Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo
44 of your 111 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.

Scan timing: clone 2.74s · analysis 5.97s · 2.4 MB · GitHub preflight 594ms

kalynnka/octomate

https://github.com/kalynnka/octomate.git · scanned 2026-06-25 17:45 UTC (1 month ago) · 10 languages

249 raw signals (105 security + 144 graph) 18th percentile · Python · medium (20-100K LoC)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 1 month ago · v1 · 176 actionable findings from 2 signal sources. 73 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
52.3
/100
Security checks
51
62 findings
System graph
54
77.8% cov · 114 findings
Critical
1
click to filter
Agents
10
0 votes
Crowd
0
reported
Score breakdown â 2026-05-18-v5
Component Sub-score Weight Contribution
structure_score 75.0 0.15 11.25
security_score 24.3 0.25 6.08
testing_score 100.0 0.20 20.00
documentation_score 58.0 0.15 8.70
practices_score 52.0 0.15 7.80
code_quality 60.9 0.10 6.09
Overall 1.00 59.9
Severity distribution — click a segment to filter
Active filters: severity: low × excluding tests × Reset all
Severity: Critical 1 High 40 Medium 47 Low 65 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 62 System graph 114 Crowd 0 Layer: Quality 64 Security 57 Software 40 Cicd 10 Network 3 Hardware 2
Corpus Intelligence Cross-corpus context (cohort percentile, top patterns, fix plan) is shown only on repositories you own. Sign up and connect your repo to view it.
Scan summary Repository scanned at 53.6/100 with 77.8% coverage. It contains 1634 nodes across 6 cross-layer flows, written primarily in mixed languages. Engine surfaced 144 findings — concentrated in security (69), quality (57), software (13). Risk profile is high: 0 critical, 33 high, 34 medium. Recommended next step: open the security layer findings first — that's where the highest-impact wins live.

Showing 65 of 176 actionable findings. 249 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

