{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "SEC017", "name": "[SEC017] Unbounded Input to LLM/External API: User input is passed to an LLM or external AI API (OpenAI, Anthropic, etc.", "shortDescription": {"text": "[SEC017] Unbounded Input to LLM/External API: User input is passed to an LLM or external AI API (OpenAI, Anthropic, etc.) without any visible length or size validation. This creates two risks: (1) Cost abuse \u2014 an attacker can send extremely"}, "fullDescription": {"text": "1) Enforce a maximum input length BEFORE sending to the API: e.g. `if len(text) > 4000: return error`. 2) Use token counting (tiktoken for OpenAI, anthropic's token counter) to enforce token-level limits. 3) Set max_tokens on the API call to cap response cost. 4) Add rate limiting per user/IP to prevent automated abuse. 5) Monitor API spend with alerts for unusual usage patterns."}, "properties": {"scanner": "repobility-threat-engine", "category": "llm_injection", "severity": "medium", "confidence": 0.8, "cwe": "", "owasp": ""}}, {"id": "ERR001", "name": "[ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even in cleanup code, log at DEBUG ", "shortDescription": {"text": "[ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even in cleanup code, log at DEBUG level."}, "fullDescription": {"text": "Log the error: `except Exception: logger.debug('cleanup failed', exc_info=True)`. Or handle specific exception types."}, "properties": {"scanner": "repobility-threat-engine", "category": "error_handling", "severity": "medium", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "COMP001", "name": "[COMP001] High cognitive complexity: Function `draw` has cognitive complexity 23 (SonarSource scale). Cognitive complexi", "shortDescription": {"text": "[COMP001] High cognitive complexity: Function `draw` has cognitive complexity 23 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand \u2014 nested branches, boolean chains, and recursion all weig"}, "fullDescription": {"text": "Extract nested branches into named helper functions; flatten early-return / guard clauses; replace long if/elif chains with dispatch dicts or polymorphism. SonarQube's threshold for 'should refactor' is 15 \u2014 yours is 23."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "medium", "confidence": 0.95, "cwe": "", "owasp": ""}}, {"id": "MINED111", "name": "Bare except continues silently", "shortDescription": {"text": "Bare except continues silently"}, "fullDescription": {"text": "Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose."}, "properties": {"scanner": "repobility-ast-engine", "category": "quality", "severity": "medium", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "AIC001", "name": "Parallel implementation file sits beside a canonical file", "shortDescription": {"text": "Parallel implementation file sits beside a canonical file"}, "fullDescription": {"text": "AI-assisted edits often create a new sibling file instead of integrating the change into the existing module. That leaves two paths for future maintainers to understand and can hide the code that is actually wired into the app."}, "properties": {"scanner": "repobility-ai-code-hygiene", "category": "quality", "severity": "medium", "confidence": 0.82, "cwe": "", "owasp": ""}}, {"id": "CORE_NO_CI", "name": "No CI/CD configuration found", "shortDescription": {"text": "No CI/CD configuration found"}, "fullDescription": {"text": "Add a CI/CD pipeline: create .github/workflows/ci.yml for GitHub Actions with steps to lint, test, and build on every push and pull request."}, "properties": {"scanner": "repobility-core", "category": "practices", "severity": "medium", "confidence": null, "cwe": "", "owasp": ""}}, {"id": "AIC003", "name": "Duplicated implementation block across source files", "shortDescription": {"text": "Duplicated implementation block across source files"}, "fullDescription": {"text": "Duplicated blocks are a common artifact when generated code is pasted or recreated instead of reused. They increase maintenance cost because every future bug fix must be found in multiple locations."}, "properties": {"scanner": "repobility-ai-code-hygiene", "category": "quality", "severity": "low", "confidence": 0.86, "cwe": "", "owasp": ""}}, {"id": "SEC020", "name": "[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequen", "shortDescription": {"text": "[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequent AI-assisted coding failure: the helper exposes the exact value needed for troubleshooting."}, "fullDescription": {"text": "Log only redacted, hashed, or last-four-style metadata. Rotate any secret that may have reached logs."}, "properties": {"scanner": "repobility-threat-engine", "category": "credential_exposure", "severity": "info", "confidence": 0.1, "cwe": "", "owasp": ""}}, {"id": "MINED063", "name": "[MINED063] Toctou Os Path Exists: if os.path.exists(p): open(p) \u2014 file can be replaced/deleted between check and use.", "shortDescription": {"text": "[MINED063] Toctou Os Path Exists: if os.path.exists(p): open(p) \u2014 file can be replaced/deleted between check and use."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-367 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED062", "name": "[MINED062] Python Dataclass No Fields (and 1 more): Same pattern found in 1 additional files. Review if needed.", "shortDescription": {"text": "[MINED062] Python Dataclass No Fields (and 1 more): Same pattern found in 1 additional files. Review if needed."}, "fullDescription": {"text": "Review and fix per the pattern semantics."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "MINED050", "name": "[MINED050] Stub Only Function (and 15 more): Same pattern found in 15 additional files. Review if needed.", "shortDescription": {"text": "[MINED050] Stub Only Function (and 15 more): Same pattern found in 15 additional files. Review if needed."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-1188 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "MINED001", "name": "[MINED001] Bare Except Pass (and 16 more): Same pattern found in 16 additional files. Review if needed.", "shortDescription": {"text": "[MINED001] Bare Except Pass (and 16 more): Same pattern found in 16 additional files. Review if needed."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-755 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "SEC029", "name": "[SEC029] Server-Side Request Forgery (SSRF) \u2014 outbound HTTP from user input: Outbound HTTP request to a user-controlled ", "shortDescription": {"text": "[SEC029] Server-Side Request Forgery (SSRF) \u2014 outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.254.169.254 metadata, internal Kubernetes e"}, "fullDescription": {"text": "Validate the URL against an allowlist BEFORE fetching:\n  ALLOWED = {'images.example.com', 'cdn.example.com'}\n  host = urlparse(url).hostname\n  if host not in ALLOWED: abort(400)\nOr use a server-side proxy (Imgproxy / serve-files-only-from-S3) that isolates outbound network access from the request handler.\nBlock private CIDRs explicitly: 10/8, 172.16/12, 192.168/16, 169.254/16."}, "properties": {"scanner": "repobility-threat-engine", "category": "ssrf", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC016", "name": "[SEC016] LLM Prompt Injection \u2014 User Input in AI Prompt: User-supplied text is interpolated directly into an AI/LLM prom", "shortDescription": {"text": "[SEC016] LLM Prompt Injection \u2014 User Input in AI Prompt: User-supplied text is interpolated directly into an AI/LLM prompt (e.g. OpenAI, Anthropic, or local model). This is the AI equivalent of SQL injection: an attacker can craft input tha"}, "fullDescription": {"text": "1) Separate user content from instructions: use the 'user' role for user text and 'system' role for your instructions \u2014 never concatenate them into one string. 2) Validate and constrain: limit input length, strip control characters, and reject known injection patterns. 3) Use structured output (JSON mode / function calling) so the model returns data, not freeform actions. 4) Apply output validation: check the AI's response before acting on it. 5) Consider a prompt injection detection layer (e.g. Anthropic's constitutional AI, prompt-guard models)."}, "properties": {"scanner": "repobility-threat-engine", "category": "llm_injection", "severity": "high", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "MINED037", "name": "[MINED037] Insecure Random: random.random/randint/choice for tokens/IDs/keys instead of secrets/os.urandom.", "shortDescription": {"text": "[MINED037] Insecure Random: random.random/randint/choice for tokens/IDs/keys instead of secrets/os.urandom."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-330,CWE-338 / A02:2021 for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED009", "name": "[MINED009] Floats For Money: Variable named price/amount/cost typed as float instead of Decimal.", "shortDescription": {"text": "[MINED009] Floats For Money: Variable named price/amount/cost typed as float instead of Decimal."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-682 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED106", "name": "Phantom test coverage: test_all_themes_simulate_without_error", "shortDescription": {"text": "Phantom test coverage: test_all_themes_simulate_without_error"}, "fullDescription": {"text": "Test function `test_all_themes_simulate_without_error` runs code but contains no assert / expect / should call \u2014 it passes regardless of behaviour. Adds line coverage without verifying anything."}, "properties": {"scanner": "repobility-ast-engine", "category": "quality", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED108", "name": "`self.vy` used but never assigned in __init__", "shortDescription": {"text": "`self.vy` used but never assigned in __init__"}, "fullDescription": {"text": "Method `reset` of class `BootParticle` reads `self.vy`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance."}, "properties": {"scanner": "repobility-ast-engine", "category": "quality", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "scanner-1887f355f415b341", "name": "Possibly dead Python function: big_text_width", "shortDescription": {"text": "Possibly dead Python function: big_text_width"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-43f9b5316196a95d", "name": "Possibly dead Python function: draw_black_strip", "shortDescription": {"text": "Possibly dead Python function: draw_black_strip"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b15b899865682a28", "name": "Possibly dead Python function: section_feature_highlights", "shortDescription": {"text": "Possibly dead Python function: section_feature_highlights"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7d386e5f922dab84", "name": "Possibly dead Python function: run_demo", "shortDescription": {"text": "Possibly dead Python function: run_demo"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-582de552ab8839b5", "name": "Possibly dead Python function: diagnose_terminal_opacity", "shortDescription": {"text": "Possibly dead Python function: diagnose_terminal_opacity"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cf5089b21622fb86", "name": "Possibly dead Python function: run_gallery_wrapper", "shortDescription": {"text": "Possibly dead Python function: run_gallery_wrapper"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-87cbe0e235510665", "name": "Possibly dead Python function: run_curses", "shortDescription": {"text": "Possibly dead Python function: run_curses"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-53eccafdfbc7178a", "name": "Possibly dead Python function: registered_names", "shortDescription": {"text": "Possibly dead Python function: registered_names"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-302e93fa85b9dd2f", "name": "SkillSpector AST4 (behavioral-ast) in hermes_neurovision/app.py", "shortDescription": {"text": "SkillSpector AST4 (behavioral-ast) in hermes_neurovision/app.py"}, "fullDescription": {"text": "subprocess.Popen(\n            ['osascript', '-e',\n             'tell application \"System Events\" to keystroke \"f\" '\n             'using {control down, command down}'],\n            stdout=subpr\n\nsubprocess module calls execute external commands. Without careful input validation, this enables command injection.\n\nSkill: unknown\nRule: AST4  Category: behavioral-ast\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Use subprocess.run() with shell=False and an explicit argument list. Validate all inputs and avoid passing user-controlled data to commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-214c7b1886356e95", "name": "SkillSpector AST4 (behavioral-ast) in hermes_neurovision/bg_mode.py", "shortDescription": {"text": "SkillSpector AST4 (behavioral-ast) in hermes_neurovision/bg_mode.py"}, "fullDescription": {"text": "proc = subprocess.Popen(\n        cmd,\n        stdin=subprocess.DEVNULL,\n        stdout=subprocess.DEVNULL,\n        stderr=subprocess.DEVNULL,\n        start_new_session=True,  # detach from our pro\n\nsubprocess module calls execute external commands. Without careful input validation, this enables command injection.\n\nSkill: unknown\nRule: AST4  Category: behavioral-ast\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Use subprocess.run() with shell=False and an explicit argument list. Validate all inputs and avoid passing user-controlled data to commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-1fee55e13ef7822a", "name": "SkillSpector AST1 (behavioral-ast) in hermes_neurovision/import_theme.py", "shortDescription": {"text": "SkillSpector AST1 (behavioral-ast) in hermes_neurovision/import_theme.py"}, "fullDescription": {"text": "exec(plugin_code, namespace)\n\nDirect exec() call allows arbitrary code execution. An attacker can inject code that runs with the full privileges of the process.\n\nSkill: unknown\nRule: AST1  Category: behavioral-ast\nSeverity: HIGH  Confidence: 0.60\n\nRemediation: Replace exec() with a safe alternative. If dynamic execution is required, use a sandboxed environment or restricted eval with __builtins__ disabled."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.6}}, {"id": "scanner-d49429a90302b02c", "name": "SkillSpector AST4 (behavioral-ast) in hermes_neurovision/launcher.py", "shortDescription": {"text": "SkillSpector AST4 (behavioral-ast) in hermes_neurovision/launcher.py"}, "fullDescription": {"text": "result = subprocess.run(\n            [\"ps\", \"aux\"],\n            capture_output=True,\n            text=True,\n            timeout=2\n        )\n\nsubprocess module calls execute external commands. Without careful input validation, this enables command injection.\n\nSkill: unknown\nRule: AST4  Category: behavioral-ast\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Use subprocess.run() with shell=False and an explicit argument list. Validate all inputs and avoid passing user-controlled data to commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-74fed6f00fe1660d", "name": "SkillSpector AST5 (behavioral-ast) in hermes_neurovision/overlay.py", "shortDescription": {"text": "SkillSpector AST5 (behavioral-ast) in hermes_neurovision/overlay.py"}, "fullDescription": {"text": "os.execvp(self.child_cmd[0], self.child_cmd)\n\nos.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.\n\nSkill: unknown\nRule: AST5  Category: behavioral-ast\nSeverity: HIGH  Confidence: 0.60\n\nRemediation: Replace os.system() with subprocess.run(shell=False). Use explicit argument lists and validate all command inputs."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.6}}, {"id": "scanner-9197a41dd834b829", "name": "SkillSpector AST4 (behavioral-ast) in hermes_neurovision/sound.py", "shortDescription": {"text": "SkillSpector AST4 (behavioral-ast) in hermes_neurovision/sound.py"}, "fullDescription": {"text": "subprocess.Popen(\n            ['say', '-v', 'Whisper', text],\n            stdout=subprocess.DEVNULL,\n            stderr=subprocess.DEVNULL,\n            start_new_session=True,\n        )\n\nsubprocess module calls execute external commands. Without careful input validation, this enables command injection.\n\nSkill: unknown\nRule: AST4  Category: behavioral-ast\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Use subprocess.run() with shell=False and an explicit argument list. Validate all inputs and avoid passing user-controlled data to commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-e5a6355a5d1e7619", "name": "SkillSpector AST4 (behavioral-ast) in hermes_neurovision/sources/docker_tasks.py", "shortDescription": {"text": "SkillSpector AST4 (behavioral-ast) in hermes_neurovision/sources/docker_tasks.py"}, "fullDescription": {"text": "result = subprocess.run(\n            [\"docker\", \"ps\", \"--format\", \"{{.Names}}\"],\n            capture_output=True, text=True, timeout=2.0,\n        )\n\nsubprocess module calls execute external commands. Without careful input validation, this enables command injection.\n\nSkill: unknown\nRule: AST4  Category: behavioral-ast\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Use subprocess.run() with shell=False and an explicit argument list. Validate all inputs and avoid passing user-controlled data to commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-be8f29fad4a23456", "name": "SkillSpector AST4 (behavioral-ast) in hermes_neurovision/sources/hook_handler.py", "shortDescription": {"text": "SkillSpector AST4 (behavioral-ast) in hermes_neurovision/sources/hook_handler.py"}, "fullDescription": {"text": "subprocess.Popen(\n            [\n                \"python3\", \"-c\",\n                f\"from hermes_neurovision.launcher import auto_launch; \"\n                f\"result = auto_launch('{vision_cmd}')\n\nsubprocess module calls execute external commands. Without careful input validation, this enables command injection.\n\nSkill: unknown\nRule: AST4  Category: behavioral-ast\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Use subprocess.run() with shell=False and an explicit argument list. Validate all inputs and avoid passing user-controlled data to commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-c65144f4d039f6b3", "name": "SkillSpector AST7 (behavioral-ast) in hermes_neurovision/sources/trajectories.py", "shortDescription": {"text": "SkillSpector AST7 (behavioral-ast) in hermes_neurovision/sources/trajectories.py"}, "fullDescription": {"text": "current_offset = getattr(self, offset_attr)\n\nDynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.\n\nSkill: unknown\nRule: AST7  Category: behavioral-ast\nSeverity: LOW  Confidence: 0.50\n\nRemediation: Replace dynamic getattr() with explicit attribute access or a dictionary lookup with an allowlist of permitted attributes."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.5}}, {"id": "scanner-cffbcc4259ca1b66", "name": "SkillSpector AST7 (behavioral-ast) in hermes_neurovision/theme_editor.py", "shortDescription": {"text": "SkillSpector AST7 (behavioral-ast) in hermes_neurovision/theme_editor.py"}, "fullDescription": {"text": "return getattr(self._config, attr)\n\nDynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.\n\nSkill: unknown\nRule: AST7  Category: behavioral-ast\nSeverity: LOW  Confidence: 0.50\n\nRemediation: Replace dynamic getattr() with explicit attribute access or a dictionary lookup with an allowlist of permitted attributes."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.5}}, {"id": "scanner-0f7480abbdfe8280", "name": "SkillSpector AST3 (behavioral-ast) in hermes_neurovision/theme_plugins/__init__.py", "shortDescription": {"text": "SkillSpector AST3 (behavioral-ast) in hermes_neurovision/theme_plugins/__init__.py"}, "fullDescription": {"text": "__import__(f\"hermes_neurovision.theme_plugins.{mod}\")\n\nDynamic __import__() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.\n\nSkill: unknown\nRule: AST3  Category: behavioral-ast\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Use standard import statements instead of __import__(). If dynamic loading is needed, use importlib with an allowlist of permitted modules."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-84fda417dd181f67", "name": "SkillSpector AST3 (behavioral-ast) in hermes_neurovision/theme_plugins/hybrid.py", "shortDescription": {"text": "SkillSpector AST3 (behavioral-ast) in hermes_neurovision/theme_plugins/hybrid.py"}, "fullDescription": {"text": "rng = __import__(\"random\")\n\nDynamic __import__() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.