{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "WEB003", "name": "Public web service has no security.txt", "shortDescription": {"text": "Public web service has no security.txt"}, "fullDescription": {"text": "security.txt gives researchers and customers a safe disclosure channel. Public web apps and APIs should publish it under /.well-known/security.txt."}, "properties": {"scanner": "repobility-web-presence", "category": "quality", "severity": "medium", "confidence": 0.78, "cwe": "", "owasp": ""}}, {"id": "AUC012", "name": "[AUC012] FastAPI interactive docs may be exposed by framework defaults: FastAPI exposes /docs, /redoc, and /openapi.json", "shortDescription": {"text": "[AUC012] FastAPI interactive docs may be exposed by framework defaults: FastAPI exposes /docs, /redoc, and /openapi.json by default. Public production APIs should explicitly disable those defaults, protect them behind admin authentication, "}, "fullDescription": {"text": "FastAPI exposes /docs, /redoc, and /openapi.json by default. Public production APIs should explicitly disable those defaults, protect them behind admin authentication, or publish a reviewed OpenAPI spec with declared security requirements."}, "properties": {"scanner": "repobility-access-control", "category": "auth", "severity": "medium", "confidence": 0.72, "cwe": "CWE-285", "owasp": "WSTG-AUTHZ"}}, {"id": "AUC001", "name": "[AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobilit", "shortDescription": {"text": "[AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation."}, "fullDescription": {"text": "The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation."}, "properties": {"scanner": "repobility-access-control", "category": "auth", "severity": "medium", "confidence": 0.92, "cwe": "CWE-285", "owasp": "WSTG-AUTHZ"}}, {"id": "GHSA-jq35-7prp-9v3f", "name": "pyjwt: GHSA-jq35-7prp-9v3f", "shortDescription": {"text": "pyjwt: GHSA-jq35-7prp-9v3f"}, "fullDescription": {"text": "PyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keys"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-993g-76c3-p5m4", "name": "pyjwt: GHSA-993g-76c3-p5m4", "shortDescription": {"text": "pyjwt: GHSA-993g-76c3-p5m4"}, "fullDescription": {"text": "PyJWKClient: missing scheme allowlist enables CVE-2024-21643-class SSRF + token forgery via file://, ftp://, data: schemes"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-4xgf-cpjx-pc3j", "name": "pydantic-settings: GHSA-4xgf-cpjx-pc3j", "shortDescription": {"text": "pydantic-settings: GHSA-4xgf-cpjx-pc3j"}, "fullDescription": {"text": "pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-xcgm-r5h9-7989", "name": "aiohttp: GHSA-xcgm-r5h9-7989", "shortDescription": {"text": "aiohttp: GHSA-xcgm-r5h9-7989"}, "fullDescription": {"text": "aiohttp: Incomplete websocket frame payloads bypass memory limits"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-jg22-mg44-37j8", "name": "aiohttp: GHSA-jg22-mg44-37j8", "shortDescription": {"text": "aiohttp: GHSA-jg22-mg44-37j8"}, "fullDescription": {"text": "AIOHTTP is Vulnerable to Deserialization of Untrusted Data"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-hpj7-wq8m-9hgp", "name": "aiohttp: GHSA-hpj7-wq8m-9hgp", "shortDescription": {"text": "aiohttp: GHSA-hpj7-wq8m-9hgp"}, "fullDescription": {"text": "aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-hg6j-4rv6-33pg", "name": "aiohttp: GHSA-hg6j-4rv6-33pg", "shortDescription": {"text": "aiohttp: GHSA-hg6j-4rv6-33pg"}, "fullDescription": {"text": "AIOHTTP is vulnerable to cross-origin redirect with per-request cookies"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-g3cq-j2xw-wf74", "name": "aiohttp: GHSA-g3cq-j2xw-wf74", "shortDescription": {"text": "aiohttp: GHSA-g3cq-j2xw-wf74"}, "fullDescription": {"text": "aiohttp: Unread Compressed Request Bodies Bypass client_max_size During Cleanup"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-63hw-fmq6-xxg2", "name": "aiohttp: GHSA-63hw-fmq6-xxg2", "shortDescription": {"text": "aiohttp: GHSA-63hw-fmq6-xxg2"}, "fullDescription": {"text": "aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-4fvr-rgm6-gqmc", "name": "aiohttp: GHSA-4fvr-rgm6-gqmc", "shortDescription": {"text": "aiohttp: GHSA-4fvr-rgm6-gqmc"}, "fullDescription": {"text": "aiohttp: HTTP/1 Pipelined Requests Queue Without Limit"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "DKR003", "name": "Compose service `pgadmin` image uses the latest tag", "shortDescription": {"text": "Compose service `pgadmin` image uses the latest tag"}, "fullDescription": {"text": "The latest tag is mutable and can change without a code review, producing different images from the same source."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "medium", "confidence": 0.94, "cwe": "", "owasp": ""}}, {"id": "DKC015", "name": "Database service has no healthcheck", "shortDescription": {"text": "Database service has no healthcheck"}, "fullDescription": {"text": "Compose starts dependent containers in dependency order, but it does not wait for a database to be ready unless a healthcheck is defined and dependents use service_healthy."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "DKR001", "name": "Docker final stage has no non-root USER", "shortDescription": {"text": "Docker final stage has no non-root USER"}, "fullDescription": {"text": "Docker images run as root unless the image or Dockerfile switches to a non-root user."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "medium", "confidence": 0.82, "cwe": "", "owasp": ""}}, {"id": "COMP001", "name": "[COMP001] High cognitive complexity: Function `kick` has cognitive complexity 15 (SonarSource scale). Cognitive complexi", "shortDescription": {"text": "[COMP001] High cognitive complexity: Function `kick` has cognitive complexity 15 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand \u2014 nested branches, boolean chains, and recursion all weig"}, "fullDescription": {"text": "Extract nested branches into named helper functions; flatten early-return / guard clauses; replace long if/elif chains with dispatch dicts or polymorphism. SonarQube's threshold for 'should refactor' is 15 \u2014 yours is 15."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "medium", "confidence": 0.95, "cwe": "", "owasp": ""}}, {"id": "AGT012", "name": "Agent control bridge may listen on a network interface without visible auth", "shortDescription": {"text": "Agent control bridge may listen on a network interface without visible auth"}, "fullDescription": {"text": "Agent, MCP, sidecar, and command bridge servers often start as local helpers. Binding them to 0.0.0.0 or a default all-interface listener without an authorization guard can expose tool execution or session data to the LAN."}, "properties": {"scanner": "repobility-agent-runtime", "category": "quality", "severity": "medium", "confidence": 0.72, "cwe": "", "owasp": ""}}, {"id": "MINED111", "name": "Bare except continues silently", "shortDescription": {"text": "Bare except continues silently"}, "fullDescription": {"text": "Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose."}, "properties": {"scanner": "repobility-ast-engine", "category": "quality", "severity": "medium", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "CORE_NO_CI", "name": "No CI/CD configuration found", "shortDescription": {"text": "No CI/CD configuration found"}, "fullDescription": {"text": "Add a CI/CD pipeline: create .github/workflows/ci.yml for GitHub Actions with steps to lint, test, and build on every push and pull request."}, "properties": {"scanner": "repobility-core", "category": "practices", "severity": "medium", "confidence": null, "cwe": "", "owasp": ""}}, {"id": "GHSA-vffw-93wf-4j4q", "name": "python-multipart: GHSA-vffw-93wf-4j4q", "shortDescription": {"text": "python-multipart: GHSA-vffw-93wf-4j4q"}, "fullDescription": {"text": "python-multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "low", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-v9pg-7xvm-68hf", "name": "python-multipart: GHSA-v9pg-7xvm-68hf", "shortDescription": {"text": "python-multipart: GHSA-v9pg-7xvm-68hf"}, "fullDescription": {"text": "python-multipart: Negative Content-Length in parse_form buffers the entire body in memory"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "low", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-6jv3-5f52-599m", "name": "python-multipart: GHSA-6jv3-5f52-599m", "shortDescription": {"text": "python-multipart: GHSA-6jv3-5f52-599m"}, "fullDescription": {"text": "python-multipart: Semicolon treated as querystring field separator enables parameter smuggling"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "low", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-m6qw-4cw2-hm4m", "name": "aiohttp: GHSA-m6qw-4cw2-hm4m", "shortDescription": {"text": "aiohttp: GHSA-m6qw-4cw2-hm4m"}, "fullDescription": {"text": "aiohttp: CRLF injection in multipart headers"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "low", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-9x8q-7h8h-wcw9", "name": "aiohttp: GHSA-9x8q-7h8h-wcw9", "shortDescription": {"text": "aiohttp: GHSA-9x8q-7h8h-wcw9"}, "fullDescription": {"text": "aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "low", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-4m7w-qmgq-4wj5", "name": "aiohttp: GHSA-4m7w-qmgq-4wj5", "shortDescription": {"text": "aiohttp: GHSA-4m7w-qmgq-4wj5"}, "fullDescription": {"text": "aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "low", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-2fqr-mr3j-6wp8", "name": "aiohttp: GHSA-2fqr-mr3j-6wp8", "shortDescription": {"text": "aiohttp: GHSA-2fqr-mr3j-6wp8"}, "fullDescription": {"text": "aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "low", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "DKC016", "name": "App service does not wait for database health", "shortDescription": {"text": "App service does not wait for database health"}, "fullDescription": {"text": "depends_on controls startup order, but without condition: service_healthy an app can start while the database is still initializing and fail intermittently."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "low", "confidence": 0.68, "cwe": "", "owasp": ""}}, {"id": "DKC010", "name": "Compose service lacks no-new-privileges hardening", "shortDescription": {"text": "Compose service lacks no-new-privileges hardening"}, "fullDescription": {"text": "no-new-privileges prevents processes from gaining additional privileges through setuid binaries or file capabilities."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "low", "confidence": 0.62, "cwe": "", "owasp": ""}}, {"id": "DKC006", "name": "Compose service does not declare a runtime user", "shortDescription": {"text": "Compose service does not declare a runtime user"}, "fullDescription": {"text": "If the image does not define USER internally, this service may run as root."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "low", "confidence": 0.56, "cwe": "", "owasp": ""}}, {"id": "DKR008", "name": ".dockerignore misses sensitive defaults", "shortDescription": {"text": ".dockerignore misses sensitive defaults"}, "fullDescription": {"text": ".dockerignore exists but does not cover common secret or VCS patterns."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "low", "confidence": 0.72, "cwe": "", "owasp": ""}}, {"id": "AIC003", "name": "Duplicated implementation block across source files", "shortDescription": {"text": "Duplicated implementation block across source files"}, "fullDescription": {"text": "Duplicated blocks are a common artifact when generated code is pasted or recreated instead of reused. They increase maintenance cost because every future bug fix must be found in multiple locations."}, "properties": {"scanner": "repobility-ai-code-hygiene", "category": "quality", "severity": "low", "confidence": 0.86, "cwe": "", "owasp": ""}}, {"id": "CORE_NO_LICENSE", "name": "No LICENSE file", "shortDescription": {"text": "No LICENSE file"}, "fullDescription": {"text": "Add a LICENSE file to your repository. Use choosealicense.com to pick the right license (MIT for permissive, Apache 2.0 for patent protection, GPL for copyleft)."}, "properties": {"scanner": "repobility-core", "category": "documentation", "severity": "low", "confidence": null, "cwe": "", "owasp": ""}}, {"id": "MINED050", "name": "[MINED050] Stub Only Function: Function declared but body is just pass, return None, raise NotImplementedError, or TODO ", "shortDescription": {"text": "[MINED050] Stub Only Function: Function declared but body is just pass, return None, raise NotImplementedError, or TODO comment."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-1188 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED062", "name": "[MINED062] Python Dataclass No Fields (and 5 more): Same pattern found in 5 additional files. Review if needed.", "shortDescription": {"text": "[MINED062] Python Dataclass No Fields (and 5 more): Same pattern found in 5 additional files. Review if needed."}, "fullDescription": {"text": "Review and fix per the pattern semantics."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "MINED043", "name": "[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data.", "shortDescription": {"text": "[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-319 / A02:2021 for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "AUC003", "name": "[AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby a", "shortDescription": {"text": "[AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: GET /{chat_id}."}, "fullDescription": {"text": "A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: GET /{chat_id}."}, "properties": {"scanner": "repobility-access-control", "category": "auth", "severity": "high", "confidence": 0.7, "cwe": "CWE-639", "owasp": "API1:2023 Broken Object Level Authorization"}}, {"id": "GHSA-5rvq-cxj2-64vf", "name": "python-multipart: GHSA-5rvq-cxj2-64vf", "shortDescription": {"text": "python-multipart: GHSA-5rvq-cxj2-64vf"}, "fullDescription": {"text": "python-multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "PYSEC-2026-179", "name": "pyjwt: PYSEC-2026-179", "shortDescription": {"text": "pyjwt: PYSEC-2026-179"}, "fullDescription": {"text": "PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the secret key for HMAC algorithm. This vulnerability is fixed in 2.13.0."}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "PYSEC-2026-178", "name": "pyjwt: PYSEC-2026-178", "shortDescription": {"text": "pyjwt: PYSEC-2026-178"}, "fullDescription": {"text": "PyJWT is a JSON Web Token implementation in Python. From 2.8.0 to 2.12.1, when verifying detached JWS tokens using the unencoded-payload option (\"b64\": false, RFC 7797), PyJWT performs Base64URL decoding of the compact-serialization payload segment before enforcing the detached-payload rules. For b64=false, PyJWT later discards that decoded payload and replaces it with the caller-provided detached_payload. In practice, this turns the middle segment into an attacker-controlled \u201cwork amplifier\u201d: a remote client can supply an arbitrarily large Base64URL payload segment that forces CPU work + memory allocations even if the signature is invalid. This creates an unauthenticated DoS vector against any endpoint that verifies detached JWS using PyJWT. This vulnerability is fixed in 2.13.0."}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "PYSEC-2026-177", "name": "pyjwt: PYSEC-2026-177", "shortDescription": {"text": "pyjwt: PYSEC-2026-177"}, "fullDescription": {"text": "PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient.get_signing_key() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Since kid comes from the unverified token header, an attacker can trigger unlimited outbound requests. The vulnerability surfaces only when a JWKS fetch fails; an attacker can attempt to provoke that with sustained unknown-kid traffic, but the outcome depends on upstream JWKS-endpoint behavior (rate limiting, transient errors) which is beyond the attacker's control. This vulnerability is fixed in 2.13.0."}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "PYSEC-2026-175", "name": "pyjwt: PYSEC-2026-175", "shortDescription": {"text": "pyjwt: PYSEC-2026-175"}, "fullDescription": {"text": "PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument directly to urllib.request.urlopen() which uses Python stdlib's default OpenerDirector registering HTTPHandler, HTTPSHandler, FTPHandler, FileHandler, and DataHandler. There is currently no documented option to restrict which schemes PyJWKClient will fetch. If an application's jku URL ingestion path accepts attacker-influenced URLs (e.g., from JWT header, configuration file, OAuth flow parameter), the attacker can cause PyJWKClient to read arbitrary local files via file:// (SSRF on local filesystem), cause PyJWKClient to attempt FTP / data-URI fetches (broader SSRF surface), or forge tokens that PyJWT verifies as valid. The library does not directly return non-HTTP(S) URI contents to the attacker; the chained \"plant a JWKS to forge tokens\" scenario described in the original report requires additional application-layer flaws (attacker write access to a filesystem path, untrusted jku "}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-f4xh-w4cj-qxq8", "name": "langsmith: GHSA-f4xh-w4cj-qxq8", "shortDescription": {"text": "langsmith: GHSA-f4xh-w4cj-qxq8"}, "fullDescription": {"text": "LangSmith SDK TracingMiddleware: Arbitrary server-side file read"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "PYSEC-2026-215", "name": "idna: PYSEC-2026-215", "shortDescription": {"text": "idna: PYSEC-2026-215"}, "fullDescription": {"text": "Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as `\"\\u0660\" * N` or `\"\\u30fb\" * N + \"\\u6f22\"` utilize the `valid_contexto` function prior to length rejection, and for high values of `N` will take a long time to process. This is the same issue as CVE-2024-3651, however the original remediation in 2024 was not a complete fix. A specially crafted argument to the `idna.encode()` function could consume significant resources. This may lead to a denial-of-service. Starting in version 3.14, the function rejects long inputs as soon as practicable prior to any further processing to minimize resource consumption. In version 3.15, this approach was extended to lesser used alternate functions (i.e. per-label conversions and codec support). A workaround is available. Domain names cannot exceed 253 characters in length. If thi"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-537c-gmf6-5ccf", "name": "cryptography: GHSA-537c-gmf6-5ccf", "shortDescription": {"text": "cryptography: GHSA-537c-gmf6-5ccf"}, "fullDescription": {"text": "Vulnerable OpenSSL included in cryptography wheels"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "DKC013", "name": "Database service has no persistent data volume", "shortDescription": {"text": "Database service has no persistent data volume"}, "fullDescription": {"text": "Database containers store data in the writable container layer unless a volume or bind mount is attached to the image's data directory. Recreating the container can lose state."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "high", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "DKC011", "name": "Database service publishes a host port", "shortDescription": {"text": "Database service publishes a host port"}, "fullDescription": {"text": "Publishing database ports to the host increases exposure. Internal Compose networking usually only needs expose, not ports."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "high", "confidence": 0.84, "cwe": "", "owasp": ""}}, {"id": "SEC029", "name": "[SEC029] Server-Side Request Forgery (SSRF) \u2014 outbound HTTP from user input: Outbound HTTP request to a user-controlled ", "shortDescription": {"text": "[SEC029] Server-Side Request Forgery (SSRF) \u2014 outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.254.169.254 metadata, internal Kubernetes e"}, "fullDescription": {"text": "Validate the URL against an allowlist BEFORE fetching:\n  ALLOWED = {'images.example.com', 'cdn.example.com'}\n  host = urlparse(url).hostname\n  if host not in ALLOWED: abort(400)\nOr use a server-side proxy (Imgproxy / serve-files-only-from-S3) that isolates outbound network access from the request handler.\nBlock private CIDRs explicitly: 10/8, 172.16/12, 192.168/16, 169.254/16."}, "properties": {"scanner": "repobility-threat-engine", "category": "ssrf", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED001", "name": "[MINED001] Bare Except Pass: except: pass or except Exception: pass \u2014 silently swallows everything including KeyboardInt", "shortDescription": {"text": "[MINED001] Bare Except Pass: except: pass or except Exception: pass \u2014 silently swallows everything including KeyboardInterrupt and bugs."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-755 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED118", "name": "Dockerfile FROM `ghcr.io/astral-sh/uv:python3.13-bookworm-slim` not pinned by digest", "shortDescription": {"text": "Dockerfile FROM `ghcr.io/astral-sh/uv:python3.13-bookworm-slim` not pinned by digest"}, "fullDescription": {"text": "`FROM ghcr.io/astral-sh/uv:python3.13-bookworm-slim` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potentially different. Production images should pin to `image@sha256:...` for reproducibility + supply-chain integrity."}, "properties": {"scanner": "repobility-supply-chain", "category": "dependency", "severity": "high", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "MINED112", "name": "FastAPI POST /api/chat has no auth", "shortDescription": {"text": "FastAPI POST /api/chat has no auth"}, "fullDescription": {"text": "Handler `chat` is registered with router/app.post(...) but no Depends/Security parameter is declared and no auth marker appears in the function body."}, "properties": {"scanner": "repobility-route-auth", "category": "quality", "severity": "high", "confidence": 0.8, "cwe": "", "owasp": ""}}, {"id": "MINED108", "name": "`self.octomate` used but never assigned in __init__", "shortDescription": {"text": "`self.octomate` used but never assigned in __init__"}, "fullDescription": {"text": "Method `_iter_events` of class `ClaudeCodeTentacle` reads `self.octomate`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance."}, "properties": {"scanner": "repobility-ast-engine", "category": "quality", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED106", "name": "Phantom test coverage: test_mark_action_presented_noops_for_unknown_action", "shortDescription": {"text": "Phantom test coverage: test_mark_action_presented_noops_for_unknown_action"}, "fullDescription": {"text": "Test function `test_mark_action_presented_noops_for_unknown_action` runs code but contains no assert / expect / should call \u2014 it passes regardless of behaviour. Adds line coverage without verifying anything."}, "properties": {"scanner": "repobility-ast-engine", "category": "quality", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "DKC007", "name": "Compose service contains a literal secret environment value", "shortDescription": {"text": "Compose service contains a literal secret environment value"}, "fullDescription": {"text": "Literal secrets in Compose files are committed to source and exposed through container inspection."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "critical", "confidence": 0.96, "cwe": "", "owasp": ""}}, {"id": "MINED107", "name": "Missing import: `http` used but not imported", "shortDescription": {"text": "Missing import: `http` used but not imported"}, "fullDescription": {"text": "The file uses `http.something(...)