Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo
70 of your 86 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.

Scan timing: clone 2.89s · analysis 5.72s · 8.2 MB · GitHub API rate-limit (preflight)

Tranquil-Flow/hermes-neurovision

https://github.com/Tranquil-Flow/hermes-neurovision · scanned 2026-06-19 16:03 UTC (2 months, 3 weeks ago) · 10 languages

233 raw signals (80 security + 153 graph) 37th percentile · Python · medium (20-100K LoC)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 2 months, 3 weeks ago · v1 · 144 actionable findings from 2 signal sources. 89 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
72.6
/100
Security checks
80
44 findings
System graph
65
66.7% cov · 100 findings
Critical
0
click to filter
Agents
10
0 votes
Crowd
0
reported
Score breakdown â 2026-05-18-v5
Component Sub-score Weight Contribution
structure_score 75.0 0.15 11.25
security_score 100.0 0.25 25.00
testing_score 87.0 0.20 17.40
documentation_score 97.0 0.15 14.55
practices_score 42.0 0.15 6.30
code_quality 42.1 0.10 4.21
Overall 1.00 78.7
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 0 High 16 Medium 33 Low 55 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 44 System graph 100 Crowd 0 Layer: Security 50 Quality 85 Software 9
Scan summary Repository scanned at 65.2/100 with 66.7% coverage. It contains 2128 nodes across 0 cross-layer flows, written primarily in mixed languages. Engine surfaced 153 findings — concentrated in security (86), quality (59), software (8). Risk profile is high: 0 critical, 24 high, 53 medium. Recommended next step: open the security layer findings first — that's where the highest-impact wins live.

Showing 98 of 144 actionable findings. 233 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

high Security checks quality Quality conf 1.00 ✓ Repobility [MINED037] Insecure Random: random.random/randint/choice for tokens/IDs/keys instead of secrets/os.urandom.
Review and fix per the pattern semantics. See CWE-330,CWE-338 / A02:2021 for context.
hermes_neurovision/theme_plugins/cosmic_v2.py:216
high Security checks quality Quality conf 1.00 ✓ Repobility 25 occurrences `self.age` used but never assigned in __init__
Method `reset` of class `BootParticle` reads `self.age`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
lines 528, 530, 546, 547, 550, 551, 552, 555, +16 more
demo_video.py:528, 530, 546, 547, 550, 551, 552, 555, +16 more (25 hits)
high System graph security security conf 1.00 Insecure pattern 'exec_used' in hermes_neurovision/import_theme.py:277
Found a known-risky pattern (exec_used). Review and replace if possible.
hermes_neurovision/import_theme.py:277 Exec used
high System graph security Skillspector conf 0.60 SkillSpector AST1 (behavioral-ast) in hermes_neurovision/import_theme.py
exec(plugin_code, namespace) Direct exec() call allows arbitrary code execution. An attacker can inject code that runs with the full privileges of the process. Skill: unknown Rule: AST1 Category: behavioral-ast Severity: HIGH Confidence: 0.60 Remediation: Replace exec() with a safe alternative…
hermes_neurovision/import_theme.py:277 Mcp skillBehavioral astAst1
high System graph security Skillspector conf 0.60 SkillSpector AST5 (behavioral-ast) in hermes_neurovision/overlay.py
os.execvp(self.child_cmd[0], self.child_cmd) os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution. Skill: unknown Rule: AST5 Category: behavioral-ast Severity: HIGH Confidence: 0.60 Remediation: Replace os.system() wit…
hermes_neurovision/overlay.py:331 Mcp skillBehavioral astAst5
high System graph security Skillspector conf 0.95 8 occurrences SkillSpector OH1 (output-handling) in hermes_neurovision/bg_mode.py
subprocess.run( ["osascript", "-e", script], capture_output Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution. Skill: unknown Rule: OH1 Ca…
lines 182, 212, 231, 284, 306, 321, 388, 482
hermes_neurovision/bg_mode.py:182, 212, 231, 284, 306, 321, 388, 482 (8 hits)
Mcp skillOutput handlingOh1
high System graph security Skillspector conf 0.95 2 occurrences SkillSpector OH1 (output-handling) in hermes_neurovision/launcher.py
subprocess.run( ["ps", "aux"], capture_output Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution. Skill: unknown Rule: OH1 Category: output…