low Security checks cicd CI/CD security conf 0.84 Database service publishes a host port
Publishing database ports to the host increases exposure. Internal Compose networking usually only needs expose, not ports.
docker-compose.yml:97 CI/CD securitycontainers
low Security checks quality Error handling conf 0.55 ✓ Repobility Broad exception handler needs review
This handler catches Exception/BaseException. It is actionable when it swallows errors without logging, re-raising, or returning a structured error. Handlers that intentionally convert exceptions into typed error results should not be treated as high risk.
octomate/capabilities/react.py:339 Error handlingquality
low Security checks cicd CI/CD security conf 0.72 .dockerignore misses sensitive defaults
.dockerignore exists but does not cover common secret or VCS patterns.
.dockerignore CI/CD securitycontainers
low Security checks software dependencies conf 0.88 aiohttp: GHSA-2fqr-mr3j-6wp8
aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence
uv.lock
low Security checks software dependencies conf 0.88 aiohttp: GHSA-4m7w-qmgq-4wj5
aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections
uv.lock
low Security checks software dependencies conf 0.88 aiohttp: GHSA-9x8q-7h8h-wcw9
aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect
uv.lock
low Security checks software dependencies conf 0.88 aiohttp: GHSA-m6qw-4cw2-hm4m
aiohttp: CRLF injection in multipart headers
uv.lock
low Security checks cicd CI/CD security conf 0.68 App service does not wait for database health
depends_on controls startup order, but without condition: service_healthy an app can start while the database is still initializing and fail intermittently.
docker-compose.yml:111 CI/CD securitycontainers
low Security checks quality Quality conf 0.60 3 occurrences Duplicated implementation block across source files
Duplicate implementation blocks are maintenance debt. Keep them visible, but they are not a high-severity defect unless the duplicated logic is security-sensitive or drifting.
3 files, 3 locations
octomate/models/todos.py:37
octomate/tentacles/agent/inkling/base.py:99
octomate/tentacles/channel/lark/feelers/output.py:91
duplicationquality
low Security checks quality Documentation No LICENSE file
Add a LICENSE file to your repository. Use choosealicense.com to pick the right license (MIT for permissive, Apache 2.0 for patent protection, GPL for copyleft).
low Security checks software dependencies conf 0.88 python-multipart: GHSA-6jv3-5f52-599m
python-multipart: Semicolon treated as querystring field separator enables parameter smuggling
uv.lock
low Security checks software dependencies conf 0.88 python-multipart: GHSA-v9pg-7xvm-68hf
python-multipart: Negative Content-Length in parse_form buffers the entire body in memory
uv.lock
low Security checks software dependencies conf 0.88 python-multipart: GHSA-vffw-93wf-4j4q
python-multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters
uv.lock
low System graph quality Maintenance conf 1.00 98 TODO/FIXME markers
High count of TODO/FIXME/HACK markers — track them as issues so they're not forgotten.
low System graph quality Production readiness conf 1.00 Composite production-readiness gap
Multiple low-cost hardening controls are missing together: license, ci. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation.
Repo hardeningGenerated repo pattern
low System graph security Trivy conf 1.00 CVE-2026-48524: pyjwt 2.12.1 — uv.lock
python-pyjwt: PyJWT: Denial of Service via unverified JSON Web Token key IDs PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient.get_signing_key() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Since kid…
VulnCve 2026 48524
low System graph security Trivy conf 1.00 CVE-2026-50269: aiohttp 3.13.5 — uv.lock
AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ... AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers…
VulnCve 2026 50269
low System graph security Trivy conf 1.00 CVE-2026-53537: python-multipart 0.0.28 — uv.lock
Python-Multipart is a streaming multipart parser for Python. Prior to ... Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, parse_options_header parsed Content-Disposition (and Content-Type) headers with email.message.Message, which transparently applies RFC 2231/5987 …
VulnCve 2026 53537
low System graph security Trivy conf 1.00 CVE-2026-53538: python-multipart 0.0.28 — uv.lock
Python-Multipart is a streaming multipart parser for Python. Prior to ... Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, QuerystringParser treated ; as a field separator in application/x-www-form-urlencoded bodies, in addition to &. The WHATWG URL standard, modern b…
VulnCve 2026 53538
low System graph security Trivy conf 1.00 CVE-2026-53540: python-multipart 0.0.28 — uv.lock
Python-Multipart is a streaming multipart parser for Python. Prior to ... Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.31, parse_form() did not validate the Content-Length header before using it to bound its chunked read of the request body. A negative Content-Length …
VulnCve 2026 53540
low System graph security Trivy conf 1.00 CVE-2026-54275: aiohttp 3.13.5 — uv.lock
AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ... AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, the server_hostname TLS SNI check can be bypassed when an existing connection is reused. If an application makes multiple requ…
VulnCve 2026 54275
low System graph security Trivy conf 1.00 CVE-2026-54279: aiohttp 3.13.5 — uv.lock
AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ... AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, host-only cookies that are saved with CookieJar.save() and then restored later with CookieJar.load() lose their host-only stat…
VulnCve 2026 54279
low System graph security Trivy conf 1.00 CVE-2026-54280: aiohttp 3.13.5 — uv.lock
AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ... AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, payload resources are not closed correctly when a client disconnects in the middle of a write. If a payload is using an open f…
VulnCve 2026 54280
low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: ghcr.io/astral-sh/uv:python3.13-bookworm-slim
Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.
Dockerfile:1 containersPinned dependencies
low System graph security Trivy conf 1.00 DS-0026: No HEALTHCHECK defined — Dockerfile
No HEALTHCHECK defined Add HEALTHCHECK instruction in your Dockerfile Rule: DS-0026 Severity: LOW Target: Dockerfile
Misconfig
low System graph quality Agent instructions conf 1.00 Multiple root agent instruction files without precedence
The repo has multiple top-level AI-coder instruction files. Without precedence rules, different agents may follow different policies.
Governance
low System graph quality Integrity conf 1.00 Near-duplicate function bodies in 18 places
Functions with the same first-5-line body hash: octomate/tentacles/agent/base.py:run, octomate/tentacles/agent/base.py:run, octomate/tentacles/agent/base.py:run, octomate/tentacles/agent/base.py:run_stream_events This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see ht…
duplicatesduplication
low System graph quality Integrity conf 1.00 13 occurrences Near-duplicate function bodies in 2 places