\n\nSkill: unknown\nRule: AST3  Category: behavioral-ast\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Use standard import statements instead of __import__(). If dynamic loading is needed, use importlib with an allowlist of permitted modules."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-27fae7f641d0131a", "name": "SkillSpector AST7 (behavioral-ast) in hermes_neurovision/tune.py", "shortDescription": {"text": "SkillSpector AST7 (behavioral-ast) in hermes_neurovision/tune.py"}, "fullDescription": {"text": "val = getattr(self._settings, attr)\n\nDynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.\n\nSkill: unknown\nRule: AST7  Category: behavioral-ast\nSeverity: LOW  Confidence: 0.50\n\nRemediation: Replace dynamic getattr() with explicit attribute access or a dictionary lookup with an allowlist of permitted attributes."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.5}}, {"id": "scanner-0b970b9375298583", "name": "SkillSpector AST4 (behavioral-ast) in install_helper.py", "shortDescription": {"text": "SkillSpector AST4 (behavioral-ast) in install_helper.py"}, "fullDescription": {"text": "result = subprocess.run(install_args, capture_output=True, text=True)\n\nsubprocess module calls execute external commands. Without careful input validation, this enables command injection.\n\nSkill: unknown\nRule: AST4  Category: behavioral-ast\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Use subprocess.run() with shell=False and an explicit argument list. Validate all inputs and avoid passing user-controlled data to commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-a4bb209ec834670e", "name": "SkillSpector AST4 (behavioral-ast) in scripts/neurovision_runner.py", "shortDescription": {"text": "SkillSpector AST4 (behavioral-ast) in scripts/neurovision_runner.py"}, "fullDescription": {"text": "result = subprocess.run(\n            [\"python3\", \"-c\",\n             \"from hermes_neurovision.themes import THEMES; print('\\\\n'.join(THEMES))\"],\n            capture_output=True, text=True, cwd=\n\nsubprocess module calls execute external commands. Without careful input validation, this enables command injection.\n\nSkill: unknown\nRule: AST4  Category: behavioral-ast\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Use subprocess.run() with shell=False and an explicit argument list. Validate all inputs and avoid passing user-controlled data to commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-6d2ee3f6c558c53a", "name": "SkillSpector AST7 (behavioral-ast) in tests/test_plugin_api.py", "shortDescription": {"text": "SkillSpector AST7 (behavioral-ast) in tests/test_plugin_api.py"}, "fullDescription": {"text": "method = getattr(p, method_name)\n\nDynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.\n\nSkill: unknown\nRule: AST7  Category: behavioral-ast\nSeverity: LOW  Confidence: 0.50\n\nRemediation: Replace dynamic getattr() with explicit attribute access or a dictionary lookup with an allowlist of permitted attributes."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.5}}, {"id": "scanner-b46646b3585c5571", "name": "SkillSpector AST7 (behavioral-ast) in tests/test_tune.py", "shortDescription": {"text": "SkillSpector AST7 (behavioral-ast) in tests/test_tune.py"}, "fullDescription": {"text": "before = getattr(t, attr)\n\nDynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.\n\nSkill: unknown\nRule: AST7  Category: behavioral-ast\nSeverity: LOW  Confidence: 0.50\n\nRemediation: Replace dynamic getattr() with explicit attribute access or a dictionary lookup with an allowlist of permitted attributes."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.5}}, {"id": "scanner-1b091f8d8849644b", "name": "SkillSpector TT2 (taint) in hermes_neurovision/sources/hook_handler.py", "shortDescription": {"text": "SkillSpector TT2 (taint) in hermes_neurovision/sources/hook_handler.py"}, "fullDescription": {"text": "with open(_EVENTS_PATH, \"a\") as f:\n\nData from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.\n\nSkill: unknown\nRule: TT2  Category: taint\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Validate tainted variables before passing them to sinks. Use allowlists, type checks, or sanitization functions on data from external sources."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-fcc6fb6b023ba81e", "name": "SkillSpector E3 (data-exfil) in AUTOLAUNCH.md", "shortDescription": {"text": "SkillSpector E3 (data-exfil) in AUTOLAUNCH.md"}, "fullDescription": {"text": "ls -la ~/\n\nCode scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.\n\nSkill: unknown\nRule: E3  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Remove unnecessary filesystem scanning. If file access is needed, use explicit, scoped paths. Avoid reading ~/.ssh, ~/.aws, or credential directories."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-1231afaf845848bc", "name": "SkillSpector E3 (data-exfil) in TESTING.md", "shortDescription": {"text": "SkillSpector E3 (data-exfil) in TESTING.md"}, "fullDescription": {"text": "ls -la ~/\n\nCode scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.\n\nSkill: unknown\nRule: E3  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Remove unnecessary filesystem scanning. If file access is needed, use explicit, scoped paths. Avoid reading ~/.ssh, ~/.aws, or credential directories."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-f20d65053fcb0961", "name": "SkillSpector EA3 (excessive-agency) in CHANGELOG.md", "shortDescription": {"text": "SkillSpector EA3 (excessive-agency) in CHANGELOG.md"}, "fullDescription": {"text": "not limited to\n\nSkill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.\n\nSkill: unknown\nRule: EA3  Category: excessive-agency\nSeverity: LOW  Confidence: 0.70\n\nRemediation: Limit the skill's scope to its documented purpose. Remove instructions that enable the agent to perform actions outside its stated functionality."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.7}}, {"id": "scanner-f3321f3de07fb846", "name": "SkillSpector EA3 (excessive-agency) in LICENSE", "shortDescription": {"text": "SkillSpector EA3 (excessive-agency) in LICENSE"}, "fullDescription": {"text": "NOT LIMITED TO\n\nSkill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.\n\nSkill: unknown\nRule: EA3  Category: excessive-agency\nSeverity: LOW  Confidence: 0.70\n\nRemediation: Limit the skill's scope to its documented purpose. Remove instructions that enable the agent to perform actions outside its stated functionality."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.7}}, {"id": "scanner-a432f83ed4bc6594", "name": "SkillSpector EA2 (excessive-agency) in hermes_neurovision/cli.py", "shortDescription": {"text": "SkillSpector EA2 (excessive-agency) in hermes_neurovision/cli.py"}, "fullDescription": {"text": "without confirmation\n\nSkill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.\n\nSkill: unknown\nRule: EA2  Category: excessive-agency\nSeverity: MEDIUM  Confidence: 0.75\n\nRemediation: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.75}}, {"id": "scanner-2cdeb5c40ecef5f5", "name": "SkillSpector EA2 (excessive-agency) in hermes_neurovision/import_theme.py", "shortDescription": {"text": "SkillSpector EA2 (excessive-agency) in hermes_neurovision/import_theme.py"}, "fullDescription": {"text": "skip confirmation\n\nSkill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.\n\nSkill: unknown\nRule: EA2  Category: excessive-agency\nSeverity: MEDIUM  Confidence: 0.85\n\nRemediation: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-701f785112a0958a", "name": "SkillSpector EA2 (excessive-agency) in tests/test_export_import.py", "shortDescription": {"text": "SkillSpector EA2 (excessive-agency) in tests/test_export_import.py"}, "fullDescription": {"text": "skip confirmation\n\nSkill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.\n\nSkill: unknown\nRule: EA2  Category: excessive-agency\nSeverity: MEDIUM  Confidence: 0.85\n\nRemediation: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-53b4cc56cf717590", "name": "SkillSpector OH1 (output-handling) in hermes_neurovision/bg_mode.py", "shortDescription": {"text": "SkillSpector OH1 (output-handling) in hermes_neurovision/bg_mode.py"}, "fullDescription": {"text": "subprocess.run(\n            [\"osascript\", \"-e\", script],\n            capture_output\n\nModel output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.\n\nSkill: unknown\nRule: OH1  Category: output-handling\nSeverity: HIGH  Confidence: 0.95\n\nRemediation: Validate and sanitize all model output before using it in downstream contexts. Use parameterized queries for SQL, shell quoting for commands, and HTML encoding for web output."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.95}}, {"id": "scanner-5145f74c3e177243", "name": "SkillSpector OH1 (output-handling) in hermes_neurovision/launcher.py", "shortDescription": {"text": "SkillSpector OH1 (output-handling) in hermes_neurovision/launcher.py"}, "fullDescription": {"text": "subprocess.run(\n            [\"ps\", \"aux\"],\n            capture_output\n\nModel output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.\n\nSkill: unknown\nRule: OH1  Category: output-handling\nSeverity: HIGH  Confidence: 0.95\n\nRemediation: Validate and sanitize all model output before using it in downstream contexts. Use parameterized queries for SQL, shell quoting for commands, and HTML encoding for web output."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.95}}, {"id": "scanner-d87e574d768be3b3", "name": "SkillSpector OH1 (output-handling) in hermes_neurovision/sources/docker_tasks.py", "shortDescription": {"text": "SkillSpector OH1 (output-handling) in hermes_neurovision/sources/docker_tasks.py"}, "fullDescription": {"text": "subprocess.run(\n            [\"docker\", \"ps\", \"--format\", \"{{.Names}}\"],\n            capture_output\n\nModel output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.\n\nSkill: unknown\nRule: OH1  Category: output-handling\nSeverity: HIGH  Confidence: 0.95\n\nRemediation: Validate and sanitize all model output before using it in downstream contexts. Use parameterized queries for SQL, shell quoting for commands, and HTML encoding for web output."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.95}}, {"id": "scanner-802af6af2d994c51", "name": "SkillSpector OH1 (output-handling) in hermes_neurovision/sources/hook_handler.py", "shortDescription": {"text": "SkillSpector OH1 (output-handling) in hermes_neurovision/sources/hook_handler.py"}, "fullDescription": {"text": "subprocess.Popen(\n            [\n                \"python3\", \"-c\",\n                f\"from hermes_neurovision.launcher import auto_launch; \"\n                f\"result\n\nModel output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.\n\nSkill: unknown\nRule: OH1  Category: output-handling\nSeverity: HIGH  Confidence: 0.95\n\nRemediation: Validate and sanitize all model output before using it in downstream contexts. Use parameterized queries for SQL, shell quoting for commands, and HTML encoding for web output."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.95}}, {"id": "scanner-ab607d29b1012e47", "name": "SkillSpector OH3 (output-handling) in hermes_neurovision/theme_plugins/hybrid.py", "shortDescription": {"text": "SkillSpector OH3 (output-handling) in hermes_neurovision/theme_plugins/hybrid.py"}, "fullDescription": {"text": "fill the\n    terminal\n\nOutput size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.\n\nSkill: unknown\nRule: OH3  Category: output-handling\nSeverity: MEDIUM  Confidence: 0.80\n\nRemediation: Set explicit limits on output length, generation count, and rate. Use max_tokens and truncation to prevent unbounded output."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.8}}, {"id": "scanner-6ce7bab908f46fcf", "name": "SkillSpector OH1 (output-handling) in install_helper.py", "shortDescription": {"text": "SkillSpector OH1 (output-handling) in install_helper.py"}, "fullDescription": {"text": "subprocess.run(install_args, capture_output\n\nModel output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.\n\nSkill: unknown\nRule: OH1  Category: output-handling\nSeverity: HIGH  Confidence: 0.95\n\nRemediation: Validate and sanitize all model output before using it in downstream contexts. Use parameterized queries for SQL, shell quoting for commands, and HTML encoding for web output."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.95}}, {"id": "scanner-70d912aecaf751ce", "name": "SkillSpector P1 (prompt-injection) in PLAN_v0.1.3.md", "shortDescription": {"text": "SkillSpector P1 (prompt-injection) in PLAN_v0.1.3.md"}, "fullDescription": {"text": "Override System\n\nThis pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.\n\nSkill: unknown\nRule: P1  Category: prompt-injection\nSeverity: HIGH  Confidence: 0.90\n\nRemediation: Remove or rewrite any text that instructs the agent to ignore prompts, override safety rules, or trust unverified content. Ensure skill content cannot be injected to alter agent behavior."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.9}}, {"id": "scanner-0c08c3e4a61d1df2", "name": "SkillSpector RA2 (rogue-agent) in AUTOLAUNCH.md", "shortDescription": {"text": "SkillSpector RA2 (rogue-agent) in AUTOLAUNCH.md"}, "fullDescription": {"text": "Create config file:\n```bash\nmkdir -p ~/.hermes/neurovision\ncat > ~/.hermes/neurovision/config.json << 'EOF'\n{\n  \"auto_launch\": true\n}\nEOF\n```\n\n### 2. Verify Gateway Hook is Installed\n\n```bash\n# Should\n\nSkill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.\n\nSkill: unknown\nRule: RA2  Category: rogue-agent\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-ec5f35ece1348d99", "name": "SkillSpector RA2 (rogue-agent) in CLAUDE.md", "shortDescription": {"text": "SkillSpector RA2 (rogue-agent) in CLAUDE.md"}, "fullDescription": {"text": "write test first, verify it fails, implement, verify it passes, commit\n3. Each task is self-contained \u2014 complete one fully before starting the next\n4. Tasks are ordered by dependency \u2014 do them in sequ\n\nSkill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.\n\nSkill: unknown\nRule: RA2  Category: rogue-agent\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-2cb3ab7205c3b985", "name": "SkillSpector RA2 (rogue-agent) in INSTALL.md", "shortDescription": {"text": "SkillSpector RA2 (rogue-agent) in INSTALL.md"}, "fullDescription": {"text": "mkdir -p ~/.hermes/hooks/hermes-neurovision\ncp hermes_neurovision/sources/hook_handler.py ~/.hermes/hooks/hermes-neurovision/handler.py\ncp hermes_neurovision/sources/HOOK.yaml ~/.hermes/hooks/hermes-n\n\nSkill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.\n\nSkill: unknown\nRule: RA2  Category: rogue-agent\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-b0ebcfb5114ece20", "name": "SkillSpector RA2 (rogue-agent) in PLAN.md", "shortDescription": {"text": "SkillSpector RA2 (rogue-agent) in PLAN.md"}, "fullDescription": {"text": "Write to buffer  \u2502\n          \u2502    stars, bg, edges \u2502\n          \u2502    pulses, nodes    \u2502\n          \u2502    packets, particles\u2502\n          \u2502    streaks, extras  \u2502\n          \u2502    specials, overlays\u2502\n\nSkill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.\n\nSkill: unknown\nRule: RA2  Category: rogue-agent\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-7566285baa49c54a", "name": "SkillSpector RA2 (rogue-agent) in PLAN_v0.2.0.md", "shortDescription": {"text": "SkillSpector RA2 (rogue-agent) in PLAN_v0.2.0.md"}, "fullDescription": {"text": "Write to buffer  \u2502\n          \u2502    stars, bg, edges \u2502\n          \u2502    pulses, nodes    \u2502\n          \u2502    packets, particles\u2502\n          \u2502    streaks, extras  \u2502\n          \u2502    specials, overlays\u2502\n\nSkill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.\n\nSkill: unknown\nRule: RA2  Category: rogue-agent\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-8c5aeedde37d2e75", "name": "SkillSpector RA2 (rogue-agent) in TASKS.md", "shortDescription": {"text": "SkillSpector RA2 (rogue-agent) in TASKS.md"}, "fullDescription": {"text": "Create pyproject.toml, __init__.py, directory structure. Init git repo.\n- [x] Task 2: Extract themes.py from ~/Desktop/neurovisualizer.py (THEMES tuple, ThemeConfig, build_theme_config, constants). Wr\n\nSkill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.\n\nSkill: unknown\nRule: RA2  Category: rogue-agent\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-204678bebb7a2e10", "name": "SkillSpector RA2 (rogue-agent) in TESTING.md", "shortDescription": {"text": "SkillSpector RA2 (rogue-agent) in TESTING.md"}, "fullDescription": {"text": "write timestamp to /tmp/vision-test.log with the current time\"\n```\n\n4. Verify:\n- Check `~/.hermes/neurovision/events.jsonl` for agent:start event\n- A new terminal window should open with hermes-neurov\n\nSkill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.\n\nSkill: unknown\nRule: RA2  Category: rogue-agent\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-79294629a3d63ef3", "name": "SkillSpector RA2 (rogue-agent) in hermes_neurovision/sources/HOOK.yaml", "shortDescription": {"text": "SkillSpector RA2 (rogue-agent) in hermes_neurovision/sources/HOOK.yaml"}, "fullDescription": {"text": "create\n  - checkpoint:rollback\n  - mcp:connect\n  - mcp:disconnect\n  - mcp:tool_call\n  - provider:fallback\n  - provider:error\n  - subagent:start\n  - subagent:end\n\n# Auto-launch configuration (optional)\n\nSkill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.\n\nSkill: unknown\nRule: RA2  Category: rogue-agent\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-5c4fd89c159bf599", "name": "SkillSpector RA2 (rogue-agent) in hermes_neurovision/sources/hook_handler.py", "shortDescription": {"text": "SkillSpector RA2 (rogue-agent) in hermes_neurovision/sources/hook_handler.py"}, "fullDescription": {"text": "mkdir -p ~/.hermes/hooks/hermes-neurovision\n    cp this_file.py ~/.hermes/hooks/hermes-neurovision/handler.py\n    # Create HOOK.yaml alongside it (see below)\n\"\"\"\n\nimport json\nimport os\nimport subproce\n\nSkill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.\n\nSkill: unknown\nRule: RA2  Category: rogue-agent\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-7560005ba2b9fc55", "name": "SkillSpector RA2 (rogue-agent) in install_helper.py", "shortDescription": {"text": "SkillSpector RA2 (rogue-agent) in install_helper.py"}, "fullDescription": {"text": "Create config directory\n    current += 1\n    print_step(current, total_steps, \"Setting up configuration...\")\n    config_dir = os.path.expanduser(\"~/.hermes/neurovision\")\n    os.makedirs(config_dir, ex\n\nSkill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.\n\nSkill: unknown\nRule: RA2  Category: rogue-agent\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-c6c30ca9c7b69e40", "name": "SkillSpector SC4 (supply-chain) in pyproject.toml", "shortDescription": {"text": "SkillSpector SC4 (supply-chain) in pyproject.toml"}, "fullDescription": {"text": "requires-python\n\nDependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.\n\nSkill: unknown\nRule: SC4  Category: supply-chain\nSeverity: HIGH  Confidence: 0.80\n\nRemediation: Update the dependency to a patched version that addresses the known CVE. Check OSV (osv.dev) or NVD for details on the vulnerability."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.8}}, {"id": "scanner-e7bd96ad74532b43", "name": "SkillSpector P6 (prompt-injection) in hermes_neurovision/emergent/automaton.py", "shortDescription": {"text": "SkillSpector P6 (prompt-injection) in hermes_neurovision/emergent/automaton.py"}, "fullDescription": {"text": "output\n        rule\n\nSkill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.\n\nSkill: unknown\nRule: P6  Category: prompt-injection\nSeverity: HIGH  Confidence: 0.85\n\nRemediation: Remove any instructions that reveal, print, or output system prompts or internal rules. System instructions should never be exposed to end users."