lines 14, 61
hermes_neurovision/launcher.py:14, 61 (2 hits)
Mcp skillOutput handlingOh1
high System graph security Skillspector conf 0.95 SkillSpector OH1 (output-handling) in hermes_neurovision/sources/docker_tasks.py
subprocess.run( ["docker", "ps", "--format", "{{.Names}}"], capture_output Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution. Skill: unknow…
hermes_neurovision/sources/docker_tasks.py:18 Mcp skillOutput handlingOh1
high System graph security Skillspector conf 0.95 SkillSpector OH1 (output-handling) in hermes_neurovision/sources/hook_handler.py
subprocess.Popen( [ "python3", "-c", f"from hermes_neurovision.launcher import auto_launch; " f"result Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enable…
hermes_neurovision/sources/hook_handler.py:104 Mcp skillOutput handlingOh1
high System graph security Skillspector conf 0.95 3 occurrences SkillSpector OH1 (output-handling) in install_helper.py
subprocess.run(install_args, capture_output Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution. Skill: unknown Rule: OH1 Category: output-handling Severity: HIGH …
lines 40, 47, 86
install_helper.py:40, 47, 86 (3 hits)
Mcp skillOutput handlingOh1
high System graph security Skillspector conf 0.90 SkillSpector P1 (prompt-injection) in PLAN_v0.1.3.md
Override System This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended. Skill: unknown Rule: P1 Category: prompt-injection Severity: HIGH Confidence: 0.90 Remediation: Remove or rewrite any text that instructs the …
PLAN_v0.1.3.md:77 Mcp skillPrompt injectionP1
high System graph security Skillspector conf 0.85 SkillSpector P6 (prompt-injection) in hermes_neurovision/emergent/automaton.py
output rule Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties. Skill: unknown Rule: P6 Category: prompt-injection Severity: HIGH Confidence: 0.85 Remediation: Remove any instructions that reveal, p…
hermes_neurovision/emergent/automaton.py:90 Mcp skillPrompt injectionP6
high System graph security Skillspector conf 0.80 SkillSpector SC4 (supply-chain) in pyproject.toml
requires-python Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits. Skill: unknown Rule: SC4 Category: supply-chain Severity: HIGH Confidence: 0.80 Remediation: Update the dependency to a patched version that addr…
pyproject.toml:9 Mcp skillSupply chainSc4
high System graph security Skillspector conf 0.70 SkillSpector TM1 (tool-misuse) in RELEASE_COMMANDS.md
git push origin main git push origin --tags --force Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns). Skill: unknown Rule: TM1 Category: tool-misuse Severity: HIGH Confiden…
RELEASE_COMMANDS.md:10 Mcp skillTool misuseTm1
low Security checks quality Error handling conf 1.00 3 occurrences [ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even in cleanup code, log at DEBUG level.
Log the error: `except Exception: logger.debug('cleanup failed', exc_info=True)`. Or handle specific exception types.
3 files, 3 locations
hermes_neurovision/command_menu.py:210
hermes_neurovision/events.py:38
hermes_neurovision/sources/hook_handler.py:99
low Security checks quality Error handling conf 0.55 ✓ Repobility 5 occurrences Broad exception handler needs review
This handler catches Exception/BaseException. It is actionable when it swallows errors without logging, re-raising, or returning a structured error. Handlers that intentionally convert exceptions into typed error results should not be treated as high risk.
3 files, 5 locations
hermes_neurovision/theme_editor.py:269, 309, 337 (3 hits)
hermes_neurovision/launcher.py:63
install_helper.py:53
Error handlingquality
high Security checks quality Quality conf 0.82 Parallel implementation file sits beside a canonical file
AI-assisted edits often create a new sibling file instead of integrating the change into the existing module. That leaves two paths for future maintainers to understand and can hide the code that is actually wired into the app.
hermes_neurovision/theme_plugins/cosmic_new.py:1
medium System graph quality Agent instructions conf 1.00 Agent instructions exist but release-hardening basics are missing
AI-coder instruction files were found, but the repo is missing ci. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable.