` but never imports `http`. This raises NameError at runtime the first time the line executes."}, "properties": {"scanner": "repobility-ast-engine", "category": "quality", "severity": "critical", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "scanner-4f8ab5dfe7542aa5", "name": "Possibly dead Python function: create_app", "shortDescription": {"text": "Possibly dead Python function: create_app"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-05b5880aebb4aa63", "name": "Possibly dead Python function: process_bind_param", "shortDescription": {"text": "Possibly dead Python function: process_bind_param"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6cf1015416ba832b", "name": "Possibly dead Python function: run_graph", "shortDescription": {"text": "Possibly dead Python function: run_graph"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d3358aee3ccf17c3", "name": "Possibly dead Python function: ask_user_question", "shortDescription": {"text": "Possibly dead Python function: ask_user_question"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-225f763a8759380a", "name": "Possibly dead Python function: segment_discriminator", "shortDescription": {"text": "Possibly dead Python function: segment_discriminator"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0e9cbbd8d021a8e8", "name": "Possibly dead Python function: full_text", "shortDescription": {"text": "Possibly dead Python function: full_text"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a53c9b464e8c5dfa", "name": "Possibly dead Python function: should_skip_tool_call", "shortDescription": {"text": "Possibly dead Python function: should_skip_tool_call"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c2f08b9b2ce78a0f", "name": "Possibly dead Python function: should_skip_tool_result", "shortDescription": {"text": "Possibly dead Python function: should_skip_tool_result"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a8ccb3dba40cfca6", "name": "Possibly dead Python function: card_block", "shortDescription": {"text": "Possibly dead Python function: card_block"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d5e80b330dae5519", "name": "Possibly dead Python function: log_result", "shortDescription": {"text": "Possibly dead Python function: log_result"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-56ff2ffa2769c053", "name": "Possibly dead Python function: from_deferred_requests", "shortDescription": {"text": "Possibly dead Python function: from_deferred_requests"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c259d68ad6328f7d", "name": "Possibly dead Python function: to_content_parts", "shortDescription": {"text": "Possibly dead Python function: to_content_parts"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5b53c610d64ff4d7", "name": "Possibly dead Python function: native_utc", "shortDescription": {"text": "Possibly dead Python function: native_utc"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7b1bd875f5a756b3", "name": "CVE-2026-34993: aiohttp 3.13.5 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-34993: aiohttp 3.13.5 \u2014 uv.lock"}, "fullDescription": {"text": "aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load()\n\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution. Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications. Version 3.14.0 patches the issue. If an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitize the files before loading.\n\nPackage: aiohttp\nInstalled: 3.13.5\nFixed in: 3.14.0\nSeverity: MEDIUM\nFix: Upgrade aiohttp to 3.14.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-19c6593f77847057", "name": "CVE-2026-47265: aiohttp 3.13.5 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-47265: aiohttp 3.13.5 \u2014 uv.lock"}, "fullDescription": {"text": "python-aiohttp: AIOHTTP: Information disclosure via improper handling of cookies during cross-origin redirects\n\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect. If a developer uses the `cookies` parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect. Version 3.14.0 patches the issue. If unable to upgrade, using a `Cookie` header in the `headers` parameter is not vulnerable.\n\nPackage: aiohttp\nInstalled: 3.13.5\nFixed in: 3.14.0\nSeverity: MEDIUM\nFix: Upgrade aiohttp to 3.14.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-38e2a20eca2f2493", "name": "CVE-2026-54273: aiohttp 3.13.5 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-54273: aiohttp 3.13.5 \u2014 uv.lock"}, "fullDescription": {"text": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ...\n\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, no limit was present on the number of pipelined requests that could be queued. An attacker may be able to use pipelined requests to use excessive amounts of memory, potentially leading to DoS. This vulnerability is fixed in 3.14.1.\n\nPackage: aiohttp\nInstalled: 3.13.5\nFixed in: 3.14.1\nSeverity: MEDIUM\nFix: Upgrade aiohttp to 3.14.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-58146b01331e8e00", "name": "CVE-2026-54274: aiohttp 3.13.5 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-54274: aiohttp 3.13.5 \u2014 uv.lock"}, "fullDescription": {"text": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ...\n\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if an attacker sends large incomplete websocket frame payloads, it may be possible to bypass the usual size limits on memory use. This vulnerability is fixed in 3.14.1.\n\nPackage: aiohttp\nInstalled: 3.13.5\nFixed in: 3.14.1\nSeverity: MEDIUM\nFix: Upgrade aiohttp to 3.14.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6d92e64c021d9402", "name": "CVE-2026-54276: aiohttp 3.13.5 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-54276: aiohttp 3.13.5 \u2014 uv.lock"}, "fullDescription": {"text": "aiohttp: aiohttp: Information disclosure via DigestAuthMiddleware after cross-origin redirect\n\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, DigestAuthMiddleware can send an authentication response after following a cross-origin redirect. This likely requires an open redirect vulnerability or similar on the target domain for an attacker to be able to execute. Further, the attacker is only receiving the digest, so should only be able to extract the user's credentials if the cryptography is weak or there is some kind of password reuse. This\n\nPackage: aiohttp\nInstalled: 3.13.5\nFixed in: 3.14.1\nSeverity: MEDIUM\nFix: Upgrade aiohttp to 3.14.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b7f3bfdc15e643c2", "name": "CVE-2026-54277: aiohttp 3.13.5 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-54277: aiohttp 3.13.5 \u2014 uv.lock"}, "fullDescription": {"text": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ...\n\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, it is possible to bypass the max_line_size check in parts of an HTTP request in the C parser. If using the optimised C parser (the default in pre-built wheels), then an attacker may be able to send oversized lines through the HTTP parser and use an excessive amount of memory, potentially leading to DoS. This vulnerability is fixed in 3.14.1.\n\nPackage: aiohttp\nInstalled: 3.13.5\nFixed in: 3.14.1\nSeverity: MEDIUM\nFix: Upgrade aiohttp to 3.14.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d82cda415ed63e4f", "name": "CVE-2026-54278: aiohttp 3.13.5 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-54278: aiohttp 3.13.5 \u2014 uv.lock"}, "fullDescription": {"text": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ...\n\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, during cleanup it is possible for a compressed request body to be decompressed into memory in one chunk. An attacker may be able to send a compressed payload in specific situations that could be decompressed into memory, potentially leading to DoS (a zip bomb edge case). This vulnerability is fixed in 3.14.1.\n\nPackage: aiohttp\nInstalled: 3.13.5\nFixed in: 3.14.1\nSeverity: MEDIUM\nFix: Upgrade aiohttp to 3.14.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e9846a76c6bf7076", "name": "CVE-2026-50269: aiohttp 3.13.5 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-50269: aiohttp 3.13.5 \u2014 uv.lock"}, "fullDescription": {"text": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ...\n\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request. This vulnerabi\n\nPackage: aiohttp\nInstalled: 3.13.5\nFixed in: 3.14.0\nSeverity: LOW\nFix: Upgrade aiohttp to 3.14.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-866b1585aa5f6f03", "name": "CVE-2026-54275: aiohttp 3.13.5 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-54275: aiohttp 3.13.5 \u2014 uv.lock"}, "fullDescription": {"text": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ...\n\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, the server_hostname TLS SNI check can be bypassed when an existing connection is reused. If an application makes multiple requests to the same domain, but with different per-request server_hostname parameters, then the later calls may succeed by reusing the existing connection when they should have been rejected due to the TLS SNI check. This vulnerability is fixed in 3.14.1.\n\nPackage: aiohttp\nInstalled: 3.13.5\nFixed in: 3.14.1\nSeverity: LOW\nFix: Upgrade aiohttp to 3.14.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2e147b462d40fd8b", "name": "CVE-2026-54279: aiohttp 3.13.5 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-54279: aiohttp 3.13.5 \u2014 uv.lock"}, "fullDescription": {"text": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ...\n\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, host-only cookies that are saved with CookieJar.save() and then restored later with CookieJar.load() lose their host-only status. This vulnerability is fixed in 3.14.1.\n\nPackage: aiohttp\nInstalled: 3.13.5\nFixed in: 3.14.1\nSeverity: LOW\nFix: Upgrade aiohttp to 3.14.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-80ceef5f98b6e284", "name": "CVE-2026-54280: aiohttp 3.13.5 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-54280: aiohttp 3.13.5 \u2014 uv.lock"}, "fullDescription": {"text": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ...\n\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, payload resources are not closed correctly when a client disconnects in the middle of a write. If a payload is using an open file or similar limited resource, then an attacker may be able to cause resource starvation temporarily until garbage collection or similar closes the file. This vulnerability is fixed in 3.14.1.\n\nPackage: aiohttp\nInstalled: 3.13.5\nFixed in: 3.14.1\nSeverity: LOW\nFix: Upgrade aiohttp to 3.14.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1573ce9e96f794df", "name": "GHSA-537c-gmf6-5ccf: cryptography 48.0.0 \u2014 uv.lock", "shortDescription": {"text": "GHSA-537c-gmf6-5ccf: cryptography 48.0.0 \u2014 uv.lock"}, "fullDescription": {"text": "Vulnerable OpenSSL included in cryptography wheels\n\npyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in wheels prior to cryptograph 48.01 are vulnerable to a security issue. More details about the vulnerability itself can be found in https://openssl-library.org/news/secadv/20260609.txt.\n\nIf you are building cryptography source (\"sdist\") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on \n\nPackage: cryptography\nInstalled: 48.0.0\nFixed in: 48.0.1\nSeverity: HIGH\nFix: Upgrade cryptography to 48.0.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-128deffcb86baae4", "name": "CVE-2026-45409: idna 3.13 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-45409: idna 3.13 \u2014 uv.lock"}, "fullDescription": {"text": "Internationalized Domain Names in Applications (IDNA) for Python provi ...\n\nInternationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as `\"\\u0660\" * N` or `\"\\u30fb\" * N + \"\\u6f22\"` utilize the `valid_contexto` function prior to length rejection, and for high values of `N` will take a long time to process. This is the same issue as CVE-2024-3651, however the original remediation in 2024 was not a complete fi\n\nPackage: idna\nInstalled: 3.13\nFixed in: 3.15\nSeverity: MEDIUM\nFix: Upgrade idna to 3.15"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2b339bbbda5f296e", "name": "GHSA-f4xh-w4cj-qxq8: langsmith 0.8.3 \u2014 uv.lock", "shortDescription": {"text": "GHSA-f4xh-w4cj-qxq8: langsmith 0.8.3 \u2014 uv.lock"}, "fullDescription": {"text": "LangSmith SDK TracingMiddleware: Arbitrary server-side file read\n\n# Summary\n\nAn attacker who can send an HTTP request to a server running the LangSmith SDK's `TracingMiddleware` can cause that server to read an arbitrary file from its local filesystem and upload the contents to LangSmith as a trace attachment. Depending on how the distributed trace system is deployed, triggering a read may not require authentication. Retrieving the contents requires read access to the LangSmith workspace the traces are sent to. The net effect is a trust-boundary crossing: a pa\n\nPackage: langsmith\nInstalled: 0.8.3\nFixed in: 0.8.18\nSeverity: HIGH\nFix: Upgrade langsmith to 0.8.18"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-18b7f00d17767b73", "name": "GHSA-4xgf-cpjx-pc3j: pydantic-settings 2.14.1 \u2014 uv.lock", "shortDescription": {"text": "GHSA-4xgf-cpjx-pc3j: pydantic-settings 2.14.1 \u2014 uv.lock"}, "fullDescription": {"text": "pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size\n\n### Summary\n\n`NestedSecretsSettingsSource` reads secret values from files in a configured `secrets_dir`. When `secrets_nested_subdir=True`, a directory entry inside `secrets_dir` that is a symbolic link pointing **outside** `secrets_dir` is followed, so files outside the configured directory are read into settings values. The same code path bypasses the documented `secrets_dir_max_size` protection. An attacker or lower-privileged component able to influence entries in the configured secrets dire\n\nPackage: pydantic-settings\nInstalled: 2.14.1\nFixed in: 2.14.2\nSeverity: MEDIUM\nFix: Upgrade pydantic-settings to 2.14.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6514fbdcfaa9204b", "name": "CVE-2026-48526: pyjwt 2.12.1 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-48526: pyjwt 2.12.1 \u2014 uv.lock"}, "fullDescription": {"text": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens\n\nPyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the secret key for HMAC algorithm. This vulnerability is fixed in 2.13.0.\n\nPackage: pyjwt\nInstalled: 2.12.1\nFixed in: 2.13.0\nSeverity: HIGH\nFix: Upgrade pyjwt to 2.13.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-10d45d6df7a6f197", "name": "CVE-2026-48522: pyjwt 2.12.1 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-48522: pyjwt 2.12.1 \u2014 uv.lock"}, "fullDescription": {"text": "python-pyjwt: PyJWT: Server-Side Request Forgery (SSRF) via uncontrolled URL fetching in PyJWKClient\n\nPyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument directly to urllib.request.urlopen() which uses Python stdlib's default OpenerDirector registering HTTPHandler, HTTPSHandler, FTPHandler, FileHandler, and DataHandler. There is currently no documented option to restrict which schemes PyJWKClient will fetch. If an application's jku URL ingestion path accepts attacker-influenced URLs (e.g., from JWT header, configuration file, OAuth flow parame\n\nPackage: pyjwt\nInstalled: 2.12.1\nFixed in: 2.13.0\nSeverity: MEDIUM\nFix: Upgrade pyjwt to 2.13.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5728cdec0dc11919", "name": "CVE-2026-48523: pyjwt 2.12.1 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-48523: pyjwt 2.12.1 \u2014 uv.lock"}, "fullDescription": {"text": "python-pyjwt: PyJWT: Verifier-side algorithm bypass leads to unauthorized information access\n\nPyJWT is a JSON Web Token implementation in Python. From 2.9.0 to 2.12.1, there is a verifier-side algorithm allow-list bypass when jwt.decode() or jwt.decode_complete() are called with a PyJWK key. The token header alg is checked against the caller-supplied algorithms allow-list, but signature verification is performed with the algorithm bound to the PyJWK object instead of the header algorithm. An attacker who controls a registered JWK/JWKS private key can sign with a disallowed algorithm, adv\n\nPackage: pyjwt\nInstalled: 2.12.1\nFixed in: 2.13.0\nSeverity: MEDIUM\nFix: Upgrade pyjwt to 2.13.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4ba6012c73817cff", "name": "CVE-2026-48525: pyjwt 2.12.1 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-48525: pyjwt 2.12.1 \u2014 uv.lock"}, "fullDescription": {"text": "python-pyjwt: PyJWT: Denial of Service via processing of crafted detached JWS tokens\n\nPyJWT is a JSON Web Token implementation in Python. From 2.8.0 to 2.12.1, when verifying detached JWS tokens using the unencoded-payload option (\"b64\": false, RFC 7797), PyJWT performs Base64URL decoding of the compact-serialization payload segment before enforcing the detached-payload rules. For b64=false, PyJWT later discards that decoded payload and replaces it with the caller-provided detached_payload. In practice, this turns the middle segment into an attacker-controlled \u201cwork amplifier\u201d: a\n\nPackage: pyjwt\nInstalled: 2.12.1\nFixed in: 2.13.0\nSeverity: MEDIUM\nFix: Upgrade pyjwt to 2.13.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-898e5e1bfb2fa7db", "name": "CVE-2026-48524: pyjwt 2.12.1 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-48524: pyjwt 2.12.1 \u2014 uv.lock"}, "fullDescription": {"text": "python-pyjwt: PyJWT: Denial of Service via unverified JSON Web Token key IDs\n\nPyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient.get_signing_key() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Since kid comes from the unverified token header, an attacker can trigger unlimited outbound requests. The vulnerability surfaces only when a JWKS fetch fails; an attacker can attempt to provoke that with sustained unknown-kid traffic, but the outcome depends on upstream JWKS-endpoint be\n\nPackage: pyjwt\nInstalled: 2.12.1\nFixed in: 2.13.0\nSeverity: LOW\nFix: Upgrade pyjwt to 2.13.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a6c223ad10729c43", "name": "CVE-2026-53539: python-multipart 0.0.28 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-53539: python-multipart 0.0.28 \u2014 uv.lock"}, "fullDescription": {"text": "Python-Multipart is a streaming multipart parser for Python. Prior to  ...\n\nPython-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, when parsing application/x-www-form-urlencoded bodies, QuerystringParser located the field separator with a two step lookup: it first scanned the entire remaining buffer for &, and only when no & existed anywhere ahead did it fall back to scanning for ;. For a body that uses ; as the separator and contains no &, every field iteration performed a full failed & scan over the entire remaining buffer before locating the ne\n\nPackage: python-multipart\nInstalled: 0.0.28\nFixed in: 0.0.30\nSeverity: HIGH\nFix: Upgrade python-multipart to 0.0.30"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-89441572f9872346", "name": "CVE-2026-53537: python-multipart 0.0.28 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-53537: python-multipart 0.0.28 \u2014 uv.lock"}, "fullDescription": {"text": "Python-Multipart is a streaming multipart parser for Python. Prior to  ...\n\nPython-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, parse_options_header parsed Content-Disposition (and Content-Type) headers with email.message.Message, which transparently applies RFC 2231/5987 decoding. The extended parameter syntax (filename*=charset'lang'value, name*=..., and the filename*0/filename*1 continuation form) is decoded and surfaced under the bare filename/name key, and overrides the plain parameter when both are present. RFC 7578 \u00a74.2 explicitly forbid\n\nPackage: python-multipart\nInstalled: 0.0.28\nFixed in: 0.0.30\nSeverity: LOW\nFix: Upgrade python-multipart to 0.0.30"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9430ba16a182fb4d", "name": "CVE-2026-53538: python-multipart 0.0.28 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-53538: python-multipart 0.0.28 \u2014 uv.lock"}, "fullDescription": {"text": "Python-Multipart is a streaming multipart parser for Python. Prior to  ...\n\nPython-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, QuerystringParser treated ; as a field separator in application/x-www-form-urlencoded bodies, in addition to &. The WHATWG URL standard, modern browsers, and Python's urllib.parse (since the CVE-2021-23336 fix) treat only & as a separator. This creates a parser differential: the same bytes are tokenized into different fields than a WHATWG compliant intermediary would produce, allowing an attacker to smuggle extra form \n\nPackage: python-multipart\nInstalled: 0.0.28\nFixed in: 0.0.30\nSeverity: LOW\nFix: Upgrade python-multipart to 0.0.30"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b50544acfa8285eb", "name": "CVE-2026-53540: python-multipart 0.0.28 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-53540: python-multipart 0.0.28 \u2014 uv.lock"}, "fullDescription": {"text": "Python-Multipart is a streaming multipart parser for Python. Prior to  ...\n\nPython-Multipart is a streaming multipart parser for Python. Prior to 0.0.31, parse_form() did not validate the Content-Length header before using it to bound its chunked read of the request body. A negative Content-Length turned the bounded read into a read-until-EOF, so the entire body was loaded into memory in a single read instead of in fixed-size chunks. This vulnerability is fixed in 0.0.31.\n\nPackage: python-multipart\nInstalled: 0.0.28\nFixed in: 0.0.31\nSeverity: LOW\nFix: Upgrade python-multipart to 0.0.31"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3a3527e70129fb18", "name": "DS-0002: Image user should not be 'root' \u2014 Dockerfile", "shortDescription": {"text": "DS-0002: Image user should not be 'root' \u2014 Dockerfile"}, "fullDescription": {"text": "Image user should not be 'root'\n\nSpecify at least 1 USER command in Dockerfile with non-root user as argument\n\nRule: DS-0002\nSeverity: HIGH\nTarget: Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3c4041c454cda88e", "name": "DS-0026: No HEALTHCHECK defined \u2014 Dockerfile", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 Dockerfile"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-122f91b7f2906dc4", "name": "Agent authority lacks a verifier contract: .claude/settings.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/settings.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e725d2ab884fbd49", "name": "Multiple root agent instruction files without precedence", "shortDescription": {"text": "Multiple root agent instruction files without precedence"}, "fullDescription": {"text": "The repo has multiple top-level AI-coder instruction files. Without precedence rules, different agents may follow different policies."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1dc4ed452b3ac286", "name": "SkillSpector E1 (data-exfil) in docs/plans/done/github-linear-mcp.