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.85}}, {"id": "scanner-6723e6b021740894", "name": "SkillSpector TM1 (tool-misuse) in RELEASE_COMMANDS.md", "shortDescription": {"text": "SkillSpector TM1 (tool-misuse) in RELEASE_COMMANDS.md"}, "fullDescription": {"text": "git push origin main\ngit push origin --tags --force\n\nTool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).\n\nSkill: unknown\nRule: TM1  Category: tool-misuse\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-620429c99ef3e6a7", "name": "SkillSpector TM1 (tool-misuse) in tests/test_sources.py", "shortDescription": {"text": "SkillSpector TM1 (tool-misuse) in tests/test_sources.py"}, "fullDescription": {"text": "rm -rf /\n\nTool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).\n\nSkill: unknown\nRule: TM1  Category: tool-misuse\nSeverity: HIGH  Confidence: 1.00\n\nRemediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0221100580213f6c", "name": "Insecure pattern 'exec_used' in hermes_neurovision/import_theme.py:277", "shortDescription": {"text": "Insecure pattern 'exec_used' in hermes_neurovision/import_theme.py:277"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bcbbb62293cb9a62", "name": "Very large file: demo_video.py (1223 lines)", "shortDescription": {"text": "Very large file: demo_video.py (1223 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cadb4ce5c418bd17", "name": "Very large file: hermes_neurovision/theme_plugins/legacy_v2_screens.py (2061 lines)", "shortDescription": {"text": "Very large file: hermes_neurovision/theme_plugins/legacy_v2_screens.py (2061 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7f09f476ed454abd", "name": "Very large file: hermes_neurovision/theme_plugins/redesigned.py (2927 lines)", "shortDescription": {"text": "Very large file: hermes_neurovision/theme_plugins/redesigned.py (2927 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f0ef0adfedb1645b", "name": "Very large file: hermes_neurovision/theme_plugins/originals_v2.py (1427 lines)", "shortDescription": {"text": "Very large file: hermes_neurovision/theme_plugins/originals_v2.py (1427 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ab3a4db81bb8656c", "name": "Very large file: hermes_neurovision/theme_plugins/nature_v2.py (1232 lines)", "shortDescription": {"text": "Very large file: hermes_neurovision/theme_plugins/nature_v2.py (1232 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8b51ef1817b29320", "name": "Very large file: hermes_neurovision/theme_plugins/attractors.py (1829 lines)", "shortDescription": {"text": "Very large file: hermes_neurovision/theme_plugins/attractors.py (1829 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-57d82f68d3f16a91", "name": "Very large file: hermes_neurovision/theme_plugins/legacy_v2b_screens.py (2730 lines)", "shortDescription": {"text": "Very large file: hermes_neurovision/theme_plugins/legacy_v2b_screens.py (2730 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-347b6ae69757985e", "name": "Very large file: hermes_neurovision/theme_plugins/ascii_fields.py (1476 lines)", "shortDescription": {"text": "Very large file: hermes_neurovision/theme_plugins/ascii_fields.py (1476 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a1cce830569c0608", "name": "Very large file: hermes_neurovision/theme_plugins/generators.py (1272 lines)", "shortDescription": {"text": "Very large file: hermes_neurovision/theme_plugins/generators.py (1272 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b57282b71b1e7b5b", "name": "Very large file: hermes_neurovision/theme_plugins/spectacular.py (1627 lines)", "shortDescription": {"text": "Very large file: hermes_neurovision/theme_plugins/spectacular.py (1627 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 149 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing ci. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-57a913b8b97d8a89", "name": "Network/subprocess call without timeout or try/except \u2014 install_helper.py:47", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 install_helper.py:47"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-19070e34c95652bd", "name": "Commented-code block (6 lines) in demo_video.py:1101", "shortDescription": {"text": "Commented-code block (6 lines) in demo_video.py:1101"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7c06e2780b34aade", "name": "Legacy-named symbol `include_legacy` in tests/test_new_features.py:20", "shortDescription": {"text": "Legacy-named symbol `include_legacy` in tests/test_new_features.py:20"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c5b6eeb3440a14c9", "name": "Legacy-named symbol `include_legacy` in tests/test_cli.py:48", "shortDescription": {"text": "Legacy-named symbol `include_legacy` in tests/test_cli.py:48"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-64b057323fcbb599", "name": "Legacy-named symbol `ev_old` in tests/test_log_overlay.py:25", "shortDescription": {"text": "Legacy-named symbol `ev_old` in tests/test_log_overlay.py:25"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-75a15585b123fb88", "name": "Legacy-named symbol `originals_v2` in scripts/neurovision_runner.py:216", "shortDescription": {"text": "Legacy-named symbol `originals_v2` in scripts/neurovision_runner.py:216"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ce7e06f375a87fd1", "name": "Network/subprocess call without timeout or try/except \u2014 hermes_neurovision/sound.py:100", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 hermes_neurovision/sound.py:100"}, "fullDescription": {"text": "`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8855334cc5cf5800", "name": "Legacy-named symbol `toggle_legacy` in hermes_neurovision/command_menu.py:70", "shortDescription": {"text": "Legacy-named symbol `toggle_legacy` in hermes_neurovision/command_menu.py:70"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5e4f9378d44ad31c", "name": "Commented-code block (5 lines) in hermes_neurovision/scene.py:243", "shortDescription": {"text": "Commented-code block (5 lines) in hermes_neurovision/scene.py:243"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a0c7d1151d129044", "name": "Stub function `reset_timer` (body is just `pass`/`return`) \u2014 hermes_neurovision/overlay.py:50", "shortDescription": {"text": "Stub function `reset_timer` (body is just `pass`/`return`) \u2014 hermes_neurovision/overlay.py:50"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c5070f61ca84a2ee", "name": "Network/subprocess call without timeout or try/except \u2014 hermes_neurovision/bg_mode.py:645", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 hermes_neurovision/bg_mode.py:645"}, "fullDescription": {"text": "`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a865cd5f0b4f6998", "name": "Legacy-named symbol `include_legacy` in hermes_neurovision/app.py:81", "shortDescription": {"text": "Legacy-named symbol `include_legacy` in hermes_neurovision/app.py:81"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-40f48f26fb277a51", "name": "Legacy-named symbol `list_legacy` in hermes_neurovision/cli.py:251", "shortDescription": {"text": "Legacy-named symbol `list_legacy` in hermes_neurovision/cli.py:251"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-050ae93887909a54", "name": "Legacy-named symbol `_migrate_v0_to_v1` in hermes_neurovision/import_theme.py:90", "shortDescription": {"text": "Legacy-named symbol `_migrate_v0_to_v1` in hermes_neurovision/import_theme.py:90"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c9a929da4460df60", "name": "Network/subprocess call without timeout or try/except \u2014 hermes_neurovision/sources/hook_handler.py:72", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 hermes_neurovision/sources/hook_handler.py:72"}, "fullDescription": {"text": "`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f3dd4086b29c26df", "name": "Stub function `symmetry` (body is just `pass`/`return`) \u2014 hermes_neurovision/theme_plugins/mycelium.py:184", "shortDescription": {"text": "Stub function `symmetry` (body is just `pass`/`return`) \u2014 hermes_neurovision/theme_plugins/mycelium.py:184"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f6a8b009acc1fc24", "name": "Stub function `star_glyph` (body is just `pass`/`return`) \u2014 hermes_neurovision/theme_plugins/legacy_v2_screens.py:1553", "shortDescription": {"text": "Stub function `star_glyph` (body is just `pass`/`return`) \u2014 hermes_neurovision/theme_plugins/legacy_v2_screens.py:1553"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3b4a3fad159e1e8c", "name": "Legacy-named symbol `originals_v2` in hermes_neurovision/theme_plugins/__init__.py:46", "shortDescription": {"text": "Legacy-named symbol `originals_v2` in hermes_neurovision/theme_plugins/__init__.py:46"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2bd1897eeee8ae31", "name": "Stub function `symmetry` (body is just `pass`/`return`) \u2014 hermes_neurovision/theme_plugins/redesigned.py:131", "shortDescription": {"text": "Stub function `symmetry` (body is just `pass`/`return`) \u2014 hermes_neurovision/theme_plugins/redesigned.py:131"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-73d63dc90aa1926f", "name": "Legacy-named symbol `cosmic_v2` in hermes_neurovision/theme_plugins/cosmic.py:305", "shortDescription": {"text": "Legacy-named symbol `cosmic_v2` in hermes_neurovision/theme_plugins/cosmic.py:305"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2e5e67f9dff13811", "name": "Stub function `palette_shift` (body is just `pass`/`return`) \u2014 hermes_neurovision/theme_plugins/nature_v2.py:200", "shortDescription": {"text": "Stub function `palette_shift` (body is just `pass`/`return`) \u2014 hermes_neurovision/theme_plugins/nature_v2.py:200"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b57bd1ae093f7b4f", "name": "Stub function `symmetry` (body is just `pass`/`return`) \u2014 hermes_neurovision/theme_plugins/attractors.py:233", "shortDescription": {"text": "Stub function `symmetry` (body is just `pass`/`return`) \u2014 hermes_neurovision/theme_plugins/attractors.py:233"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-14e2fceb81381827", "name": "Stub function `palette_shift` (body is just `pass`/`return`) \u2014 hermes_neurovision/theme_plugins/hybrid.py:144", "shortDescription": {"text": "Stub function `palette_shift` (body is just `pass`/`return`) \u2014 hermes_neurovision/theme_plugins/hybrid.py:144"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7e16328f3d086e11", "name": "Stub function `palette_shift` (body is just `pass`/`return`) \u2014 hermes_neurovision/theme_plugins/spectacular.py:181", "shortDescription": {"text": "Stub function `palette_shift` (body is just `pass`/`return`) \u2014 hermes_neurovision/theme_plugins/spectacular.py:181"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6e0e0648608f5f6c", "name": "Stub function `star_glyph` (body is just `pass`/`return`) \u2014 hermes_neurovision/theme_plugins/originals.py:75", "shortDescription": {"text": "Stub function `star_glyph` (body is just `pass`/`return`) \u2014 hermes_neurovision/theme_plugins/originals.py:75"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\ndemo_video.py:draw_big_text, demo_video.py:draw\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nhermes_neurovision/tune.py:put, hermes_neurovision/command_menu.py:put, hermes_neurovision/theme_editor.py:put\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49c98f7cedd9c977", "name": "Near-duplicate function bodies in 4 places", "shortDescription": {"text": "Near-duplicate function bodies in 4 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nhermes_neurovision/scene.py:step, hermes_neurovision/scene.py:step, hermes_neurovision/scene.py:step, hermes_neurovision/scene.py:step\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-76a2f6818267a9a8", "name": "Near-duplicate function bodies in 8 places", "shortDescription": {"text": "Near-duplicate function bodies in 8 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nhermes_neurovision/theme_plugins/advanced_screens.py:emergent_layer, hermes_neurovision/theme_plugins/advanced_screens.py:emergent_layer, hermes_neurovision/theme_plugins/advanced_screens.py:emergent_layer, hermes_neurovision/theme_plugins/emergent_v2.py:emergent_layer\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-02525d39071dd2c7", "name": "Near-duplicate function bodies in 5 places", "shortDescription": {"text": "Near-duplicate function bodies in 5 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nhermes_neurovision/theme_plugins/advanced_screens.py:echo_decay, hermes_neurovision/theme_plugins/advanced_screens.py:echo_decay, hermes_neurovision/theme_plugins/advanced_screens.py:echo_decay, hermes_neurovision/theme_plugins/advanced_screens.py:echo_decay\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/30725"}, "properties": {"repository": "Tranquil-Flow/hermes-neurovision", "repoUrl": "https://github.com/Tranquil-Flow/hermes-neurovision", "branch": "main"}, "results": [{"ruleId": "SEC017", "level": "warning", "message": {"text": "[SEC017] Unbounded Input to LLM/External API: User input is passed to an LLM or external AI API (OpenAI, Anthropic, etc.) without any visible length or size validation. This creates two risks: (1) Cost abuse \u2014 an attacker can send extremely long inputs to burn through your API credits (a single 128K-token request to GPT-4 costs ~$4, and automated attacks can drain budgets in minutes). (2) Context stuffing \u2014 oversized inputs can push your system prompt out of the context window, effectively disab"}, "properties": {"repobilityId": 468169, "scanner": "repobility-threat-engine", "fingerprint": "576ce8dd89015dfb289a504352cfcc02b1ee4b7c217412397995d7c55a8acad7", "category": "llm_injection", "severity": "medium", "confidence": 0.8, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "This file sends user input to an LLM with no visible length check or rate limit. Risks: (1) cost abuse \u2014 automated long inputs drain API budget ($4/request at 128K tokens on GPT-4), (2) context stuffing \u2014 oversized input pushes system prompt out of context window, disabling safety rules. Add input length validation before the API call.", "evidence": {"reason": "This file sends user input to an LLM with no visible length check or rate limit. Risks: (1) cost abuse \u2014 automated long inputs drain API budget ($4/request at 128K tokens on GPT-4), (2) context stuffing \u2014 oversized input pushes system prompt out of context window, disabling safety rules. Add input length validation before the API call.", "rule_id": "SEC017", "scanner": "repobility-threat-engine", "confidence": 0.8, "correlation_key": "fp|576ce8dd89015dfb289a504352cfcc02b1ee4b7c217412397995d7c55a8acad7"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/neurovision_runner.py"}, "region": {"startLine": 89}}}]}, {"ruleId": "ERR001", "level": "warning", "message": {"text": "[ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even in cleanup code, log at DEBUG level."}, "properties": {"repobilityId": 468161, "scanner": "repobility-threat-engine", "fingerprint": "28bc54e8575c6f3a1ed5ef48c82502e713dc08eb238d1182fd34bce413ba1fd2", "category": "error_handling", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "except:\n            pass", "reason": "Pattern matched with no mitigating context found", "rule_id": "ERR001", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|28bc54e8575c6f3a1ed5ef48c82502e713dc08eb238d1182fd34bce413ba1fd2"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/sources/hook_handler.py"}, "region": {"startLine": 99}}}]}, {"ruleId": "ERR001", "level": "warning", "message": {"text": "[ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even in cleanup code, log at DEBUG level."}, "properties": {"repobilityId": 468160, "scanner": "repobility-threat-engine", "fingerprint": "e468f5eb7ade1fb05b29a8e2456bdd8c13760862fa8cb555c3349d2262dcdb70", "category": "error_handling", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "except Exception:\n                pass", "reason": "Pattern matched with no mitigating context found", "rule_id": "ERR001", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|e468f5eb7ade1fb05b29a8e2456bdd8c13760862fa8cb555c3349d2262dcdb70"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/events.py"}, "region": {"startLine": 38}}}]}, {"ruleId": "ERR001", "level": "warning", "message": {"text": "[ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even in cleanup code, log at DEBUG level."}, "properties": {"repobilityId": 468159, "scanner": "repobility-threat-engine", "fingerprint": "0c63552be86db84e7afb8180ac022a94952b581f796c9511eb89e440394995b2", "category": "error_handling", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "except Exception:\n                    pass", "reason": "Pattern matched with no mitigating context found", "rule_id": "ERR001", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|0c63552be86db84e7afb8180ac022a94952b581f796c9511eb89e440394995b2"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/command_menu.py"}, "region": {"startLine": 210}}}]}, {"ruleId": "COMP001", "level": "warning", "message": {"text": "[COMP001] High cognitive complexity: Function `draw` has cognitive complexity 23 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand \u2014 nested branches, boolean chains, and recursion all weigh in. Breakdown: continue=4, elif=1, except=1, for=2, if=5, nested_bonus=10."}, "properties": {"repobilityId": 468155, "scanner": "repobility-threat-engine", "fingerprint": "01faef9fa9a4fce6a80dab65edaca18939f83cf8cf628ea7802b991cb2dd98c5", "category": "quality", "severity": "medium", "confidence": 0.95, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "AST-derived cognitive complexity score = 23 (severity threshold for medium: 15+).", "evidence": {"scanner": "repobility-threat-engine", "function": "draw", "breakdown": {"if": 5, "for": 2, "elif": 1, "except": 1, "continue": 4, "nested_bonus": 10}, "complexity": 23, "correlation_key": "fp|01faef9fa9a4fce6a80dab65edaca18939f83cf8cf628ea7802b991cb2dd98c5"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/ascii_art.py"}, "region": {"startLine": 24}}}]}, {"ruleId": "MINED111", "level": "warning", "message": {"text": "Bare except continues silently"}, "properties": {"repobilityId": 468117, "scanner": "repobility-ast-engine", "fingerprint": "2c9ff53fac163a107b3be630917738c20267913de56def5c148fc792c186a2fc", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "bare-except-without-pass", "owasp": null, "cwe_ids": [], "languages": ["python"], "observations_count": 21610}, "scanner": "repobility-ast-engine", "correlation_key": "fp|2c9ff53fac163a107b3be630917738c20267913de56def5c148fc792c186a2fc"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/theme_editor.py"}, "region": {"startLine": 337}}}]}, {"ruleId": "MINED111", "level": "warning", "message": {"text": "Bare except continues silently"}, "properties": {"repobilityId": 468116, "scanner": "repobility-ast-engine", "fingerprint": "4b242317f662db1515c63fe6adb758e89ea29a7bc624d8f12790aa7f152c84f5", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "bare-except-without-pass", "owasp": null, "cwe_ids": [], "languages": ["python"], "observations_count": 21610}, "scanner": "repobility-ast-engine", "correlation_key": "fp|4b242317f662db1515c63fe6adb758e89ea29a7bc624d8f12790aa7f152c84f5"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/theme_editor.py"}, "region": {"startLine": 309}}}]}, {"ruleId": "MINED111", "level": "warning", "message": {"text": "Bare except continues silently"}, "properties": {"repobilityId": 468115, "scanner": "repobility-ast-engine", "fingerprint": "31d0257b6746abc6f69f5a12b34a07ff404a42d6ce7c9169ae884f3f800e2f01", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "bare-except-without-pass", "owasp": null, "cwe_ids": [], "languages": ["python"], "observations_count": 21610}, "scanner": "repobility-ast-engine", "correlation_key": "fp|31d0257b6746abc6f69f5a12b34a07ff404a42d6ce7c9169ae884f3f800e2f01"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/theme_editor.py"}, "region": {"startLine": 269}}}]}, {"ruleId": "MINED111", "level": "warning", "message": {"text": "Bare except continues silently"}, "properties": {"repobilityId": 468114, "scanner": "repobility-ast-engine", "fingerprint": "b58bc550989cf841a4e870cdbd37e9e312626ffd27717eaeac9a67ddc3263806", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "bare-except-without-pass", "owasp": null, "cwe_ids": [], "languages": ["python"], "observations_count": 21610}, "scanner": "repobility-ast-engine", "correlation_key": "fp|b58bc550989cf841a4e870cdbd37e9e312626ffd27717eaeac9a67ddc3263806"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/launcher.py"}, "region": {"startLine": 63}}}]}, {"ruleId": "MINED111", "level": "warning", "message": {"text": "Bare except continues silently"}, "properties": {"repobilityId": 468088, "scanner": "repobility-ast-engine", "fingerprint": "293d974e4828b2abff93fa5ba5f7fac195c8503ba9cc4efd00d3e34e826e40b2", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "bare-except-without-pass", "owasp": null, "cwe_ids": [], "languages": ["python"], "observations_count": 21610}, "scanner": "repobility-ast-engine", "correlation_key": "fp|293d974e4828b2abff93fa5ba5f7fac195c8503ba9cc4efd00d3e34e826e40b2"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "install_helper.py"}, "region": {"startLine": 53}}}]}, {"ruleId": "AIC001", "level": "warning", "message": {"text": "Parallel implementation file sits beside a canonical file"}, "properties": {"repobilityId": 468085, "scanner": "repobility-ai-code-hygiene", "fingerprint": "8e087273754565d80029400c32e5f340644cb76678a57ab0906fe9e38f682683", "category": "quality", "severity": "medium", "confidence": 0.82, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Source filename has a patch-style suffix and a same-directory canonical sibling exists.", "evidence": {"suffix": "new", "rule_id": "AIC001", "scanner": "repobility-ai-code-hygiene", "references": ["https://arxiv.org/abs/2601.15195", "https://knip.dev/"], "canonical_file": "hermes_neurovision/theme_plugins/cosmic.py", "correlation_key": "fp|8e087273754565d80029400c32e5f340644cb76678a57ab0906fe9e38f682683"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/theme_plugins/cosmic_new.py"}, "region": {"startLine": 1}}}]}, {"ruleId": "CORE_NO_CI", "level": "warning", "message": {"text": "No CI/CD configuration found"}, "properties": {"repobilityId": 468084, "scanner": "repobility-core", "fingerprint": "ca5da3551af97272c4f099fc472740148135a15816b81b90bd862e8f91ec66ce", "category": "practices", "severity": "medium", "confidence": null, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"rule_id": "CORE_NO_CI", "scanner": "repobility-core", "correlation_key": "repo|practices|core_no_ci"}}}, {"ruleId": "COMP001", "level": "note", "message": {"text": "[COMP001] High cognitive complexity: Function `handle_key` has cognitive complexity 11 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand \u2014 nested branches, boolean chains, and recursion all weigh in. Breakdown: else=1, if=7, nested_bonus=3."