"repobilityId": "6fd745c41433b85d", "scanner": "scanner-primary", "fingerprint": "d9d30c659932aadd", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "html-templates"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/coding-agent/src/core/export-html/template.html"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-721bd367be61579a", "level": "warning", "message": {"text": "detect child process \u2014 packages/coding-agent/src/core/resolve-config-value.ts:187"}, "properties": {"repobilityId": "bab8c336824925a6", "scanner": "scanner-primary", "fingerprint": "721bd367be61579a", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "javascript"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/coding-agent/src/core/resolve-config-value.ts"}, "region": {"startLine": 187}}}]}, {"ruleId": "scanner-af2ffd92f6c75aa3", "level": "warning", "message": {"text": "detect child process \u2014 packages/coding-agent/src/core/tools/bash.ts:97"}, "properties": {"repobilityId": "d32087ae451c346b", "scanner": "scanner-primary", "fingerprint": "af2ffd92f6c75aa3", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "javascript"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/coding-agent/src/core/tools/bash.ts"}, "region": {"startLine": 97}}}]}, {"ruleId": "scanner-b3fc51bf05a91adb", "level": "warning", "message": {"text": "detect child process \u2014 packages/coding-agent/src/utils/clipboard-image.ts:97"}, "properties": {"repobilityId": "2299a17ec97d0eaa", "scanner": "scanner-primary", "fingerprint": "b3fc51bf05a91adb", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "javascript"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/coding-agent/src/utils/clipboard-image.ts"}, "region": {"startLine": 97}}}]}, {"ruleId": "scanner-6d9a2973abc88440", "level": "warning", "message": {"text": "detect child process \u2014 packages/coding-agent/src/utils/tools-manager.ts:76"}, "properties": {"repobilityId": "ffa8c56e918c8f47", "scanner": "scanner-primary", "fingerprint": "6d9a2973abc88440", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "javascript"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/coding-agent/src/utils/tools-manager.ts"}, "region": {"startLine": 76}}}]}, {"ruleId": "scanner-fdbae39dd81020e7", "level": "warning", "message": {"text": "detect child process \u2014 packages/tui/src/autocomplete.ts:164"}, "properties": {"repobilityId": "d87971acffb903ab", "scanner": "scanner-primary", "fingerprint": "fdbae39dd81020e7", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "javascript"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/tui/src/autocomplete.ts"}, "region": {"startLine": 164}}}]}, {"ruleId": "scanner-382e4c9b06555799", "level": "warning", "message": {"text": "CVE-2026-59877: protobufjs 7.6.4 \u2014 package-lock.json"}, "properties": {"repobilityId": "0585cee0a924cd91", "scanner": "scanner-primary", "fingerprint": "382e4c9b06555799", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59877"]}}, {"ruleId": "scanner-fdbda6c219e1c15f", "level": "error", "message": {"text": "CVE-2026-13311: shell-quote 1.8.4 \u2014 package-lock.json"}, "properties": {"repobilityId": "c24a779bdc408aa1", "scanner": "scanner-primary", "fingerprint": "fdbda6c219e1c15f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-13311"]}}, {"ruleId": "scanner-f5a3c8b13ad812a9", "level": "error", "message": {"text": "CVE-2026-12151: undici 6.26.0 \u2014 packages/coding-agent/examples/extensions/gondolin/package-lock.json"}, "properties": {"repobilityId": "b7752fb5e8f95caf", "scanner": "scanner-primary", "fingerprint": "f5a3c8b13ad812a9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12151"]}}, {"ruleId": "scanner-7ac062b1376ed2d0", "level": "warning", "message": {"text": "CVE-2026-9679: undici 6.26.0 \u2014 packages/coding-agent/examples/extensions/gondolin/package-lock.json"}, "properties": {"repobilityId": "0ddbdedb88aa048b", "scanner": "scanner-primary", "fingerprint": "7ac062b1376ed2d0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-9679"]}}, {"ruleId": "scanner-c0913f5ff768d464", "level": "note", "message": {"text": "CVE-2026-11525: undici 6.26.0 \u2014 packages/coding-agent/examples/extensions/gondolin/package-lock.json"}, "properties": {"repobilityId": "010e321be749b9db", "scanner": "scanner-primary", "fingerprint": "c0913f5ff768d464", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-11525"]}}, {"ruleId": "scanner-13f7f1cf7ddd3cf2", "level": "note", "message": {"text": "CVE-2026-6733: undici 6.26.0 \u2014 packages/coding-agent/examples/extensions/gondolin/package-lock.json"}, "properties": {"repobilityId": "eb87c3a70f40372c", "scanner": "scanner-primary", "fingerprint": "13f7f1cf7ddd3cf2", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-6733"]}}, {"ruleId": "scanner-5a0bc643f221717b", "level": "error", "message": {"text": "CVE-2026-9277: shell-quote 