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in docs/plans/done/github-linear-mcp.md"}, "fullDescription": {"text": "https://api.githubcopilot.com/\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: unknown\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.50\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.5}}, {"id": "scanner-675ca1f7861b14b8", "name": "SkillSpector E1 (data-exfil) in octomate.default.yaml", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in octomate.default.yaml"}, "fullDescription": {"text": "https://api.openai.com/\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: unknown\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.50\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.5}}, {"id": "scanner-e38b1cc2067eeb3a", "name": "SkillSpector E1 (data-exfil) in octomate/config/mcp.py", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in octomate/config/mcp.py"}, "fullDescription": {"text": "https://api.githubcopilot.com/\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: unknown\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-aaf7810c73274866", "name": "SkillSpector E1 (data-exfil) in tests/agent/test_mcp.py", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in tests/agent/test_mcp.py"}, "fullDescription": {"text": "https://api.githubcopilot.com/\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: unknown\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-50d8215adda1c860", "name": "SkillSpector E1 (data-exfil) in tests/test_config.py", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in tests/test_config.py"}, "fullDescription": {"text": "https://api.githubcopilot.com/\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: unknown\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-d4731d4200ea4c69", "name": "SkillSpector EA4 (excessive-agency) in docs/plans/claude-agent-integration.md", "shortDescription": {"text": "SkillSpector EA4 (excessive-agency) in docs/plans/claude-agent-integration.md"}, "fullDescription": {"text": "timeout=None\n\nSkill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.\n\nSkill: unknown\nRule: EA4  Category: excessive-agency\nSeverity: MEDIUM  Confidence: 0.75\n\nRemediation: Set explicit rate limits, timeouts, and resource quotas for API calls, file operations, and compute. Implement circuit breakers for runaway loops."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.75}}, {"id": "scanner-f1d39e12973d64f7", "name": "SkillSpector EA2 (excessive-agency) in octomate/managers/conversations.py", "shortDescription": {"text": "SkillSpector EA2 (excessive-agency) in octomate/managers/conversations.py"}, "fullDescription": {"text": "auto-approve\n\nSkill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.\n\nSkill: unknown\nRule: EA2  Category: excessive-agency\nSeverity: MEDIUM  Confidence: 0.85\n\nRemediation: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-e35e0c12c6df642a", "name": "SkillSpector EA2 (excessive-agency) in octomate/schemas/conversation.py", "shortDescription": {"text": "SkillSpector EA2 (excessive-agency) in octomate/schemas/conversation.py"}, "fullDescription": {"text": "auto-approve\n\nSkill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.\n\nSkill: unknown\nRule: EA2  Category: excessive-agency\nSeverity: MEDIUM  Confidence: 0.85\n\nRemediation: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-a2ae2170578b931a", "name": "SkillSpector EA2 (excessive-agency) in octomate/tentacles/agent/claude/base.py", "shortDescription": {"text": "SkillSpector EA2 (excessive-agency) in octomate/tentacles/agent/claude/base.py"}, "fullDescription": {"text": "auto-approve\n\nSkill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.\n\nSkill: unknown\nRule: EA2  Category: excessive-agency\nSeverity: MEDIUM  Confidence: 0.85\n\nRemediation: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-d605c809d0253f79", "name": "SkillSpector EA1 (excessive-agency) in octomate/tentacles/channel/lark/feelers/approvals.py", "shortDescription": {"text": "SkillSpector EA1 (excessive-agency) in octomate/tentacles/channel/lark/feelers/approvals.py"}, "fullDescription": {"text": "Tool:*\n\nSkill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.\n\nSkill: unknown\nRule: EA1  Category: excessive-agency\nSeverity: MEDIUM  Confidence: 0.85\n\nRemediation: Restrict tool access to only the tools required for the skill's stated purpose. Use an explicit allowlist rather than granting blanket access."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-46c995cd51b0282f", "name": "SkillSpector EA2 (excessive-agency) in tests/agent/test_claude_approval.py", "shortDescription": {"text": "SkillSpector EA2 (excessive-agency) in tests/agent/test_claude_approval.py"}, "fullDescription": {"text": "auto-approve\n\nSkill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.\n\nSkill: unknown\nRule: EA2  Category: excessive-agency\nSeverity: MEDIUM  Confidence: 0.85\n\nRemediation: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-712fac09fbd32908", "name": "SkillSpector EA4 (excessive-agency) in tests/agent/test_claude_approval.py", "shortDescription": {"text": "SkillSpector EA4 (excessive-agency) in tests/agent/test_claude_approval.py"}, "fullDescription": {"text": "timeout=0\n\nSkill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.\n\nSkill: unknown\nRule: EA4  Category: excessive-agency\nSeverity: MEDIUM  Confidence: 0.75\n\nRemediation: Set explicit rate limits, timeouts, and resource quotas for API calls, file operations, and compute. Implement circuit breakers for runaway loops."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.75}}, {"id": "scanner-88afe0205102f315", "name": "SkillSpector PE3 (priv-esc) in .vscode/launch.json", "shortDescription": {"text": "SkillSpector PE3 (priv-esc) in .vscode/launch.json"}, "fullDescription": {"text": ".env\"\n\nCode accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.\n\nSkill: unknown\nRule: PE3  Category: priv-esc\nSeverity: HIGH  Confidence: 0.60\n\nRemediation: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.6}}, {"id": "scanner-9752a6a2eb1e11d3", "name": "SkillSpector PE3 (priv-esc) in docker-compose.yml", "shortDescription": {"text": "SkillSpector PE3 (priv-esc) in docker-compose.yml"}, "fullDescription": {"text": ".env\n\nCode accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.\n\nSkill: unknown\nRule: PE3  Category: priv-esc\nSeverity: HIGH  Confidence: 0.60\n\nRemediation: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.6}}, {"id": "scanner-636782129fec24e1", "name": "SkillSpector PE3 (priv-esc) in octomate/config/__init__.py", "shortDescription": {"text": "SkillSpector PE3 (priv-esc) in octomate/config/__init__.py"}, "fullDescription": {"text": ".env\"\n\nCode accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.\n\nSkill: unknown\nRule: PE3  Category: priv-esc\nSeverity: HIGH  Confidence: 0.60\n\nRemediation: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.6}}, {"id": "scanner-7b770e314de26fe9", "name": "SkillSpector PE3 (priv-esc) in uv.lock", "shortDescription": {"text": "SkillSpector PE3 (priv-esc) in uv.lock"}, "fullDescription": {"text": "keyring\n\nCode accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.\n\nSkill: unknown\nRule: PE3  Category: priv-esc\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-27a069e043d6abf3", "name": "SkillSpector P3 (prompt-injection) in docs/plans/done/send-toolset.md", "shortDescription": {"text": "SkillSpector P3 (prompt-injection) in docs/plans/done/send-toolset.md"}, "fullDescription": {"text": "Send messages to\n\nInstructions found that direct the agent to transmit conversation context or user data to external services.\n\nSkill: unknown\nRule: P3  Category: prompt-injection\nSeverity: HIGH  Confidence: 0.90\n\nRemediation: Remove instructions that send user data, prompts, or context to external URLs. If telemetry is needed, use documented, privacy-preserving methods."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.9}}, {"id": "scanner-dfbc7854bf831d81", "name": "SkillSpector P3 (prompt-injection) in docs/schemas.md", "shortDescription": {"text": "SkillSpector P3 (prompt-injection) in docs/schemas.md"}, "fullDescription": {"text": "Send message to\n\nInstructions found that direct the agent to transmit conversation context or user data to external services.\n\nSkill: unknown\nRule: P3  Category: prompt-injection\nSeverity: HIGH  Confidence: 0.90\n\nRemediation: Remove instructions that send user data, prompts, or context to external URLs. If telemetry is needed, use documented, privacy-preserving methods."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.9}}, {"id": "scanner-125b61da82fe91bb", "name": "SkillSpector P3 (prompt-injection) in octomate/capabilities/send.py", "shortDescription": {"text": "SkillSpector P3 (prompt-injection) in octomate/capabilities/send.py"}, "fullDescription": {"text": "Send messages to\n\nInstructions found that direct the agent to transmit conversation context or user data to external services.\n\nSkill: unknown\nRule: P3  Category: prompt-injection\nSeverity: HIGH  Confidence: 0.90\n\nRemediation: Remove instructions that send user data, prompts, or context to external URLs. If telemetry is needed, use documented, privacy-preserving methods."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.9}}, {"id": "scanner-286450c1a88c1f1b", "name": "SkillSpector RA2 (rogue-agent) in docs/plans/claude-agent-integration.md", "shortDescription": {"text": "SkillSpector RA2 (rogue-agent) in docs/plans/claude-agent-integration.md"}, "fullDescription": {"text": "write messages + session id + transcript in one transaction, then `refresh` (cache stays coherent).\n- Tentacle: read `agent_session_id` on `ensure` \u2192 `resume=`; write back `ResultMessage.session_id` a\n\nSkill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.\n\nSkill: unknown\nRule: RA2  Category: rogue-agent\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-350060911064ba23", "name": "SkillSpector SC3 (supply-chain) in tests/src/events/inkling_text.jsonl", "shortDescription": {"text": "SkillSpector SC3 (supply-chain) in tests/src/events/inkling_text.jsonl"}, "fullDescription": {"text": "\"EqkCCmUIDhABGAIqQBdHqBtE3CuDf8Pd9rb5xSbdfT8SO8dX/jyjc9Wia+VDKRS76sIkwBffovn3dAizgoizegUU7co/YTEwNvppmpEyD2NsYXVkZS1vcHVzLTQtNzgAQgh0aGlua2luZxIMTj0Oyj1VLmoinL4iGgwifgnneuYXxZ4WWxgiMPrXX9pr/LWHi0XzxF7\n\nCode contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.\n\nSkill: unknown\nRule: SC3  Category: supply-chain\nSeverity: HIGH  Confidence: 0.50\n\nRemediation: Remove obfuscated code. Use plain, readable implementations. Obfuscation hinders security review and raises trust concerns."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.5}}, {"id": "scanner-c6c30ca9c7b69e40", "name": "SkillSpector SC4 (supply-chain) in pyproject.toml", "shortDescription": {"text": "SkillSpector SC4 (supply-chain) in pyproject.toml"}, "fullDescription": {"text": "requires-python\n\nDependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.\n\nSkill: unknown\nRule: SC4  Category: supply-chain\nSeverity: HIGH  Confidence: 0.80\n\nRemediation: Update the dependency to a patched version that addresses the known CVE. Check OSV (osv.dev) or NVD for details on the vulnerability."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.8}}, {"id": "scanner-ba3b6b931850460b", "name": "SkillSpector TM1 (tool-misuse) in Dockerfile", "shortDescription": {"text": "SkillSpector TM1 (tool-misuse) in Dockerfile"}, "fullDescription": {"text": "rm -rf /\n\nTool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).\n\nSkill: unknown\nRule: TM1  Category: tool-misuse\nSeverity: LOW  Confidence: 0.15\n\nRemediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.15}}, {"id": "scanner-32d45991ffe1ca10", "name": "SkillSpector TM2 (tool-misuse) in Dockerfile", "shortDescription": {"text": "SkillSpector TM2 (tool-misuse) in Dockerfile"}, "fullDescription": {"text": "&& rm -\n\nTool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.\n\nSkill: unknown\nRule: TM2  Category: tool-misuse\nSeverity: LOW  Confidence: 0.15\n\nRemediation: Limit tool chaining depth and validate the output of each tool before passing it to the next. Require explicit user approval for multi-step chains."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.15}}, {"id": "scanner-c092073ec2ab0ac2", "name": "SkillSpector TM1 (tool-misuse) in tests/src/images/usagi.jpg", "shortDescription": {"text": "SkillSpector TM1 (tool-misuse) in tests/src/images/usagi.jpg"}, "fullDescription": {"text": "rMcxw[\ufffdtC'\ufffd\ufffdOh\ufffd/\n\nTool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).\n\nSkill: unknown\nRule: TM1  Category: tool-misuse\nSeverity: HIGH  Confidence: 0.85\n\nRemediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.85}}, {"id": "scanner-e637c415447867e4", "name": "Run SkillSpector's LLM-backed analysis in your own pipeline", "shortDescription": {"text": "Run SkillSpector's LLM-backed analysis in your own pipeline"}, "fullDescription": {"text": "Repobility ran SkillSpector's static rules server-side. The deeper LLM-backed analyzers \u2014 tool-poisoning (TP*), semantic security discovery (SSD*), developer-intent mismatch (SDI*) \u2014 are meant to run on YOUR machine with YOUR model; repobility never sends your code to an LLM. Recipe:\n\n# 1. Install SkillSpector in your own isolated env\npipx install \"skillspector @ git+https://github.com/NVIDIA/SkillSpector.git\"\n\n# 2. Point it at YOUR LLM pipeline (pick one) - your code stays on your machine\nexport SKILLSPECTOR_PROVIDER=anthropic && export ANTHROPIC_API_KEY=sk-ant-...\n# export SKILLSPECTOR_PROVIDER=openai   && export OPENAI_API_KEY=sk-...\n# export SKILLSPECTOR_PROVIDER=openai OPENAI_API_KEY=ollama OPENAI_BASE_URL=http://localhost:11434/v1 SKILLSPECTOR_MODEL=llama3.1:8b\n# export SKILLSPECTOR_PROVIDER=nv_build && export NVIDIA_INFERENCE_KEY=nvapi-...\n\n# 3. Run the LLM-backed scan per skill (omit --no-llm to enable the LLM analyzers)\nskillspector scan . --format sarif --output skillspector-"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e27bc7b03839a3a0", "name": "Privileged port 2 in use", "shortDescription": {"text": "Privileged port 2 in use"}, "fullDescription": {"text": "Port 2 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cceddc168c5fa791", "name": "Privileged port 42 in use", "shortDescription": {"text": "Privileged port 42 in use"}, "fullDescription": {"text": "Port 42 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-74a1e2ee5578c8e8", "name": "Privileged port 11 in use", "shortDescription": {"text": "Privileged port 11 in use"}, "fullDescription": {"text": "Port 11 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d63da3583b14afc0", "name": "Dockerfile runs as root: Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b65429def9b82d3a", "name": "Docker base image is tag-pinned but not digest-pinned: ghcr.io/astral-sh/uv:python3.13-bookworm-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: ghcr.io/astral-sh/uv:python3.13-bookworm-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4fc6e967d4418d48", "name": "98 TODO/FIXME markers", "shortDescription": {"text": "98 TODO/FIXME markers"}, "fullDescription": {"text": "High count of TODO/FIXME/HACK markers \u2014 track them as issues so they're not forgotten."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license, ci. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5018afddda1bbfff", "name": "Legacy-named symbol `files_upload_v2` in tests/channels/slack/fakes.py:301", "shortDescription": {"text": "Legacy-named symbol `files_upload_v2` in tests/channels/slack/fakes.py:301"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dc78060790e6e092", "name": "Legacy-named symbol `model_copy` in tests/channels/slack/test_streaming.py:223", "shortDescription": {"text": "Legacy-named symbol `model_copy` in tests/channels/slack/test_streaming.py:223"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1442ed29cceee17a", "name": "Legacy-named symbol `p2_im_message_receive_v1` in tests/channels/lark/test_ink.py:7", "shortDescription": {"text": "Legacy-named symbol `p2_im_message_receive_v1` in tests/channels/lark/test_ink.py:7"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fe3ca8fff7c99098", "name": "Legacy-named symbol `model_copy` in tests/channels/lark/test_streaming.py:179", "shortDescription": {"text": "Legacy-named symbol `model_copy` in tests/channels/lark/test_streaming.py:179"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c2864b108d59e862", "name": "Legacy-named symbol `p2_im_message_receive_v1` in tests/channels/lark/test_chromo.py:7", "shortDescription": {"text": "Legacy-named symbol `p2_im_message_receive_v1` in tests/channels/lark/test_chromo.py:7"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bbbee252e674f992", "name": "Legacy-named symbol `model_copy` in tests/support/scenarios.py:268", "shortDescription": {"text": "Legacy-named symbol `model_copy` in tests/support/scenarios.py:268"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-99dfcb5f012a8128", "name": "Legacy-named symbol `model_copy` in tests/trigger/test_napcat.py:106", "shortDescription": {"text": "Legacy-named symbol `model_copy` in tests/trigger/test_napcat.py:106"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-25ff2155a9efb5e5", "name": "Legacy-named symbol `model_copy` in tests/trigger/test_slack.py:134", "shortDescription": {"text": "Legacy-named symbol `model_copy` in tests/trigger/test_slack.py:134"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-842d635258542b84", "name": "Legacy-named symbol `model_copy` in tests/trigger/test_lark.py:125", "shortDescription": {"text": "Legacy-named symbol `model_copy` in tests/trigger/test_lark.py:125"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-91632f339987e536", "name": "Legacy-named symbol `model_copy` in scripts/capture_inkling_events.py:164", "shortDescription": {"text": "Legacy-named symbol `model_copy` in scripts/capture_inkling_events.py:164"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6b09b59cf8f4cdef", "name": "Commented-code block (5 lines) in octomate/base.py:112", "shortDescription": {"text": "Commented-code block (5 lines) in octomate/base.py:112"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ab9efaf13b1d5847", "name": "Legacy-named symbol `model_copy` in octomate/triage/graph.py:456", "shortDescription": {"text": "Legacy-named symbol `model_copy` in octomate/triage/graph.py:456"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-52a5b8bfe3b1ce2a", "name": "Commented-code block (5 lines) in octomate/capabilities/react.py:171", "shortDescription": {"text": "Commented-code block (5 lines) in octomate/capabilities/react.py:171"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-36b5b76ad64016be", "name": "Commented-code block (6 lines) in octomate/capabilities/agent.py:178", "shortDescription": {"text": "Commented-code block (6 lines) in octomate/capabilities/agent.py:178"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e3ba9fd2219611b4", "name": "Blocking `httpx.post(...)` inside `async def inspect` \u2014 octomate/tentacles/channel/napcat/ink.py:34", "shortDescription": {"text": "Blocking `httpx.post(...)` inside `async def inspect` \u2014 octomate/tentacles/channel/napcat/ink.py:34"}, "fullDescription": {"text": "Sync I/O inside an async function blocks the event loop. While `httpx.post(...)` is running, *all* other coroutines on this loop are paused \u2014 silent throughput collapse under concurrency. Use the async equivalent (`httpx.AsyncClient`, `asyncio.sleep`, `aiofiles`) or wrap with `await asyncio.to_thread(...)`."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7c29f974a157b98c", "name": "Blocking `httpx.post(...)` inside `async def inspect` \u2014 octomate/tentacles/channel/napcat/ink.py:38", "shortDescription": {"text": "Blocking `httpx.post(...)` inside `async def inspect` \u2014 octomate/tentacles/channel/napcat/ink.py:38"}, "fullDescription": {"text": "Sync I/O inside an async function blocks the event loop. While `httpx.post(...)` is running, *all* other coroutines on this loop are paused \u2014 silent throughput collapse under concurrency. Use the async equivalent (`httpx.AsyncClient`, `asyncio.sleep`, `aiofiles`) or wrap with `await asyncio.to_thread(...)`."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "high", "confidence": 1.0}}, {"id": "scanner-93bec4e730adad00", "name": "Blocking `httpx.post(...)` inside `async def get_user_profile` \u2014 octomate/tentacles/channel/napcat/ink.py:49", "shortDescription": {"text": "Blocking `httpx.post(...)` inside `async def get_user_profile` \u2014 octomate/tentacles/channel/napcat/ink.py:49"}, "fullDescription": {"text": "Sync I/O inside an async function blocks the event loop. While `httpx.post(...)` is running, *all* other coroutines on this loop are paused \u2014 silent throughput collapse under concurrency. Use the async equivalent (`httpx.AsyncClient`, `asyncio.sleep`, `aiofiles`) or wrap with `await asyncio.to_thread(...)`."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e319a0f6ddb829c0", "name": "Blocking `httpx.post(...)` inside `async def get_image_url` \u2014 octomate/tentacles/channel/napcat/ink.py:67", "shortDescription": {"text": "Blocking `httpx.post(...)` inside `async def get_image_url` \u2014 octomate/tentacles/channel/napcat/ink.py:67"}, "fullDescription": {"text": "Sync I/O inside an async function blocks the event loop. While `httpx.post(...)` is running, *all* other coroutines on this loop are paused \u2014 silent throughput collapse under concurrency. Use the async equivalent (`httpx.AsyncClient`, `asyncio.sleep`, `aiofiles`) or wrap with `await asyncio.to_thread(...)`."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "high", "confidence": 1.0}}, {"id": "scanner-efee87e14010f7ba", "name": "Blocking `httpx.get(...)` inside `async def download` \u2014 octomate/tentacles/channel/napcat/ink.py:72", "shortDescription": {"text": "Blocking `httpx.get(...)` inside `async def download` \u2014 octomate/tentacles/channel/napcat/ink.py:72"}, "fullDescription": {"text": "Sync I/O inside an async function blocks the event loop. While `httpx.get(...)` is running, *all* other coroutines on this loop are paused \u2014 silent throughput collapse under concurrency. Use the async equivalent (`httpx.AsyncClient`, `asyncio.sleep`, `aiofiles`) or wrap with `await asyncio.to_thread(...)`."