}, "properties": {"repobilityId": 468157, "scanner": "repobility-threat-engine", "fingerprint": "1bfb2c9069d6b709be43be606fa92e4b82b8d46b313fcbd51931bb931e61682b", "category": "quality", "severity": "low", "confidence": 0.95, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "AST-derived cognitive complexity score = 11 (severity threshold for low: 8+).", "evidence": {"scanner": "repobility-threat-engine", "function": "handle_key", "breakdown": {"if": 7, "else": 1, "nested_bonus": 3}, "complexity": 11, "correlation_key": "fp|1bfb2c9069d6b709be43be606fa92e4b82b8d46b313fcbd51931bb931e61682b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/command_menu.py"}, "region": {"startLine": 107}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 468087, "scanner": "repobility-ai-code-hygiene", "fingerprint": "3a0b3e7ce1dd00c87bb28e4783188f9c981a0cab9bd62be3831d6c4b22393946", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "hermes_neurovision/theme_plugins/industrial.py", "duplicate_line": 254, "correlation_key": "fp|3a0b3e7ce1dd00c87bb28e4783188f9c981a0cab9bd62be3831d6c4b22393946"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/theme_plugins/whimsical.py"}, "region": {"startLine": 213}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 468086, "scanner": "repobility-ai-code-hygiene", "fingerprint": "ce8b4bbe85b76119e7b83d79ad02771dfdd597621e9515a03a36a9d93526f7eb", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "hermes_neurovision/theme_plugins/experimental.py", "duplicate_line": 146, "correlation_key": "fp|ce8b4bbe85b76119e7b83d79ad02771dfdd597621e9515a03a36a9d93526f7eb"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/theme_plugins/legacy_v1_screens.py"}, "region": {"startLine": 306}}}]}, {"ruleId": "SEC020", "level": "none", "message": {"text": "[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequent AI-assisted coding failure: the helper exposes the exact value needed for troubleshooting."}, "properties": {"repobilityId": 468166, "scanner": "repobility-threat-engine", "fingerprint": "a380176d819fac129f53644204f15c2897be198dadb561a34d4b2d86aa5fa494", "category": "credential_exposure", "severity": "info", "confidence": 0.1, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Safe context pattern detected", "evidence": {"match": "print(\"  echo '{\\\"auto_launch\\\": true}' > ~/.hermes/neurovision/config.json\")", "reason": "Safe context pattern detected", "rule_id": "SEC020", "scanner": "repobility-threat-engine", "confidence": 0.1, "correlation_key": "secret|install_helper.py|12|print echo auto_launch : true /. token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "install_helper.py"}, "region": {"startLine": 121}}}]}, {"ruleId": "MINED063", "level": "none", "message": {"text": "[MINED063] Toctou Os Path Exists: if os.path.exists(p): open(p) \u2014 file can be replaced/deleted between check and use."}, "properties": {"repobilityId": 468164, "scanner": "repobility-threat-engine", "fingerprint": "0a96654d2f840b5cc13fc1cdb7973fc894bed3225d4525ccf17e85a9e15c9862", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "toctou-os-path-exists", "owasp": null, "cwe_ids": ["CWE-367"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348048+00:00", "triaged_in_corpus": 12, "observations_count": 90754, "ai_coder_pattern_id": 41}, "scanner": "repobility-threat-engine", "correlation_key": "fp|0a96654d2f840b5cc13fc1cdb7973fc894bed3225d4525ccf17e85a9e15c9862"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/sources/hook_handler.py"}, "region": {"startLine": 64}}}]}, {"ruleId": "ERR001", "level": "none", "message": {"text": "[ERR001] Silent Exception Swallowing (and 1 more): Same pattern found in 1 additional files. Review if needed."}, "properties": {"repobilityId": 468162, "scanner": "repobility-threat-engine", "fingerprint": "93b9da83522ef7033c1689b56fc2639ef703f7cce5574751f2046196162761e3", "category": "error_handling", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 1 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 1 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "ERR001", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|93b9da83522ef7033c1689b56fc2639ef703f7cce5574751f2046196162761e3"}}}, {"ruleId": "COMP001", "level": "none", "message": {"text": "[COMP001] High cognitive complexity (and 39 more): Same pattern found in 39 additional files. Review if needed."}, "properties": {"repobilityId": 468158, "scanner": "repobility-threat-engine", "fingerprint": "0b7fe54636352719cbc4711a7a74d6c7c2a5986f9272e22fb517084b56a61a3c", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 39 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"scanner": "repobility-threat-engine", "function": "draw", "breakdown": {"if": 5, "for": 2, "elif": 1, "except": 1, "continue": 4, "nested_bonus": 10}, "aggregated": true, "complexity": 23, "correlation_key": "fp|0b7fe54636352719cbc4711a7a74d6c7c2a5986f9272e22fb517084b56a61a3c", "aggregated_count": 39}}}, {"ruleId": "MINED062", "level": "none", "message": {"text": "[MINED062] Python Dataclass No Fields (and 1 more): Same pattern found in 1 additional files. Review if needed."}, "properties": {"repobilityId": 468154, "scanner": "repobility-threat-engine", "fingerprint": "fae806c2ee90fa304d3a37e2a631a59e1c95dc447dbe00b9024d66fc54d3ca88", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 1 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"mined": true, "mining": {"slug": "python-dataclass-no-fields", "owasp": null, "cwe_ids": [], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348046+00:00", "triaged_in_corpus": 10, "observations_count": 92448, "ai_coder_pattern_id": 144}, "scanner": "repobility-threat-engine", "aggregated": true, "correlation_key": "fp|fae806c2ee90fa304d3a37e2a631a59e1c95dc447dbe00b9024d66fc54d3ca88", "aggregated_count": 1}}}, {"ruleId": "MINED062", "level": "none", "message": {"text": "[MINED062] Python Dataclass No Fields: @dataclass over an empty class \u2014 unfinished model."}, "properties": {"repobilityId": 468153, "scanner": "repobility-threat-engine", "fingerprint": "97463d771b146974a855be8a773a9f0455b01731918763f08ed13c6b6b1516ee", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "python-dataclass-no-fields", "owasp": null, "cwe_ids": [], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348046+00:00", "triaged_in_corpus": 10, "observations_count": 92448, "ai_coder_pattern_id": 144}, "scanner": "repobility-threat-engine", "correlation_key": "fp|97463d771b146974a855be8a773a9f0455b01731918763f08ed13c6b6b1516ee"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/reactive.py"}, "region": {"startLine": 20}}}]}, {"ruleId": "MINED062", "level": "none", "message": {"text": "[MINED062] Python Dataclass No Fields: @dataclass over an empty class \u2014 unfinished model."}, "properties": {"repobilityId": 468152, "scanner": "repobility-threat-engine", "fingerprint": "506f16d1162ff6bcf8a7ee6628bc8c2f61f20aef6d52b80b025f1c1566ead0d8", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "python-dataclass-no-fields", "owasp": null, "cwe_ids": [], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348046+00:00", "triaged_in_corpus": 10, "observations_count": 92448, "ai_coder_pattern_id": 144}, "scanner": "repobility-threat-engine", "correlation_key": "fp|506f16d1162ff6bcf8a7ee6628bc8c2f61f20aef6d52b80b025f1c1566ead0d8"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/compositor.py"}, "region": {"startLine": 45}}}]}, {"ruleId": "MINED062", "level": "none", "message": {"text": "[MINED062] Python Dataclass No Fields: @dataclass over an empty class \u2014 unfinished model."}, "properties": {"repobilityId": 468151, "scanner": "repobility-threat-engine", "fingerprint": "72e3cdb8ef7d31debd5bcfb0327b9fe1c065392ce9794c7bd98b5d3339b0e850", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "python-dataclass-no-fields", "owasp": null, "cwe_ids": [], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348046+00:00", "triaged_in_corpus": 10, "observations_count": 92448, "ai_coder_pattern_id": 144}, "scanner": "repobility-threat-engine", "correlation_key": "fp|72e3cdb8ef7d31debd5bcfb0327b9fe1c065392ce9794c7bd98b5d3339b0e850"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/ascii_art.py"}, "region": {"startLine": 10}}}]}, {"ruleId": "MINED050", "level": "none", "message": {"text": "[MINED050] Stub Only Function (and 15 more): Same pattern found in 15 additional files. Review if needed."}, "properties": {"repobilityId": 468150, "scanner": "repobility-threat-engine", "fingerprint": "facf796ae6e2aa7466283972d237a4863312611f907ddf04cc3a6f3da2ca0582", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 15 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"mined": true, "mining": {"slug": "stub-only-function", "owasp": null, "cwe_ids": ["CWE-1188"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348017+00:00", "triaged_in_corpus": 12, "observations_count": 633513, "ai_coder_pattern_id": 2}, "scanner": "repobility-threat-engine", "aggregated": true, "correlation_key": "fp|facf796ae6e2aa7466283972d237a4863312611f907ddf04cc3a6f3da2ca0582", "aggregated_count": 15}}}, {"ruleId": "MINED050", "level": "none", "message": {"text": "[MINED050] Stub Only Function: Function declared but body is just pass, return None, raise NotImplementedError, or TODO comment."}, "properties": {"repobilityId": 468149, "scanner": "repobility-threat-engine", "fingerprint": "72efbe21f6820d941a594871b18e9e81d879a8be0ba7cb179d67ee34cf6cab0a", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "stub-only-function", "owasp": null, "cwe_ids": ["CWE-1188"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348017+00:00", "triaged_in_corpus": 12, "observations_count": 633513, "ai_coder_pattern_id": 2}, "scanner": "repobility-threat-engine", "correlation_key": "fp|72efbe21f6820d941a594871b18e9e81d879a8be0ba7cb179d67ee34cf6cab0a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/compositor.py"}, "region": {"startLine": 224}}}]}, {"ruleId": "MINED050", "level": "none", "message": {"text": "[MINED050] Stub Only Function: Function declared but body is just pass, return None, raise NotImplementedError, or TODO comment."}, "properties": {"repobilityId": 468148, "scanner": "repobility-threat-engine", "fingerprint": "77f1aa0da075d1555bab286012ccfd1c61d7f5663eeb242b3ca3b234f582e1d5", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "stub-only-function", "owasp": null, "cwe_ids": ["CWE-1188"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348017+00:00", "triaged_in_corpus": 12, "observations_count": 633513, "ai_coder_pattern_id": 2}, "scanner": "repobility-threat-engine", "correlation_key": "fp|77f1aa0da075d1555bab286012ccfd1c61d7f5663eeb242b3ca3b234f582e1d5"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/command_menu.py"}, "region": {"startLine": 13}}}]}, {"ruleId": "MINED050", "level": "none", "message": {"text": "[MINED050] Stub Only Function: Function declared but body is just pass, return None, raise NotImplementedError, or TODO comment."}, "properties": {"repobilityId": 468147, "scanner": "repobility-threat-engine", "fingerprint": "7ef65d8fed8f4512050235e35cf7053b253a37cf5dda39c8a86b9a73148fc376", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "stub-only-function", "owasp": null, "cwe_ids": ["CWE-1188"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348017+00:00", "triaged_in_corpus": 12, "observations_count": 633513, "ai_coder_pattern_id": 2}, "scanner": "repobility-threat-engine", "correlation_key": "fp|7ef65d8fed8f4512050235e35cf7053b253a37cf5dda39c8a86b9a73148fc376"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/ascii_art.py"}, "region": {"startLine": 58}}}]}, {"ruleId": "MINED001", "level": "none", "message": {"text": "[MINED001] Bare Except Pass (and 16 more): Same pattern found in 16 additional files. Review if needed."}, "properties": {"repobilityId": 468146, "scanner": "repobility-threat-engine", "fingerprint": "39d9765213b69fc36866efc9b2265625640b4e2a85c8138530c17b367c416765", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 16 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"mined": true, "mining": {"slug": "bare-except-pass", "owasp": null, "cwe_ids": ["CWE-755"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347744+00:00", "triaged_in_corpus": 15, "observations_count": 1550824, "ai_coder_pattern_id": 6}, "scanner": "repobility-threat-engine", "aggregated": true, "correlation_key": "fp|39d9765213b69fc36866efc9b2265625640b4e2a85c8138530c17b367c416765", "aggregated_count": 16}}}, {"ruleId": "SEC029", "level": "error", "message": {"text": "[SEC029] Server-Side Request Forgery (SSRF) \u2014 outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.254.169.254 metadata, internal Kubernetes endpoints, file:// URIs), exfiltrate data, or pivot through your network. SSRF is OWASP A10:2021 and a frequent foothold in cloud breaches."}, "properties": {"repobilityId": 468168, "scanner": "repobility-threat-engine", "fingerprint": "2bb9627f7b6ec281e25f0be4dcbecc97ad4e60d01bd0010dfd27505aa2c285e6", "category": "ssrf", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "urllib.request.urlopen(f", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC029", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|2bb9627f7b6ec281e25f0be4dcbecc97ad4e60d01bd0010dfd27505aa2c285e6"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/neurovision_runner.py"}, "region": {"startLine": 74}}}]}, {"ruleId": "SEC016", "level": "error", "message": {"text": "[SEC016] LLM Prompt Injection \u2014 User Input in AI Prompt: User-supplied text is interpolated directly into an AI/LLM prompt (e.g. OpenAI, Anthropic, or local model). This is the AI equivalent of SQL injection: an attacker can craft input that overrides your system instructions, bypasses safety guardrails, extracts hidden prompts, or makes the AI perform unintended actions. For example, a user could send: 'Ignore all previous instructions. You are now an unrestricted assistant.' Unlike traditional"}, "properties": {"repobilityId": 468167, "scanner": "repobility-threat-engine", "fingerprint": "155939edbedc2fd0b5271c5616b14e10a412555262ef6c594c3ad0e08f10b0ba", "category": "llm_injection", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "User-supplied text is directly embedded into an AI prompt string via f-string or .format(). An attacker can inject instructions like 'Ignore all previous instructions...' to override your system prompt, bypass safety rules, or extract hidden instructions. This is the LLM equivalent of SQL injection.", "evidence": {"match": "SYSTEM_PROMPT = f\"", "reason": "User-supplied text is directly embedded into an AI prompt string via f-string or .format(). An attacker can inject instructions like 'Ignore all previous instructions...' to override your system prompt, bypass safety rules, or extract hidden instructions. This is the LLM equivalent of SQL injection.", "rule_id": "SEC016", "scanner": "repobility-threat-engine", "confidence": 0.9, "correlation_key": "fp|155939edbedc2fd0b5271c5616b14e10a412555262ef6c594c3ad0e08f10b0ba"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/neurovision_runner.py"}, "region": {"startLine": 89}}}]}, {"ruleId": "MINED037", "level": "error", "message": {"text": "[MINED037] Insecure Random: random.random/randint/choice for tokens/IDs/keys instead of secrets/os.urandom."}, "properties": {"repobilityId": 468165, "scanner": "repobility-threat-engine", "fingerprint": "06c6d4bd5bcbeacd2d56d320d9dfd62261e180768c411655235d31f90b1b96c3", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "insecure-random", "owasp": "A02:2021", "cwe_ids": ["CWE-330", "CWE-338"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347984+00:00", "triaged_in_corpus": 15, "observations_count": 2049, "ai_coder_pattern_id": 14}, "scanner": "repobility-threat-engine", "correlation_key": "fp|06c6d4bd5bcbeacd2d56d320d9dfd62261e180768c411655235d31f90b1b96c3"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/theme_plugins/cosmic_v2.py"}, "region": {"startLine": 216}}}]}, {"ruleId": "MINED009", "level": "error", "message": {"text": "[MINED009] Floats For Money: Variable named price/amount/cost typed as float instead of Decimal."}, "properties": {"repobilityId": 468163, "scanner": "repobility-threat-engine", "fingerprint": "af398bc03c0577299e23622d6ec066f0d2d7124ef9abd770db2b35d995a2b2cd", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "floats-for-money", "owasp": null, "cwe_ids": ["CWE-682"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347918+00:00", "triaged_in_corpus": 15, "observations_count": 208571, "ai_coder_pattern_id": 20}, "scanner": "repobility-threat-engine", "correlation_key": "fp|af398bc03c0577299e23622d6ec066f0d2d7124ef9abd770db2b35d995a2b2cd"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/emergent/physarum.py"}, "region": {"startLine": 31}}}]}, {"ruleId": "COMP001", "level": "error", "message": {"text": "[COMP001] High cognitive complexity: Function `draw` has cognitive complexity 28 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand \u2014 nested branches, boolean chains, and recursion all weigh in. Breakdown: break=1, continue=1, except=2, for=2, if=6, nested_bonus=13, ternary=3."