Functions with the same first-5-line body hash: octomate/triage/graph.py:receptions, octomate/triage/graph.py:reception This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate.
13 occurrences
repo-level (13 hits)
duplicatesduplication
low System graph quality Integrity conf 1.00 2 occurrences Near-duplicate function bodies in 3 places
Functions with the same first-5-line body hash: octomate/triage/graph.py:channel, octomate/triage/graph.py:channel, octomate/triage/graph.py:channel This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene). Consolidate or document why they'r…
2 occurrences
repo-level (2 hits)
duplicatesduplication
low System graph quality Integrity conf 1.00 3 occurrences Near-duplicate function bodies in 4 places
Functions with the same first-5-line body hash: octomate/capabilities/react.py:run, octomate/capabilities/react.py:run, octomate/capabilities/react.py:run, octomate/capabilities/react.py:run This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hy…
3 occurrences
repo-level (3 hits)
duplicatesduplication
low System graph quality Integrity conf 1.00 Near-duplicate function bodies in 6 places
Functions with the same first-5-line body hash: octomate/triage/graph.py:run, octomate/triage/graph.py:run, octomate/triage/graph.py:run, octomate/triage/graph.py:run This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene). Consolidate or d…
duplicatesduplication
low System graph quality License conf 1.00 No license file detected
No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake.
Repo hardeningGenerated repo pattern
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `card_v2` in octomate/tentacles/channel/lark/feelers/cards.py:83
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `card_v2` in octomate/tentacles/channel/lark/feelers/output.py:207
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `files_upload_v2` in octomate/tentacles/channel/slack/ink.py:75
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `files_upload_v2` in tests/channels/slack/fakes.py:301
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `model_copy` in octomate/triage/graph.py:456
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `model_copy` in scripts/capture_inkling_events.py:164
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `model_copy` in tests/channels/lark/test_streaming.py:179
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `model_copy` in tests/channels/slack/test_streaming.py:223
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `model_copy` in tests/support/scenarios.py:268
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `model_copy` in tests/trigger/test_lark.py:125
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `model_copy` in tests/trigger/test_napcat.py:106
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `model_copy` in tests/trigger/test_slack.py:134
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `p2_im_message_receive_v1` in octomate/tentacles/channel/lark/base.py:10
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `p2_im_message_receive_v1` in octomate/tentacles/channel/lark/chromo.py:9
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `p2_im_message_receive_v1` in tests/channels/lark/test_chromo.py:7
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `p2_im_message_receive_v1` in tests/channels/lark/test_ink.py:7
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph software Dead code conf 1.00 Possibly dead Python function: ask_user_question
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
octomate/tentacles/agent/claude/base.py:268
low System graph software Dead code conf 1.00 Possibly dead Python function: card_block
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
octomate/tentacles/channel/slack/feelers/cards.py:10
low System graph software Dead code conf 1.00 Possibly dead Python function: create_app
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
main.py:30
low System graph software Dead code conf 1.00 Possibly dead Python function: from_deferred_requests
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
octomate/schemas/deferred.py:162
low System graph software Dead code conf 1.00 Possibly dead Python function: full_text
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
octomate/tentacles/channel/feelers/output.py:280
low System graph software Dead code conf 1.00 Possibly dead Python function: log_result
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
octomate/tentacles/channel/lark/base.py:166
low System graph software Dead code conf 1.00 Possibly dead Python function: native_utc
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
octomate/schemas/messages.py:48
low System graph software Dead code conf 1.00 Possibly dead Python function: process_bind_param
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
octomate/models/messages.py:32
low System graph software Dead code conf 1.00 Possibly dead Python function: run_graph
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
octomate/capabilities/react.py:321
low System graph software Dead code conf 1.00 Possibly dead Python function: segment_discriminator
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
octomate/tentacles/channel/napcat/schema.py:150
low System graph software Dead code conf 1.00 Possibly dead Python function: should_skip_tool_call
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
octomate/tentacles/channel/slack/feelers/output.py:440
low System graph software Dead code conf 1.00 Possibly dead Python function: should_skip_tool_result
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
octomate/tentacles/channel/slack/feelers/output.py:447
low System graph software Dead code conf 1.00 Possibly dead Python function: to_content_parts
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
octomate/schemas/events.py:47
low System graph quality Provenance conf 1.00 Shallow git history limits provenance confidence
The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence.
Git historyGenerated repo pattern
low System graph security Skillspector conf 0.15 2 occurrences SkillSpector TM1 (tool-misuse) in Dockerfile
rm -rf / Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns). Skill: unknown Rule: TM1 Category: tool-misuse Severity: LOW Confidence: 0.15 Remediation: Validate all tool par…
lines 3
Dockerfile:3 (2 hits)
Mcp skillTool misuseTm1
low System graph security Skillspector conf 0.15 SkillSpector TM2 (tool-misuse) in Dockerfile
&& rm - Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow. Skill: unknown Rule: TM2 Category: tool-misuse Severity: LOW Confidence: 0.15 Remediation: Limit tool chaining depth and validate the output of each tool bef…
Dockerfile:3 Mcp skillTool misuseTm2
low System graph quality Integrity conf 1.00 Stub function `upload_media` (body is just `pass`/`return`) — octomate/tentacles/channel/napcat/ink.py:63
Likely an AI scaffold that was never filled in. Remove or implement.
Empty handlerDead code
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/dcff4a50-675c-47e5-a49f-0776d8a6d870/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/dcff4a50-675c-47e5-a49f-0776d8a6d870/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.