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1ec31f1609038192", "name": "Stub function `upload_media` (body is just `pass`/`return`) \u2014 octomate/tentacles/channel/napcat/ink.py:63", "shortDescription": {"text": "Stub function `upload_media` (body is just `pass`/`return`) \u2014 octomate/tentacles/channel/napcat/ink.py:63"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5ce390dfdd85cc43", "name": "Commented-code block (6 lines) in octomate/tentacles/channel/web/vercel/routes.py:63", "shortDescription": {"text": "Commented-code block (6 lines) in octomate/tentacles/channel/web/vercel/routes.py:63"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-65468ed3836f8f0a", "name": "Commented-code block (5 lines) in octomate/tentacles/channel/feelers/output.py:514", "shortDescription": {"text": "Commented-code block (5 lines) in octomate/tentacles/channel/feelers/output.py:514"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b723d77d8fbef833", "name": "Legacy-named symbol `files_upload_v2` in octomate/tentacles/channel/slack/ink.py:75", "shortDescription": {"text": "Legacy-named symbol `files_upload_v2` in octomate/tentacles/channel/slack/ink.py:75"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4e2b18e9cb871d2f", "name": "Commented-code block (5 lines) in octomate/tentacles/channel/slack/base.py:155", "shortDescription": {"text": "Commented-code block (5 lines) in octomate/tentacles/channel/slack/base.py:155"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-61b16abf755dacaa", "name": "Legacy-named symbol `p2_im_message_receive_v1` in octomate/tentacles/channel/lark/chromo.py:9", "shortDescription": {"text": "Legacy-named symbol `p2_im_message_receive_v1` in octomate/tentacles/channel/lark/chromo.py:9"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6b427eea0d773764", "name": "Commented-code block (5 lines) in octomate/tentacles/channel/lark/chromo.py:51", "shortDescription": {"text": "Commented-code block (5 lines) in octomate/tentacles/channel/lark/chromo.py:51"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-757bbbb8c8ed7871", "name": "Legacy-named symbol `p2_im_message_receive_v1` in octomate/tentacles/channel/lark/base.py:10", "shortDescription": {"text": "Legacy-named symbol `p2_im_message_receive_v1` in octomate/tentacles/channel/lark/base.py:10"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-913d850c52c39531", "name": "Legacy-named symbol `card_v2` in octomate/tentacles/channel/lark/feelers/output.py:207", "shortDescription": {"text": "Legacy-named symbol `card_v2` in octomate/tentacles/channel/lark/feelers/output.py:207"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-53171dacf81fcdbe", "name": "Legacy-named symbol `card_v2` in octomate/tentacles/channel/lark/feelers/cards.py:83", "shortDescription": {"text": "Legacy-named symbol `card_v2` in octomate/tentacles/channel/lark/feelers/cards.py:83"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\noctomate/triage/graph.py:channel, octomate/triage/graph.py:channel, octomate/triage/graph.py:channel\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\noctomate/triage/graph.py:receptions, octomate/triage/graph.py:reception\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-33a6b62e30ce7ab4", "name": "Near-duplicate function bodies in 6 places", "shortDescription": {"text": "Near-duplicate function bodies in 6 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\noctomate/triage/graph.py:run, octomate/triage/graph.py:run, octomate/triage/graph.py:run, octomate/triage/graph.py:run\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49c98f7cedd9c977", "name": "Near-duplicate function bodies in 4 places", "shortDescription": {"text": "Near-duplicate function bodies in 4 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\noctomate/capabilities/react.py:run, octomate/capabilities/react.py:run, octomate/capabilities/react.py:run, octomate/capabilities/react.py:run\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-959dc775c4241ad4", "name": "Near-duplicate function bodies in 18 places", "shortDescription": {"text": "Near-duplicate function bodies in 18 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\noctomate/tentacles/agent/base.py:run, octomate/tentacles/agent/base.py:run, octomate/tentacles/agent/base.py:run, octomate/tentacles/agent/base.py:run_stream_events\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-259ce6bddfcf5d05", "name": "FastAPI POST `chat` without auth dependency \u2014 octomate/tentacles/channel/web/vercel/routes.py:48", "shortDescription": {"text": "FastAPI POST `chat` without auth dependency \u2014 octomate/tentacles/channel/web/vercel/routes.py:48"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/30735"}, "properties": {"repository": "kalynnka/octomate", "repoUrl": "https://github.com/kalynnka/octomate.git", "branch": "main"}, "results": [{"ruleId": "WEB003", "level": "warning", "message": {"text": "Public web service has no security.txt"}, "properties": {"repobilityId": 469757, "scanner": "repobility-web-presence", "fingerprint": "5cd26606c5a53c9f403ff7a92a6917c19cf440a23ce03e2b90e8c493312ef8cd", "category": "quality", "severity": "medium", "confidence": 0.78, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Repository looks like a public web app/API but no security.txt file or route was discovered.", "evidence": {"rule_id": "WEB003", "scanner": "repobility-web-presence", "references": ["https://www.rfc-editor.org/rfc/rfc9116", "https://github.com/Lissy93/web-check"], "correlation_key": "fp|5cd26606c5a53c9f403ff7a92a6917c19cf440a23ce03e2b90e8c493312ef8cd"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".well-known/security.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "AUC012", "level": "warning", "message": {"text": "[AUC012] FastAPI interactive docs may be exposed by framework defaults: FastAPI exposes /docs, /redoc, and /openapi.json by default. Public production APIs should explicitly disable those defaults, protect them behind admin authentication, or publish a reviewed OpenAPI spec with declared security requirements."}, "properties": {"repobilityId": 469756, "scanner": "repobility-access-control", "fingerprint": "27f8c50db94c1d5138790446654bd4d0b5823ce185d040059e5a7502358b5899", "category": "auth", "severity": "medium", "confidence": 0.72, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"apps": [{"line": 124, "file_path": "octomate/base.py", "docs_url_disabled": false, "redoc_url_disabled": true, "openapi_url_disabled": false}], "scanner": "repobility-access-control", "correlation_key": "fp|27f8c50db94c1d5138790446654bd4d0b5823ce185d040059e5a7502358b5899"}}}, {"ruleId": "AUC001", "level": "warning", "message": {"text": "[AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation."}, "properties": {"repobilityId": 469754, "scanner": "repobility-access-control", "fingerprint": "f1305052c3ba1e6c1cdb5dccc19e58a8168cf78b176658f32b1fc823df3e9d10", "category": "auth", "severity": "medium", "confidence": 0.92, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"scanner": "repobility-access-control", "frameworks": ["FastAPI"], "expected_files": [".repobility/access.yml", ".repobility/access.yaml", ".repobility/access.json", ".repobility/authorization.yml"], "correlation_key": "fp|f1305052c3ba1e6c1cdb5dccc19e58a8168cf78b176658f32b1fc823df3e9d10"}}}, {"ruleId": "GHSA-jq35-7prp-9v3f", "level": "warning", "message": {"text": "pyjwt: GHSA-jq35-7prp-9v3f"}, "properties": {"repobilityId": 469749, "scanner": "osv-scanner", "fingerprint": "ace751b2018152d2488e4ca021afd52594284e143740f90d3dcdd247c0ddeff4", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-48523", "PYSEC-2026-176"], "package": "pyjwt", "rule_id": "GHSA-jq35-7prp-9v3f", "scanner": "osv-scanner", "correlation_key": "vuln|pyjwt|CVE-2026-48523|uv.lock"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-993g-76c3-p5m4", "level": "warning", "message": {"text": "pyjwt: GHSA-993g-76c3-p5m4"}, "properties": {"repobilityId": 469748, "scanner": "osv-scanner", "fingerprint": "6f2803bd43271cfcaf387745d14e8414bc415f3a33966c9fbf4ce93552cc3ded", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-48522", "PYSEC-2026-175"], "package": "pyjwt", "rule_id": "GHSA-993g-76c3-p5m4", "scanner": "osv-scanner", "correlation_key": "vuln|pyjwt|CVE-2024-21643|uv.lock"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-4xgf-cpjx-pc3j", "level": "warning", "message": {"text": "pydantic-settings: GHSA-4xgf-cpjx-pc3j"}, "properties": {"repobilityId": 469743, "scanner": "osv-scanner", "fingerprint": "903e8c3212d22aa61cc050cfdffd7a938535e5cf16e51bb1339b8610fa68b6b9", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "package": "pydantic-settings", "rule_id": "GHSA-4xgf-cpjx-pc3j", "scanner": "osv-scanner", "correlation_key": "vuln|pydantic-settings|GHSA-4XGF-CPJX-PC3J|uv.lock"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-xcgm-r5h9-7989", "level": "warning", "message": {"text": "aiohttp: GHSA-xcgm-r5h9-7989"}, "properties": {"repobilityId": 469739, "scanner": "osv-scanner", "fingerprint": "db2a4c5903f4ebc20ab9fe80db52a50390bbb50fb900f85a2e5ba5b6fe27aece", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-54274"], "package": "aiohttp", "rule_id": "GHSA-xcgm-r5h9-7989", "scanner": "osv-scanner", "correlation_key": "vuln|aiohttp|CVE-2026-54274|uv.lock"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-jg22-mg44-37j8", "level": "warning", "message": {"text": "aiohttp: GHSA-jg22-mg44-37j8"}, "properties": {"repobilityId": 469737, "scanner": "osv-scanner", "fingerprint": "f360dcc0eba31763fb048fbf952ff9aaacd93fae36b950018274d5457fa1322d", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-34993"], "package": "aiohttp", "rule_id": "GHSA-jg22-mg44-37j8", "scanner": "osv-scanner", "correlation_key": "vuln|aiohttp|CVE-2026-34993|uv.lock"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-hpj7-wq8m-9hgp", "level": "warning", "message": {"text": "aiohttp: GHSA-hpj7-wq8m-9hgp"}, "properties": {"repobilityId": 469736, "scanner": "osv-scanner", "fingerprint": "09b04a75a93ce247fbf8468b246944c48d4e751ea06393754d5c0439b0665d18", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-54276"], "package": "aiohttp", "rule_id": "GHSA-hpj7-wq8m-9hgp", "scanner": "osv-scanner", "correlation_key": "vuln|aiohttp|CVE-2026-54276|uv.lock"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-hg6j-4rv6-33pg", "level": "warning", "message": {"text": "aiohttp: GHSA-hg6j-4rv6-33pg"}, "properties": {"repobilityId": 469735, "scanner": "osv-scanner", "fingerprint": "2da1f8cf81a5e62587e98e266536e6b0ec96ebc178f00a59702cebb0a7957e28", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-47265"], "package": "aiohttp", "rule_id": "GHSA-hg6j-4rv6-33pg", "scanner": "osv-scanner", "correlation_key": "vuln|aiohttp|CVE-2026-47265|uv.lock"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-g3cq-j2xw-wf74", "level": "warning", "message": {"text": "aiohttp: GHSA-g3cq-j2xw-wf74"}, "properties": {"repobilityId": 469734, "scanner": "osv-scanner", "fingerprint": "508f73ac24e9a89d247752feb0f84fbf739840bef7ecca181742f4ba47c758f3", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-54278"], "package": "aiohttp", "rule_id": "GHSA-g3cq-j2xw-wf74", "scanner": "osv-scanner", "correlation_key": "vuln|aiohttp|CVE-2026-54278|uv.lock"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-63hw-fmq6-xxg2", "level": "warning", "message": {"text": "aiohttp: GHSA-63hw-fmq6-xxg2"}, "properties": {"repobilityId": 469732, "scanner": "osv-scanner", "fingerprint": "fcfc515b44cff33d97cd4fc558d31b523f15bfdedf639e8a52995d05ca457ff8", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-54277"], "package": "aiohttp", "rule_id": "GHSA-63hw-fmq6-xxg2", "scanner": "osv-scanner", "correlation_key": "vuln|aiohttp|CVE-2026-54277|uv.lock"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-4fvr-rgm6-gqmc", "level": "warning", "message": {"text": "aiohttp: GHSA-4fvr-rgm6-gqmc"}, "properties": {"repobilityId": 469730, "scanner": "osv-scanner", "fingerprint": "07ccf9ba9056e3c840d144eb54e329637e852a058a113f8cb86943c5dc4c3cc6", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-54273"], "package": "aiohttp", "rule_id": "GHSA-4fvr-rgm6-gqmc", "scanner": "osv-scanner", "correlation_key": "vuln|aiohttp|CVE-2026-54273|uv.lock"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "DKR003", "level": "warning", "message": {"text": "Compose service `pgadmin` image uses the latest tag"}, "properties": {"repobilityId": 469724, "scanner": "repobility-docker", "fingerprint": "c329154052ee63df7c0c2bbc5d840dfc788608e60564bd56a276aca86f321286", "category": "docker", "severity": "medium", "confidence": 0.94, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Image tag is latest.", "evidence": {"image": "dpage/pgadmin4:latest", "rule_id": "DKR003", "scanner": "repobility-docker", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://docs.docker.com/scout/policy/", "https://github.com/hadolint/hadolint"], "correlation_key": "fp|c329154052ee63df7c0c2bbc5d840dfc788608e60564bd56a276aca86f321286"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 111}}}]}, {"ruleId": "DKC015", "level": "warning", "message": {"text": "Database service has no healthcheck"}, "properties": {"repobilityId": 469723, "scanner": "repobility-docker", "fingerprint": "cb7a9c604001b926344967ef8239f95b78b01db0da0ac3257106dd2a84539f0c", "category": "docker", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Database-like service has no Compose healthcheck.", "evidence": {"rule_id": "DKC015", "scanner": "repobility-docker", "service": "postgres", "references": ["https://docs.docker.com/compose/how-tos/startup-order/"], "correlation_key": "fp|cb7a9c604001b926344967ef8239f95b78b01db0da0ac3257106dd2a84539f0c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 97}}}]}, {"ruleId": "DKR003", "level": "warning", "message": {"text": "Compose service `attu` image uses the latest tag"}, "properties": {"repobilityId": 469717, "scanner": "repobility-docker", "fingerprint": "2f3fbc4ab4c3b8b3194b84ee2cb8818e19f617cf9f88d7823b5491ef1869844a", "category": "docker", "severity": "medium", "confidence": 0.94, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Image tag is latest.", "evidence": {"image": "zilliz/attu:latest", "rule_id": "DKR003", "scanner": "repobility-docker", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://docs.docker.com/scout/policy/", "https://github.com/hadolint/hadolint"], "correlation_key": "fp|2f3fbc4ab4c3b8b3194b84ee2cb8818e19f617cf9f88d7823b5491ef1869844a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 85}}}]}, {"ruleId": "DKR003", "level": "warning", "message": {"text": "Compose service `milvus-rustfs` image uses the latest tag"}, "properties": {"repobilityId": 469713, "scanner": "repobility-docker", "fingerprint": "14dbad237f5ab42e5294e2add1a217abf5b9ebce548741b87e0e5581a0f8dae3", "category": "docker", "severity": "medium", "confidence": 0.94, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Image tag is latest.", "evidence": {"image": "rustfs/rustfs:latest", "rule_id": "DKR003", "scanner": "repobility-docker", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://docs.docker.com/scout/policy/", "https://github.com/hadolint/hadolint"], "correlation_key": "fp|14dbad237f5ab42e5294e2add1a217abf5b9ebce548741b87e0e5581a0f8dae3"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 61}}}]}, {"ruleId": "DKR003", "level": "warning", "message": {"text": "Compose service `napcat` image uses the latest tag"}, "properties": {"repobilityId": 469710, "scanner": "repobility-docker", "fingerprint": "91601621e8342bb7f45d8c45c061b9d1ae25a9b954511573cc763c1cf53ef710", "category": "docker", "severity": "medium", "confidence": 0.94, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Image tag is latest.", "evidence": {"image": "mlikiowa/napcat-docker:latest", "rule_id": "DKR003", "scanner": "repobility-docker", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://docs.docker.com/scout/policy/", "https://github.com/hadolint/hadolint"], "correlation_key": "fp|91601621e8342bb7f45d8c45c061b9d1ae25a9b954511573cc763c1cf53ef710"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 28}}}]}, {"ruleId": "DKR001", "level": "warning", "message": {"text": "Docker final stage has no non-root USER"}, "properties": {"repobilityId": 469706, "scanner": "repobility-docker", "fingerprint": "bbddb30f89178c7f394f661014c4463818fa0d7143e3346dcf37c2b53e571e10", "category": "docker", "severity": "medium", "confidence": 0.82, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "No USER directive was found in the final runtime stage.", "evidence": {"rule_id": "DKR001", "scanner": "repobility-docker", "final_base": "ghcr.io/astral-sh/uv:python3.13-bookworm-slim", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html", "https://github.com/hadolint/hadolint"], "correlation_key": "fp|bbddb30f89178c7f394f661014c4463818fa0d7143e3346dcf37c2b53e571e10"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "COMP001", "level": "warning", "message": {"text": "[COMP001] High cognitive complexity: Function `kick` has cognitive complexity 15 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand \u2014 nested branches, boolean chains, and recursion all weigh in. Breakdown: continue=2, elif=1, for=1, if=4, nested_bonus=7."}, "properties": {"repobilityId": 469693, "scanner": "repobility-threat-engine", "fingerprint": "f0b6ff3a29bb8a8da7600f8c77b4c660d658b9c3e980917741e4e09ffcf6021b", "category": "quality", "severity": "medium", "confidence": 0.95, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "AST-derived cognitive complexity score = 15 (severity threshold for medium: 15+).", "evidence": {"scanner": "repobility-threat-engine", "function": "kick", "breakdown": {"if": 4, "for": 1, "elif": 1, "continue": 2, "nested_bonus": 7}, "complexity": 15, "correlation_key": "fp|f0b6ff3a29bb8a8da7600f8c77b4c660d658b9c3e980917741e4e09ffcf6021b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/base.py"}, "region": {"startLine": 70}}}]}, {"ruleId": "AGT012", "level": "warning", "message": {"text": "Agent control bridge may listen on a network interface without visible auth"}, "properties": {"repobilityId": 469689, "scanner": "repobility-agent-runtime", "fingerprint": "7d2815c7159b2595c470131d6d7e604b4aca22928315b5794f9d846be7c33b3b", "category": "quality", "severity": "medium", "confidence": 0.72, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "File combines agent-control wording with an HTTP/SSE/WebSocket listener on an all-interface host and no visible auth guard.", "evidence": {"rule_id": "AGT012", "scanner": "repobility-agent-runtime", "references": [], "correlation_key": "fp|7d2815c7159b2595c470131d6d7e604b4aca22928315b5794f9d846be7c33b3b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 18}}}]}, {"ruleId": "MINED111", "level": "warning", "message": {"text": "Bare except continues silently"}, "properties": {"repobilityId": 469666, "scanner": "repobility-ast-engine", "fingerprint": "ff44356195cd1bd19a6459db338196dddc7af70c1a275f7708a14a9f0eca47d6", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "bare-except-without-pass", "owasp": null, "cwe_ids": [], "languages": ["python"], "observations_count": 21610}, "scanner": "repobility-ast-engine", "correlation_key": "fp|ff44356195cd1bd19a6459db338196dddc7af70c1a275f7708a14a9f0eca47d6"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/capabilities/react.py"}, "region": {"startLine": 339}}}]}, {"ruleId": "CORE_NO_CI", "level": "warning", "message": {"text": "No CI/CD configuration found"}, "properties": {"repobilityId": 469652, "scanner": "repobility-core", "fingerprint": "ca5da3551af97272c4f099fc472740148135a15816b81b90bd862e8f91ec66ce", "category": "practices", "severity": "medium", "confidence": null, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"rule_id": "CORE_NO_CI", "scanner": "repobility-core", "correlation_key": "repo|practices|core_no_ci"}}}, {"ruleId": "GHSA-vffw-93wf-4j4q", "level": "note", "message": {"text": "python-multipart: GHSA-vffw-93wf-4j4q"}, "properties": {"repobilityId": 469753, "scanner": "osv-scanner", "fingerprint": "ce6313d9da7ec0530d98036b2539a2d00593558da4515fdd29a0f47d4b9a58f1", "category": "dependency", "severity": "low", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-53537"], "package": "python-multipart", "rule_id": "GHSA-vffw-93wf-4j4q", "scanner": "osv-scanner", "correlation_key": "vuln|python-multipart|CVE-2026-53537|uv.lock"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-v9pg-7xvm-68hf", "level": "note", "message": {"text": "python-multipart: GHSA-v9pg-7xvm-68hf"}, "properties": {"repobilityId": 469752, "scanner": "osv-scanner", "fingerprint": "b89479bef7f53bed2e6ccbb6047f7a364da01dfda141824b8048fb725116d94c", "category": "dependency", "severity": "low", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-53540"], "package": "python-multipart", "rule_id": "GHSA-v9pg-7xvm-68hf", "scanner": "osv-scanner", "correlation_key": "vuln|python-multipart|CVE-2026-53540|uv.lock"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-6jv3-5f52-599m", "level": "note", "message": {"text": "python-multipart: GHSA-6jv3-5f52-599m"}, "properties": {"repobilityId": 469751, "scanner": "osv-scanner", "fingerprint": "ef03415f68056a09d0affcc9965c7baee7a4d3123e8a03c55f837bf6520e2f70", "category": "dependency", "severity": "low", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-53538"], "package": "python-multipart", "rule_id": "GHSA-6jv3-5f52-599m", "scanner": "osv-scanner", "correlation_key": "vuln|python-multipart|CVE-2026-53538|uv.lock"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-m6qw-4cw2-hm4m", "level": "note", "message": {"text": "aiohttp: GHSA-m6qw-4cw2-hm4m"}, "properties": {"repobilityId": 469738, "scanner": "osv-scanner", "fingerprint": "9017a4829c5a43652e57228ddf52c0360dcb093945051137abec92823694d2c9", "category": "dependency", "severity": "low", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-50269"], "package": "aiohttp", "rule_id": "GHSA-m6qw-4cw2-hm4m", "scanner": "osv-scanner", "correlation_key": "vuln|aiohttp|CVE-2026-50269|uv.lock"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-9x8q-7h8h-wcw9", "level": "note", "message": {"text": "aiohttp: GHSA-9x8q-7h8h-wcw9"}, "properties": {"repobilityId": 469733, "scanner": "osv-scanner", "fingerprint": "a31990607eca1ab3fe77bd3ce98e4c621f0ec57bcf86f199ad5313bc25329221", "category": "dependency", "severity": "low", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-54280"], "package": "aiohttp", "rule_id": "GHSA-9x8q-7h8h-wcw9", "scanner": "osv-scanner", "correlation_key": "vuln|aiohttp|CVE-2026-54280|uv.lock"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-4m7w-qmgq-4wj5", "level": "note", "message": {"text": "aiohttp: GHSA-4m7w-qmgq-4wj5"}, "properties": {"repobilityId": 469731, "scanner": "osv-scanner", "fingerprint": "d730dd3a16b1fc2db4cb90ad679feec0fbac819da886b6624fda31c0e60865ba", "category": "dependency", "severity": "low", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-54275"], "package": "aiohttp", "rule_id": "GHSA-4m7w-qmgq-4wj5", "scanner": "osv-scanner", "correlation_key": "vuln|aiohttp|CVE-2026-54275|uv.lock"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-2fqr-mr3j-6wp8", "level": "note", "message": {"text": "aiohttp: GHSA-2fqr-mr3j-6wp8"}, "properties": {"repobilityId": 469729, "scanner": "osv-scanner", "fingerprint": "dde50137007f6911caff9484814314dc67b232a9a9632d76e4927fa0a2719482", "category": "dependency", "severity": "low", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-54279"], "package": "aiohttp", "rule_id": "GHSA-2fqr-mr3j-6wp8", "scanner": "osv-scanner", "correlation_key": "vuln|aiohttp|CVE-2026-54279|uv.lock"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "DKC016", "level": "note", "message": {"text": "App service does not wait for database health"}, "properties": {"repobilityId": 469728, "scanner": "repobility-docker", "fingerprint": "40d2f16a76d1301e9ad0e3ba4397fd360ddd1ca2940a25a8c92d5a00df04fe5b", "category": "docker", "severity": "low", "confidence": 0.68, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "App depends on a database-like service without a health-gated dependency.", "evidence": {"rule_id": "DKC016", "scanner": "repobility-docker", "service": "pgadmin", "dependency": "postgres", "references": ["https://docs.docker.com/compose/how-tos/startup-order/"], "correlation_key": "fp|40d2f16a76d1301e9ad0e3ba4397fd360ddd1ca2940a25a8c92d5a00df04fe5b", "dependency_has_healthcheck": false}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 111}}}]}, {"ruleId": "DKC010", "level": "note", "message": {"text": "Compose service lacks no-new-privileges hardening"}, "properties": {"repobilityId": 469727, "scanner": "repobility-docker", "fingerprint": "d43b8b63cd4d8842dfdd72a57a58eb02ad4ed50b3d7238e012d0b54866869539", "category": "docker", "severity": "low", "confidence": 0.62, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "App-like service has no security_opt no-new-privileges setting.", "evidence": {"rule_id": "DKC010", "scanner": "repobility-docker", "service": "pgadmin", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|d43b8b63cd4d8842dfdd72a57a58eb02ad4ed50b3d7238e012d0b54866869539"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 