}, "properties": {"repobilityId": 468156, "scanner": "repobility-threat-engine", "fingerprint": "0decfefa13bf45484ef5c10d5fa70d0edad33a75f234246aba79fc28ef1db109", "category": "quality", "severity": "high", "confidence": 0.95, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "AST-derived cognitive complexity score = 28 (severity threshold for high: 25+).", "evidence": {"scanner": "repobility-threat-engine", "function": "draw", "breakdown": {"if": 6, "for": 2, "break": 1, "except": 2, "ternary": 3, "continue": 1, "nested_bonus": 13}, "complexity": 28, "correlation_key": "fp|0decfefa13bf45484ef5c10d5fa70d0edad33a75f234246aba79fc28ef1db109"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/command_menu.py"}, "region": {"startLine": 147}}}]}, {"ruleId": "MINED001", "level": "error", "message": {"text": "[MINED001] Bare Except Pass: except: pass or except Exception: pass \u2014 silently swallows everything including KeyboardInterrupt and bugs."}, "properties": {"repobilityId": 468145, "scanner": "repobility-threat-engine", "fingerprint": "fc094e0c3784a3df83368539b3553ce177e0ab6e7d2ea7ac3fbc0f06829ca604", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "bare-except-pass", "owasp": null, "cwe_ids": ["CWE-755"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347744+00:00", "triaged_in_corpus": 15, "observations_count": 1550824, "ai_coder_pattern_id": 6}, "scanner": "repobility-threat-engine", "correlation_key": "fp|fc094e0c3784a3df83368539b3553ce177e0ab6e7d2ea7ac3fbc0f06829ca604"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/compositor.py"}, "region": {"startLine": 223}}}]}, {"ruleId": "MINED001", "level": "error", "message": {"text": "[MINED001] Bare Except Pass: except: pass or except Exception: pass \u2014 silently swallows everything including KeyboardInterrupt and bugs."}, "properties": {"repobilityId": 468144, "scanner": "repobility-threat-engine", "fingerprint": "52bfce0240e1f16e9a372a295e40be1cc930157c29f8440d014e6f51522de44a", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "bare-except-pass", "owasp": null, "cwe_ids": ["CWE-755"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347744+00:00", "triaged_in_corpus": 15, "observations_count": 1550824, "ai_coder_pattern_id": 6}, "scanner": "repobility-threat-engine", "correlation_key": "fp|52bfce0240e1f16e9a372a295e40be1cc930157c29f8440d014e6f51522de44a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/command_menu.py"}, "region": {"startLine": 166}}}]}, {"ruleId": "MINED001", "level": "error", "message": {"text": "[MINED001] Bare Except Pass: except: pass or except Exception: pass \u2014 silently swallows everything including KeyboardInterrupt and bugs."}, "properties": {"repobilityId": 468143, "scanner": "repobility-threat-engine", "fingerprint": "ee89be43ca9af60fbbceea8acc98ccd345b9c088e7771e49b812ca4976292bb2", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "bare-except-pass", "owasp": null, "cwe_ids": ["CWE-755"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347744+00:00", "triaged_in_corpus": 15, "observations_count": 1550824, "ai_coder_pattern_id": 6}, "scanner": "repobility-threat-engine", "correlation_key": "fp|ee89be43ca9af60fbbceea8acc98ccd345b9c088e7771e49b812ca4976292bb2"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/ascii_art.py"}, "region": {"startLine": 57}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "Phantom test coverage: test_all_themes_simulate_without_error"}, "properties": {"repobilityId": 468142, "scanner": "repobility-ast-engine", "fingerprint": "86714ebc6643b1da01d75ed12ca09a91e5fdb390f774dab2865a6c49e7f8f827", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|86714ebc6643b1da01d75ed12ca09a91e5fdb390f774dab2865a6c49e7f8f827"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/test_scene.py"}, "region": {"startLine": 50}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "Phantom test coverage: test_debug_panel_draw_does_not_raise_when_visible"}, "properties": {"repobilityId": 468141, "scanner": "repobility-ast-engine", "fingerprint": "1a039b864a48ea995c711fe875f3c79173d9e40f37e2163cf9c57c9aca860323", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|1a039b864a48ea995c711fe875f3c79173d9e40f37e2163cf9c57c9aca860323"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/test_debug_panel.py"}, "region": {"startLine": 112}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "Phantom test coverage: test_debug_panel_draw_does_not_raise_when_hidden"}, "properties": {"repobilityId": 468140, "scanner": "repobility-ast-engine", "fingerprint": "2f1e5f2e121368f41a3bb568a76d5294e1b3c5ee831c1301cba22bff02b88133", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|2f1e5f2e121368f41a3bb568a76d5294e1b3c5ee831c1301cba22bff02b88133"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/test_debug_panel.py"}, "region": {"startLine": 98}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "Phantom test coverage: test_deep_signal_headless_no_error"}, "properties": {"repobilityId": 468139, "scanner": "repobility-ast-engine", "fingerprint": "72cdd211d191737aa563dafd37c3be2031e372e2ccf1d52f1db50351237a3971", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|72cdd211d191737aa563dafd37c3be2031e372e2ccf1d52f1db50351237a3971"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/test_hybrid_themes.py"}, "region": {"startLine": 121}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "Phantom test coverage: test_plasma_grid_headless_no_error"}, "properties": {"repobilityId": 468138, "scanner": "repobility-ast-engine", "fingerprint": "3dcbbaec7fe300017232d4f8f43cd1ea2236748dd42876e5ff9d48c46d8573e8", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|3dcbbaec7fe300017232d4f8f43cd1ea2236748dd42876e5ff9d48c46d8573e8"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/test_hybrid_themes.py"}, "region": {"startLine": 92}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "Phantom test coverage: test_plasma_grid_draw_background_does_not_call_draw_extras"}, "properties": {"repobilityId": 468137, "scanner": "repobility-ast-engine", "fingerprint": "36b2cebebecc98abdd5c07ee658bb53d72b42d6975ed153e9630292e5b460879", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|36b2cebebecc98abdd5c07ee658bb53d72b42d6975ed153e9630292e5b460879"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/test_hybrid_themes.py"}, "region": {"startLine": 59}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "Phantom test coverage: test_handle_bg_command_stop"}, "properties": {"repobilityId": 468136, "scanner": "repobility-ast-engine", "fingerprint": "8018fae8fdf56d2a91d0faf7b68e0acdcb492357ae8fcf15ec04f61f8e947aeb", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|8018fae8fdf56d2a91d0faf7b68e0acdcb492357ae8fcf15ec04f61f8e947aeb"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/test_bg_mode.py"}, "region": {"startLine": 873}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "Phantom test coverage: test_launch_bg_calls_auto_opacity"}, "properties": {"repobilityId": 468135, "scanner": "repobility-ast-engine", "fingerprint": "4a5c47c280fade2dacafbd0431404331b85af83d4501087d37f0736f6ed3d8e8", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|4a5c47c280fade2dacafbd0431404331b85af83d4501087d37f0736f6ed3d8e8"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/test_bg_mode.py"}, "region": {"startLine": 679}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "Phantom test coverage: test_renderer_skips_draw_background_when_background_disabled"}, "properties": {"repobilityId": 468134, "scanner": "repobility-ast-engine", "fingerprint": "968b5490b28737b420d9dd894fec3765441d9c6de61290c69b1a777ed5987fd4", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|968b5490b28737b420d9dd894fec3765441d9c6de61290c69b1a777ed5987fd4"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/test_renderer.py"}, "region": {"startLine": 131}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "Phantom test coverage: test_renderer_calls_draw_background"}, "properties": {"repobilityId": 468133, "scanner": "repobility-ast-engine", "fingerprint": "89fd569483bf67e1396dc9357241f2af5608266b005aac0b6cb6a78ce05bcf80", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|89fd569483bf67e1396dc9357241f2af5608266b005aac0b6cb6a78ce05bcf80"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/test_renderer.py"}, "region": {"startLine": 117}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "Phantom test coverage: test_renderer_skips_stars_draw_when_stars_disabled"}, "properties": {"repobilityId": 468132, "scanner": "repobility-ast-engine", "fingerprint": "288987a0487a8b6375da35f980fcfe5dbc26f962649f0c578d0301bc2f4e6e04", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|288987a0487a8b6375da35f980fcfe5dbc26f962649f0c578d0301bc2f4e6e04"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/test_renderer.py"}, "region": {"startLine": 88}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "Phantom test coverage: test_renderer_skips_nodes_and_edges_when_nodes_disabled"}, "properties": {"repobilityId": 468131, "scanner": "repobility-ast-engine", "fingerprint": "a88b8e30b0a67b909df3b12b2cf3b4a71af019a235cac885150adc95552174cd", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|a88b8e30b0a67b909df3b12b2cf3b4a71af019a235cac885150adc95552174cd"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/test_renderer.py"}, "region": {"startLine": 74}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "Phantom test coverage: test_renderer_calls_draw_extras_when_background_enabled"}, "properties": {"repobilityId": 468130, "scanner": "repobility-ast-engine", "fingerprint": "1be93585372f25ed86b31a2143e4b9c4f5ca79475a96cf1360ec5a9012b84242", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|1be93585372f25ed86b31a2143e4b9c4f5ca79475a96cf1360ec5a9012b84242"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/test_renderer.py"}, "region": {"startLine": 61}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "Phantom test coverage: test_renderer_skips_draw_extras_when_background_disabled"}, "properties": {"repobilityId": 468129, "scanner": "repobility-ast-engine", "fingerprint": "5357c281dac4d7fb02fd7e490253047bf04ca9ed5ae02483f8e4d7ff206abc3a", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|5357c281dac4d7fb02fd7e490253047bf04ca9ed5ae02483f8e4d7ff206abc3a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/test_renderer.py"}, "region": {"startLine": 48}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "Phantom test coverage: test_fractal_engine_draw_extras_no_attribute_error"}, "properties": {"repobilityId": 468128, "scanner": "repobility-ast-engine", "fingerprint": "e3a12b5ae1707dc417cfca79fd56ca71931631dce6dd01220078a324a2d84347", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|e3a12b5ae1707dc417cfca79fd56ca71931631dce6dd01220078a324a2d84347"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/test_themes.py"}, "region": {"startLine": 66}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "Phantom test coverage: test_handle_crash_safety"}, "properties": {"repobilityId": 468127, "scanner": "repobility-ast-engine", "fingerprint": "0644613ffc9f8ef93eaee0a3e3a2979e2394750547412f635de572535ba65ef3", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|0644613ffc9f8ef93eaee0a3e3a2979e2394750547412f635de572535ba65ef3"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/test_hook_handler.py"}, "region": {"startLine": 280}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "Phantom test coverage: test_handle_does_not_launch_wrong_conditions"}, "properties": {"repobilityId": 468126, "scanner": "repobility-ast-engine", "fingerprint": "c5542bc9d8513f7dd869361843686d67acb01583b785327cdf7fb47ed43b1436", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|c5542bc9d8513f7dd869361843686d67acb01583b785327cdf7fb47ed43b1436"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/test_hook_handler.py"}, "region": {"startLine": 232}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "Phantom test coverage: test_framebuffer_blit_curses_error_safe"}, "properties": {"repobilityId": 468125, "scanner": "repobility-ast-engine", "fingerprint": "948415975402d14359e4587eb31ef0e71ff1781cbab99dc425c94be49d6d19e1", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|948415975402d14359e4587eb31ef0e71ff1781cbab99dc425c94be49d6d19e1"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/test_buffer.py"}, "region": {"startLine": 117}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "Phantom test coverage: test_live_delegate_polls_events"}, "properties": {"repobilityId": 468124, "scanner": "repobility-ast-engine", "fingerprint": "88f39281dbe95a49dde1eb87888ad2f10de21db19b3e574a2a691169cb5b707b", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|88f39281dbe95a49dde1eb87888ad2f10de21db19b3e574a2a691169cb5b707b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/test_overlay.py"}, "region": {"startLine": 41}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "Phantom test coverage: test_gallery_delegate_steps_state"}, "properties": {"repobilityId": 468123, "scanner": "repobility-ast-engine", "fingerprint": "7c55671e8cdf42917682ae0c0944cfa704655c58a28d85c5af5f1656eddef3a8", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|7c55671e8cdf42917682ae0c0944cfa704655c58a28d85c5af5f1656eddef3a8"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/test_overlay.py"}, "region": {"startLine": 24}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "Phantom test coverage: test_renderer_draws_streaks"}, "properties": {"repobilityId": 468122, "scanner": "repobility-ast-engine", "fingerprint": "d6401ff4010b4ba5979c4b5d5954fb1ec4c2b20d3d604cf797a8dd63cf523226", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|d6401ff4010b4ba5979c4b5d5954fb1ec4c2b20d3d604cf797a8dd63cf523226"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/test_phase3_effects.py"}, "region": {"startLine": 279}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "Phantom test coverage: test_renderer_calls_postfx_in_draw"}, "properties": {"repobilityId": 468121, "scanner": "repobility-ast-engine", "fingerprint": "b976d34cd756749874bd0cf4cc92c27f73814d61f84dfd26c4ecc76c7968fc38", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|b976d34cd756749874bd0cf4cc92c27f73814d61f84dfd26c4ecc76c7968fc38"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/test_postfx.py"}, "region": {"startLine": 308}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "Phantom test coverage: test_force_disabled_when_strength_zero"}, "properties": {"repobilityId": 468120, "scanner": "repobility-ast-engine", "fingerprint": "2a9e61c570fd37bc86a5de4f2918af2c05699f4413fb6b930210d8fc4e96ed0d", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|2a9e61c570fd37bc86a5de4f2918af2c05699f4413fb6b930210d8fc4e96ed0d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/test_postfx.py"}, "region": {"startLine": 234}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "Phantom test coverage: test_echo_disabled_when_zero_frames"}, "properties": {"repobilityId": 468119, "scanner": "repobility-ast-engine", "fingerprint": "d96b3bbaed035daaa66c6250a31a11750a2d96e6cfa55364dd6c5103988c3bc9", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|d96b3bbaed035daaa66c6250a31a11750a2d96e6cfa55364dd6c5103988c3bc9"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/test_postfx.py"}, "region": {"startLine": 77}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "Phantom test coverage: test_void_ignores_out_of_bounds"}, "properties": {"repobilityId": 468118, "scanner": "repobility-ast-engine", "fingerprint": "392e031def603e043d3a2921cd8572f38700a5616f66bcd6170da4e447bb2c65", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|392e031def603e043d3a2921cd8572f38700a5616f66bcd6170da4e447bb2c65"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/test_postfx.py"}, "region": {"startLine": 68}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.vy` used but never assigned in __init__"}, "properties": {"repobilityId": 468113, "scanner": "repobility-ast-engine", "fingerprint": "1a860bf6695157420caa70a03fdf56db889cd1143a5ded3c88090dd182a70324", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|1a860bf6695157420caa70a03fdf56db889cd1143a5ded3c88090dd182a70324"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "demo_video.py"}, "region": {"startLine": 570}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.vx` used but never assigned in __init__"}, "properties": {"repobilityId": 468112, "scanner": "repobility-ast-engine", "fingerprint": "8ba0f04ea1b705b391b2577a5f868e70403fe159efb243adb0a10b93b5a8fded", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|8ba0f04ea1b705b391b2577a5f868e70403fe159efb243adb0a10b93b5a8fded"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "demo_video.py"}, "region": {"startLine": 570}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.y` used but never assigned in __init__"}, "properties": {"repobilityId": 468111, "scanner": "repobility-ast-engine", "fingerprint": "f4b39d5462f16a3c9660b599597f2afdcce926ed9c2a7bde3e8867b77ca7d735", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|f4b39d5462f16a3c9660b599597f2afdcce926ed9c2a7bde3e8867b77ca7d735"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "demo_video.py"}, "region": {"startLine": 569}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.x` used but never assigned in __init__"}, "properties": {"repobilityId": 468110, "scanner": "repobility-ast-engine", "fingerprint": "6fb8c32265b3e81e55ed86fac318192a49aad52d12869a65e0cb4f36d4151589", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|6fb8c32265b3e81e55ed86fac318192a49aad52d12869a65e0cb4f36d4151589"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "demo_video.py"}, "region": {"startLine": 568}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.omega` used but never assigned in __init__"}, "properties": {"repobilityId": 468109, "scanner": "repobility-ast-engine", "fingerprint": "88290dce6c17ebd412bea6520967d51daf870597b6ab64bc5e10dd36e3ba8184", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|88290dce6c17ebd412bea6520967d51daf870597b6ab64bc5e10dd36e3ba8184"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "demo_video.py"}, "region": {"startLine": 567}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.angle` used but never assigned in __init__"}, "properties": {"repobilityId": 468108, "scanner": "repobility-ast-engine", "fingerprint": "2660ab330ecf6414a80f931f009194211afd358e0453a9cb6c535411958fac12", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|2660ab330ecf6414a80f931f009194211afd358e0453a9cb6c535411958fac12"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "demo_video.py"}, "region": {"startLine": 566}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.radius` used but never assigned in __init__"}, "properties": {"repobilityId": 468107, "scanner": "repobility-ast-engine", "fingerprint": "bfdfb222806756988857944a1900a48ad88a6579437e66d5cc36647f85dc5033", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|bfdfb222806756988857944a1900a48ad88a6579437e66d5cc36647f85dc5033"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "demo_video.py"}, "region": {"startLine": 565}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.cy` used but never assigned in __init__"}, "properties": {"repobilityId": 468106, "scanner": "repobility-ast-engine", "fingerprint": "2db5ee117858904e182dc358893587f36e964a01cad90ee0706828e8d89c9a91", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|2db5ee117858904e182dc358893587f36e964a01cad90ee0706828e8d89c9a91"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "demo_video.py"}, "region": {"startLine": 564}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.cx` used but never assigned in __init__"}, "properties": {"repobilityId": 468105, "scanner": "repobility-ast-engine", "fingerprint": "15a2e567e35b7f2c82bdd48dc7ee648c137ce18a295b7f3b2d8700cd59769aa7", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|15a2e567e35b7f2c82bdd48dc7ee648c137ce18a295b7f3b2d8700cd59769aa7"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "demo_video.py"}, "region": {"startLine": 563}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.cp` used but never assigned in __init__"}, "properties": {"repobilityId": 468104, "scanner": "repobility-ast-engine", "fingerprint": "61dceee11233b384137b89f398163fbdb1f0af2a791a3f35ceeb5b5e6a47de72", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|61dceee11233b384137b89f398163fbdb1f0af2a791a3f35ceeb5b5e6a47de72"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "demo_video.py"}, "region": {"startLine": 610}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.char` used but never assigned in __init__"}, "properties": {"repobilityId": 