1.8.3 \u2014 packages/coding-agent/examples/extensions/sandbox/package-lock.json"}, "properties": {"repobilityId": "21b3be2f2a95330c", "scanner": "scanner-primary", "fingerprint": "5a0bc643f221717b", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-9277"]}}, {"ruleId": "scanner-9e6ac7214c75ccb3", "level": "error", "message": {"text": "CVE-2026-13311: shell-quote 1.8.3 \u2014 packages/coding-agent/examples/extensions/sandbox/package-lock.json"}, "properties": {"repobilityId": "6f8ddbf1f4304ab0", "scanner": "scanner-primary", "fingerprint": "9e6ac7214c75ccb3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-13311"]}}, {"ruleId": "scanner-4bc64905d42a4660", "level": "warning", "message": {"text": "CVE-2026-59877: protobufjs 7.6.4 \u2014 packages/coding-agent/install-lock/package-lock.json"}, "properties": {"repobilityId": "1915b97c50255cb4", "scanner": "scanner-primary", "fingerprint": "4bc64905d42a4660", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59877"]}}, {"ruleId": "scanner-2679282aa1c484b5", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: AGENTS.md"}, "properties": {"repobilityId": "27d579812e6be614", "scanner": "scanner-primary", "fingerprint": "2679282aa1c484b5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "agents_md"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "AGENTS.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e637c415447867e4", "level": "none", "message": {"text": "Run SkillSpector's LLM-backed analysis in your own pipeline"}, "properties": {"repobilityId": "1936f198ff5212bf", "scanner": "scanner-primary", "fingerprint": "e637c415447867e4", "layer": "security", "severity": "info", "confidence": 1.0, "tags": ["skillspector", "mcp-skill", "llm-advisory", "ai-coder"]}}, {"ruleId": "scanner-132ae653955024d8", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/diff-model-catalog.mjs:6"}, "properties": {"repobilityId": "1407fb7aa0f3e91c", "scanner": "scanner-primary", "fingerprint": "132ae653955024d8", "layer": "security", "severity": "medium", "confidence": 0.8, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/diff-model-catalog.mjs"}, "region": {"startLine": 6}}}]}, {"ruleId": "scanner-bce5324550fa6f45", "level": "error", "message": {"text": "Insecure pattern 'node_child_process' in scripts/release.mjs:21"}, "properties": {"repobilityId": "b54b635c778fb88f", "scanner": "scanner-primary", "fingerprint": "bce5324550fa6f45", "layer": "security", "severity": "high", "confidence": 0.9, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/release.mjs"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-2860edf552efdceb", "level": "error", "message": {"text": "Insecure pattern 'node_child_process' in packages/tui/src/terminal-image.ts:1"}, "properties": {"repobilityId": "ab1606db63064e2b", "scanner": "scanner-primary", "fingerprint": "2860edf552efdceb", "layer": "security", "severity": "high", "confidence": 0.9, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/tui/src/terminal-image.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a8afb557567b452c", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in packages/agent/src/harness/types.ts:364"}, "properties": {"repobilityId": "5ac6915724cb12ac", "scanner": "scanner-primary", "fingerprint": "a8afb557567b452c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/agent/src/harness/types.ts"}, "region": {"startLine": 364}}}]}, {"ruleId": "scanner-0d4183e1f499e90c", "level": "error", "message": {"text": "Insecure pattern 'node_child_process' in packages/coding-agent/src/utils/clipboard.ts:1"}, "properties": {"repobilityId": "c79dcacc834fc9bd", "scanner": "scanner-primary", "fingerprint": "0d4183e1f499e90c", "layer": "security", "severity": "high", "confidence": 0.9, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/coding-agent/src/utils/clipboard.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1f5c952dd4f52ea9", "level": "error", "message": {"text": "Insecure pattern 'node_child_process' in packages/coding-agent/src/core/resolve-config-value.ts:6"}, "properties": {"repobilityId": "88827aa50061ea6e", "scanner": "scanner-primary", "fingerprint": "1f5c952dd4f52ea9", "layer": "security", "severity": "high", "confidence": 0.9, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/coding-agent/src/core/resolve-config-value.ts"}, "region": {"startLine": 6}}}]}, {"ruleId": "scanner-aa34b4b441034ac8", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in packages/coding-agent/src/core/extensions/loader.ts:334"}, "properties": {"repobilityId": "dd0f09c12cebcedb", "scanner": "scanner-primary", "fingerprint": "aa34b4b441034ac8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/coding-agent/src/core/extensions/loader.ts"}, "region": {"startLine": 334}}}]}, {"ruleId": "scanner-fa90a69c41975e26", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in