111}}}]}, {"ruleId": "DKC006", "level": "note", "message": {"text": "Compose service does not declare a runtime user"}, "properties": {"repobilityId": 469725, "scanner": "repobility-docker", "fingerprint": "10032ce73e7810cc1b9d99b585dda4203a5d936ee49b5732f415a2b8499669b3", "category": "docker", "severity": "low", "confidence": 0.56, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Service has no user setting and Repobility could not prove the image runs non-root.", "evidence": {"rule_id": "DKC006", "scanner": "repobility-docker", "service": "pgadmin", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|10032ce73e7810cc1b9d99b585dda4203a5d936ee49b5732f415a2b8499669b3"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 111}}}]}, {"ruleId": "DKC010", "level": "note", "message": {"text": "Compose service lacks no-new-privileges hardening"}, "properties": {"repobilityId": 469719, "scanner": "repobility-docker", "fingerprint": "c88bf4535b464e4c9808224116a71db9fc7f250867367aaec8ac5ca4b21725da", "category": "docker", "severity": "low", "confidence": 0.62, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "App-like service has no security_opt no-new-privileges setting.", "evidence": {"rule_id": "DKC010", "scanner": "repobility-docker", "service": "attu", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|c88bf4535b464e4c9808224116a71db9fc7f250867367aaec8ac5ca4b21725da"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 85}}}]}, {"ruleId": "DKC006", "level": "note", "message": {"text": "Compose service does not declare a runtime user"}, "properties": {"repobilityId": 469718, "scanner": "repobility-docker", "fingerprint": "10605762f94e9d7ee9faa79052f0a5e1a0e8990334ea0ff5d47c82e6c972767e", "category": "docker", "severity": "low", "confidence": 0.56, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Service has no user setting and Repobility could not prove the image runs non-root.", "evidence": {"rule_id": "DKC006", "scanner": "repobility-docker", "service": "attu", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|10605762f94e9d7ee9faa79052f0a5e1a0e8990334ea0ff5d47c82e6c972767e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 85}}}]}, {"ruleId": "DKC010", "level": "note", "message": {"text": "Compose service lacks no-new-privileges hardening"}, "properties": {"repobilityId": 469716, "scanner": "repobility-docker", "fingerprint": "568e18a74e6d52590d1dc360c4db87c6483f0810621a6b3bab1858a255774e44", "category": "docker", "severity": "low", "confidence": 0.62, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "App-like service has no security_opt no-new-privileges setting.", "evidence": {"rule_id": "DKC010", "scanner": "repobility-docker", "service": "milvus", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|568e18a74e6d52590d1dc360c4db87c6483f0810621a6b3bab1858a255774e44"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 71}}}]}, {"ruleId": "DKC006", "level": "note", "message": {"text": "Compose service does not declare a runtime user"}, "properties": {"repobilityId": 469715, "scanner": "repobility-docker", "fingerprint": "4305973f0bb57e01da8e487f7d7c62d31b1baf059dd2f87f953c16337b2c60aa", "category": "docker", "severity": "low", "confidence": 0.56, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Service has no user setting and Repobility could not prove the image runs non-root.", "evidence": {"rule_id": "DKC006", "scanner": "repobility-docker", "service": "milvus", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|4305973f0bb57e01da8e487f7d7c62d31b1baf059dd2f87f953c16337b2c60aa"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 71}}}]}, {"ruleId": "DKC010", "level": "note", "message": {"text": "Compose service lacks no-new-privileges hardening"}, "properties": {"repobilityId": 469712, "scanner": "repobility-docker", "fingerprint": "a9802bf3cddadad48ff0bc4ae970a9287371defb43ff460f2fbf2dd31207c115", "category": "docker", "severity": "low", "confidence": 0.62, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "App-like service has no security_opt no-new-privileges setting.", "evidence": {"rule_id": "DKC010", "scanner": "repobility-docker", "service": "napcat", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|a9802bf3cddadad48ff0bc4ae970a9287371defb43ff460f2fbf2dd31207c115"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 28}}}]}, {"ruleId": "DKC006", "level": "note", "message": {"text": "Compose service does not declare a runtime user"}, "properties": {"repobilityId": 469711, "scanner": "repobility-docker", "fingerprint": "f34f9d0e67b38513ceb678b214c4eafb7d729620eb38f727fb19fd3e0df1bfbc", "category": "docker", "severity": "low", "confidence": 0.56, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Service has no user setting and Repobility could not prove the image runs non-root.", "evidence": {"rule_id": "DKC006", "scanner": "repobility-docker", "service": "napcat", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|f34f9d0e67b38513ceb678b214c4eafb7d729620eb38f727fb19fd3e0df1bfbc"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 28}}}]}, {"ruleId": "DKC010", "level": "note", "message": {"text": "Compose service lacks no-new-privileges hardening"}, "properties": {"repobilityId": 469709, "scanner": "repobility-docker", "fingerprint": "7f80983f54868d8bec198a3977b7dcbe8bfb5f2291356d590fb078148e91780d", "category": "docker", "severity": "low", "confidence": 0.62, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "App-like service has no security_opt no-new-privileges setting.", "evidence": {"rule_id": "DKC010", "scanner": "repobility-docker", "service": "octomate", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|7f80983f54868d8bec198a3977b7dcbe8bfb5f2291356d590fb078148e91780d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "DKC006", "level": "note", "message": {"text": "Compose service does not declare a runtime user"}, "properties": {"repobilityId": 469708, "scanner": "repobility-docker", "fingerprint": "2ae03d2ca68f689d193058b7c353aabad57bc3d37942d6a7c1406762df909513", "category": "docker", "severity": "low", "confidence": 0.56, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Service has no user setting and Repobility could not prove the image runs non-root.", "evidence": {"rule_id": "DKC006", "scanner": "repobility-docker", "service": "octomate", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|2ae03d2ca68f689d193058b7c353aabad57bc3d37942d6a7c1406762df909513"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "DKR008", "level": "note", "message": {"text": ".dockerignore misses sensitive defaults"}, "properties": {"repobilityId": 469707, "scanner": "repobility-docker", "fingerprint": "aea2ad92c68c4ee1f8432bb1ec25e7d45ac12c9e1790ac2d3fffe638b1acce12", "category": "docker", "severity": "low", "confidence": 0.72, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "A Docker build context should exclude secrets and repository metadata.", "evidence": {"rule_id": "DKR008", "scanner": "repobility-docker", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/"], "correlation_key": "fp|aea2ad92c68c4ee1f8432bb1ec25e7d45ac12c9e1790ac2d3fffe638b1acce12", "missing_patterns": ["id_rsa", "*.pem", "*.key"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".dockerignore"}, "region": {"startLine": 1}}}]}, {"ruleId": "COMP001", "level": "note", "message": {"text": "[COMP001] High cognitive complexity: Function `create_app` has cognitive complexity 8 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand \u2014 nested branches, boolean chains, and recursion all weigh in. Breakdown: if=5, ternary=3."}, "properties": {"repobilityId": 469692, "scanner": "repobility-threat-engine", "fingerprint": "f0cf0a48f7bdb21216bd0cc93a3c7d733b83fab66bb0d38ac67cffe767f11ad4", "category": "quality", "severity": "low", "confidence": 0.95, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "AST-derived cognitive complexity score = 8 (severity threshold for low: 8+).", "evidence": {"scanner": "repobility-threat-engine", "function": "create_app", "breakdown": {"if": 5, "ternary": 3}, "complexity": 8, "correlation_key": "fp|f0cf0a48f7bdb21216bd0cc93a3c7d733b83fab66bb0d38ac67cffe767f11ad4"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 30}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 469655, "scanner": "repobility-ai-code-hygiene", "fingerprint": "17f1144bdcb57c0183c32208e1021588411ca4b9dee93096d86229676c3d7dd4", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "octomate/tentacles/channel/lark/chromo.py", "duplicate_line": 93, "correlation_key": "fp|17f1144bdcb57c0183c32208e1021588411ca4b9dee93096d86229676c3d7dd4"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/tentacles/channel/lark/feelers/output.py"}, "region": {"startLine": 91}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 469654, "scanner": "repobility-ai-code-hygiene", "fingerprint": "1206610ae16898bbd306daf7cfe626db46d89a98d6124228274b5b42da749d1b", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "octomate/tentacles/agent/claude/base.py", "duplicate_line": 355, "correlation_key": "fp|1206610ae16898bbd306daf7cfe626db46d89a98d6124228274b5b42da749d1b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/tentacles/agent/inkling/base.py"}, "region": {"startLine": 99}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 469653, "scanner": "repobility-ai-code-hygiene", "fingerprint": "e2baddb5d2a61c528bff36026d22abe859b4235de6f5687641cd11135d5d4441", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "octomate/models/deferred.py", "duplicate_line": 41, "correlation_key": "fp|e2baddb5d2a61c528bff36026d22abe859b4235de6f5687641cd11135d5d4441"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/models/todos.py"}, "region": {"startLine": 37}}}]}, {"ruleId": "CORE_NO_LICENSE", "level": "note", "message": {"text": "No LICENSE file"}, "properties": {"repobilityId": 469651, "scanner": "repobility-core", "fingerprint": "9314e9238cd99885865b92490d1aaa96ca62b1390c9377878d5f3d99227e1c3c", "category": "documentation", "severity": "low", "confidence": null, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"rule_id": "CORE_NO_LICENSE", "scanner": "repobility-core", "correlation_key": "repo|documentation|core_no_license"}}}, {"ruleId": "MINED050", "level": "none", "message": {"text": "[MINED050] Stub Only Function: Function declared but body is just pass, return None, raise NotImplementedError, or TODO comment."}, "properties": {"repobilityId": 469704, "scanner": "repobility-threat-engine", "fingerprint": "995b2248d1cc9ca80cb2e1281cd420aecdffe5ae45fc240a82e5284ff98f9e59", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "stub-only-function", "owasp": null, "cwe_ids": ["CWE-1188"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348017+00:00", "triaged_in_corpus": 12, "observations_count": 633513, "ai_coder_pattern_id": 2}, "scanner": "repobility-threat-engine", "correlation_key": "fp|995b2248d1cc9ca80cb2e1281cd420aecdffe5ae45fc240a82e5284ff98f9e59"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/tentacles/channel/web/vercel/base.py"}, "region": {"startLine": 59}}}]}, {"ruleId": "MINED050", "level": "none", "message": {"text": "[MINED050] Stub Only Function: Function declared but body is just pass, return None, raise NotImplementedError, or TODO comment."}, "properties": {"repobilityId": 469703, "scanner": "repobility-threat-engine", "fingerprint": "a73d17436b591de3e2eb34b819878529a942aa156c42969edcad7ec65c2bafe9", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "stub-only-function", "owasp": null, "cwe_ids": ["CWE-1188"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348017+00:00", "triaged_in_corpus": 12, "observations_count": 633513, "ai_coder_pattern_id": 2}, "scanner": "repobility-threat-engine", "correlation_key": "fp|a73d17436b591de3e2eb34b819878529a942aa156c42969edcad7ec65c2bafe9"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/tentacles/channel/napcat/base.py"}, "region": {"startLine": 81}}}]}, {"ruleId": "MINED050", "level": "none", "message": {"text": "[MINED050] Stub Only Function: Function declared but body is just pass, return None, raise NotImplementedError, or TODO comment."}, "properties": {"repobilityId": 469702, "scanner": "repobility-threat-engine", "fingerprint": "eac1056df342a6907e423e497fe6c53a80c2fe4737892f6fe0e057e53925e088", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "stub-only-function", "owasp": null, "cwe_ids": ["CWE-1188"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348017+00:00", "triaged_in_corpus": 12, "observations_count": 633513, "ai_coder_pattern_id": 2}, "scanner": "repobility-threat-engine", "correlation_key": "fp|eac1056df342a6907e423e497fe6c53a80c2fe4737892f6fe0e057e53925e088"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/tentacles/channel/lark/base.py"}, "region": {"startLine": 147}}}]}, {"ruleId": "MINED062", "level": "none", "message": {"text": "[MINED062] Python Dataclass No Fields (and 5 more): Same pattern found in 5 additional files. Review if needed."}, "properties": {"repobilityId": 469699, "scanner": "repobility-threat-engine", "fingerprint": "f21a509cb42d5a10654d67728dd01be5ca388dbc41df3dd3b607b559fba18ef1", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 5 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"mined": true, "mining": {"slug": "python-dataclass-no-fields", "owasp": null, "cwe_ids": [], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348046+00:00", "triaged_in_corpus": 10, "observations_count": 92448, "ai_coder_pattern_id": 144}, "scanner": "repobility-threat-engine", "aggregated": true, "correlation_key": "fp|f21a509cb42d5a10654d67728dd01be5ca388dbc41df3dd3b607b559fba18ef1", "aggregated_count": 5}}}, {"ruleId": "MINED062", "level": "none", "message": {"text": "[MINED062] Python Dataclass No Fields: @dataclass over an empty class \u2014 unfinished model."}, "properties": {"repobilityId": 469698, "scanner": "repobility-threat-engine", "fingerprint": "9c3b2acaf70bcd7eed8acc02ceb8f39dbf6848a2a963917f97b3f9ebace95837", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "python-dataclass-no-fields", "owasp": null, "cwe_ids": [], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348046+00:00", "triaged_in_corpus": 10, "observations_count": 92448, "ai_coder_pattern_id": 144}, "scanner": "repobility-threat-engine", "correlation_key": "fp|9c3b2acaf70bcd7eed8acc02ceb8f39dbf6848a2a963917f97b3f9ebace95837"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/capabilities/history.py"}, "region": {"startLine": 91}}}]}, {"ruleId": "MINED062", "level": "none", "message": {"text": "[MINED062] Python Dataclass No Fields: @dataclass over an empty class \u2014 unfinished model."}, "properties": {"repobilityId": 469697, "scanner": "repobility-threat-engine", "fingerprint": "f03ab49c3d58a495832ecb893457eb3c85128304fd51788ffabd33ae84e4965c", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "python-dataclass-no-fields", "owasp": null, "cwe_ids": [], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348046+00:00", "triaged_in_corpus": 10, "observations_count": 92448, "ai_coder_pattern_id": 144}, "scanner": "repobility-threat-engine", "correlation_key": "fp|f03ab49c3d58a495832ecb893457eb3c85128304fd51788ffabd33ae84e4965c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/capabilities/events.py"}, "region": {"startLine": 46}}}]}, {"ruleId": "MINED062", "level": "none", "message": {"text": "[MINED062] Python Dataclass No Fields: @dataclass over an empty class \u2014 unfinished model."}, "properties": {"repobilityId": 469696, "scanner": "repobility-threat-engine", "fingerprint": "b5d658079b6ef642c1365c025e6ada6495182033a5e824c155f0722c417d1c9d", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "python-dataclass-no-fields", "owasp": null, "cwe_ids": [], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348046+00:00", "triaged_in_corpus": 10, "observations_count": 92448, "ai_coder_pattern_id": 144}, "scanner": "repobility-threat-engine", "correlation_key": "fp|b5d658079b6ef642c1365c025e6ada6495182033a5e824c155f0722c417d1c9d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/base.py"}, "region": {"startLine": 34}}}]}, {"ruleId": "COMP001", "level": "none", "message": {"text": "[COMP001] High cognitive complexity (and 27 more): Same pattern found in 27 additional files. Review if needed."}, "properties": {"repobilityId": 469695, "scanner": "repobility-threat-engine", "fingerprint": "26623a4384c15353821760bd652659c8310cb263e68e02d0d97e21365c6a16f3", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 27 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"scanner": "repobility-threat-engine", "function": "create_app", "breakdown": {"if": 5, "ternary": 3}, "aggregated": true, "complexity": 8, "correlation_key": "fp|26623a4384c15353821760bd652659c8310cb263e68e02d0d97e21365c6a16f3", "aggregated_count": 27}}}, {"ruleId": "MINED043", "level": "none", "message": {"text": "[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data."}, "properties": {"repobilityId": 469691, "scanner": "repobility-threat-engine", "fingerprint": "2b8966d1157c484083c3d98a8cdf2e3b1af6931bb1947412db482e1e7cbceb99", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "http-not-https", "owasp": "A02:2021", "cwe_ids": ["CWE-319"], "precision": 0.917, "promoted_at": "2026-05-18T14:01:32.347999+00:00", "triaged_in_corpus": 12, "observations_count": 4113831, "ai_coder_pattern_id": 15}, "scanner": "repobility-threat-engine", "correlation_key": "fp|2b8966d1157c484083c3d98a8cdf2e3b1af6931bb1947412db482e1e7cbceb99"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py"}, "region": {"startLine": 139}}}]}, {"ruleId": "MINED043", "level": "none", "message": {"text": "[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data."}, "properties": {"repobilityId": 469690, "scanner": "repobility-threat-engine", "fingerprint": "ceb531b30b67d027ab6c00459fc64ae6be781508535c9752f4d43cec889650e8", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "http-not-https", "owasp": "A02:2021", "cwe_ids": ["CWE-319"], "precision": 0.917, "promoted_at": "2026-05-18T14:01:32.347999+00:00", "triaged_in_corpus": 12, "observations_count": 4113831, "ai_coder_pattern_id": 15}, "scanner": "repobility-threat-engine", "correlation_key": "fp|ceb531b30b67d027ab6c00459fc64ae6be781508535c9752f4d43cec889650e8"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 56}}}]}, {"ruleId": "AUC003", "level": "error", "message": {"text": "[AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: GET /{chat_id}."}, "properties": {"repobilityId": 469755, "scanner": "repobility-access-control", "fingerprint": "ec8c70faedebb40a2b348155e43233d802cb98f26731ba1f7ded5803c6f464fb", "category": "auth", "severity": "high", "confidence": 0.7, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"path": "/{chat_id}", "method": "GET", "scanner": "repobility-access-control", "framework": "FastAPI", "correlation_key": "code|auth|token|94|cwe-639", "identity_targets": ["unknown", "owner"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/tentacles/channel/web/vercel/routes.py"}, "region": {"startLine": 94}}}]}, {"ruleId": "GHSA-5rvq-cxj2-64vf", "level": "error", "message": {"text": "python-multipart: GHSA-5rvq-cxj2-64vf"}, "properties": {"repobilityId": 469750, "scanner": "osv-scanner", "fingerprint": "d1b8e75b4089ebdb078c4314ec0cc433640bf7fc5ae6341e51ea7afc27357e08", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-53539"], "package": "python-multipart", "rule_id": "GHSA-5rvq-cxj2-64vf", "scanner": "osv-scanner", "correlation_key": "vuln|python-multipart|CVE-2026-53539|uv.lock"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "PYSEC-2026-179", "level": "error", "message": {"text": "pyjwt: PYSEC-2026-179"}, "properties": {"repobilityId": 469747, "scanner": "osv-scanner", "fingerprint": "3a8c92a4bc42452ab63c8b780593c12b550761e77665f811c437dd35791069ae", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "Collapsed 1 duplicate scanner signal(s) for the same underlying issue.", "evidence": {"match": "", "aliases": ["CVE-2026-48526", "GHSA-xgmm-8j9v-c9wx"], "package": "pyjwt", "rule_id": "PYSEC-2026-179", "scanner": "osv-scanner", "correlation_key": "vuln|pyjwt|CVE-2026-48526|uv.lock", "duplicate_count": 1, "duplicate_rule_ids": ["GHSA-xgmm-8j9v-c9wx", "PYSEC-2026-179"], "duplicate_scanners": ["osv-scanner"], "duplicate_fingerprints": ["3a8c92a4bc42452ab63c8b780593c12b550761e77665f811c437dd35791069ae", "da86ce6a38ff47e3e8bec1678d81dfa2db14f43446b528d8ea50a2d7a662c412"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "PYSEC-2026-178", "level": "error", "message": {"text": "pyjwt: PYSEC-2026-178"}, "properties": {"repobilityId": 469746, "scanner": "osv-scanner", "fingerprint": "529afc49608a001ef35ca72e2e5bf2ab615fb9fdf39e2d3fc621ae3c7274698b", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "Collapsed 1 duplicate scanner signal(s) for the same underlying issue.", "evidence": {"match": "", "aliases": ["CVE-2026-48525", "GHSA-w7vc-732c-9m39"], "package": "pyjwt", "rule_id": "PYSEC-2026-178", "scanner": "osv-scanner", "correlation_key": "vuln|pyjwt|CVE-2026-48525|uv.lock", "duplicate_count": 1, "duplicate_rule_ids": ["GHSA-w7vc-732c-9m39", "PYSEC-2026-178"], "duplicate_scanners": ["osv-scanner"], "duplicate_fingerprints": ["529afc49608a001ef35ca72e2e5bf2ab615fb9fdf39e2d3fc621ae3c7274698b", "ae58e877d7147892fc1cdc33ade0f9016eaf354cb32906917c75e770d828a48e"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "PYSEC-2026-177", "level": "error", "message": {"text": "pyjwt: PYSEC-2026-177"}, "properties": {"repobilityId": 469745, "scanner": "osv-scanner", "fingerprint": "e4a57bf8d7416024fd079256b08e268bcee4f11f05b7eaee044fc1d8b95a1189", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "Collapsed 1 duplicate scanner signal(s) for the same underlying issue.", "evidence": {"match": "", "aliases": ["CVE-2026-48524", "GHSA-fhv5-28vv-h8m8"], "package": "pyjwt", "rule_id": "PYSEC-2026-177", "scanner": "osv-scanner", "correlation_key": "vuln|pyjwt|CVE-2026-48524|uv.lock", "duplicate_count": 1, "duplicate_rule_ids": ["GHSA-fhv5-28vv-h8m8", "PYSEC-2026-177"], "duplicate_scanners": ["osv-scanner"], "duplicate_fingerprints": ["3affda48f7eba44140d4227d3cd700b9b3d4400c3666331fce79b27f7b8baf8b", "e4a57bf8d7416024fd079256b08e268bcee4f11f05b7eaee044fc1d8b95a1189"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "PYSEC-2026-175", "level": "error", "message": {"text": "pyjwt: PYSEC-2026-175"}, "properties": {"repobilityId": 469744, "scanner": "osv-scanner", "fingerprint": "5008712fe3bda523fafb9d2d087e037a86c42cd2bee1401e12b9c2d636db62f1", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-48522", "GHSA-993g-76c3-p5m4"], "package": "pyjwt", "rule_id": "PYSEC-2026-175", "scanner": "osv-scanner", "correlation_key": "vuln|pyjwt|CVE-2026-48522|uv.lock"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-f4xh-w4cj-qxq8", "level": "error", "message": {"text": "langsmith: GHSA-f4xh-w4cj-qxq8"}, "properties": {"repobilityId": 469742, "scanner": "osv-scanner", "fingerprint": "c1bfdf17cfaf9ec9c2d89e9c7f0bce4cfca4d5372d16077dfcfd2d9ed82b9982", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "package": "langsmith", "rule_id": "GHSA-f4xh-w4cj-qxq8", "scanner": "osv-scanner", "correlation_key": "vuln|langsmith|GHSA-F4XH-W4CJ-QXQ8|uv.lock"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "PYSEC-2026-215", "level": "error", "message": {"text": "idna: PYSEC-2026-215"}, "properties": {"repobilityId": 469741, "scanner": "osv-scanner", "fingerprint": "1ea079cb1f6d31c6a9957d030eeea3ee85932f00d4e09b856c4f8edd1cf46668", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "Collapsed 1 duplicate scanner signal(s) for the same underlying issue.", "evidence": {"match": "", "aliases": ["CVE-2026-45409", "GHSA-65pc-fj4g-8rjx"], "package": "idna", "rule_id": "PYSEC-2026-215", "scanner": "osv-scanner", "correlation_key": "vuln|idna|CVE-2024-3651|uv.lock", "duplicate_count": 1, "duplicate_rule_ids": ["GHSA-65pc-fj4g-8rjx", "PYSEC-2026-215"], "duplicate_scanners": ["osv-scanner"], "duplicate_fingerprints": ["1ea079cb1f6d31c6a9957d030eeea3ee85932f00d4e09b856c4f8edd1cf46668", "3cb0e6e51097792f0802522bd5a1c534f3c96b9d90576d70a538075f8c4d5bb0"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-537c-gmf6-5ccf", "level": "error", "message": {"text": "cryptography: GHSA-537c-gmf6-5ccf"}, "properties": {"repobilityId": 469740, "scanner": "osv-scanner", "fingerprint": "af943e2fe3ba1a79e5ec053949ece37897bdfafdca8c5f7b95b5f2d633d34331", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "package": "cryptography", "rule_id": "GHSA-537c-gmf6-5ccf", "scanner": "osv-scanner", "correlation_key": "vuln|cryptography|GHSA-537C-GMF6-5CCF|uv.lock"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "DKC013", "level": "error", "message": {"text": "Database service has no persistent data volume"}, "properties": {"repobilityId": 469722, "scanner": "repobility-docker", "fingerprint": "300d6f5a85a9117163cec3ef2bb2ee8ffb19fb95a8f32e0d157693cbabb57fed", "category": "docker", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Database-like service does not mount a known data directory.", "evidence": {"rule_id": "DKC013", "scanner": "repobility-docker", "service": "postgres", "references": ["https://docs.docker.com/engine/storage/volumes/"], "correlation_key": "fp|300d6f5a85a9117163cec3ef2bb2ee8ffb19fb95a8f32e0d157693cbabb57fed", "expected_targets": ["/var/lib/postgresql/data"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 97}}}]}, {"ruleId": "DKC011", "level": "error", "message": {"text": "Database service publishes a host port"}, "properties": {"repobilityId": 469721, "scanner": "repobility-docker", "fingerprint": "d2035eaf9443d817eaf7afbb2cdfa37893fa5596058d96c908ea01c0821b80eb", "category": "docker", "severity": "high", "confidence": 0.84, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Database-like image publishes host ports without a loopback-only bind.", "evidence": {"ports": [{"raw": "5432:5432", "target": "5432", "host_ip": "", "published": "5432"}], "rule_id": "DKC011", "scanner": "repobility-docker", "service": "postgres", "references": ["https://docs.docker.com/compose/how-tos/environment-variables/best-practices/", "https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "exposure_scope": "public", "correlation_key": "fp|d2035eaf9443d817eaf7afbb2cdfa37893fa5596058d96c908ea01c0821b80eb"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 97}}}]}, {"ruleId": "SEC029", "level": "error", "message": {"text": "[SEC029] Server-Side Request Forgery (SSRF) \u2014 outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.254.169.254 metadata, internal Kubernetes endpoints, file:// URIs), exfiltrate data, or pivot through your network. SSRF is OWASP A10:2021 and a frequent foothold in cloud breaches."