Repo hardeningGenerated repo pattern
medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — hermes_neurovision/bg_mode.py:645
`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — hermes_neurovision/sound.py:100
`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — hermes_neurovision/sources/hook_handler.py:72
`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — install_helper.py:47
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
runtime safetyRobustness
medium System graph security Coverage conf 1.00 No auth library detected
The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing.
auth
medium System graph security Skillspector conf 0.60 SkillSpector AST3 (behavioral-ast) in hermes_neurovision/theme_plugins/__init__.py
__import__(f"hermes_neurovision.theme_plugins.{mod}") Dynamic __import__() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code. Skill: unknown Rule: AST3 Category: behavioral-ast Severity: MEDIUM Confidence: 0.60 Remediation: Use standard i…
hermes_neurovision/theme_plugins/__init__.py:66 Mcp skillBehavioral astAst3
medium System graph security Skillspector conf 0.60 2 occurrences SkillSpector AST3 (behavioral-ast) in hermes_neurovision/theme_plugins/hybrid.py
rng = __import__("random") Dynamic __import__() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code. Skill: unknown Rule: AST3 Category: behavioral-ast Severity: MEDIUM Confidence: 0.60 Remediation: Use standard import statements instead of…
lines 113, 276
hermes_neurovision/theme_plugins/hybrid.py:113, 276 (2 hits)
Mcp skillBehavioral astAst3
medium System graph security Skillspector conf 0.60 SkillSpector AST4 (behavioral-ast) in hermes_neurovision/app.py
subprocess.Popen( ['osascript', '-e', 'tell application "System Events" to keystroke "f" ' 'using {control down, command down}'], stdout=subpr subprocess module calls execute external commands. Without careful input validation, this enables command…
hermes_neurovision/app.py:29 Mcp skillBehavioral astAst4
medium System graph security Skillspector conf 0.60 10 occurrences SkillSpector AST4 (behavioral-ast) in hermes_neurovision/bg_mode.py
result = subprocess.run( ["osascript", "-e", script], capture_output=True, text=True, timeout=3 ) subprocess module calls execute external commands. Without careful input validation, this enables command injection. Skill: unknown Rule: AST4 Category: behavioral-as…
lines 182, 212, 231, 284, 306, 321, 345, 388, +2 more
hermes_neurovision/bg_mode.py:182, 212, 231, 284, 306, 321, 345, 388, +2 more (10 hits)
Mcp skillBehavioral astAst4
medium System graph security Skillspector conf 0.60 7 occurrences SkillSpector AST4 (behavioral-ast) in hermes_neurovision/launcher.py
result = subprocess.run( ["ps", "aux"], capture_output=True, text=True, timeout=2 ) subprocess module calls execute external commands. Without careful input validation, this enables command injection. Skill: unknown Rule: AST4 Category: beh…
lines 14, 61, 83, 106, 120, 134, 148
hermes_neurovision/launcher.py:14, 61, 83, 106, 120, 134, 148 (7 hits)
Mcp skillBehavioral astAst4
medium System graph security Skillspector conf 0.60 2 occurrences SkillSpector AST4 (behavioral-ast) in hermes_neurovision/sound.py
subprocess.Popen( ['say', '-v', 'Whisper', text], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, start_new_session=True, ) subprocess module calls execute external commands. Without careful input validation, this enables command inject…
lines 100, 112
hermes_neurovision/sound.py:100, 112 (2 hits)
Mcp skillBehavioral astAst4
medium System graph security Skillspector conf 0.60 SkillSpector AST4 (behavioral-ast) in hermes_neurovision/sources/docker_tasks.py
result = subprocess.run( ["docker", "ps", "--format", "{{.Names}}"], capture_output=True, text=True, timeout=2.0, ) subprocess module calls execute external commands. Without careful input validation, this enables command injection. Skill: unknown Rule: AST4 Categ…