468103, "scanner": "repobility-ast-engine", "fingerprint": "32134dec636e554f10e0b531b0a52dfbb0d688c8393cc691d70a3af96e46c52a", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|32134dec636e554f10e0b531b0a52dfbb0d688c8393cc691d70a3af96e46c52a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "demo_video.py"}, "region": {"startLine": 560}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.life` used but never assigned in __init__"}, "properties": {"repobilityId": 468102, "scanner": "repobility-ast-engine", "fingerprint": "9e3c5f0568736769cb1bbb6399d22b7112231b417585507bd3da91da5fc86e4c", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|9e3c5f0568736769cb1bbb6399d22b7112231b417585507bd3da91da5fc86e4c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "demo_video.py"}, "region": {"startLine": 559}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.vy` used but never assigned in __init__"}, "properties": {"repobilityId": 468101, "scanner": "repobility-ast-engine", "fingerprint": "b088986dbc3d7b32664fc3383a700402ce357970fa862babf9f98ce2b32e4475", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|b088986dbc3d7b32664fc3383a700402ce357970fa862babf9f98ce2b32e4475"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "demo_video.py"}, "region": {"startLine": 558}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.vx` used but never assigned in __init__"}, "properties": {"repobilityId": 468100, "scanner": "repobility-ast-engine", "fingerprint": "b360c6b53fb3bd7968e6715045bb441fc8465e369243c907fa06016d6ca95ec3", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|b360c6b53fb3bd7968e6715045bb441fc8465e369243c907fa06016d6ca95ec3"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "demo_video.py"}, "region": {"startLine": 557}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.y` used but never assigned in __init__"}, "properties": {"repobilityId": 468099, "scanner": "repobility-ast-engine", "fingerprint": "1a8d3dfcb328fadd86add2040a4eed8d50edf98881ea0b307de0c73b08b72ffd", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|1a8d3dfcb328fadd86add2040a4eed8d50edf98881ea0b307de0c73b08b72ffd"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "demo_video.py"}, "region": {"startLine": 556}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.x` used but never assigned in __init__"}, "properties": {"repobilityId": 468098, "scanner": "repobility-ast-engine", "fingerprint": "88821f6ae3d6efbe4576494db04b37c6e950adb8341823b92ad1f197a0b9800d", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|88821f6ae3d6efbe4576494db04b37c6e950adb8341823b92ad1f197a0b9800d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "demo_video.py"}, "region": {"startLine": 555}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.cp` used but never assigned in __init__"}, "properties": {"repobilityId": 468097, "scanner": "repobility-ast-engine", "fingerprint": "86fa2b8f85a670a88ea6510fb1c9e8c72f2f6217c849116181e35c7122ac8b2c", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|86fa2b8f85a670a88ea6510fb1c9e8c72f2f6217c849116181e35c7122ac8b2c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "demo_video.py"}, "region": {"startLine": 608}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.life` used but never assigned in __init__"}, "properties": {"repobilityId": 468096, "scanner": "repobility-ast-engine", "fingerprint": "8ad1bb3a7f45704b0ffebbb86adbfc068435678d57f49af457bc1597f2f6e251", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|8ad1bb3a7f45704b0ffebbb86adbfc068435678d57f49af457bc1597f2f6e251"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "demo_video.py"}, "region": {"startLine": 552}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.vy` used but never assigned in __init__"}, "properties": {"repobilityId": 468095, "scanner": "repobility-ast-engine", "fingerprint": "8e7d482fd969c267379d8ba31a32d2970cabdaa66a806ef0e69e489754d6cb04", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|8e7d482fd969c267379d8ba31a32d2970cabdaa66a806ef0e69e489754d6cb04"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "demo_video.py"}, "region": {"startLine": 551}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.vx` used but never assigned in __init__"}, "properties": {"repobilityId": 468094, "scanner": "repobility-ast-engine", "fingerprint": "12776af2192706154711b7af58922eb20e6f4b586c51b8ffc36473dfdc491ead", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|12776af2192706154711b7af58922eb20e6f4b586c51b8ffc36473dfdc491ead"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "demo_video.py"}, "region": {"startLine": 550}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.y` used but never assigned in __init__"}, "properties": {"repobilityId": 468093, "scanner": "repobility-ast-engine", "fingerprint": "471490cc25eb31e7594cd58ad068258291874a1032f33493c61bc439265db4df", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|471490cc25eb31e7594cd58ad068258291874a1032f33493c61bc439265db4df"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "demo_video.py"}, "region": {"startLine": 547}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.x` used but never assigned in __init__"}, "properties": {"repobilityId": 468092, "scanner": "repobility-ast-engine", "fingerprint": "3a4aa0ade67efa7c962616d74d22f6dc267690f403b757d133af6fc0b1eb5a1c", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|3a4aa0ade67efa7c962616d74d22f6dc267690f403b757d133af6fc0b1eb5a1c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "demo_video.py"}, "region": {"startLine": 546}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.bold` used but never assigned in __init__"}, "properties": {"repobilityId": 468091, "scanner": "repobility-ast-engine", "fingerprint": "abb15264bb343ad429c451ea0c34a50877dd3df86b893c11d7c42c0790002a7c", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|abb15264bb343ad429c451ea0c34a50877dd3df86b893c11d7c42c0790002a7c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "demo_video.py"}, "region": {"startLine": 617}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.char` used but never assigned in __init__"}, "properties": {"repobilityId": 468090, "scanner": "repobility-ast-engine", "fingerprint": "30acdcf49a30dce20b045981705b44448c7e5f3ab3d312c38a64ab493e1151c8", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|30acdcf49a30dce20b045981705b44448c7e5f3ab3d312c38a64ab493e1151c8"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "demo_video.py"}, "region": {"startLine": 530}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.age` used but never assigned in __init__"}, "properties": {"repobilityId": 468089, "scanner": "repobility-ast-engine", "fingerprint": "1367ddd0075cf9e19743f917dd64cbb751a9502233c3b2b32a6e2777ad76ecf2", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|1367ddd0075cf9e19743f917dd64cbb751a9502233c3b2b32a6e2777ad76ecf2"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "demo_video.py"}, "region": {"startLine": 528}}}]}, {"ruleId": "scanner-1887f355f415b341", "level": "note", "message": {"text": "Possibly dead Python function: big_text_width"}, "properties": {"repobilityId": "328d0174589acf7b", "scanner": "scanner-primary", "fingerprint": "1887f355f415b341", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "demo_video.py:79"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-43f9b5316196a95d", "level": "note", "message": {"text": "Possibly dead Python function: draw_black_strip"}, "properties": {"repobilityId": "e1363492337d51c1", "scanner": "scanner-primary", "fingerprint": "43f9b5316196a95d", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "demo_video.py:371"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b15b899865682a28", "level": "note", "message": {"text": "Possibly dead Python function: section_feature_highlights"}, "properties": {"repobilityId": "325a69112c4dc8f0", "scanner": "scanner-primary", "fingerprint": "b15b899865682a28", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "demo_video.py:996"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7d386e5f922dab84", "level": "note", "message": {"text": "Possibly dead Python function: run_demo"}, "properties": {"repobilityId": "299b39989ca5260c", "scanner": "scanner-primary", "fingerprint": "7d386e5f922dab84", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "demo_video.py:1191"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-582de552ab8839b5", "level": "note", "message": {"text": "Possibly dead Python function: diagnose_terminal_opacity"}, "properties": {"repobilityId": "c8b2a6838774a730", "scanner": "scanner-primary", "fingerprint": "582de552ab8839b5", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/bg_mode.py:193"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cf5089b21622fb86", "level": "note", "message": {"text": "Possibly dead Python function: run_gallery_wrapper"}, "properties": {"repobilityId": "15c9f1688e7becd0", "scanner": "scanner-primary", "fingerprint": "cf5089b21622fb86", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/cli.py:297"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-87cbe0e235510665", "level": "note", "message": {"text": "Possibly dead Python function: run_curses"}, "properties": {"repobilityId": "3ff408ee2168b43f", "scanner": "scanner-primary", "fingerprint": "87cbe0e235510665", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/cli.py:460"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-53eccafdfbc7178a", "level": "note", "message": {"text": "Possibly dead Python function: registered_names"}, "properties": {"repobilityId": "ac3ae1bf129438cf", "scanner": "scanner-primary", "fingerprint": "53eccafdfbc7178a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/theme_plugins/__init__.py:27"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-302e93fa85b9dd2f", "level": "warning", "message": {"text": "SkillSpector AST4 (behavioral-ast) in hermes_neurovision/app.py"}, "properties": {"repobilityId": "e3e761e59d5aaab2", "scanner": "scanner-primary", "fingerprint": "302e93fa85b9dd2f", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST4", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/app.py"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-214c7b1886356e95", "level": "warning", "message": {"text": "SkillSpector AST4 (behavioral-ast) in hermes_neurovision/bg_mode.py"}, "properties": {"repobilityId": "10b74f60c1d202c6", "scanner": "scanner-primary", "fingerprint": "214c7b1886356e95", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST4", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/bg_mode.py"}, "region": {"startLine": 645}}}]}, {"ruleId": "scanner-214c7b1886356e95", "level": "warning", "message": {"text": "SkillSpector AST4 (behavioral-ast) in hermes_neurovision/bg_mode.py"}, "properties": {"repobilityId": "10b74f60c1d202c6", "scanner": "scanner-primary", "fingerprint": "214c7b1886356e95", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST4", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/bg_mode.py"}, "region": {"startLine": 182}}}]}, {"ruleId": "scanner-214c7b1886356e95", "level": "warning", "message": {"text": "SkillSpector AST4 (behavioral-ast) in hermes_neurovision/bg_mode.py"}, "properties": {"repobilityId": "10b74f60c1d202c6", "scanner": "scanner-primary", "fingerprint": "214c7b1886356e95", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST4", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/bg_mode.py"}, "region": {"startLine": 231}}}]}, {"ruleId": "scanner-214c7b1886356e95", "level": "warning", "message": {"text": "SkillSpector AST4 (behavioral-ast) in hermes_neurovision/bg_mode.py"}, "properties": {"repobilityId": "10b74f60c1d202c6", "scanner": "scanner-primary", "fingerprint": "214c7b1886356e95", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST4", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/bg_mode.py"}, "region": {"startLine": 284}}}]}, {"ruleId": "scanner-214c7b1886356e95", "level": "warning", "message": {"text": "SkillSpector AST4 (behavioral-ast) in hermes_neurovision/bg_mode.py"}, "properties": {"repobilityId": "10b74f60c1d202c6", "scanner": "scanner-primary", "fingerprint": "214c7b1886356e95", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST4", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/bg_mode.py"}, "region": {"startLine": 306}}}]}, {"ruleId": "scanner-214c7b1886356e95", "level": "warning", "message": {"text": "SkillSpector AST4 (behavioral-ast) in hermes_neurovision/bg_mode.py"}, "properties": {"repobilityId": "10b74f60c1d202c6", "scanner": "scanner-primary", "fingerprint": "214c7b1886356e95", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST4", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/bg_mode.py"}, "region": {"startLine": 321}}}]}, {"ruleId": "scanner-214c7b1886356e95", "level": "warning", "message": {"text": "SkillSpector AST4 (behavioral-ast) in hermes_neurovision/bg_mode.py"}, "properties": {"repobilityId": "10b74f60c1d202c6", "scanner": "scanner-primary", "fingerprint": "214c7b1886356e95", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST4", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/bg_mode.py"}, "region": {"startLine": 345}}}]}, {"ruleId": "scanner-214c7b1886356e95", "level": "warning", "message": {"text": "SkillSpector AST4 (behavioral-ast) in hermes_neurovision/bg_mode.py"}, "properties": {"repobilityId": "10b74f60c1d202c6", "scanner": "scanner-primary", "fingerprint": "214c7b1886356e95", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST4", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/bg_mode.py"}, "region": {"startLine": 388}}}]}, {"ruleId": "scanner-214c7b1886356e95", "level": "warning", "message": {"text": "SkillSpector AST4 (behavioral-ast) in hermes_neurovision/bg_mode.py"}, "properties": {"repobilityId": "10b74f60c1d202c6", "scanner": "scanner-primary", "fingerprint": "214c7b1886356e95", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST4", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/bg_mode.py"}, "region": {"startLine": 482}}}]}, {"ruleId": "scanner-214c7b1886356e95", "level": "warning", "message": {"text": "SkillSpector AST4 (behavioral-ast) in hermes_neurovision/bg_mode.py"}, "properties": {"repobilityId": "10b74f60c1d202c6", "scanner": "scanner-primary", "fingerprint": "214c7b1886356e95", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST4", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/bg_mode.py"}, "region": {"startLine": 212}}}]}, {"ruleId": "scanner-1fee55e13ef7822a", "level": "error", "message": {"text": "SkillSpector AST1 (behavioral-ast) in hermes_neurovision/import_theme.py"}, "properties": {"repobilityId": "c308f0fb381d7aa1", "scanner": "scanner-primary", "fingerprint": "1fee55e13ef7822a", "layer": "security", "severity": "high", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST1", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/import_theme.py"}, "region": {"startLine": 277}}}]}, {"ruleId": "scanner-d49429a90302b02c", "level": "warning", "message": {"text": "SkillSpector AST4 (behavioral-ast) in hermes_neurovision/launcher.py"}, "properties": {"repobilityId": "9cf6c9aa1272379d", "scanner": "scanner-primary", "fingerprint": "d49429a90302b02c", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST4", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/launcher.py"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-d49429a90302b02c", "level": "warning", "message": {"text": "SkillSpector AST4 (behavioral-ast) in hermes_neurovision/launcher.py"}, "properties": {"repobilityId": "9cf6c9aa1272379d", "scanner": "scanner-primary", "fingerprint": "d49429a90302b02c", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST4", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/launcher.py"}, "region": {"startLine": 83}}}]}, {"ruleId": "scanner-d49429a90302b02c", "level": "warning", "message": {"text": "SkillSpector AST4 (behavioral-ast) in hermes_neurovision/launcher.py"}, "properties": {"repobilityId": "9cf6c9aa1272379d", "scanner": "scanner-primary", "fingerprint": "d49429a90302b02c", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST4", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/launcher.py"}, "region": {"startLine": 106}}}]}, {"ruleId": "scanner-d49429a90302b02c", "level": "warning", "message": {"text": "SkillSpector AST4 (behavioral-ast) in hermes_neurovision/launcher.py"}, "properties": {"repobilityId": "9cf6c9aa1272379d", "scanner": "scanner-primary", "fingerprint": "d49429a90302b02c", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST4", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/launcher.py"}, "region": {"startLine": 120}}}]}, {"ruleId": "scanner-d49429a90302b02c", "level": "warning", "message": {"text": "SkillSpector AST4 (behavioral-ast) in hermes_neurovision/launcher.py"}, "properties": {"repobilityId": "9cf6c9aa1272379d", "scanner": "scanner-primary", "fingerprint": "d49429a90302b02c", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST4", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/launcher.py"}, "region": {"startLine": 134}}}]}, {"ruleId": "scanner-d49429a90302b02c", "level": "warning", "message": {"text": "SkillSpector AST4 (behavioral-ast) in hermes_neurovision/launcher.py"}, "properties": {"repobilityId": "9cf6c9aa1272379d", "scanner": "scanner-primary", "fingerprint": "d49429a90302b02c", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST4", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/launcher.py"}, "region": {"startLine": 148}}}]}, {"ruleId": "scanner-d49429a90302b02c", "level": "warning", "message": {"text": "SkillSpector AST4 (behavioral-ast) in hermes_neurovision/launcher.py"}, "properties": {"repobilityId": "9cf6c9aa1272379d", "scanner": "scanner-primary", "fingerprint": "d49429a90302b02c", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST4", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/launcher.py"}, "region": {"startLine": 61}}}]}, {"ruleId": "scanner-74fed6f00fe1660d", "level": "error", "message": {"text": "SkillSpector AST5 (behavioral-ast) in hermes_neurovision/overlay.py"}, "properties": {"repobilityId": "dcfb322de4258366", "scanner": "scanner-primary", "fingerprint": "74fed6f00fe1660d", "layer": "security", "severity": "high", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST5", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/overlay.py"}, "region": {"startLine": 331}}}]}, {"ruleId": "scanner-9197a41dd834b829", "level": "warning", "message": {"text": "SkillSpector AST4 (behavioral-ast) in hermes_neurovision/sound.py"}, "properties": {"repobilityId": "f9eabcf9119342b0", "scanner": "scanner-primary", "fingerprint": "9197a41dd834b829", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST4", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/sound.py"}, "region": {"startLine": 100}}}]}, {"ruleId": "scanner-9197a41dd834b829", "level": "warning", "message": {"text": "SkillSpector AST4 (behavioral-ast) in hermes_neurovision/sound.py"}, "properties": {"repobilityId": "f9eabcf9119342b0", "scanner": "scanner-primary", "fingerprint": "9197a41dd834b829", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST4", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/sound.py"}, "region": {"startLine": 112}}}]}, {"ruleId": "scanner-e5a6355a5d1e7619", "level": "warning", "message": {"text": "SkillSpector AST4 (behavioral-ast) in hermes_neurovision/sources/docker_tasks.py"}, "properties": {"repobilityId": "a930f9e3f19ac36c", "scanner": "scanner-primary", "fingerprint": "e5a6355a5d1e7619", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST4", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/sources/docker_tasks.py"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-be8f29fad4a23456", "level": "warning", "message": {"text": "SkillSpector AST4 (behavioral-ast) in hermes_neurovision/sources/hook_handler.py"}, "properties": {"repobilityId": "ad5e52663b732363", "scanner": "scanner-primary", "fingerprint": "be8f29fad4a23456", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST4", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/sources/hook_handler.py"}, "region": {"startLine": 104}}}]}, {"ruleId": "scanner-be8f29fad4a23456", "level": "warning", "message": {"text": "SkillSpector AST4 (behavioral-ast) in hermes_neurovision/sources/hook_handler.py"}, "properties": {"repobilityId": "ad5e52663b732363", "scanner": "scanner-primary", "fingerprint": "be8f29fad4a23456", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST4", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/sources/hook_handler.py"}, "region": {"startLine": 