}, "properties": {"repobilityId": 469705, "scanner": "repobility-threat-engine", "fingerprint": "b7f88e475eeaa6ee89db73d50216afa427845952659fe32ddfac56645d4cd9ee", "category": "ssrf", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "http.get(\n                    r", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC029", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|b7f88e475eeaa6ee89db73d50216afa427845952659fe32ddfac56645d4cd9ee"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/tentacles/channel/slack/ink.py"}, "region": {"startLine": 88}}}]}, {"ruleId": "MINED001", "level": "error", "message": {"text": "[MINED001] Bare Except Pass: except: pass or except Exception: pass \u2014 silently swallows everything including KeyboardInterrupt and bugs."}, "properties": {"repobilityId": 469701, "scanner": "repobility-threat-engine", "fingerprint": "a17d31b7a856c9183e4457bd2fe3f5c172351ac1109b3619c90a5e969df7a22c", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "bare-except-pass", "owasp": null, "cwe_ids": ["CWE-755"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347744+00:00", "triaged_in_corpus": 15, "observations_count": 1550824, "ai_coder_pattern_id": 6}, "scanner": "repobility-threat-engine", "correlation_key": "fp|a17d31b7a856c9183e4457bd2fe3f5c172351ac1109b3619c90a5e969df7a22c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/tentacles/channel/napcat/base.py"}, "region": {"startLine": 80}}}]}, {"ruleId": "MINED001", "level": "error", "message": {"text": "[MINED001] Bare Except Pass: except: pass or except Exception: pass \u2014 silently swallows everything including KeyboardInterrupt and bugs."}, "properties": {"repobilityId": 469700, "scanner": "repobility-threat-engine", "fingerprint": "f8b3d0bd7c3024efdd621b2f6df9c293b15fde5bde32ff65914620fd49655c32", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "bare-except-pass", "owasp": null, "cwe_ids": ["CWE-755"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347744+00:00", "triaged_in_corpus": 15, "observations_count": 1550824, "ai_coder_pattern_id": 6}, "scanner": "repobility-threat-engine", "correlation_key": "fp|f8b3d0bd7c3024efdd621b2f6df9c293b15fde5bde32ff65914620fd49655c32"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/tentacles/channel/lark/base.py"}, "region": {"startLine": 146}}}]}, {"ruleId": "COMP001", "level": "error", "message": {"text": "[COMP001] High cognitive complexity: Function `validate_channel_agent_routes` has cognitive complexity 31 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand \u2014 nested branches, boolean chains, and recursion all weigh in. Breakdown: continue=3, elif=1, for=2, if=8, nested_bonus=17."}, "properties": {"repobilityId": 469694, "scanner": "repobility-threat-engine", "fingerprint": "0636431afbd202ecbd5acb6b7e4c5557b88ef8d6f34f0bf1fd18458b4baf0f50", "category": "quality", "severity": "high", "confidence": 0.95, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "AST-derived cognitive complexity score = 31 (severity threshold for high: 25+).", "evidence": {"scanner": "repobility-threat-engine", "function": "validate_channel_agent_routes", "breakdown": {"if": 8, "for": 2, "elif": 1, "continue": 3, "nested_bonus": 17}, "complexity": 31, "correlation_key": "fp|0636431afbd202ecbd5acb6b7e4c5557b88ef8d6f34f0bf1fd18458b4baf0f50"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/config/__init__.py"}, "region": {"startLine": 76}}}]}, {"ruleId": "MINED118", "level": "error", "message": {"text": "Dockerfile FROM `ghcr.io/astral-sh/uv:python3.13-bookworm-slim` not pinned by digest"}, "properties": {"repobilityId": 469688, "scanner": "repobility-supply-chain", "fingerprint": "cf8059ed3cc8186cfde13807936858bb6dc016189d796ffbd35b56eab737e827", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "docker-from-unpinned", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["dockerfile"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|cf8059ed3cc8186cfde13807936858bb6dc016189d796ffbd35b56eab737e827"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "MINED112", "level": "error", "message": {"text": "FastAPI POST /api/chat has no auth"}, "properties": {"repobilityId": 469687, "scanner": "repobility-route-auth", "fingerprint": "910123818ea6ce1214ab61f83455526ac59681491f974d3e19c20a89ad4a3d95", "category": "quality", "severity": "high", "confidence": 0.8, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "fastapi-destructive-unauth", "owasp": "A01:2021", "cwe_ids": ["CWE-306", "CWE-862"], "languages": ["python", "javascript"], "observations_count": 10455}, "scanner": "repobility-route-auth", "correlation_key": "fp|910123818ea6ce1214ab61f83455526ac59681491f974d3e19c20a89ad4a3d95"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/tentacles/channel/web/vercel/routes.py"}, "region": {"startLine": 53}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.octomate` used but never assigned in __init__"}, "properties": {"repobilityId": 469685, "scanner": "repobility-ast-engine", "fingerprint": "4266395f0720ad0158e89a368ec3fec3c4b6b9a289e70cdd15bb42e594d29330", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|4266395f0720ad0158e89a368ec3fec3c4b6b9a289e70cdd15bb42e594d29330"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/tentacles/agent/claude/base.py"}, "region": {"startLine": 367}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.octomate` used but never assigned in __init__"}, "properties": {"repobilityId": 469684, "scanner": "repobility-ast-engine", "fingerprint": "4850a856aff87f3861f890342c60ec72ede86ef1364c087c10d3400d3d7b5677", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|4850a856aff87f3861f890342c60ec72ede86ef1364c087c10d3400d3d7b5677"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/tentacles/agent/claude/base.py"}, "region": {"startLine": 185}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.id` used but never assigned in __init__"}, "properties": {"repobilityId": 469683, "scanner": "repobility-ast-engine", "fingerprint": "4b98e87aaaa0c9feb7b49e09ca0e2513b4dc614c33a58b5b0ea66ac6c20b8bb4", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|4b98e87aaaa0c9feb7b49e09ca0e2513b4dc614c33a58b5b0ea66ac6c20b8bb4"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/tentacles/agent/claude/base.py"}, "region": {"startLine": 340}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.id` used but never assigned in __init__"}, "properties": {"repobilityId": 469682, "scanner": "repobility-ast-engine", "fingerprint": "f568e480b4cb5aafa9c48295f28c86326a725dbb39952b5096b7aaffc0a203e9", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|f568e480b4cb5aafa9c48295f28c86326a725dbb39952b5096b7aaffc0a203e9"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/tentacles/agent/claude/base.py"}, "region": {"startLine": 186}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.octomate` used but never assigned in __init__"}, "properties": {"repobilityId": 469681, "scanner": "repobility-ast-engine", "fingerprint": "cb20d377a88ac0eccadaa9217bd63c5d583f1db43411f8c9087a90e00eb13758", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|cb20d377a88ac0eccadaa9217bd63c5d583f1db43411f8c9087a90e00eb13758"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/tentacles/agent/claude/base.py"}, "region": {"startLine": 158}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.octomate` used but never assigned in __init__"}, "properties": {"repobilityId": 469680, "scanner": "repobility-ast-engine", "fingerprint": "b5f13d42a06c8593bcbf812ebda25717c76372e60c91febb6de068f1dd24cffb", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|b5f13d42a06c8593bcbf812ebda25717c76372e60c91febb6de068f1dd24cffb"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/tentacles/agent/claude/base.py"}, "region": {"startLine": 162}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.octomate` used but never assigned in __init__"}, "properties": {"repobilityId": 469679, "scanner": "repobility-ast-engine", "fingerprint": "500ec0684373bd34fa57b917b7199a045b28fc5b06c513b25258df8d3141e46a", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|500ec0684373bd34fa57b917b7199a045b28fc5b06c513b25258df8d3141e46a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/tentacles/agent/claude/base.py"}, "region": {"startLine": 139}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.id` used but never assigned in __init__"}, "properties": {"repobilityId": 469678, "scanner": "repobility-ast-engine", "fingerprint": "a670215586c6faf1761bad9c293729a6c48c30d9c30eae84dec6642b260d774d", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|a670215586c6faf1761bad9c293729a6c48c30d9c30eae84dec6642b260d774d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/tentacles/agent/claude/base.py"}, "region": {"startLine": 141}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.octomate` used but never assigned in __init__"}, "properties": {"repobilityId": 469677, "scanner": "repobility-ast-engine", "fingerprint": "fe7bd5184a6823917705df8b1e11109308cb43a47f3e68a4f79be69197e64265", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|fe7bd5184a6823917705df8b1e11109308cb43a47f3e68a4f79be69197e64265"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/tentacles/agent/claude/base.py"}, "region": {"startLine": 132}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.id` used but never assigned in __init__"}, "properties": {"repobilityId": 469676, "scanner": "repobility-ast-engine", "fingerprint": "92b08edea7e00b0e0043c6353872ca6767fab9a2268b4308926adaf46857d9e3", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|92b08edea7e00b0e0043c6353872ca6767fab9a2268b4308926adaf46857d9e3"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/tentacles/channel/base.py"}, "region": {"startLine": 294}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.id` used but never assigned in __init__"}, "properties": {"repobilityId": 469675, "scanner": "repobility-ast-engine", "fingerprint": "47ec78fbc7b5147d5a172c51698796d42adbfd4ee244cae97cd1269c6607546a", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|47ec78fbc7b5147d5a172c51698796d42adbfd4ee244cae97cd1269c6607546a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/tentacles/channel/base.py"}, "region": {"startLine": 289}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.id` used but never assigned in __init__"}, "properties": {"repobilityId": 469674, "scanner": "repobility-ast-engine", "fingerprint": "4e86169703dca67efc93d7c6842d162be98aa5269e1c494a99b22b0a7336a7ed", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|4e86169703dca67efc93d7c6842d162be98aa5269e1c494a99b22b0a7336a7ed"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/tentacles/channel/base.py"}, "region": {"startLine": 251}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.octomate` used but never assigned in __init__"}, "properties": {"repobilityId": 469673, "scanner": "repobility-ast-engine", "fingerprint": "f9cc988c87b4cc8be6236dfee5b7da8b678f56a31303ef9d9258301799d6954a", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|f9cc988c87b4cc8be6236dfee5b7da8b678f56a31303ef9d9258301799d6954a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/tentacles/channel/base.py"}, "region": {"startLine": 240}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.id` used but never assigned in __init__"}, "properties": {"repobilityId": 469672, "scanner": "repobility-ast-engine", "fingerprint": "c67c374046ab20540f0afe5b5fb77c4f2b56470f99289bc9a8784767aef88825", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|c67c374046ab20540f0afe5b5fb77c4f2b56470f99289bc9a8784767aef88825"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/tentacles/channel/base.py"}, "region": {"startLine": 242}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.id` used but never assigned in __init__"}, "properties": {"repobilityId": 469671, "scanner": "repobility-ast-engine", "fingerprint": "338cb825270ce0cb6057e710ac686ae8395e981b220da0c4f62c886e368a53a0", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|338cb825270ce0cb6057e710ac686ae8395e981b220da0c4f62c886e368a53a0"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/tentacles/channel/base.py"}, "region": {"startLine": 236}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.id` used but never assigned in __init__"}, "properties": {"repobilityId": 469670, "scanner": "repobility-ast-engine", "fingerprint": "d417dd0147f21155fdde20351dae5f8d766459501aee04a28f8dd4caae412eae", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|d417dd0147f21155fdde20351dae5f8d766459501aee04a28f8dd4caae412eae"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/tentacles/channel/base.py"}, "region": {"startLine": 225}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.id` used but never assigned in __init__"}, "properties": {"repobilityId": 469669, "scanner": "repobility-ast-engine", "fingerprint": "110a3fa004fbb09539d2567f4b79246efd625f6a278502aae8907fee87c3fbe3", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|110a3fa004fbb09539d2567f4b79246efd625f6a278502aae8907fee87c3fbe3"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/tentacles/channel/base.py"}, "region": {"startLine": 217}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.id` used but never assigned in __init__"}, "properties": {"repobilityId": 469668, "scanner": "repobility-ast-engine", "fingerprint": "a898c62bc852cd57d884082412c3232c58bdcb89c6d9a63a2d8ddc0f5385a4a9", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|a898c62bc852cd57d884082412c3232c58bdcb89c6d9a63a2d8ddc0f5385a4a9"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/tentacles/channel/base.py"}, "region": {"startLine": 212}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.id` used but never assigned in __init__"}, "properties": {"repobilityId": 469667, "scanner": "repobility-ast-engine", "fingerprint": "e81a3a7a1e509e28799e9f5b6660d039d744252a722aa030f6f92d024160ca6f", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|e81a3a7a1e509e28799e9f5b6660d039d744252a722aa030f6f92d024160ca6f"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/tentacles/channel/base.py"}, "region": {"startLine": 189}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.parts` used but never assigned in __init__"}, "properties": {"repobilityId": 469665, "scanner": "repobility-ast-engine", "fingerprint": "2f6cd8ac799c5e4ac588793ffdb9f9a0a2eaa05d2dc51448bdfa72d1fa7c7d32", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|2f6cd8ac799c5e4ac588793ffdb9f9a0a2eaa05d2dc51448bdfa72d1fa7c7d32"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/schemas/messages.py"}, "region": {"startLine": 138}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.parts` used but never assigned in __init__"}, "properties": {"repobilityId": 469664, "scanner": "repobility-ast-engine", "fingerprint": "817ed6b6054145b889eed4922f8ff5fd8b2d09e4fa1f55b2223a5a0546dcd8ac", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|817ed6b6054145b889eed4922f8ff5fd8b2d09e4fa1f55b2223a5a0546dcd8ac"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/schemas/messages.py"}, "region": {"startLine": 112}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.parts` used but never assigned in __init__"}, "properties": {"repobilityId": 469663, "scanner": "repobility-ast-engine", "fingerprint": "72cf2b7b324a326434db60a608f82fec313be554b064093368ffb416879ab4ac", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|72cf2b7b324a326434db60a608f82fec313be554b064093368ffb416879ab4ac"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/schemas/messages.py"}, "region": {"startLine": 106}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.position` used but never assigned in __init__"}, "properties": {"repobilityId": 469662, "scanner": "repobility-ast-engine", "fingerprint": "884c687262b2ee675de9e5765abb10c7be2228016044f1893ed1bc1048098d31", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|884c687262b2ee675de9e5765abb10c7be2228016044f1893ed1bc1048098d31"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/schemas/deferred.py"}, "region": {"startLine": 143}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.position` used but never assigned in __init__"}, "properties": {"repobilityId": 469661, "scanner": "repobility-ast-engine", "fingerprint": "7524942c50006889f6014cad4609954b127f71b634c100a3d36bd1ec6db80f10", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|7524942c50006889f6014cad4609954b127f71b634c100a3d36bd1ec6db80f10"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/schemas/deferred.py"}, "region": {"startLine": 140}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "Phantom test coverage: test_mark_action_presented_noops_for_unknown_action"}, "properties": {"repobilityId": 469659, "scanner": "repobility-ast-engine", "fingerprint": "9dfbb10191205b24c7656026afdda469eed18f8a27b7ae211875a6ddef166ebc", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|9dfbb10191205b24c7656026afdda469eed18f8a27b7ae211875a6ddef166ebc"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/agent/test_deferred_actions.py"}, "region": {"startLine": 202}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "`self.noticed` used but never assigned in __init__"}, "properties": {"repobilityId": 469657, "scanner": "repobility-ast-engine", "fingerprint": "9b902e93f5de941d0edda4587bf4d28c9a85661d44be2f8039d86087288e361c", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|9b902e93f5de941d0edda4587bf4d28c9a85661d44be2f8039d86087288e361c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/support/channels.py"}, "region": {"startLine": 296}}}]}, {"ruleId": "DKC007", "level": "error", "message": {"text": "Compose service contains a literal secret environment value"}, "properties": {"repobilityId": 469726, "scanner": "repobility-docker", "fingerprint": "aab4b6b972e9bf34d96e6f6d1ce5021378ac52aeefcc766cb4736aa200283c7f", "category": "docker", "severity": "critical", "confidence": 0.96, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Environment variable name is secret-like and value is a committed literal.", "evidence": {"rule_id": "DKC007", "scanner": "repobility-docker", "service": "pgadmin", "variable": "PGADMIN_DEFAULT_PASSWORD", "references": ["https://docs.docker.com/compose/how-tos/environment-variables/best-practices/", "https://docs.docker.com/reference/compose-file/secrets/"], "path_context": "runtime", "correlation_key": "fp|aab4b6b972e9bf34d96e6f6d1ce5021378ac52aeefcc766cb4736aa200283c7f", "compose_secrets_declared": false}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 111}}}]}, {"ruleId": "DKC007", "level": "error", "message": {"text": "Compose service contains a literal secret environment value"}, "properties": {"repobilityId": 469720, "scanner": "repobility-docker", "fingerprint": "e3f0a5dcbc9f60c9894690e24a19ac4c4bfe5ba50850bba7746407215ed2c576", "category": "docker", "severity": "critical", "confidence": 0.96, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Environment variable name is secret-like and value is a committed literal.", "evidence": {"rule_id": "DKC007", "scanner": "repobility-docker", "service": "postgres", "variable": "POSTGRES_PASSWORD", "references": ["https://docs.docker.com/compose/how-tos/environment-variables/best-practices/", "https://docs.docker.com/reference/compose-file/secrets/"], "path_context": "runtime", "correlation_key": "fp|e3f0a5dcbc9f60c9894690e24a19ac4c4bfe5ba50850bba7746407215ed2c576", "compose_secrets_declared": false}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 97}}}]}, {"ruleId": "DKC007", "level": "error", "message": {"text": "Compose service contains a literal secret environment value"}, "properties": {"repobilityId": 469714, "scanner": "repobility-docker", "fingerprint": "b5b433ab6bf427ca14d211a6c1bbdc4261eb6f9401ee71cba848bb7d72f853a0", "category": "docker", "severity": "critical", "confidence": 0.96, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Environment variable name is secret-like and value is a committed literal.", "evidence": {"rule_id": "DKC007", "scanner": "repobility-docker", "service": "milvus-rustfs", "variable": "RUSTFS_ACCESS_KEY", "references": ["https://docs.docker.com/compose/how-tos/environment-variables/best-practices/", "https://docs.docker.com/reference/compose-file/secrets/"], "path_context": "runtime", "correlation_key": "fp|b5b433ab6bf427ca14d211a6c1bbdc4261eb6f9401ee71cba848bb7d72f853a0", "compose_secrets_declared": false}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 61}}}]}, {"ruleId": "MINED107", "level": "error", "message": {"text": "Missing import: `http` used but not imported"}, "properties": {"repobilityId": 