hermes_neurovision/sources/docker_tasks.py:18 Mcp skillBehavioral astAst4
medium System graph security Skillspector conf 0.60 2 occurrences SkillSpector AST4 (behavioral-ast) in hermes_neurovision/sources/hook_handler.py
subprocess.Popen( shlex.split(custom_cmd), stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, start_new_session=True, subprocess module calls execute external commands. Without careful input validation, this enables command injecti…
lines 72, 104
hermes_neurovision/sources/hook_handler.py:72, 104 (2 hits)
Mcp skillBehavioral astAst4
medium System graph security Skillspector conf 0.60 3 occurrences SkillSpector AST4 (behavioral-ast) in install_helper.py
result = subprocess.run(install_args, capture_output=True, text=True) subprocess module calls execute external commands. Without careful input validation, this enables command injection. Skill: unknown Rule: AST4 Category: behavioral-ast Severity: MEDIUM Confidence: 0.60 Remediation: Use subpr…
lines 40, 47, 86
install_helper.py:40, 47, 86 (3 hits)
Mcp skillBehavioral astAst4
medium System graph security Skillspector conf 0.60 SkillSpector AST4 (behavioral-ast) in scripts/neurovision_runner.py
result = subprocess.run( ["python3", "-c", "from hermes_neurovision.themes import THEMES; print('\\n'.join(THEMES))"], capture_output=True, text=True, cwd= subprocess module calls execute external commands. Without careful input validation, this enables command…
scripts/neurovision_runner.py:199 Mcp skillBehavioral astAst4
medium System graph security Skillspector conf 0.60 SkillSpector E3 (data-exfil) in AUTOLAUNCH.md
ls -la ~/ Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft. Skill: unknown Rule: E3 Category: data-exfil Severity: MEDIUM Confidence: 0.60 Remediation: Remove unnecessary filesystem scanning. If file access is needed, use explici…
AUTOLAUNCH.md:31 Mcp skillData exfilE3
medium System graph security Skillspector conf 0.75 SkillSpector EA2 (excessive-agency) in hermes_neurovision/cli.py
without confirmation Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation. Skill: unknown Rule: EA2 Category: excessive-agency Severity: M…
hermes_neurovision/cli.py:68 Mcp skillExcessive agencyEa2
medium System graph security Skillspector conf 0.85 SkillSpector EA2 (excessive-agency) in hermes_neurovision/import_theme.py
skip confirmation Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation. Skill: unknown Rule: EA2 Category: excessive-agency Severity: MEDI…
hermes_neurovision/import_theme.py:52 Mcp skillExcessive agencyEa2
medium System graph security Skillspector conf 0.80 SkillSpector OH3 (output-handling) in hermes_neurovision/theme_plugins/hybrid.py
fill the terminal Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing. Skill: unknown Rule: OH3 Category: output-handling Severity: MEDIUM Confidence: 0.80 Remediation: Set explicit …
hermes_neurovision/theme_plugins/hybrid.py:185 Mcp skillOutput handlingOh3
medium System graph security Skillspector conf 0.60 SkillSpector RA2 (rogue-agent) in AUTOLAUNCH.md
Create config file: ```bash mkdir -p ~/.hermes/neurovision cat > ~/.hermes/neurovision/config.json << 'EOF' { "auto_launch": true } EOF ``` ### 2. Verify Gateway Hook is Installed ```bash # Should Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or sta…
AUTOLAUNCH.md:17 Mcp skillRogue agentRa2
medium System graph security Skillspector conf 0.60 SkillSpector RA2 (rogue-agent) in CLAUDE.md
write test first, verify it fails, implement, verify it passes, commit 3. Each task is self-contained — complete one fully before starting the next 4. Tasks are ordered by dependency — do them in sequ Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or sta…
CLAUDE.md:38 Mcp skillRogue agentRa2
medium System graph security Skillspector conf 0.60 SkillSpector RA2 (rogue-agent) in hermes_neurovision/sources/HOOK.yaml
create - checkpoint:rollback - mcp:connect - mcp:disconnect - mcp:tool_call - provider:fallback - provider:error - subagent:start - subagent:end # Auto-launch configuration (optional) Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or sta…