72}}}]}, {"ruleId": "scanner-c65144f4d039f6b3", "level": "note", "message": {"text": "SkillSpector AST7 (behavioral-ast) in hermes_neurovision/sources/trajectories.py"}, "properties": {"repobilityId": "dec1ce7878921fc0", "scanner": "scanner-primary", "fingerprint": "c65144f4d039f6b3", "layer": "security", "severity": "low", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST7", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/sources/trajectories.py"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-cffbcc4259ca1b66", "level": "note", "message": {"text": "SkillSpector AST7 (behavioral-ast) in hermes_neurovision/theme_editor.py"}, "properties": {"repobilityId": "eebb3d0ed8438a4f", "scanner": "scanner-primary", "fingerprint": "cffbcc4259ca1b66", "layer": "security", "severity": "low", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST7", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/theme_editor.py"}, "region": {"startLine": 122}}}]}, {"ruleId": "scanner-0f7480abbdfe8280", "level": "warning", "message": {"text": "SkillSpector AST3 (behavioral-ast) in hermes_neurovision/theme_plugins/__init__.py"}, "properties": {"repobilityId": "a646f34ccca73baf", "scanner": "scanner-primary", "fingerprint": "0f7480abbdfe8280", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST3", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/theme_plugins/__init__.py"}, "region": {"startLine": 66}}}]}, {"ruleId": "scanner-84fda417dd181f67", "level": "warning", "message": {"text": "SkillSpector AST3 (behavioral-ast) in hermes_neurovision/theme_plugins/hybrid.py"}, "properties": {"repobilityId": "241e5e5b78038abc", "scanner": "scanner-primary", "fingerprint": "84fda417dd181f67", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST3", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/theme_plugins/hybrid.py"}, "region": {"startLine": 113}}}]}, {"ruleId": "scanner-84fda417dd181f67", "level": "warning", "message": {"text": "SkillSpector AST3 (behavioral-ast) in hermes_neurovision/theme_plugins/hybrid.py"}, "properties": {"repobilityId": "241e5e5b78038abc", "scanner": "scanner-primary", "fingerprint": "84fda417dd181f67", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST3", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/theme_plugins/hybrid.py"}, "region": {"startLine": 276}}}]}, {"ruleId": "scanner-27fae7f641d0131a", "level": "note", "message": {"text": "SkillSpector AST7 (behavioral-ast) in hermes_neurovision/tune.py"}, "properties": {"repobilityId": "e41c04e7e79c4bad", "scanner": "scanner-primary", "fingerprint": "27fae7f641d0131a", "layer": "security", "severity": "low", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST7", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/tune.py"}, "region": {"startLine": 232}}}]}, {"ruleId": "scanner-27fae7f641d0131a", "level": "note", "message": {"text": "SkillSpector AST7 (behavioral-ast) in hermes_neurovision/tune.py"}, "properties": {"repobilityId": "e41c04e7e79c4bad", "scanner": "scanner-primary", "fingerprint": "27fae7f641d0131a", "layer": "security", "severity": "low", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST7", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/tune.py"}, "region": {"startLine": 282}}}]}, {"ruleId": "scanner-27fae7f641d0131a", "level": "note", "message": {"text": "SkillSpector AST7 (behavioral-ast) in hermes_neurovision/tune.py"}, "properties": {"repobilityId": "e41c04e7e79c4bad", "scanner": "scanner-primary", "fingerprint": "27fae7f641d0131a", "layer": "security", "severity": "low", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST7", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/tune.py"}, "region": {"startLine": 303}}}]}, {"ruleId": "scanner-27fae7f641d0131a", "level": "note", "message": {"text": "SkillSpector AST7 (behavioral-ast) in hermes_neurovision/tune.py"}, "properties": {"repobilityId": "e41c04e7e79c4bad", "scanner": "scanner-primary", "fingerprint": "27fae7f641d0131a", "layer": "security", "severity": "low", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST7", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/tune.py"}, "region": {"startLine": 239}}}]}, {"ruleId": "scanner-0b970b9375298583", "level": "warning", "message": {"text": "SkillSpector AST4 (behavioral-ast) in install_helper.py"}, "properties": {"repobilityId": "da3e6af19e5fe63d", "scanner": "scanner-primary", "fingerprint": "0b970b9375298583", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST4", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "install_helper.py"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-0b970b9375298583", "level": "warning", "message": {"text": "SkillSpector AST4 (behavioral-ast) in install_helper.py"}, "properties": {"repobilityId": "da3e6af19e5fe63d", "scanner": "scanner-primary", "fingerprint": "0b970b9375298583", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST4", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "install_helper.py"}, "region": {"startLine": 86}}}]}, {"ruleId": "scanner-0b970b9375298583", "level": "warning", "message": {"text": "SkillSpector AST4 (behavioral-ast) in install_helper.py"}, "properties": {"repobilityId": "da3e6af19e5fe63d", "scanner": "scanner-primary", "fingerprint": "0b970b9375298583", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST4", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "install_helper.py"}, "region": {"startLine": 47}}}]}, {"ruleId": "scanner-a4bb209ec834670e", "level": "warning", "message": {"text": "SkillSpector AST4 (behavioral-ast) in scripts/neurovision_runner.py"}, "properties": {"repobilityId": "3d9b31831ae5ebf6", "scanner": "scanner-primary", "fingerprint": "a4bb209ec834670e", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST4", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/neurovision_runner.py"}, "region": {"startLine": 199}}}]}, {"ruleId": "scanner-6d2ee3f6c558c53a", "level": "note", "message": {"text": "SkillSpector AST7 (behavioral-ast) in tests/test_plugin_api.py"}, "properties": {"repobilityId": "6c194027db1a8989", "scanner": "scanner-primary", "fingerprint": "6d2ee3f6c558c53a", "layer": "security", "severity": "low", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST7", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/test_plugin_api.py"}, "region": {"startLine": 231}}}]}, {"ruleId": "scanner-b46646b3585c5571", "level": "note", "message": {"text": "SkillSpector AST7 (behavioral-ast) in tests/test_tune.py"}, "properties": {"repobilityId": "b9b1ef0f67ad2e6a", "scanner": "scanner-primary", "fingerprint": "b46646b3585c5571", "layer": "security", "severity": "low", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST7", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/test_tune.py"}, "region": {"startLine": 184}}}]}, {"ruleId": "scanner-b46646b3585c5571", "level": "note", "message": {"text": "SkillSpector AST7 (behavioral-ast) in tests/test_tune.py"}, "properties": {"repobilityId": "b9b1ef0f67ad2e6a", "scanner": "scanner-primary", "fingerprint": "b46646b3585c5571", "layer": "security", "severity": "low", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST7", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/test_tune.py"}, "region": {"startLine": 220}}}]}, {"ruleId": "scanner-b46646b3585c5571", "level": "note", "message": {"text": "SkillSpector AST7 (behavioral-ast) in tests/test_tune.py"}, "properties": {"repobilityId": "b9b1ef0f67ad2e6a", "scanner": "scanner-primary", "fingerprint": "b46646b3585c5571", "layer": "security", "severity": "low", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST7", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/test_tune.py"}, "region": {"startLine": 186}}}]}, {"ruleId": "scanner-b46646b3585c5571", "level": "note", "message": {"text": "SkillSpector AST7 (behavioral-ast) in tests/test_tune.py"}, "properties": {"repobilityId": "b9b1ef0f67ad2e6a", "scanner": "scanner-primary", "fingerprint": "b46646b3585c5571", "layer": "security", "severity": "low", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST7", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/test_tune.py"}, "region": {"startLine": 222}}}]}, {"ruleId": "scanner-b46646b3585c5571", "level": "note", "message": {"text": "SkillSpector AST7 (behavioral-ast) in tests/test_tune.py"}, "properties": {"repobilityId": "b9b1ef0f67ad2e6a", "scanner": "scanner-primary", "fingerprint": "b46646b3585c5571", "layer": "security", "severity": "low", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST7", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/test_tune.py"}, "region": {"startLine": 225}}}]}, {"ruleId": "scanner-1b091f8d8849644b", "level": "warning", "message": {"text": "SkillSpector TT2 (taint) in hermes_neurovision/sources/hook_handler.py"}, "properties": {"repobilityId": "279aae4eb428032c", "scanner": "scanner-primary", "fingerprint": "1b091f8d8849644b", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "taint", "TT2", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/sources/hook_handler.py"}, "region": {"startLine": 131}}}]}, {"ruleId": "scanner-fcc6fb6b023ba81e", "level": "warning", "message": {"text": "SkillSpector E3 (data-exfil) in AUTOLAUNCH.md"}, "properties": {"repobilityId": "9dbfb04af0832093", "scanner": "scanner-primary", "fingerprint": "fcc6fb6b023ba81e", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "data-exfil", "E3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "AUTOLAUNCH.md"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-1231afaf845848bc", "level": "warning", "message": {"text": "SkillSpector E3 (data-exfil) in TESTING.md"}, "properties": {"repobilityId": "1e4d169e19630975", "scanner": "scanner-primary", "fingerprint": "1231afaf845848bc", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "data-exfil", "E3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "TESTING.md"}, "region": {"startLine": 41}}}]}, {"ruleId": "scanner-f20d65053fcb0961", "level": "note", "message": {"text": "SkillSpector EA3 (excessive-agency) in CHANGELOG.md"}, "properties": {"repobilityId": "f7c57a6c2999a83c", "scanner": "scanner-primary", "fingerprint": "f20d65053fcb0961", "layer": "security", "severity": "low", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "excessive-agency", "EA3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "CHANGELOG.md"}, "region": {"startLine": 157}}}]}, {"ruleId": "scanner-f3321f3de07fb846", "level": "note", "message": {"text": "SkillSpector EA3 (excessive-agency) in LICENSE"}, "properties": {"repobilityId": "1b29968a80e56e5c", "scanner": "scanner-primary", "fingerprint": "f3321f3de07fb846", "layer": "security", "severity": "low", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "excessive-agency", "EA3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "LICENSE"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-a432f83ed4bc6594", "level": "warning", "message": {"text": "SkillSpector EA2 (excessive-agency) in hermes_neurovision/cli.py"}, "properties": {"repobilityId": "2f53b52713b5ec86", "scanner": "scanner-primary", "fingerprint": "a432f83ed4bc6594", "layer": "security", "severity": "medium", "confidence": 0.75, "tags": ["skillspector", "mcp-skill", "excessive-agency", "EA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/cli.py"}, "region": {"startLine": 68}}}]}, {"ruleId": "scanner-2cdeb5c40ecef5f5", "level": "warning", "message": {"text": "SkillSpector EA2 (excessive-agency) in hermes_neurovision/import_theme.py"}, "properties": {"repobilityId": "5912060684ae0c01", "scanner": "scanner-primary", "fingerprint": "2cdeb5c40ecef5f5", "layer": "security", "severity": "medium", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "excessive-agency", "EA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/import_theme.py"}, "region": {"startLine": 52}}}]}, {"ruleId": "scanner-701f785112a0958a", "level": "warning", "message": {"text": "SkillSpector EA2 (excessive-agency) in tests/test_export_import.py"}, "properties": {"repobilityId": "b3aa6c85f528aae1", "scanner": "scanner-primary", "fingerprint": "701f785112a0958a", "layer": "security", "severity": "medium", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "excessive-agency", "EA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/test_export_import.py"}, "region": {"startLine": 66}}}]}, {"ruleId": "scanner-53b4cc56cf717590", "level": "error", "message": {"text": "SkillSpector OH1 (output-handling) in hermes_neurovision/bg_mode.py"}, "properties": {"repobilityId": "5707a5d99056755b", "scanner": "scanner-primary", "fingerprint": "53b4cc56cf717590", "layer": "security", "severity": "high", "confidence": 0.95, "tags": ["skillspector", "mcp-skill", "output-handling", "OH1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/bg_mode.py"}, "region": {"startLine": 182}}}]}, {"ruleId": "scanner-53b4cc56cf717590", "level": "error", "message": {"text": "SkillSpector OH1 (output-handling) in hermes_neurovision/bg_mode.py"}, "properties": {"repobilityId": "5707a5d99056755b", "scanner": "scanner-primary", "fingerprint": "53b4cc56cf717590", "layer": "security", "severity": "high", "confidence": 0.95, "tags": ["skillspector", "mcp-skill", "output-handling", "OH1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/bg_mode.py"}, "region": {"startLine": 212}}}]}, {"ruleId": "scanner-53b4cc56cf717590", "level": "error", "message": {"text": "SkillSpector OH1 (output-handling) in hermes_neurovision/bg_mode.py"}, "properties": {"repobilityId": "5707a5d99056755b", "scanner": "scanner-primary", "fingerprint": "53b4cc56cf717590", "layer": "security", "severity": "high", "confidence": 0.95, "tags": ["skillspector", "mcp-skill", "output-handling", "OH1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/bg_mode.py"}, "region": {"startLine": 231}}}]}, {"ruleId": "scanner-53b4cc56cf717590", "level": "error", "message": {"text": "SkillSpector OH1 (output-handling) in hermes_neurovision/bg_mode.py"}, "properties": {"repobilityId": "5707a5d99056755b", "scanner": "scanner-primary", "fingerprint": "53b4cc56cf717590", "layer": "security", "severity": "high", "confidence": 0.95, "tags": ["skillspector", "mcp-skill", "output-handling", "OH1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/bg_mode.py"}, "region": {"startLine": 284}}}]}, {"ruleId": "scanner-53b4cc56cf717590", "level": "error", "message": {"text": "SkillSpector OH1 (output-handling) in hermes_neurovision/bg_mode.py"}, "properties": {"repobilityId": "5707a5d99056755b", "scanner": "scanner-primary", "fingerprint": "53b4cc56cf717590", "layer": "security", "severity": "high", "confidence": 0.95, "tags": ["skillspector", "mcp-skill", "output-handling", "OH1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/bg_mode.py"}, "region": {"startLine": 306}}}]}, {"ruleId": "scanner-53b4cc56cf717590", "level": "error", "message": {"text": "SkillSpector OH1 (output-handling) in hermes_neurovision/bg_mode.py"}, "properties": {"repobilityId": "5707a5d99056755b", "scanner": "scanner-primary", "fingerprint": "53b4cc56cf717590", "layer": "security", "severity": "high", "confidence": 0.95, "tags": ["skillspector", "mcp-skill", "output-handling", "OH1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/bg_mode.py"}, "region": {"startLine": 321}}}]}, {"ruleId": "scanner-53b4cc56cf717590", "level": "error", "message": {"text": "SkillSpector OH1 (output-handling) in hermes_neurovision/bg_mode.py"}, "properties": {"repobilityId": "5707a5d99056755b", "scanner": "scanner-primary", "fingerprint": "53b4cc56cf717590", "layer": "security", "severity": "high", "confidence": 0.95, "tags": ["skillspector", "mcp-skill", "output-handling", "OH1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/bg_mode.py"}, "region": {"startLine": 388}}}]}, {"ruleId": "scanner-53b4cc56cf717590", "level": "error", "message": {"text": "SkillSpector OH1 (output-handling) in hermes_neurovision/bg_mode.py"}, "properties": {"repobilityId": "5707a5d99056755b", "scanner": "scanner-primary", "fingerprint": "53b4cc56cf717590", "layer": "security", "severity": "high", "confidence": 0.95, "tags": ["skillspector", "mcp-skill", "output-handling", "OH1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/bg_mode.py"}, "region": {"startLine": 482}}}]}, {"ruleId": "scanner-5145f74c3e177243", "level": "error", "message": {"text": "SkillSpector OH1 (output-handling) in hermes_neurovision/launcher.py"}, "properties": {"repobilityId": "c133b4cbe1a5434c", "scanner": "scanner-primary", "fingerprint": "5145f74c3e177243", "layer": "security", "severity": "high", "confidence": 0.95, "tags": ["skillspector", "mcp-skill", "output-handling", "OH1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/launcher.py"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-5145f74c3e177243", "level": "error", "message": {"text": "SkillSpector OH1 (output-handling) in hermes_neurovision/launcher.py"}, "properties": {"repobilityId": "c133b4cbe1a5434c", "scanner": "scanner-primary", "fingerprint": "5145f74c3e177243", "layer": "security", "severity": "high", "confidence": 0.95, "tags": ["skillspector", "mcp-skill", "output-handling", "OH1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/launcher.py"}, "region": {"startLine": 61}}}]}, {"ruleId": "scanner-d87e574d768be3b3", "level": "error", "message": {"text": "SkillSpector OH1 (output-handling) in hermes_neurovision/sources/docker_tasks.py"}, "properties": {"repobilityId": "2c175b03f8a3d628", "scanner": "scanner-primary", "fingerprint": "d87e574d768be3b3", "layer": "security", "severity": "high", "confidence": 0.95, "tags": ["skillspector", "mcp-skill", "output-handling", "OH1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/sources/docker_tasks.py"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-802af6af2d994c51", "level": "error", "message": {"text": "SkillSpector OH1 (output-handling) in hermes_neurovision/sources/hook_handler.py"}, "properties": {"repobilityId": "475cf5a36be6f1dc", "scanner": "scanner-primary", "fingerprint": "802af6af2d994c51", "layer": "security", "severity": "high", "confidence": 0.95, "tags": ["skillspector", "mcp-skill", "output-handling", "OH1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/sources/hook_handler.py"}, "region": {"startLine": 104}}}]}, {"ruleId": "scanner-ab607d29b1012e47", "level": "warning", "message": {"text": "SkillSpector OH3 (output-handling) in hermes_neurovision/theme_plugins/hybrid.py"}, "properties": {"repobilityId": "e01a285f6444f63d", "scanner": "scanner-primary", "fingerprint": "ab607d29b1012e47", "layer": "security", "severity": "medium", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "output-handling", "OH3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/theme_plugins/hybrid.py"}, "region": {"startLine": 185}}}]}, {"ruleId": "scanner-6ce7bab908f46fcf", "level": "error", "message": {"text": "SkillSpector OH1 (output-handling) in install_helper.py"}, "properties": {"repobilityId": "0e0158a1a3457b6a", "scanner": "scanner-primary", "fingerprint": "6ce7bab908f46fcf", "layer": "security", "severity": "high", "confidence": 0.95, "tags": ["skillspector", "mcp-skill", "output-handling", "OH1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "install_helper.py"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-6ce7bab908f46fcf", "level": "error", "message": {"text": "SkillSpector OH1 (output-handling) in install_helper.py"}, "properties": {"repobilityId": "0e0158a1a3457b6a", "scanner": "scanner-primary", "fingerprint": "6ce7bab908f46fcf", "layer": "security", "severity": "high", "confidence": 0.95, "tags": ["skillspector", "mcp-skill", "output-handling", "OH1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "install_helper.py"}, "region": {"startLine": 47}}}]}, {"ruleId": "scanner-6ce7bab908f46fcf", "level": "error", "message": {"text": "SkillSpector OH1 (output-handling) in install_helper.py"}, "properties": {"repobilityId": "0e0158a1a3457b6a", "scanner": "scanner-primary", "fingerprint": "6ce7bab908f46fcf", "layer": "security", "severity": "high", "confidence": 0.95, "tags": ["skillspector", "mcp-skill", "output-handling", "OH1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "install_helper.py"}, "region": {"startLine": 86}}}]}, {"ruleId": "scanner-70d912aecaf751ce", "level": "error", "message": {"text": "SkillSpector P1 (prompt-injection) in