packages/coding-agent/src/core/extensions/types.ts:1306"}, "properties": {"repobilityId": "3d80093af38de197", "scanner": "scanner-primary", "fingerprint": "fa90a69c41975e26", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/coding-agent/src/core/extensions/types.ts"}, "region": {"startLine": 1306}}}]}, {"ruleId": "scanner-6e4b8d1bf6575cfd", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in packages/storage/sqlite-node/src/index.ts:55"}, "properties": {"repobilityId": "31fe89134d288b40", "scanner": "scanner-primary", "fingerprint": "6e4b8d1bf6575cfd", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/storage/sqlite-node/src/index.ts"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-398089fc42a9d7a8", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in packages/storage/sqlite-node/src/sqlite/types.ts:20"}, "properties": {"repobilityId": "35e6daae26f0c090", "scanner": "scanner-primary", "fingerprint": "398089fc42a9d7a8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/storage/sqlite-node/src/sqlite/types.ts"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-e4d7dc1816f5e82b", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "7c6e8c70cfd0d51d", "scanner": "scanner-primary", "fingerprint": "e4d7dc1816f5e82b", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/approve-contributor.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e4d042c6ae3bf770", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "3fa2f641970a6323", "scanner": "scanner-primary", "fingerprint": "e4d042c6ae3bf770", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build-binaries.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cb639d9a10a47b23", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "b86179956da3a4a8", "scanner": "scanner-primary", "fingerprint": "cb639d9a10a47b23", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c58e6b4d13b240d6", "level": "note", "message": {"text": "Very large file: packages/ai/test/openai-codex-stream.test.ts (2286 lines)"}, "properties": {"repobilityId": "4d1ba5e485b90370", "scanner": "scanner-primary", "fingerprint": "c58e6b4d13b240d6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-0947dbc83f8897b4", "level": "note", "message": {"text": "Very large file: packages/ai/test/stream.test.ts (1691 lines)"}, "properties": {"repobilityId": "36fe80f0ef9e758b", "scanner": "scanner-primary", "fingerprint": "0947dbc83f8897b4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6a134a2582cf29fd", "level": "note", "message": {"text": "Very large file: packages/ai/scripts/generate-models.ts (2645 lines)"}, "properties": {"repobilityId": "061304a3c58a58c0", "scanner": "scanner-primary", "fingerprint": "6a134a2582cf29fd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-249406ab360f61f4", "level": "note", "message": {"text": "Very large file: packages/ai/src/api/openai-codex-responses.ts (1590 lines)"}, "properties": {"repobilityId": "707693bf0415ae28", "scanner": "scanner-primary", "fingerprint": "249406ab360f61f4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-2fd1a4bf9f018cd4", "level": "note", "message": {"text": "Very large file: packages/tui/test/editor.test.ts (4151 lines)"}, "properties": {"repobilityId": "3ad0dc2a385803ff", "scanner": "scanner-primary", "fingerprint": "2fd1a4bf9f018cd4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-90a7b166fc11156a", "level": "note", "message": {"text": "Very large file: packages/tui/test/markdown.test.ts (1442 lines)"}, "properties": {"repobilityId": "4f7f572833b08b1d", "scanner": "scanner-primary", "fingerprint": "90a7b166fc11156a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-898d34ae509572fe", "level": "note", "message": {"text": "Very large file: packages/tui/src/tui.ts (1719 lines)"}, "properties": {"repobilityId": "1487033323b0353f", "scanner": "scanner-primary", "fingerprint": "898d34ae509572fe", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e85f1fd01bf113bb", "level": "note", "message": {"text": "Very large file: packages/tui/src/components/editor.ts (2351 lines)"}, "properties": {"repobilityId": "0878cd40279c4612", "scanner": "scanner-primary", "fingerprint": "e85f1fd01bf113bb", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6efa939dfd49df0e", "level": "note", "message": {"text": "Very large file: packages/coding-agent/test/package-manager.test.ts (2512 lines)"}, "properties": {"repobilityId": "f1bed86e3244d3e9", "scanner": "scanner-primary", "fingerprint": "6efa939dfd49df0e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-4d918f8f335820bc", "level": "note", "message": {"text": "Very large file: packages/coding-agent/test/model-registry.test.ts (1934 lines)"}, "properties": {"repobilityId": "76cda65918702e9c", "scanner": "scanner-primary", "fingerprint": "4d918f8f335820bc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-51f1ec6a5bc8f1c7", "level": "note", "message": {"text": "Very