hermes_neurovision/sources/HOOK.yaml:16 Mcp skillRogue agentRa2
medium System graph security Skillspector conf 0.60 SkillSpector RA2 (rogue-agent) in hermes_neurovision/sources/hook_handler.py
mkdir -p ~/.hermes/hooks/hermes-neurovision cp this_file.py ~/.hermes/hooks/hermes-neurovision/handler.py # Create HOOK.yaml alongside it (see below) """ import json import os import subproce Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or sta…
hermes_neurovision/sources/hook_handler.py:8 Mcp skillRogue agentRa2
medium System graph security Skillspector conf 0.60 SkillSpector RA2 (rogue-agent) in INSTALL.md
mkdir -p ~/.hermes/hooks/hermes-neurovision cp hermes_neurovision/sources/hook_handler.py ~/.hermes/hooks/hermes-neurovision/handler.py cp hermes_neurovision/sources/HOOK.yaml ~/.hermes/hooks/hermes-n Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or sta…
INSTALL.md:23 Mcp skillRogue agentRa2
medium System graph security Skillspector conf 0.60 SkillSpector RA2 (rogue-agent) in install_helper.py
Create config directory current += 1 print_step(current, total_steps, "Setting up configuration...") config_dir = os.path.expanduser("~/.hermes/neurovision") os.makedirs(config_dir, ex Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or sta…
install_helper.py:70 Mcp skillRogue agentRa2
medium System graph security Skillspector conf 0.60 SkillSpector RA2 (rogue-agent) in PLAN.md
Write to buffer │ │ stars, bg, edges │ │ pulses, nodes │ │ packets, particles│ │ streaks, extras │ │ specials, overlays│ Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. …
PLAN.md:90 Mcp skillRogue agentRa2
medium System graph security Skillspector conf 0.60 SkillSpector RA2 (rogue-agent) in PLAN_v0.2.0.md
Write to buffer │ │ stars, bg, edges │ │ pulses, nodes │ │ packets, particles│ │ streaks, extras │ │ specials, overlays│ Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. …
PLAN_v0.2.0.md:90 Mcp skillRogue agentRa2
medium System graph security Skillspector conf 0.60 SkillSpector RA2 (rogue-agent) in TASKS.md
Create pyproject.toml, __init__.py, directory structure. Init git repo. - [x] Task 2: Extract themes.py from ~/Desktop/neurovisualizer.py (THEMES tuple, ThemeConfig, build_theme_config, constants). Wr Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or sta…
TASKS.md:7 Mcp skillRogue agentRa2
medium System graph security Skillspector conf 0.60 SkillSpector TT2 (taint) in hermes_neurovision/sources/hook_handler.py
with open(_EVENTS_PATH, "a") as f: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow. Skill: unknown Rule: TT2 Category: taint Severity: MEDIUM Confidence: 0.60 Remediation: Validate tainted variables before passing them to sin…
hermes_neurovision/sources/hook_handler.py:131 Mcp skillTaintTt2
low Security checks quality Quality conf 0.60 Duplicated implementation block across source files
Duplicate implementation blocks are maintenance debt. Keep them visible, but they are not a high-severity defect unless the duplicated logic is security-sensitive or drifting.
hermes_neurovision/theme_plugins/whimsical.py:213 duplicationquality
low Security checks quality Quality conf 0.60 Duplicated implementation block across source files
Duplicate implementation blocks are maintenance debt. Keep them visible, but they are not a high-severity defect unless the duplicated logic is security-sensitive or drifting.
hermes_neurovision/theme_plugins/legacy_v1_screens.py:306 duplicationquality
low System graph quality Debug conf 1.00 Debug logging residue appears in source files
Found 149 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup.
CleanupRepo hardeningGenerated repo pattern
low System graph quality Integrity conf 1.00 8 occurrences Near-duplicate function bodies in 2 places
Functions with the same first-5-line body hash: demo_video.py:draw_big_text, demo_video.py:draw This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate.