PLAN_v0.1.3.md"}, "properties": {"repobilityId": "cea7790c304f9695", "scanner": "scanner-primary", "fingerprint": "70d912aecaf751ce", "layer": "security", "severity": "high", "confidence": 0.9, "tags": ["skillspector", "mcp-skill", "prompt-injection", "P1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "PLAN_v0.1.3.md"}, "region": {"startLine": 77}}}]}, {"ruleId": "scanner-0c08c3e4a61d1df2", "level": "warning", "message": {"text": "SkillSpector RA2 (rogue-agent) in AUTOLAUNCH.md"}, "properties": {"repobilityId": "e31c6dd90e95edea", "scanner": "scanner-primary", "fingerprint": "0c08c3e4a61d1df2", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "rogue-agent", "RA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "AUTOLAUNCH.md"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-ec5f35ece1348d99", "level": "warning", "message": {"text": "SkillSpector RA2 (rogue-agent) in CLAUDE.md"}, "properties": {"repobilityId": "957d72cf9c517a20", "scanner": "scanner-primary", "fingerprint": "ec5f35ece1348d99", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "rogue-agent", "RA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "CLAUDE.md"}, "region": {"startLine": 38}}}]}, {"ruleId": "scanner-2cb3ab7205c3b985", "level": "warning", "message": {"text": "SkillSpector RA2 (rogue-agent) in INSTALL.md"}, "properties": {"repobilityId": "074d542d75062592", "scanner": "scanner-primary", "fingerprint": "2cb3ab7205c3b985", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "rogue-agent", "RA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "INSTALL.md"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-b0ebcfb5114ece20", "level": "warning", "message": {"text": "SkillSpector RA2 (rogue-agent) in PLAN.md"}, "properties": {"repobilityId": "ff03415c3a99e1f9", "scanner": "scanner-primary", "fingerprint": "b0ebcfb5114ece20", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "rogue-agent", "RA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "PLAN.md"}, "region": {"startLine": 90}}}]}, {"ruleId": "scanner-7566285baa49c54a", "level": "warning", "message": {"text": "SkillSpector RA2 (rogue-agent) in PLAN_v0.2.0.md"}, "properties": {"repobilityId": "e122e7e657664e53", "scanner": "scanner-primary", "fingerprint": "7566285baa49c54a", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "rogue-agent", "RA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "PLAN_v0.2.0.md"}, "region": {"startLine": 90}}}]}, {"ruleId": "scanner-8c5aeedde37d2e75", "level": "warning", "message": {"text": "SkillSpector RA2 (rogue-agent) in TASKS.md"}, "properties": {"repobilityId": "54c08c6a775aafc2", "scanner": "scanner-primary", "fingerprint": "8c5aeedde37d2e75", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "rogue-agent", "RA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "TASKS.md"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-204678bebb7a2e10", "level": "warning", "message": {"text": "SkillSpector RA2 (rogue-agent) in TESTING.md"}, "properties": {"repobilityId": "b1493a5c27dbf604", "scanner": "scanner-primary", "fingerprint": "204678bebb7a2e10", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "rogue-agent", "RA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "TESTING.md"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-79294629a3d63ef3", "level": "warning", "message": {"text": "SkillSpector RA2 (rogue-agent) in hermes_neurovision/sources/HOOK.yaml"}, "properties": {"repobilityId": "3f46db2b6fee995e", "scanner": "scanner-primary", "fingerprint": "79294629a3d63ef3", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "rogue-agent", "RA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/sources/HOOK.yaml"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-5c4fd89c159bf599", "level": "warning", "message": {"text": "SkillSpector RA2 (rogue-agent) in hermes_neurovision/sources/hook_handler.py"}, "properties": {"repobilityId": "04c0ad5b59e0b8ad", "scanner": "scanner-primary", "fingerprint": "5c4fd89c159bf599", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "rogue-agent", "RA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/sources/hook_handler.py"}, "region": {"startLine": 8}}}]}, {"ruleId": "scanner-7560005ba2b9fc55", "level": "warning", "message": {"text": "SkillSpector RA2 (rogue-agent) in install_helper.py"}, "properties": {"repobilityId": "0296a2d997b14e92", "scanner": "scanner-primary", "fingerprint": "7560005ba2b9fc55", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "rogue-agent", "RA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "install_helper.py"}, "region": {"startLine": 70}}}]}, {"ruleId": "scanner-c6c30ca9c7b69e40", "level": "error", "message": {"text": "SkillSpector SC4 (supply-chain) in pyproject.toml"}, "properties": {"repobilityId": "c14f294691562be9", "scanner": "scanner-primary", "fingerprint": "c6c30ca9c7b69e40", "layer": "security", "severity": "high", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC4"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pyproject.toml"}, "region": {"startLine": 9}}}]}, {"ruleId": "scanner-e7bd96ad74532b43", "level": "error", "message": {"text": "SkillSpector P6 (prompt-injection) in hermes_neurovision/emergent/automaton.py"}, "properties": {"repobilityId": "a40d2ec9f99e2e10", "scanner": "scanner-primary", "fingerprint": "e7bd96ad74532b43", "layer": "security", "severity": "high", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "prompt-injection", "P6"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/emergent/automaton.py"}, "region": {"startLine": 90}}}]}, {"ruleId": "scanner-6723e6b021740894", "level": "error", "message": {"text": "SkillSpector TM1 (tool-misuse) in RELEASE_COMMANDS.md"}, "properties": {"repobilityId": "6fdcf5ddbb3b7f80", "scanner": "scanner-primary", "fingerprint": "6723e6b021740894", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "RELEASE_COMMANDS.md"}, "region": {"startLine": 10}}}]}, {"ruleId": "scanner-620429c99ef3e6a7", "level": "error", "message": {"text": "SkillSpector TM1 (tool-misuse) in tests/test_sources.py"}, "properties": {"repobilityId": "54759e97ee1b305f", "scanner": "scanner-primary", "fingerprint": "620429c99ef3e6a7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/test_sources.py"}, "region": {"startLine": 278}}}]}, {"ruleId": "scanner-620429c99ef3e6a7", "level": "error", "message": {"text": "SkillSpector TM1 (tool-misuse) in tests/test_sources.py"}, "properties": {"repobilityId": "54759e97ee1b305f", "scanner": "scanner-primary", "fingerprint": "620429c99ef3e6a7", "layer": "security", "severity": "high", "confidence": 0.95, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/test_sources.py"}, "region": {"startLine": 278}}}]}, {"ruleId": "scanner-0221100580213f6c", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in hermes_neurovision/import_theme.py:277"}, "properties": {"repobilityId": "063e8f78abb21573", "scanner": "scanner-primary", "fingerprint": "0221100580213f6c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hermes_neurovision/import_theme.py"}, "region": {"startLine": 277}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-bcbbb62293cb9a62", "level": "note", "message": {"text": "Very large file: demo_video.py (1223 lines)"}, "properties": {"repobilityId": "286c2ece15dc465e", "scanner": "scanner-primary", "fingerprint": "bcbbb62293cb9a62", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-cadb4ce5c418bd17", "level": "note", "message": {"text": "Very large file: hermes_neurovision/theme_plugins/legacy_v2_screens.py (2061 lines)"}, "properties": {"repobilityId": "ee6d396fbaf66f80", "scanner": "scanner-primary", "fingerprint": "cadb4ce5c418bd17", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-7f09f476ed454abd", "level": "note", "message": {"text": "Very large file: hermes_neurovision/theme_plugins/redesigned.py (2927 lines)"}, "properties": {"repobilityId": "24f21064ded40e2c", "scanner": "scanner-primary", "fingerprint": "7f09f476ed454abd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f0ef0adfedb1645b", "level": "note", "message": {"text": "Very large file: hermes_neurovision/theme_plugins/originals_v2.py (1427 lines)"}, "properties": {"repobilityId": "c8b5fb0225512955", "scanner": "scanner-primary", "fingerprint": "f0ef0adfedb1645b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ab3a4db81bb8656c", "level": "note", "message": {"text": "Very large file: hermes_neurovision/theme_plugins/nature_v2.py (1232 lines)"}, "properties": {"repobilityId": "5c9edeb50c45dda2", "scanner": "scanner-primary", "fingerprint": "ab3a4db81bb8656c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-8b51ef1817b29320", "level": "note", "message": {"text": "Very large file: hermes_neurovision/theme_plugins/attractors.py (1829 lines)"}, "properties": {"repobilityId": "a7fe0932ef59a6d8", "scanner": "scanner-primary", "fingerprint": "8b51ef1817b29320", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-57d82f68d3f16a91", "level": "note", "message": {"text": "Very large file: hermes_neurovision/theme_plugins/legacy_v2b_screens.py (2730 lines)"}, "properties": {"repobilityId": "9f2420722695bb41", "scanner": "scanner-primary", "fingerprint": "57d82f68d3f16a91", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-347b6ae69757985e", "level": "note", "message": {"text": "Very large file: hermes_neurovision/theme_plugins/ascii_fields.py (1476 lines)"}, "properties": {"repobilityId": "9df225796c669b7a", "scanner": "scanner-primary", "fingerprint": "347b6ae69757985e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-a1cce830569c0608", "level": "note", "message": {"text": "Very large file: hermes_neurovision/theme_plugins/generators.py (1272 lines)"}, "properties": {"repobilityId": "cb69595f6682be35", "scanner": "scanner-primary", "fingerprint": "a1cce830569c0608", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-b57282b71b1e7b5b", "level": "note", "message": {"text": "Very large file: hermes_neurovision/theme_plugins/spectacular.py (1627 lines)"}, "properties": {"repobilityId": "bce985aa7ee396cf", "scanner": "scanner-primary", "fingerprint": "b57282b71b1e7b5b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "8f15e99d849b8ecc", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "d66aa2a9ba070b78", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "ede207f55385fe81", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "b0e147286fb79331", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-57a913b8b97d8a89", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 install_helper.py:47"}, "properties": {"repobilityId": "f2c6c1a3b62ff783", "scanner": "scanner-primary", "fingerprint": "57a913b8b97d8a89", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-19070e34c95652bd", "level": "none", "message": {"text": "Commented-code block (6 lines) in demo_video.py:1101"}, "properties": {"repobilityId": "ff9d8dca9af91170", "scanner": "scanner-primary", "fingerprint": "19070e34c95652bd", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7c06e2780b34aade", "level": "note", "message": {"text": "Legacy-named symbol `include_legacy` in tests/test_new_features.py:20"}, "properties": {"repobilityId": "fadb84c50d161e74", "scanner": "scanner-primary", "fingerprint": "7c06e2780b34aade", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-c5b6eeb3440a14c9", "level": "note", "message": {"text": "Legacy-named symbol `include_legacy` in tests/test_cli.py:48"}, "properties": {"repobilityId": "ae5c03e060b3e564", "scanner": "scanner-primary", "fingerprint": "c5b6eeb3440a14c9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-64b057323fcbb599", "level": "note", "message": {"text": "Legacy-named symbol `ev_old` in tests/test_log_overlay.py:25"}, "properties": {"repobilityId": "2b2ad659b29f1fb4", "scanner": "scanner-primary", "fingerprint": "64b057323fcbb599", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-75a15585b123fb88", "level": "note", "message": {"text": "Legacy-named symbol `originals_v2` in scripts/neurovision_runner.py:216"}, "properties": {"repobilityId": "254a89a449a52013", "scanner": "scanner-primary", "fingerprint": "75a15585b123fb88", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-ce7e06f375a87fd1", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 hermes_neurovision/sound.py:100"}, "properties": {"repobilityId": "286f3184d3a38975", "scanner": "scanner-primary", "fingerprint": "ce7e06f375a87fd1", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-8855334cc5cf5800", "level": "note", "message": {"text": "Legacy-named symbol `toggle_legacy` in hermes_neurovision/command_menu.py:70"}, "properties": {"repobilityId": "9e33d1b73f0b846b", "scanner": "scanner-primary", "fingerprint": "8855334cc5cf5800", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-5e4f9378d44ad31c", "level": "none", "message": {"text": "Commented-code block (5 lines) in hermes_neurovision/scene.py:243"}, "properties": {"repobilityId": "3b210bb9f847b3e8", "scanner": "scanner-primary", "fingerprint": "5e4f9378d44ad31c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a0c7d1151d129044", "level": "note", "message": {"text": "Stub function `reset_timer` (body is just `pass`/`return`) \u2014 hermes_neurovision/overlay.py:50"}, "properties": {"repobilityId": "8bb396e9aecd6764", "scanner": "scanner-primary", "fingerprint": "a0c7d1151d129044", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-c5070f61ca84a2ee", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 hermes_neurovision/bg_mode.py:645"}, "properties": {"repobilityId": "4adeebcb3b7d947b", "scanner": "scanner-primary", "fingerprint": "c5070f61ca84a2ee", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-a865cd5f0b4f6998", "level": "note", "message": {"text": "Legacy-named symbol `include_legacy` in hermes_neurovision/app.py:81"}, "properties": {"repobilityId": "70c9e45b80255d5e", "scanner": "scanner-primary", "fingerprint": "a865cd5f0b4f6998", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-40f48f26fb277a51", "level": "note", "message": {"text": "Legacy-named symbol `list_legacy` in hermes_neurovision/cli.py:251"}, "properties": {"repobilityId": "e2d44a5cdd3e958a", "scanner": "scanner-primary", "fingerprint": "40f48f26fb277a51", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-050ae93887909a54", "level": "note", "message": {"text": "Legacy-named symbol `_migrate_v0_to_v1` in hermes_neurovision/import_theme.py:90"}, "properties": {"repobilityId": "4518367176aadb93", "scanner": "scanner-primary", "fingerprint": "050ae93887909a54", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-c9a929da4460df60", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 hermes_neurovision/sources/hook_handler.py:72"}, "properties": {"repobilityId": "b3f13e4fc5b52e8b", "scanner": "scanner-primary", "fingerprint": "c9a929da4460df60", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-f3dd4086b29c26df", "level": "note", "message": {"text": "Stub function `symmetry` (body is just `pass`/`return`) \u2014 hermes_neurovision/theme_plugins/mycelium.py:184"}, "properties": {"repobilityId": "97555c1c71614cf2", "scanner": "scanner-primary", "fingerprint": "f3dd4086b29c26df", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-f6a8b009acc1fc24", "level": "note", "message": {"text": "Stub function `star_glyph` (body is just `pass`/`return`) \u2014 hermes_neurovision/theme_plugins/legacy_v2_screens.py:1553"}, "properties": {"repobilityId": "18843bd1a51ce727", "scanner": "scanner-primary", "fingerprint": "f6a8b009acc1fc24", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-3b4a3fad159e1e8c", "level": "note", "message": {"text": "Legacy-named symbol `originals_v2` in hermes_neurovision/theme_plugins/__init__.py:46"}, "properties": {"repobilityId": "e1471041f8fe16a9", "scanner": "scanner-primary", "fingerprint": "3b4a3fad159e1e8c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-2bd1897eeee8ae31", "level": "note", "message": {"text": "Stub function `symmetry` (body is just `pass`/`return`) \u2014 hermes_neurovision/theme_plugins/redesigned.py:131"}, "properties": {"repobilityId": "3efccdd6999219d2", "scanner": "scanner-primary", "fingerprint": "2bd1897eeee8ae31", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-73d63dc90aa1926f", "level": "note", "message": {"text": "Legacy-named symbol `cosmic_v2` in hermes_neurovision/theme_plugins/cosmic.py:305"}, "properties": {"repobilityId": "40283f3acef190e1", "scanner": "scanner-primary", "fingerprint": "73d63dc90aa1926f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-2e5e67f9dff13811", "level": "note", "message": {"text": "Stub function `palette_shift` (body is just `pass`/`return`) \u2014 hermes_neurovision/theme_plugins/nature_v2.py:200"}, "properties": {"repobilityId": "861b4b88d86b7248", "scanner": "scanner-primary", "fingerprint": "2e5e67f9dff13811", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-b57bd1ae093f7b4f", "level": "note", "message": {"text": "Stub function `symmetry` (body is just `pass`/`return`) \u2014 hermes_neurovision/theme_plugins/attractors.py:233"}, "properties": {"repobilityId": "ce05db67a87f3651", "scanner": "scanner-primary", "fingerprint": "b57bd1ae093f7b4f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-14e2fceb81381827", "level": "note", "message": {"text": "Stub function `palette_shift` (body is just `pass`/`return`) \u2014 hermes_neurovision/theme_plugins/hybrid.py:144"}, "properties": {"repobilityId": "4c70dbf8e10df13b", "scanner": "scanner-primary", "fingerprint": "14e2fceb81381827", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-7e16328f3d086e11", "level": "note", "message": {"text": "Stub function `palette_shift` (body is just `pass`/`return`) \u2014 hermes_neurovision/theme_plugins/spectacular.py:181"}, "properties": {"repobilityId": "c8fc52e6dcfd8a63", "scanner": "scanner-primary", "fingerprint": "7e16328f3d086e11", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-6e0e0648608f5f6c", "level": "note", "message": {"text": "Stub function `star_glyph` (body is just `pass`/`return`) \u2014 hermes_neurovision/theme_plugins/originals.py:75"}, "properties": {"repobilityId": "e63d4bc2645ccbd3", "scanner": "scanner-primary", "fingerprint": "6e0e0648608f5f6c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "097884cb775972f8", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "6a6914f19e710ff8", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "bbbf4b193c813c0b", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "1e351ca378a2cbb3", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "dcb957d0d7180571", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "6c124ab41ad032d5", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "35fae6d8a5f5a7cf", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "df42aed9fd02b75c", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "3f941cf3bf9551a0", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "aead6bcbfc46d13c", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "44f0b9eec09d7427", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "f725152bc2668ef8", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "c2739aa138b154e3", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "1e5638e162064dc0", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "8ed6519f29eb821b", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-76a2f6818267a9a8", "level": "note", "message": {"text": "Near-duplicate function bodies in 8 places"}, "properties": {"repobilityId": "6b79c7e81b23137c", "scanner": "scanner-primary", "fingerprint": "76a2f6818267a9a8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "3e687d03cce52397", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-02525d39071dd2c7", "level": "note", "message": {"text": "Near-duplicate function bodies in 5 places"}, "properties": {"repobilityId": "d474a36deed27535", "scanner": "scanner-primary", "fingerprint": "02525d39071dd2c7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-02525d39071dd2c7", "level": "note", "message": {"text": "Near-duplicate function bodies in 5 places"}, "properties": {"repobilityId": "51a1622ea87333d0", "scanner": "scanner-primary", "fingerprint": "02525d39071dd2c7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-02525d39071dd2c7", "level": "note", "message": {"text": "Near-duplicate function bodies in 5 places"}, "properties": {"repobilityId": "a59303f9ee151406", "scanner": "scanner-primary", "fingerprint": "02525d39071dd2c7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}]}]}