469686, "scanner": "repobility-ast-engine", "fingerprint": "f395233a39158e046bf4c9834bff1962256a46434e5dbbcba43ee30a3d0efde6", "category": "quality", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "missing-import-python", "owasp": "A06:2021", "cwe_ids": ["CWE-1075"], "languages": ["python"], "observations_count": 2192}, "scanner": "repobility-ast-engine", "correlation_key": "fp|f395233a39158e046bf4c9834bff1962256a46434e5dbbcba43ee30a3d0efde6"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/tentacles/channel/slack/ink.py"}, "region": {"startLine": 88}}}]}, {"ruleId": "MINED107", "level": "error", "message": {"text": "Missing import: `http` used but not imported"}, "properties": {"repobilityId": 469660, "scanner": "repobility-ast-engine", "fingerprint": "a30169dbec9210a4ea701a729576c358d592f65c09077f303037e345909d06ff", "category": "quality", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "missing-import-python", "owasp": "A06:2021", "cwe_ids": ["CWE-1075"], "languages": ["python"], "observations_count": 2192}, "scanner": "repobility-ast-engine", "correlation_key": "fp|a30169dbec9210a4ea701a729576c358d592f65c09077f303037e345909d06ff"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/channels/napcat/test_ink.py"}, "region": {"startLine": 47}}}]}, {"ruleId": "MINED107", "level": "error", "message": {"text": "Missing import: `signal` used but not imported"}, "properties": {"repobilityId": 469658, "scanner": "repobility-ast-engine", "fingerprint": "136bac904a00d1fbd3a8bcc506394a65a99f02a0baba45660db3eb3303ae53c5", "category": "quality", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "missing-import-python", "owasp": "A06:2021", "cwe_ids": ["CWE-1075"], "languages": ["python"], "observations_count": 2192}, "scanner": "repobility-ast-engine", "correlation_key": "fp|136bac904a00d1fbd3a8bcc506394a65a99f02a0baba45660db3eb3303ae53c5"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/channels/test_base.py"}, "region": {"startLine": 115}}}]}, {"ruleId": "MINED107", "level": "error", "message": {"text": "Missing import: `signal` used but not imported"}, "properties": {"repobilityId": 469656, "scanner": "repobility-ast-engine", "fingerprint": "b7345caad6bc3ae0ab9c256a6b20df1c02c92bb1a1eaecf8ac84a5c0ebedbe66", "category": "quality", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "missing-import-python", "owasp": "A06:2021", "cwe_ids": ["CWE-1075"], "languages": ["python"], "observations_count": 2192}, "scanner": "repobility-ast-engine", "correlation_key": "fp|b7345caad6bc3ae0ab9c256a6b20df1c02c92bb1a1eaecf8ac84a5c0ebedbe66"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/base.py"}, "region": {"startLine": 79}}}]}, {"ruleId": "scanner-4f8ab5dfe7542aa5", "level": "note", "message": {"text": "Possibly dead Python function: create_app"}, "properties": {"repobilityId": "a79cd2100928826c", "scanner": "scanner-primary", "fingerprint": "4f8ab5dfe7542aa5", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "main.py:30"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-05b5880aebb4aa63", "level": "note", "message": {"text": "Possibly dead Python function: process_bind_param"}, "properties": {"repobilityId": "a51428934072abb6", "scanner": "scanner-primary", "fingerprint": "05b5880aebb4aa63", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/models/messages.py:32"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6cf1015416ba832b", "level": "note", "message": {"text": "Possibly dead Python function: run_graph"}, "properties": {"repobilityId": "46a72423724bec8b", "scanner": "scanner-primary", "fingerprint": "6cf1015416ba832b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/capabilities/react.py:321"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d3358aee3ccf17c3", "level": "note", "message": {"text": "Possibly dead Python function: ask_user_question"}, "properties": {"repobilityId": "8d8fd8864087c6b4", "scanner": "scanner-primary", "fingerprint": "d3358aee3ccf17c3", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/tentacles/agent/claude/base.py:268"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-225f763a8759380a", "level": "note", "message": {"text": "Possibly dead Python function: segment_discriminator"}, "properties": {"repobilityId": "c72e330496cde83a", "scanner": "scanner-primary", "fingerprint": "225f763a8759380a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/tentacles/channel/napcat/schema.py:150"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0e9cbbd8d021a8e8", "level": "note", "message": {"text": "Possibly dead Python function: full_text"}, "properties": {"repobilityId": "88bbe879178996f6", "scanner": "scanner-primary", "fingerprint": "0e9cbbd8d021a8e8", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/tentacles/channel/feelers/output.py:280"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a53c9b464e8c5dfa", "level": "note", "message": {"text": "Possibly dead Python function: should_skip_tool_call"}, "properties": {"repobilityId": "d67dff4c4b6401b4", "scanner": "scanner-primary", "fingerprint": "a53c9b464e8c5dfa", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/tentacles/channel/slack/feelers/output.py:440"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c2f08b9b2ce78a0f", "level": "note", "message": {"text": "Possibly dead Python function: should_skip_tool_result"}, "properties": {"repobilityId": "c7d3da0609cc1240", "scanner": "scanner-primary", "fingerprint": "c2f08b9b2ce78a0f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/tentacles/channel/slack/feelers/output.py:447"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a8ccb3dba40cfca6", "level": "note", "message": {"text": "Possibly dead Python function: card_block"}, "properties": {"repobilityId": "218ef3553ff6924b", "scanner": "scanner-primary", "fingerprint": "a8ccb3dba40cfca6", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/tentacles/channel/slack/feelers/cards.py:10"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d5e80b330dae5519", "level": "note", "message": {"text": "Possibly dead Python function: log_result"}, "properties": {"repobilityId": "14bdeb2834f4600f", "scanner": "scanner-primary", "fingerprint": "d5e80b330dae5519", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/tentacles/channel/lark/base.py:166"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-56ff2ffa2769c053", "level": "note", "message": {"text": "Possibly dead Python function: from_deferred_requests"}, "properties": {"repobilityId": "5b45deb7627ba54a", "scanner": "scanner-primary", "fingerprint": "56ff2ffa2769c053", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/schemas/deferred.py:162"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c259d68ad6328f7d", "level": "note", "message": {"text": "Possibly dead Python function: to_content_parts"}, "properties": {"repobilityId": "2129b03476e84146", "scanner": "scanner-primary", "fingerprint": "c259d68ad6328f7d", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/schemas/events.py:47"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5b53c610d64ff4d7", "level": "note", "message": {"text": "Possibly dead Python function: native_utc"}, "properties": {"repobilityId": "d1453ac3e3f0d978", "scanner": "scanner-primary", "fingerprint": "5b53c610d64ff4d7", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/schemas/messages.py:48"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7b1bd875f5a756b3", "level": "warning", "message": {"text": "CVE-2026-34993: aiohttp 3.13.5 \u2014 uv.lock"}, "properties": {"repobilityId": "e7977c365bb7bb0f", "scanner": "scanner-primary", "fingerprint": "7b1bd875f5a756b3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-34993"]}}, {"ruleId": "scanner-19c6593f77847057", "level": "warning", "message": {"text": "CVE-2026-47265: aiohttp 3.13.5 \u2014 uv.lock"}, "properties": {"repobilityId": "7035166482a6d084", "scanner": "scanner-primary", "fingerprint": "19c6593f77847057", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-47265"]}}, {"ruleId": "scanner-38e2a20eca2f2493", "level": "warning", "message": {"text": "CVE-2026-54273: aiohttp 3.13.5 \u2014 uv.lock"}, "properties": {"repobilityId": "af0aae7929b420d3", "scanner": "scanner-primary", "fingerprint": "38e2a20eca2f2493", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54273"]}}, {"ruleId": "scanner-58146b01331e8e00", "level": "warning", "message": {"text": "CVE-2026-54274: aiohttp 3.13.5 \u2014 uv.lock"}, "properties": {"repobilityId": "7e10ded903752976", "scanner": "scanner-primary", "fingerprint": "58146b01331e8e00", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54274"]}}, {"ruleId": "scanner-6d92e64c021d9402", "level": "warning", "message": {"text": "CVE-2026-54276: aiohttp 3.13.5 \u2014 uv.lock"}, "properties": {"repobilityId": "4eb50b27324e7d60", "scanner": "scanner-primary", "fingerprint": "6d92e64c021d9402", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54276"]}}, {"ruleId": "scanner-b7f3bfdc15e643c2", "level": "warning", "message": {"text": "CVE-2026-54277: aiohttp 3.13.5 \u2014 uv.lock"}, "properties": {"repobilityId": "76d7edda54afad46", "scanner": "scanner-primary", "fingerprint": "b7f3bfdc15e643c2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54277"]}}, {"ruleId": "scanner-d82cda415ed63e4f", "level": "warning", "message": {"text": "CVE-2026-54278: aiohttp 3.13.5 \u2014 uv.lock"}, "properties": {"repobilityId": "aebcc1b43ac4ed5e", "scanner": "scanner-primary", "fingerprint": "d82cda415ed63e4f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54278"]}}, {"ruleId": "scanner-e9846a76c6bf7076", "level": "note", "message": {"text": "CVE-2026-50269: aiohttp 3.13.5 \u2014 uv.lock"}, "properties": {"repobilityId": "ecf7a91f3d433ba8", "scanner": "scanner-primary", "fingerprint": "e9846a76c6bf7076", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-50269"]}}, {"ruleId": "scanner-866b1585aa5f6f03", "level": "note", "message": {"text": "CVE-2026-54275: aiohttp 3.13.5 \u2014 uv.lock"}, "properties": {"repobilityId": "151d3b178324b38a", "scanner": "scanner-primary", "fingerprint": "866b1585aa5f6f03", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54275"]}}, {"ruleId": "scanner-2e147b462d40fd8b", "level": "note", "message": {"text": "CVE-2026-54279: aiohttp 3.13.5 \u2014 uv.lock"}, "properties": {"repobilityId": "151a621396dd496c", "scanner": "scanner-primary", "fingerprint": "2e147b462d40fd8b", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54279"]}}, {"ruleId": "scanner-80ceef5f98b6e284", "level": "note", "message": {"text": "CVE-2026-54280: aiohttp 3.13.5 \u2014 uv.lock"}, "properties": {"repobilityId": "79293d0b4dfc10d1", "scanner": "scanner-primary", "fingerprint": "80ceef5f98b6e284", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54280"]}}, {"ruleId": "scanner-1573ce9e96f794df", "level": "error", "message": {"text": "GHSA-537c-gmf6-5ccf: cryptography 48.0.0 \u2014 uv.lock"}, "properties": {"repobilityId": "a6d76544a3204701", "scanner": "scanner-primary", "fingerprint": "1573ce9e96f794df", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-537c-gmf6-5ccf"]}}, {"ruleId": "scanner-128deffcb86baae4", "level": "warning", "message": {"text": "CVE-2026-45409: idna 3.13 \u2014 uv.lock"}, "properties": {"repobilityId": "c2f0a4d128834c6b", "scanner": "scanner-primary", "fingerprint": "128deffcb86baae4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45409"]}}, {"ruleId": "scanner-2b339bbbda5f296e", "level": "error", "message": {"text": "GHSA-f4xh-w4cj-qxq8: langsmith 0.8.3 \u2014 uv.lock"}, "properties": {"repobilityId": "efbb73d3627413e3", "scanner": "scanner-primary", "fingerprint": "2b339bbbda5f296e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-f4xh-w4cj-qxq8"]}}, {"ruleId": "scanner-18b7f00d17767b73", "level": "warning", "message": {"text": "GHSA-4xgf-cpjx-pc3j: pydantic-settings 2.14.1 \u2014 uv.lock"}, "properties": {"repobilityId": "c882a46b2faaf478", "scanner": "scanner-primary", "fingerprint": "18b7f00d17767b73", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-4xgf-cpjx-pc3j"]}}, {"ruleId": "scanner-6514fbdcfaa9204b", "level": "error", "message": {"text": "CVE-2026-48526: pyjwt 2.12.1 \u2014 uv.lock"}, "properties": {"repobilityId": "5c15467f51394509", "scanner": "scanner-primary", "fingerprint": "6514fbdcfaa9204b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48526"]}}, {"ruleId": "scanner-10d45d6df7a6f197", "level": "warning", "message": {"text": "CVE-2026-48522: pyjwt 2.12.1 \u2014 uv.lock"}, "properties": {"repobilityId": "398f7c0886f6723a", "scanner": "scanner-primary", "fingerprint": "10d45d6df7a6f197", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48522"]}}, {"ruleId": "scanner-5728cdec0dc11919", "level": "warning", "message": {"text": "CVE-2026-48523: pyjwt 2.12.1 \u2014 uv.lock"}, "properties": {"repobilityId": "626f80e71164bc6f", "scanner": "scanner-primary", "fingerprint": "5728cdec0dc11919", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48523"]}}, {"ruleId": "scanner-4ba6012c73817cff", "level": "warning", "message": {"text": "CVE-2026-48525: pyjwt 2.12.1 \u2014 uv.lock"}, "properties": {"repobilityId": "ac36236fcc88958d", "scanner": "scanner-primary", "fingerprint": "4ba6012c73817cff", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48525"]}}, {"ruleId": "scanner-898e5e1bfb2fa7db", "level": "note", "message": {"text": "CVE-2026-48524: pyjwt 2.12.1 \u2014 uv.lock"}, "properties": {"repobilityId": "11b232edb016b81d", "scanner": "scanner-primary", "fingerprint": "898e5e1bfb2fa7db", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48524"]}}, {"ruleId": "scanner-a6c223ad10729c43", "level": "error", "message": {"text": "CVE-2026-53539: python-multipart 0.0.28 \u2014 uv.lock"}, "properties": {"repobilityId": "25b2742cc7a21766", "scanner": "scanner-primary", "fingerprint": "a6c223ad10729c43", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-53539"]}}, {"ruleId": "scanner-89441572f9872346", "level": "note", "message": {"text": "CVE-2026-53537: python-multipart 0.0.28 \u2014 uv.lock"}, "properties": {"repobilityId": "f480cda055939429", "scanner": "scanner-primary", "fingerprint": "89441572f9872346", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-53537"]}}, {"ruleId": "scanner-9430ba16a182fb4d", "level": "note", "message": {"text": "CVE-2026-53538: python-multipart 0.0.28 \u2014 uv.lock"}, "properties": {"repobilityId": "2458c0fb8d686551", "scanner": "scanner-primary", "fingerprint": "9430ba16a182fb4d", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-53538"]}}, {"ruleId": "scanner-b50544acfa8285eb", "level": "note", "message": {"text": "CVE-2026-53540: python-multipart 0.0.28 \u2014 uv.lock"}, "properties": {"repobilityId": "68c69c7c120812e6", "scanner": "scanner-primary", "fingerprint": "b50544acfa8285eb", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-53540"]}}, {"ruleId": "scanner-3a3527e70129fb18", "level": "error", "message": {"text": "DS-0002: Image user should not be 'root' \u2014 Dockerfile"}, "properties": {"repobilityId": "691787f6b20605df", "scanner": "scanner-primary", "fingerprint": "3a3527e70129fb18", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-3c4041c454cda88e", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 Dockerfile"}, "properties": {"repobilityId": "da995bb2cfa21f65", "scanner": "scanner-primary", "fingerprint": "3c4041c454cda88e", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-122f91b7f2906dc4", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/settings.json"}, "properties": {"repobilityId": "a2967269048b6a9d", "scanner": "scanner-primary", "fingerprint": "122f91b7f2906dc4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/settings.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e725d2ab884fbd49", "level": "note", "message": {"text": "Multiple root agent instruction files without precedence"}, "properties": {"repobilityId": "1953db6c89508d22", "scanner": "scanner-primary", "fingerprint": "e725d2ab884fbd49", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["agent-instructions", "governance"]}}, {"ruleId": "scanner-1dc4ed452b3ac286", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in docs/plans/done/github-linear-mcp.md"}, "properties": {"repobilityId": "b643f5cb6f245629", "scanner": "scanner-primary", "fingerprint": "1dc4ed452b3ac286", "layer": "security", "severity": "medium", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/plans/done/github-linear-mcp.md"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-1dc4ed452b3ac286", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in docs/plans/done/github-linear-mcp.md"}, "properties": {"repobilityId": "b643f5cb6f245629", "scanner": "scanner-primary", "fingerprint": "1dc4ed452b3ac286", "layer": "security", "severity": "medium", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/plans/done/github-linear-mcp.md"}, "region": {"startLine": 67}}}]}, {"ruleId": "scanner-675ca1f7861b14b8", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in octomate.default.yaml"}, "properties": {"repobilityId": "1bb40c9779bfcf74", "scanner": "scanner-primary", "fingerprint": "675ca1f7861b14b8", "layer": "security", "severity": "medium", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate.default.yaml"}, "region": {"startLine": 74}}}]}, {"ruleId": "scanner-e38b1cc2067eeb3a", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in octomate/config/mcp.py"}, "properties": {"repobilityId": "c3ac47e0eb54a8b2", "scanner": "scanner-primary", "fingerprint": "e38b1cc2067eeb3a", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/config/mcp.py"}, "region": {"startLine": 9}}}]}, {"ruleId": "scanner-aaf7810c73274866", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in tests/agent/test_mcp.py"}, "properties": {"repobilityId": "63d6e0a5176b2f1d", "scanner": "scanner-primary", "fingerprint": "aaf7810c73274866", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/agent/test_mcp.py"}, "region": {"startLine": 69}}}]}, {"ruleId": "scanner-aaf7810c73274866", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in tests/agent/test_mcp.py"}, "properties": {"repobilityId": "63d6e0a5176b2f1d", "scanner": "scanner-primary", "fingerprint": "aaf7810c73274866", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/agent/test_mcp.py"}, "region": {"startLine": 80}}}]}, {"ruleId": "scanner-50d8215adda1c860", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in tests/test_config.py"}, "properties": {"repobilityId": "b71097bd446d1698", "scanner": "scanner-primary", "fingerprint": "50d8215adda1c860", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/test_config.py"}, "region": {"startLine": 372}}}]}, {"ruleId": "scanner-d4731d4200ea4c69", "level": "warning", "message": {"text": "SkillSpector EA4 (excessive-agency) in docs/plans/claude-agent-integration.md"}, "properties": {"repobilityId": "d8e9effba71d7c2d", "scanner": "scanner-primary", "fingerprint": "d4731d4200ea4c69", "layer": "security", "severity": "medium", "confidence": 0.75, "tags": ["skillspector", "mcp-skill", "excessive-agency", "EA4"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/plans/claude-agent-integration.md"}, "region": {"startLine": 117}}}]}, {"ruleId": "scanner-f1d39e12973d64f7", "level": "warning", "message": {"text": "SkillSpector EA2 (excessive-agency) in octomate/managers/conversations.py"}, "properties": {"repobilityId": "e9a1a51e6e7df1f3", "scanner": "scanner-primary", "fingerprint": "f1d39e12973d64f7", "layer": "security", "severity": "medium", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "excessive-agency", "EA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/managers/conversations.py"}, "region": {"startLine": 155}}}]}, {"ruleId": "scanner-e35e0c12c6df642a", "level": "warning", "message": {"text": "SkillSpector EA2 (excessive-agency) in octomate/schemas/conversation.py"}, "properties": {"repobilityId": "47f7f80c40f14bd4", "scanner": "scanner-primary", "fingerprint": "e35e0c12c6df642a", "layer": "security", "severity": "medium", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "excessive-agency", "EA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/schemas/conversation.py"}, "region": {"startLine": 86}}}]}, {"ruleId": "scanner-a2ae2170578b931a", "level": "warning", "message": {"text": "SkillSpector EA2 (excessive-agency) in octomate/tentacles/agent/claude/base.py"}, "properties": {"repobilityId": "760db193e9d0b279", "scanner": "scanner-primary", "fingerprint": "a2ae2170578b931a", "layer": "security", "severity": "medium", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "excessive-agency", "EA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/tentacles/agent/claude/base.py"}, "region": {"startLine": 191}}}]}, {"ruleId": "scanner-d605c809d0253f79", "level": "warning", "message": {"text": "SkillSpector EA1 (excessive-agency) in octomate/tentacles/channel/lark/feelers/approvals.py"}, "properties": {"repobilityId": "7b03e7d77e66c37a", "scanner": "scanner-primary", "fingerprint": "d605c809d0253f79", "layer": "security", "severity": "medium", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "excessive-agency", "EA1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/tentacles/channel/lark/feelers/approvals.py"}, "region": {"startLine": 74}}}]}, {"ruleId": "scanner-46c995cd51b0282f", "level": "warning", "message": {"text": "SkillSpector EA2 (excessive-agency) in tests/agent/test_claude_approval.py"}, "properties": {"repobilityId": "80a6ed49fa174858", "scanner": "scanner-primary", "fingerprint": "46c995cd51b0282f", "layer": "security", "severity": "medium", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "excessive-agency", "EA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/agent/test_claude_approval.py"}, "region": {"startLine": 288}}}]}, {"ruleId": "scanner-712fac09fbd32908", "level": "warning", "message": {"text": "SkillSpector EA4 (excessive-agency) in tests/agent/test_claude_approval.py"}, "properties": {"repobilityId": "51c7657f857ddb44", "scanner": "scanner-primary", "fingerprint": "712fac09fbd32908", "layer": "security", "severity": "medium", "confidence": 0.75, "tags": ["skillspector", "mcp-skill", "excessive-agency", "EA4"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/agent/test_claude_approval.py"}, "region": {"startLine": 351}}}]}, {"ruleId": "scanner-88afe0205102f315", "level": "error", "message": {"text": "SkillSpector PE3 (priv-esc) in .vscode/launch.json"}, "properties": {"repobilityId": "d9b76f55f214458c", "scanner": "scanner-primary", "fingerprint": "88afe0205102f315", "layer": "security", "severity": "high", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "priv-esc", "PE3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".vscode/launch.json"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-88afe0205102f315", "level": "error", "message": {"text": "SkillSpector PE3 (priv-esc) in .vscode/launch.json"}, "properties": {"repobilityId": "d9b76f55f214458c", "scanner": "scanner-primary", "fingerprint": "88afe0205102f315", "layer": "security", "severity": "high", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "priv-esc", "PE3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".vscode/launch.json"}, "region": {"startLine": 38}}}]}, {"ruleId": "scanner-9752a6a2eb1e11d3", "level": "error", "message": {"text": "SkillSpector PE3 (priv-esc) in docker-compose.yml"}, "properties": {"repobilityId": "7f822bfa8f4f6f15", "scanner": "scanner-primary", "fingerprint": "9752a6a2eb1e11d3", "layer": "security", "severity": "high", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "priv-esc", "PE3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-636782129fec24e1", "level": "error", "message": {"text": "SkillSpector PE3 (priv-esc) in