8 occurrences
repo-level (8 hits)
duplicatesduplication
low System graph quality Integrity conf 1.00 6 occurrences Near-duplicate function bodies in 3 places
Functions with the same first-5-line body hash: hermes_neurovision/tune.py:put, hermes_neurovision/command_menu.py:put, hermes_neurovision/theme_editor.py:put This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene). Consolidate or document …
6 occurrences
repo-level (6 hits)
duplicatesduplication
low System graph quality Integrity conf 1.00 2 occurrences Near-duplicate function bodies in 4 places
Functions with the same first-5-line body hash: hermes_neurovision/scene.py:step, hermes_neurovision/scene.py:step, hermes_neurovision/scene.py:step, hermes_neurovision/scene.py:step This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene). …
2 occurrences
repo-level (2 hits)
duplicatesduplication
low System graph quality Integrity conf 1.00 3 occurrences Near-duplicate function bodies in 5 places
Functions with the same first-5-line body hash: hermes_neurovision/theme_plugins/advanced_screens.py:echo_decay, hermes_neurovision/theme_plugins/advanced_screens.py:echo_decay, hermes_neurovision/theme_plugins/advanced_screens.py:echo_decay, hermes_neurovision/theme_plugins/advanced_screens.py:ech…
3 occurrences
repo-level (3 hits)
duplicatesduplication
low System graph quality Integrity conf 1.00 Near-duplicate function bodies in 8 places
Functions with the same first-5-line body hash: hermes_neurovision/theme_plugins/advanced_screens.py:emergent_layer, hermes_neurovision/theme_plugins/advanced_screens.py:emergent_layer, hermes_neurovision/theme_plugins/advanced_screens.py:emergent_layer, hermes_neurovision/theme_plugins/emergent_v2…
duplicatesduplication
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `_migrate_v0_to_v1` in hermes_neurovision/import_theme.py:90
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `cosmic_v2` in hermes_neurovision/theme_plugins/cosmic.py:305
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `ev_old` in tests/test_log_overlay.py:25
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `include_legacy` in hermes_neurovision/app.py:81
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `include_legacy` in tests/test_cli.py:48
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `include_legacy` in tests/test_new_features.py:20
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `list_legacy` in hermes_neurovision/cli.py:251
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `originals_v2` in hermes_neurovision/theme_plugins/__init__.py:46
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `originals_v2` in scripts/neurovision_runner.py:216
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `toggle_legacy` in hermes_neurovision/command_menu.py:70
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph software Dead code conf 1.00 Possibly dead Python function: big_text_width
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
demo_video.py:79
low System graph software Dead code conf 1.00 Possibly dead Python function: diagnose_terminal_opacity
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
hermes_neurovision/bg_mode.py:193
low System graph software Dead code conf 1.00 Possibly dead Python function: draw_black_strip
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
demo_video.py:371
low System graph software Dead code conf 1.00 Possibly dead Python function: registered_names
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
hermes_neurovision/theme_plugins/__init__.py:27
low System graph software Dead code conf 1.00 Possibly dead Python function: run_curses
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
hermes_neurovision/cli.py:460
low System graph software Dead code conf 1.00 Possibly dead Python function: run_demo
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
demo_video.py:1191
low System graph software Dead code conf 1.00 Possibly dead Python function: run_gallery_wrapper
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
hermes_neurovision/cli.py:297
low System graph software Dead code conf 1.00 Possibly dead Python function: section_feature_highlights
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
demo_video.py:996
low System graph quality Provenance conf 1.00 Shallow git history limits provenance confidence
The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence.