large file: packages/coding-agent/src/modes/interactive/interactive-mode.ts (6009 lines)"}, "properties": {"repobilityId": "6cd24431d67cec52", "scanner": "scanner-primary", "fingerprint": "51f1ec6a5bc8f1c7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-5b399eaeb1905eb3", "level": "note", "message": {"text": "Very large file: packages/coding-agent/src/core/session-manager.ts (1712 lines)"}, "properties": {"repobilityId": "a8cc1c80c36b1bdc", "scanner": "scanner-primary", "fingerprint": "5b399eaeb1905eb3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-1af29da02ba378c6", "level": "note", "message": {"text": "Very large file: packages/coding-agent/src/core/agent-session.ts (3328 lines)"}, "properties": {"repobilityId": "c213590d7d94c120", "scanner": "scanner-primary", "fingerprint": "1af29da02ba378c6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-05a6644ae97b267f", "level": "note", "message": {"text": "Very large file: packages/coding-agent/src/core/package-manager.ts (2650 lines)"}, "properties": {"repobilityId": "6985fec47c2afe94", "scanner": "scanner-primary", "fingerprint": "05a6644ae97b267f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-b76f2aa25ee449a7", "level": "note", "message": {"text": "Very large file: packages/coding-agent/src/core/extensions/types.ts (1689 lines)"}, "properties": {"repobilityId": "7052598e94b11c58", "scanner": "scanner-primary", "fingerprint": "b76f2aa25ee449a7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-a60b9cc4e8397caa", "level": "note", "message": {"text": "Very large file: packages/coding-agent/src/core/export-html/template.js (1864 lines)"}, "properties": {"repobilityId": "ee4272eb5716f7dd", "scanner": "scanner-primary", "fingerprint": "a60b9cc4e8397caa", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-7d95ce09bbf81c6f", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/ai/package.json"}, "properties": {"repobilityId": "2d5eb1212f62ce31", "scanner": "scanner-primary", "fingerprint": "7d95ce09bbf81c6f", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/ai/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b8fb65ca83f2101f", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/tui/package.json"}, "properties": {"repobilityId": "9c1f34e916ee30aa", "scanner": "scanner-primary", "fingerprint": "b8fb65ca83f2101f", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/tui/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2d6dff449a76fd5a", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/agent/package.json"}, "properties": {"repobilityId": "b452e6ff5ef3f0e3", "scanner": "scanner-primary", "fingerprint": "2d6dff449a76fd5a", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/agent/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3d70367860be13de", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/server/package.json"}, "properties": {"repobilityId": "d7cb4fafc3b292b2", "scanner": "scanner-primary", "fingerprint": "3d70367860be13de", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/server/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-df973504bb434091", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/storage/sqlite-node/package.json"}, "properties": {"repobilityId": "42fa583e28a305fc", "scanner": "scanner-primary", "fingerprint": "df973504bb434091", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/storage/sqlite-node/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "3724e02d4dd3fe5b", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "5601a12a4ae38ce5", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "38779844ff269d58", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "4bb1e04cbbc28637", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-a7494fb1d207a4c9", "level": "none", "message": {"text": "Commented-code block (7 lines) in packages/coding-agent/examples/sdk/11-sessions.ts:46"}, "properties": {"repobilityId": "fd1840c860a2f27b", "scanner": "scanner-primary", "fingerprint": "a7494fb1d207a4c9", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/coding-agent/examples/sdk/11-sessions.ts"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-642c4be3a370f23e", "level": "note", "message": {"text": "Vulnerable dependency undici 6.26.0: GHSA-35p6-xmwp-9g52"}, "properties": {"repobilityId": "d8fcf964b86f1dfe", "scanner": "scanner-primary", "fingerprint": "642c4be3a370f23e", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-35p6-xmwp-9g52"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/coding-agent/examples/extensions/gondolin/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4e052885edacc0ef", "level": "note", "message": {"text": "Vulnerable dependency undici 6.26.0: GHSA-g8m3-5g58-fq7m"}, "properties": {"repobilityId": "0f3ab2948c05bd14", "scanner": "scanner-primary", "fingerprint": "4e052885edacc0ef", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-g8m3-5g58-fq7m"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/coding-agent/examples/extensions/gondolin/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7a103d7c4a8070fc", "level": "warning", "message": {"text": "Vulnerable dependency undici 6.26.0: GHSA-p88m-4jfj-68fv"}, "properties": {"repobilityId": "33be8da9f56d0465", "scanner": "scanner-primary", "fingerprint": "7a103d7c4a8070fc", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-p88m-4jfj-68fv"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/coding-agent/examples/extensions/gondolin/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-567f0311b221c9e6", "level": "error", "message": {"text": "Vulnerable dependency undici 6.26.0: GHSA-vxpw-j846-p89q"}, "properties": {"repobilityId": "ec18be448e194ae6", "scanner": "scanner-primary", "fingerprint": "567f0311b221c9e6", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-vxpw-j846-p89q"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/coding-agent/examples/extensions/gondolin/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d140df2e88197d8d", "level": "warning", "message": {"text": "Vulnerable dependency protobufjs 7.6.4: GHSA-j3f2-48v5-ccww"}, "properties": {"repobilityId": "3ae4375f6d7971a7", "scanner": "scanner-primary", "fingerprint": "d140df2e88197d8d", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-j3f2-48v5-ccww", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6a12020002cf91e8", "level": "error", "message": {"text": "Vulnerable dependency shell-quote 1.8.4: GHSA-395f-4hp3-45gv"}, "properties": {"repobilityId": "6d24e67ba9970e89", "scanner": "scanner-primary", "fingerprint": "6a12020002cf91e8", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-395f-4hp3-45gv", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-173dd4cbf3a2b654", "level": "error", "message": {"text": "Vulnerable dependency shell-quote 1.8.3: GHSA-395f-4hp3-45gv"}, "properties": {"repobilityId": "d2ff4f3f2274cb96", "scanner": "scanner-primary", "fingerprint": "173dd4cbf3a2b654", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-395f-4hp3-45gv", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/coding-agent/examples/extensions/sandbox/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-32a66b40c1ed4f72", "level": "error", "message": {"text": "Vulnerable dependency shell-quote 1.8.3: GHSA-w7jw-789q-3m8p"}, "properties": {"repobilityId": "69a9017628c68dab", "scanner": "scanner-primary", "fingerprint": "32a66b40c1ed4f72", "layer": "dependencies", "severity": "critical", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-w7jw-789q-3m8p", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/coding-agent/examples/extensions/sandbox/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-62d06b69a5c011cf", "level": "note", "message": {"text": "Dependency @google/genai is a major version behind"}, "properties": {"repobilityId": "9c8d7b0b59ae601a", "scanner": "scanner-primary", "fingerprint": "62d06b69a5c011cf", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/ai/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-66d00359008ba6a7", "level": "note", "message": {"text": "Dependency diff is a major version behind"}, "properties": {"repobilityId": "47fe03014259e83a", "scanner": "scanner-primary", "fingerprint": "66d00359008ba6a7", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/agent/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a8468c5605a33337", "level": "note", "message": {"text": "Dependency highlight.js is a major version behind"}, "properties": {"repobilityId": "03f3a62dc8b3a4af", "scanner": "scanner-primary", "fingerprint": "a8468c5605a33337", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/coding-agent/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bad5b3cd7bf3255d", "level": "note", "message": {"text": "Dependency hosted-git-info is a major version behind"}, "properties": {"repobilityId": "f87754573bfb0d90", "scanner": "scanner-primary", "fingerprint": "bad5b3cd7bf3255d", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/coding-agent/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-632723c8c2a7f0f7", "level": "warning", "message": {"text": "Dependency http-proxy-agent is two or more major versions behind"}, "properties": {"repobilityId": "44fa1c6e15e69083", "scanner": "scanner-primary", "fingerprint": "632723c8c2a7f0f7", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/ai/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-edf15603e0d737d1", "level": "warning", "message": {"text": "Dependency https-proxy-agent is two or more major versions behind"}, "properties": {"repobilityId": "190467bf077276e2", "scanner": "scanner-primary", "fingerprint": "edf15603e0d737d1", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/ai/package.json"}, "region": {"startLine": 1}}}]}]}]}