octomate/config/__init__.py"}, "properties": {"repobilityId": "239573d710c5a5c3", "scanner": "scanner-primary", "fingerprint": "636782129fec24e1", "layer": "security", "severity": "high", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "priv-esc", "PE3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/config/__init__.py"}, "region": {"startLine": 58}}}]}, {"ruleId": "scanner-7b770e314de26fe9", "level": "error", "message": {"text": "SkillSpector PE3 (priv-esc) in uv.lock"}, "properties": {"repobilityId": "5d3ade855258b227", "scanner": "scanner-primary", "fingerprint": "7b770e314de26fe9", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "priv-esc", "PE3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 883}}}]}, {"ruleId": "scanner-7b770e314de26fe9", "level": "error", "message": {"text": "SkillSpector PE3 (priv-esc) in uv.lock"}, "properties": {"repobilityId": "5d3ade855258b227", "scanner": "scanner-primary", "fingerprint": "7b770e314de26fe9", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "priv-esc", "PE3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 899}}}]}, {"ruleId": "scanner-7b770e314de26fe9", "level": "error", "message": {"text": "SkillSpector PE3 (priv-esc) in uv.lock"}, "properties": {"repobilityId": "5d3ade855258b227", "scanner": "scanner-primary", "fingerprint": "7b770e314de26fe9", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "priv-esc", "PE3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1660}}}]}, {"ruleId": "scanner-7b770e314de26fe9", "level": "error", "message": {"text": "SkillSpector PE3 (priv-esc) in uv.lock"}, "properties": {"repobilityId": "5d3ade855258b227", "scanner": "scanner-primary", "fingerprint": "7b770e314de26fe9", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "priv-esc", "PE3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1672}}}]}, {"ruleId": "scanner-7b770e314de26fe9", "level": "error", "message": {"text": "SkillSpector PE3 (priv-esc) in uv.lock"}, "properties": {"repobilityId": "5d3ade855258b227", "scanner": "scanner-primary", "fingerprint": "7b770e314de26fe9", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "priv-esc", "PE3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1674}}}]}, {"ruleId": "scanner-7b770e314de26fe9", "level": "error", "message": {"text": "SkillSpector PE3 (priv-esc) in uv.lock"}, "properties": {"repobilityId": "5d3ade855258b227", "scanner": "scanner-primary", "fingerprint": "7b770e314de26fe9", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "priv-esc", "PE3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 2868}}}]}, {"ruleId": "scanner-7b770e314de26fe9", "level": "error", "message": {"text": "SkillSpector PE3 (priv-esc) in uv.lock"}, "properties": {"repobilityId": "5d3ade855258b227", "scanner": "scanner-primary", "fingerprint": "7b770e314de26fe9", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "priv-esc", "PE3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 2869}}}]}, {"ruleId": "scanner-27a069e043d6abf3", "level": "error", "message": {"text": "SkillSpector P3 (prompt-injection) in docs/plans/done/send-toolset.md"}, "properties": {"repobilityId": "3a58039c7086bcb7", "scanner": "scanner-primary", "fingerprint": "27a069e043d6abf3", "layer": "security", "severity": "high", "confidence": 0.9, "tags": ["skillspector", "mcp-skill", "prompt-injection", "P3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/plans/done/send-toolset.md"}, "region": {"startLine": 106}}}]}, {"ruleId": "scanner-dfbc7854bf831d81", "level": "error", "message": {"text": "SkillSpector P3 (prompt-injection) in docs/schemas.md"}, "properties": {"repobilityId": "51afbbffc5082ee4", "scanner": "scanner-primary", "fingerprint": "dfbc7854bf831d81", "layer": "security", "severity": "high", "confidence": 0.9, "tags": ["skillspector", "mcp-skill", "prompt-injection", "P3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/schemas.md"}, "region": {"startLine": 103}}}]}, {"ruleId": "scanner-dfbc7854bf831d81", "level": "error", "message": {"text": "SkillSpector P3 (prompt-injection) in docs/schemas.md"}, "properties": {"repobilityId": "51afbbffc5082ee4", "scanner": "scanner-primary", "fingerprint": "dfbc7854bf831d81", "layer": "security", "severity": "high", "confidence": 0.9, "tags": ["skillspector", "mcp-skill", "prompt-injection", "P3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/schemas.md"}, "region": {"startLine": 105}}}]}, {"ruleId": "scanner-125b61da82fe91bb", "level": "error", "message": {"text": "SkillSpector P3 (prompt-injection) in octomate/capabilities/send.py"}, "properties": {"repobilityId": "21b81009dbb68889", "scanner": "scanner-primary", "fingerprint": "125b61da82fe91bb", "layer": "security", "severity": "high", "confidence": 0.9, "tags": ["skillspector", "mcp-skill", "prompt-injection", "P3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/capabilities/send.py"}, "region": {"startLine": 59}}}]}, {"ruleId": "scanner-286450c1a88c1f1b", "level": "warning", "message": {"text": "SkillSpector RA2 (rogue-agent) in docs/plans/claude-agent-integration.md"}, "properties": {"repobilityId": "c282300e6b6d241b", "scanner": "scanner-primary", "fingerprint": "286450c1a88c1f1b", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "rogue-agent", "RA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/plans/claude-agent-integration.md"}, "region": {"startLine": 105}}}]}, {"ruleId": "scanner-350060911064ba23", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in tests/src/events/inkling_text.jsonl"}, "properties": {"repobilityId": "b9f0a889444eb89f", "scanner": "scanner-primary", "fingerprint": "350060911064ba23", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/src/events/inkling_text.jsonl"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-350060911064ba23", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in tests/src/events/inkling_text.jsonl"}, "properties": {"repobilityId": "b9f0a889444eb89f", "scanner": "scanner-primary", "fingerprint": "350060911064ba23", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/src/events/inkling_text.jsonl"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-350060911064ba23", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in tests/src/events/inkling_text.jsonl"}, "properties": {"repobilityId": "b9f0a889444eb89f", "scanner": "scanner-primary", "fingerprint": "350060911064ba23", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/src/events/inkling_text.jsonl"}, "region": {"startLine": 145}}}]}, {"ruleId": "scanner-c6c30ca9c7b69e40", "level": "error", "message": {"text": "SkillSpector SC4 (supply-chain) in pyproject.toml"}, "properties": {"repobilityId": "c14f294691562be9", "scanner": "scanner-primary", "fingerprint": "c6c30ca9c7b69e40", "layer": "security", "severity": "high", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC4"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pyproject.toml"}, "region": {"startLine": 6}}}]}, {"ruleId": "scanner-ba3b6b931850460b", "level": "note", "message": {"text": "SkillSpector TM1 (tool-misuse) in Dockerfile"}, "properties": {"repobilityId": "2e52148c79c2cfc8", "scanner": "scanner-primary", "fingerprint": "ba3b6b931850460b", "layer": "security", "severity": "low", "confidence": 0.15, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 3}}}]}, {"ruleId": "scanner-ba3b6b931850460b", "level": "note", "message": {"text": "SkillSpector TM1 (tool-misuse) in Dockerfile"}, "properties": {"repobilityId": "2e52148c79c2cfc8", "scanner": "scanner-primary", "fingerprint": "ba3b6b931850460b", "layer": "security", "severity": "low", "confidence": 0.15, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 3}}}]}, {"ruleId": "scanner-32d45991ffe1ca10", "level": "note", "message": {"text": "SkillSpector TM2 (tool-misuse) in Dockerfile"}, "properties": {"repobilityId": "50c5f99853f5f830", "scanner": "scanner-primary", "fingerprint": "32d45991ffe1ca10", "layer": "security", "severity": "low", "confidence": 0.15, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 3}}}]}, {"ruleId": "scanner-c092073ec2ab0ac2", "level": "error", "message": {"text": "SkillSpector TM1 (tool-misuse) in tests/src/images/usagi.jpg"}, "properties": {"repobilityId": "086513a0ab9b3511", "scanner": "scanner-primary", "fingerprint": "c092073ec2ab0ac2", "layer": "security", "severity": "high", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/src/images/usagi.jpg"}, "region": {"startLine": 475}}}]}, {"ruleId": "scanner-c092073ec2ab0ac2", "level": "error", "message": {"text": "SkillSpector TM1 (tool-misuse) in tests/src/images/usagi.jpg"}, "properties": {"repobilityId": "086513a0ab9b3511", "scanner": "scanner-primary", "fingerprint": "c092073ec2ab0ac2", "layer": "security", "severity": "high", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/src/images/usagi.jpg"}, "region": {"startLine": 883}}}]}, {"ruleId": "scanner-c092073ec2ab0ac2", "level": "error", "message": {"text": "SkillSpector TM1 (tool-misuse) in tests/src/images/usagi.jpg"}, "properties": {"repobilityId": "086513a0ab9b3511", "scanner": "scanner-primary", "fingerprint": "c092073ec2ab0ac2", "layer": "security", "severity": "high", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/src/images/usagi.jpg"}, "region": {"startLine": 887}}}]}, {"ruleId": "scanner-e637c415447867e4", "level": "none", "message": {"text": "Run SkillSpector's LLM-backed analysis in your own pipeline"}, "properties": {"repobilityId": "1936f198ff5212bf", "scanner": "scanner-primary", "fingerprint": "e637c415447867e4", "layer": "security", "severity": "info", "confidence": 1.0, "tags": ["skillspector", "mcp-skill", "llm-advisory", "ai-coder"]}}, {"ruleId": "scanner-e27bc7b03839a3a0", "level": "warning", "message": {"text": "Privileged port 2 in use"}, "properties": {"repobilityId": "755b04866010e843", "scanner": "scanner-primary", "fingerprint": "e27bc7b03839a3a0", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cceddc168c5fa791", "level": "warning", "message": {"text": "Privileged port 42 in use"}, "properties": {"repobilityId": "16d9608735f9e01a", "scanner": "scanner-primary", "fingerprint": "cceddc168c5fa791", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-74a1e2ee5578c8e8", "level": "warning", "message": {"text": "Privileged port 11 in use"}, "properties": {"repobilityId": "5b3038c67fabb4c8", "scanner": "scanner-primary", "fingerprint": "74a1e2ee5578c8e8", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d63da3583b14afc0", "level": "warning", "message": {"text": "Dockerfile runs as root: Dockerfile"}, "properties": {"repobilityId": "a2ed1bd120e507db", "scanner": "scanner-primary", "fingerprint": "d63da3583b14afc0", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-b65429def9b82d3a", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: ghcr.io/astral-sh/uv:python3.13-bookworm-slim"}, "properties": {"repobilityId": "99521a52277f01ac", "scanner": "scanner-primary", "fingerprint": "b65429def9b82d3a", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-4fc6e967d4418d48", "level": "note", "message": {"text": "98 TODO/FIXME markers"}, "properties": {"repobilityId": "4b38c118003e07d2", "scanner": "scanner-primary", "fingerprint": "4fc6e967d4418d48", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["maintenance"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "66af22532b165d20", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "b058e66e85e4793c", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "acb576cab5464a3c", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "13d54aae03d8cc4c", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "658ee259ebea57c5", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-5018afddda1bbfff", "level": "note", "message": {"text": "Legacy-named symbol `files_upload_v2` in tests/channels/slack/fakes.py:301"}, "properties": {"repobilityId": "cd3e20601fe2844f", "scanner": "scanner-primary", "fingerprint": "5018afddda1bbfff", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-dc78060790e6e092", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in tests/channels/slack/test_streaming.py:223"}, "properties": {"repobilityId": "7fa4dcbf369f121e", "scanner": "scanner-primary", "fingerprint": "dc78060790e6e092", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-1442ed29cceee17a", "level": "note", "message": {"text": "Legacy-named symbol `p2_im_message_receive_v1` in tests/channels/lark/test_ink.py:7"}, "properties": {"repobilityId": "be1ad5b9b35fab2a", "scanner": "scanner-primary", "fingerprint": "1442ed29cceee17a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-fe3ca8fff7c99098", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in tests/channels/lark/test_streaming.py:179"}, "properties": {"repobilityId": "acf0fc8ed89e6338", "scanner": "scanner-primary", "fingerprint": "fe3ca8fff7c99098", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-c2864b108d59e862", "level": "note", "message": {"text": "Legacy-named symbol `p2_im_message_receive_v1` in tests/channels/lark/test_chromo.py:7"}, "properties": {"repobilityId": "a81a96f90bc110b1", "scanner": "scanner-primary", "fingerprint": "c2864b108d59e862", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-bbbee252e674f992", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in tests/support/scenarios.py:268"}, "properties": {"repobilityId": "d1989dc523606603", "scanner": "scanner-primary", "fingerprint": "bbbee252e674f992", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-99dfcb5f012a8128", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in tests/trigger/test_napcat.py:106"}, "properties": {"repobilityId": "1368eca25bf64733", "scanner": "scanner-primary", "fingerprint": "99dfcb5f012a8128", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-25ff2155a9efb5e5", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in tests/trigger/test_slack.py:134"}, "properties": {"repobilityId": "5e94c5341827a590", "scanner": "scanner-primary", "fingerprint": "25ff2155a9efb5e5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-842d635258542b84", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in tests/trigger/test_lark.py:125"}, "properties": {"repobilityId": "bd0015e4a2eeb4b5", "scanner": "scanner-primary", "fingerprint": "842d635258542b84", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-91632f339987e536", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in scripts/capture_inkling_events.py:164"}, "properties": {"repobilityId": "86163f1d7eecb400", "scanner": "scanner-primary", "fingerprint": "91632f339987e536", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-6b09b59cf8f4cdef", "level": "none", "message": {"text": "Commented-code block (5 lines) in octomate/base.py:112"}, "properties": {"repobilityId": "91c3a7464a9dd8fc", "scanner": "scanner-primary", "fingerprint": "6b09b59cf8f4cdef", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ab9efaf13b1d5847", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in octomate/triage/graph.py:456"}, "properties": {"repobilityId": "2c68addc5437298a", "scanner": "scanner-primary", "fingerprint": "ab9efaf13b1d5847", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-52a5b8bfe3b1ce2a", "level": "none", "message": {"text": "Commented-code block (5 lines) in octomate/capabilities/react.py:171"}, "properties": {"repobilityId": "2b76b652fa357ece", "scanner": "scanner-primary", "fingerprint": "52a5b8bfe3b1ce2a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-36b5b76ad64016be", "level": "none", "message": {"text": "Commented-code block (6 lines) in octomate/capabilities/agent.py:178"}, "properties": {"repobilityId": "47eede4ebcc0abdf", "scanner": "scanner-primary", "fingerprint": "36b5b76ad64016be", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e3ba9fd2219611b4", "level": "error", "message": {"text": "Blocking `httpx.post(...)` inside `async def inspect` \u2014 octomate/tentacles/channel/napcat/ink.py:34"}, "properties": {"repobilityId": "1b8c97d5e5f634b5", "scanner": "scanner-primary", "fingerprint": "e3ba9fd2219611b4", "layer": "quality", "severity": "high", "confidence": 1.0, "tags": ["integrity", "sync-io-in-async", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/tentacles/channel/napcat/ink.py"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-7c29f974a157b98c", "level": "error", "message": {"text": "Blocking `httpx.post(...)` inside `async def inspect` \u2014 octomate/tentacles/channel/napcat/ink.py:38"}, "properties": {"repobilityId": "5783f7aae75adfc5", "scanner": "scanner-primary", "fingerprint": "7c29f974a157b98c", "layer": "quality", "severity": "high", "confidence": 1.0, "tags": ["integrity", "sync-io-in-async", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/tentacles/channel/napcat/ink.py"}, "region": {"startLine": 38}}}]}, {"ruleId": "scanner-93bec4e730adad00", "level": "error", "message": {"text": "Blocking `httpx.post(...)` inside `async def get_user_profile` \u2014 octomate/tentacles/channel/napcat/ink.py:49"}, "properties": {"repobilityId": "24125d7117abcff9", "scanner": "scanner-primary", "fingerprint": "93bec4e730adad00", "layer": "quality", "severity": "high", "confidence": 1.0, "tags": ["integrity", "sync-io-in-async", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/tentacles/channel/napcat/ink.py"}, "region": {"startLine": 49}}}]}, {"ruleId": "scanner-e319a0f6ddb829c0", "level": "error", "message": {"text": "Blocking `httpx.post(...)` inside `async def get_image_url` \u2014 octomate/tentacles/channel/napcat/ink.py:67"}, "properties": {"repobilityId": "48dc054872735ce0", "scanner": "scanner-primary", "fingerprint": "e319a0f6ddb829c0", "layer": "quality", "severity": "high", "confidence": 1.0, "tags": ["integrity", "sync-io-in-async", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/tentacles/channel/napcat/ink.py"}, "region": {"startLine": 67}}}]}, {"ruleId": "scanner-efee87e14010f7ba", "level": "error", "message": {"text": "Blocking `httpx.get(...)` inside `async def download` \u2014 octomate/tentacles/channel/napcat/ink.py:72"}, "properties": {"repobilityId": "bde8f98d0ba12c7c", "scanner": "scanner-primary", "fingerprint": "efee87e14010f7ba", "layer": "quality", "severity": "high", "confidence": 1.0, "tags": ["integrity", "sync-io-in-async", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/tentacles/channel/napcat/ink.py"}, "region": {"startLine": 72}}}]}, {"ruleId": "scanner-1ec31f1609038192", "level": "note", "message": {"text": "Stub function `upload_media` (body is just `pass`/`return`) \u2014 octomate/tentacles/channel/napcat/ink.py:63"}, "properties": {"repobilityId": "f12ed0b9cbc14508", "scanner": "scanner-primary", "fingerprint": "1ec31f1609038192", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-5ce390dfdd85cc43", "level": "none", "message": {"text": "Commented-code block (6 lines) in octomate/tentacles/channel/web/vercel/routes.py:63"}, "properties": {"repobilityId": "e734137c24b12b79", "scanner": "scanner-primary", "fingerprint": "5ce390dfdd85cc43", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-65468ed3836f8f0a", "level": "none", "message": {"text": "Commented-code block (5 lines) in octomate/tentacles/channel/feelers/output.py:514"}, "properties": {"repobilityId": "d1433b4a0f8477ca", "scanner": "scanner-primary", "fingerprint": "65468ed3836f8f0a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b723d77d8fbef833", "level": "note", "message": {"text": "Legacy-named symbol `files_upload_v2` in octomate/tentacles/channel/slack/ink.py:75"}, "properties": {"repobilityId": "01fa4e5ee699ad6d", "scanner": "scanner-primary", "fingerprint": "b723d77d8fbef833", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-4e2b18e9cb871d2f", "level": "none", "message": {"text": "Commented-code block (5 lines) in octomate/tentacles/channel/slack/base.py:155"}, "properties": {"repobilityId": "b2276921a0838513", "scanner": "scanner-primary", "fingerprint": "4e2b18e9cb871d2f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-61b16abf755dacaa", "level": "note", "message": {"text": "Legacy-named symbol `p2_im_message_receive_v1` in octomate/tentacles/channel/lark/chromo.py:9"}, "properties": {"repobilityId": "1ffc507925d81320", "scanner": "scanner-primary", "fingerprint": "61b16abf755dacaa", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-6b427eea0d773764", "level": "none", "message": {"text": "Commented-code block (5 lines) in octomate/tentacles/channel/lark/chromo.py:51"}, "properties": {"repobilityId": "f9c93fe40f2a57f7", "scanner": "scanner-primary", "fingerprint": "6b427eea0d773764", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-757bbbb8c8ed7871", "level": "note", "message": {"text": "Legacy-named symbol `p2_im_message_receive_v1` in octomate/tentacles/channel/lark/base.py:10"}, "properties": {"repobilityId": "1adc6baf60a6446b", "scanner": "scanner-primary", "fingerprint": "757bbbb8c8ed7871", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-913d850c52c39531", "level": "note", "message": {"text": "Legacy-named symbol `card_v2` in octomate/tentacles/channel/lark/feelers/output.py:207"}, "properties": {"repobilityId": "3215106afac416b3", "scanner": "scanner-primary", "fingerprint": "913d850c52c39531", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-53171dacf81fcdbe", "level": "note", "message": {"text": "Legacy-named symbol `card_v2` in octomate/tentacles/channel/lark/feelers/cards.py:83"}, "properties": {"repobilityId": "986d9503dfa54b75", "scanner": "scanner-primary", "fingerprint": "53171dacf81fcdbe", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "840973af6c41d55c", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "8c413f2e1ba25e0a", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-33a6b62e30ce7ab4", "level": "note", "message": {"text": "Near-duplicate function bodies in 6 places"}, "properties": {"repobilityId": "7d3efd85d3dfb1ba", "scanner": "scanner-primary", "fingerprint": "33a6b62e30ce7ab4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "3fce644720d95320", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "442f7f1b0ff9a12e", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "920deb41d0bd6f94", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "c75ee3a845fb0a72", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-959dc775c4241ad4", "level": "note", "message": {"text": "Near-duplicate function bodies in 18 places"}, "properties": {"repobilityId": "46d02723ff43bf64", "scanner": "scanner-primary", "fingerprint": "959dc775c4241ad4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "8713f0e2ce062983", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "ecddebaea912faa4", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "82c2ba9e5060065f", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "801d5b7d88b965c8", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "452b68fcaec06a17", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "88af9dc8188fc66a", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "ebc596853e6ab474", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "ecaac3a2192c66ff", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "501d8ccd261a0ab3", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "a0d8beb501648202", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "3153716facf3cccf", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "27350108b65899ba", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-259ce6bddfcf5d05", "level": "error", "message": {"text": "FastAPI POST `chat` without auth dependency \u2014 octomate/tentacles/channel/web/vercel/routes.py:48"}, "properties": {"repobilityId": "a02de8ec1ad8c4f4", "scanner": "scanner-primary", "fingerprint": "259ce6bddfcf5d05", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "octomate/tentacles/channel/web/vercel/routes.py"}, "region": {"startLine": 48}}}]}]}]}