Git historyGenerated repo pattern
low System graph security Skillspector conf 0.50 SkillSpector AST7 (behavioral-ast) in hermes_neurovision/sources/trajectories.py
current_offset = getattr(self, offset_attr) Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls. Skill: unknown Rule: AST7 Category: behavioral-ast Severity: LOW Confidence: 0.50 Remediation: Replace dynamic getattr(…
hermes_neurovision/sources/trajectories.py:35 Mcp skillBehavioral astAst7
low System graph security Skillspector conf 0.50 SkillSpector AST7 (behavioral-ast) in hermes_neurovision/theme_editor.py
return getattr(self._config, attr) Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls. Skill: unknown Rule: AST7 Category: behavioral-ast Severity: LOW Confidence: 0.50 Remediation: Replace dynamic getattr() with ex…
hermes_neurovision/theme_editor.py:122 Mcp skillBehavioral astAst7
low System graph security Skillspector conf 0.50 4 occurrences SkillSpector AST7 (behavioral-ast) in hermes_neurovision/tune.py
val = getattr(self._settings, attr) Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls. Skill: unknown Rule: AST7 Category: behavioral-ast Severity: LOW Confidence: 0.50 Remediation: Replace dynamic getattr() with e…
lines 232, 239, 282, 303
hermes_neurovision/tune.py:232, 239, 282, 303 (4 hits)
Mcp skillBehavioral astAst7
low System graph security Skillspector conf 0.70 SkillSpector EA3 (excessive-agency) in CHANGELOG.md
not limited to Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface. Skill: unknown Rule: EA3 Category: excessive-agency Severity: LOW Confidence: 0.70 Remediat…
CHANGELOG.md:157 Mcp skillExcessive agencyEa3
low System graph security Skillspector conf 0.70 SkillSpector EA3 (excessive-agency) in LICENSE
NOT LIMITED TO Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface. Skill: unknown Rule: EA3 Category: excessive-agency Severity: LOW Confidence: 0.70 Remediat…
LICENSE:16 Mcp skillExcessive agencyEa3
low System graph quality Integrity conf 1.00 Stub function `palette_shift` (body is just `pass`/`return`) — hermes_neurovision/theme_plugins/hybrid.py:144
Likely an AI scaffold that was never filled in. Remove or implement.
Empty handlerDead code
low System graph quality Integrity conf 1.00 Stub function `palette_shift` (body is just `pass`/`return`) — hermes_neurovision/theme_plugins/nature_v2.py:200
Likely an AI scaffold that was never filled in. Remove or implement.
Empty handlerDead code
low System graph quality Integrity conf 1.00 Stub function `palette_shift` (body is just `pass`/`return`) — hermes_neurovision/theme_plugins/spectacular.py:181
Likely an AI scaffold that was never filled in. Remove or implement.
Empty handlerDead code
low System graph quality Integrity conf 1.00 Stub function `reset_timer` (body is just `pass`/`return`) — hermes_neurovision/overlay.py:50
Likely an AI scaffold that was never filled in. Remove or implement.
Empty handlerDead code
low System graph quality Integrity conf 1.00 Stub function `star_glyph` (body is just `pass`/`return`) — hermes_neurovision/theme_plugins/legacy_v2_screens.py:1553
Likely an AI scaffold that was never filled in. Remove or implement.
Empty handlerDead code
low System graph quality Integrity conf 1.00 Stub function `star_glyph` (body is just `pass`/`return`) — hermes_neurovision/theme_plugins/originals.py:75
Likely an AI scaffold that was never filled in. Remove or implement.
Empty handlerDead code
low System graph quality Integrity conf 1.00 Stub function `symmetry` (body is just `pass`/`return`) — hermes_neurovision/theme_plugins/attractors.py:233
Likely an AI scaffold that was never filled in. Remove or implement.
Empty handlerDead code
low System graph quality Integrity conf 1.00 Stub function `symmetry` (body is just `pass`/`return`) — hermes_neurovision/theme_plugins/mycelium.py:184
Likely an AI scaffold that was never filled in. Remove or implement.
Empty handlerDead code
low System graph quality Integrity conf 1.00 Stub function `symmetry` (body is just `pass`/`return`) — hermes_neurovision/theme_plugins/redesigned.py:131
Likely an AI scaffold that was never filled in. Remove or implement.
Empty handlerDead code
low System graph quality Complexity conf 1.00 Very large file: demo_video.py (1223 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: hermes_neurovision/theme_plugins/ascii_fields.py (1476 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: hermes_neurovision/theme_plugins/attractors.py (1829 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: hermes_neurovision/theme_plugins/generators.py (1272 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: hermes_neurovision/theme_plugins/legacy_v2_screens.py (2061 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: hermes_neurovision/theme_plugins/legacy_v2b_screens.py (2730 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: hermes_neurovision/theme_plugins/nature_v2.py (1232 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: hermes_neurovision/theme_plugins/originals_v2.py (1427 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: hermes_neurovision/theme_plugins/redesigned.py (2927 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: hermes_neurovision/theme_plugins/spectacular.py (1627 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/d0ae0c3c-93d3-4a26-8ad5-6e1934fbd83b/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/d0ae0c3c-93d3-4a26-8ad5-6e1934fbd83b/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.