{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "JRN012", "name": "Runtime environment contract is missing referenced variables", "shortDescription": {"text": "Runtime environment contract is missing referenced variables"}, "fullDescription": {"text": "Deployment failures in the mined human reports often came from generated code that assumed runtime keys, API URLs, model credentials, or database URLs without a complete environment contract. The scanner found env vars used by source code that are not documented in the visible env template/config docs."}, "properties": {"scanner": "repobility-journey-contract", "category": "quality", "severity": "medium", "confidence": 0.72, "cwe": "", "owasp": ""}}, {"id": "GHSA-rcv9-qm8p-9p6j", "name": "transformers: GHSA-rcv9-qm8p-9p6j", "shortDescription": {"text": "transformers: GHSA-rcv9-qm8p-9p6j"}, "fullDescription": {"text": "Hugging Face Transformers library has Regular Expression Denial of Service"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-qq3j-4f4f-9583", "name": "transformers: GHSA-qq3j-4f4f-9583", "shortDescription": {"text": "transformers: GHSA-qq3j-4f4f-9583"}, "fullDescription": {"text": "Hugging Face Transformers Regular Expression Denial of Service"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-q2wp-rjmx-x6x9", "name": "transformers: GHSA-q2wp-rjmx-x6x9", "shortDescription": {"text": "transformers: GHSA-q2wp-rjmx-x6x9"}, "fullDescription": {"text": "Transformers's ReDoS vulnerability in get_configuration_file can lead to catastrophic backtracking"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-jjph-296x-mrcr", "name": "transformers: GHSA-jjph-296x-mrcr", "shortDescription": {"text": "transformers: GHSA-jjph-296x-mrcr"}, "fullDescription": {"text": "Transformers vulnerable to ReDoS attack through its get_imports() function"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-fpwr-67px-3qhx", "name": "transformers: GHSA-fpwr-67px-3qhx", "shortDescription": {"text": "transformers: GHSA-fpwr-67px-3qhx"}, "fullDescription": {"text": "Transformers Regular Expression Denial of Service (ReDoS) vulnerability"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-9356-575x-2w9m", "name": "transformers: GHSA-9356-575x-2w9m", "shortDescription": {"text": "transformers: GHSA-9356-575x-2w9m"}, "fullDescription": {"text": "Hugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerability"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-69w3-r845-3855", "name": "transformers: GHSA-69w3-r845-3855", "shortDescription": {"text": "transformers: GHSA-69w3-r845-3855"}, "fullDescription": {"text": "HuggingFace Transformers allows for arbitrary code execution in the `Trainer` class"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-59p9-h35m-wg4g", "name": "transformers: GHSA-59p9-h35m-wg4g", "shortDescription": {"text": "transformers: GHSA-59p9-h35m-wg4g"}, "fullDescription": {"text": "Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-4w7r-h757-3r74", "name": "transformers: GHSA-4w7r-h757-3r74", "shortDescription": {"text": "transformers: GHSA-4w7r-h757-3r74"}, "fullDescription": {"text": "Hugging Face Transformers vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-489j-g2vx-39wf", "name": "transformers: GHSA-489j-g2vx-39wf", "shortDescription": {"text": "transformers: GHSA-489j-g2vx-39wf"}, "fullDescription": {"text": "Transformers vulnerable to ReDoS attack through its SETTING_RE variable"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-37mw-44qp-f5jm", "name": "transformers: GHSA-37mw-44qp-f5jm", "shortDescription": {"text": "transformers: GHSA-37mw-44qp-f5jm"}, "fullDescription": {"text": "Transformers is vulnerable to ReDoS attack through its DonutProcessor class"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "DKR001", "name": "Docker final stage has no non-root USER", "shortDescription": {"text": "Docker final stage has no non-root USER"}, "fullDescription": {"text": "Docker images run as root unless the image or Dockerfile switches to a non-root user."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "medium", "confidence": 0.82, "cwe": "", "owasp": ""}}, {"id": "DKR007", "name": "Docker build context has no .dockerignore", "shortDescription": {"text": "Docker build context has no .dockerignore"}, "fullDescription": {"text": "Without .dockerignore, build context can include source history, local env files, dependencies, and generated artifacts."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "medium", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "SEC011", "name": "[SEC011] Unsafe PyTorch Model Loading: torch.load() uses pickle internally and can execute arbitrary code from untrusted", "shortDescription": {"text": "[SEC011] Unsafe PyTorch Model Loading: torch.load() uses pickle internally and can execute arbitrary code from untrusted model files."}, "fullDescription": {"text": "Use torch.load(..., weights_only=True) or use safetensors format."}, "properties": {"scanner": "repobility-threat-engine", "category": "deserialization", "severity": "medium", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "DEPCUR-PY", "name": "Python package `transformers` is 1 major version(s) behind (4.49.0 -> 5.12.1)", "shortDescription": {"text": "Python package `transformers` is 1 major version(s) behind (4.49.0 -> 5.12.1)"}, "fullDescription": {"text": "`transformers==4.49.0` is 1 major version(s) behind the latest stable release on PyPI (5.12.1). Pinned-but-stale Python dependencies drift away from upstream security and bugfix releases. This is the version-currency signal Dependabot raises."}, "properties": {"scanner": "repobility-dependency-currency", "category": "dependency", "severity": "medium", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "MINED124", "name": "requirements.txt: `numpy<2` has no version pin", "shortDescription": {"text": "requirements.txt: `numpy<2` has no version pin"}, "fullDescription": {"text": "Unpinned pip requirement means every fresh install may resolve a different version. Newer releases can introduce malicious code (typosquats, account compromises). Reproducible installs need exact pins."}, "properties": {"scanner": "repobility-supply-chain", "category": "dependency", "severity": "medium", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "MINED111", "name": "Bare except continues silently", "shortDescription": {"text": "Bare except continues silently"}, "fullDescription": {"text": "Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose."}, "properties": {"scanner": "repobility-ast-engine", "category": "quality", "severity": "medium", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "GHSA-phhr-52qp-3mj4", "name": "transformers: GHSA-phhr-52qp-3mj4", "shortDescription": {"text": "transformers: GHSA-phhr-52qp-3mj4"}, "fullDescription": {"text": "Transformers's Improper Input Validation vulnerability can be exploited through username injection"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "low", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "COMP001", "name": "[COMP001] High cognitive complexity: Function `format_capabilities_text` has cognitive complexity 8 (SonarSource scale).", "shortDescription": {"text": "[COMP001] High cognitive complexity: Function `format_capabilities_text` has cognitive complexity 8 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand \u2014 nested branches, boolean chains, and"}, "fullDescription": {"text": "Extract nested branches into named helper functions; flatten early-return / guard clauses; replace long if/elif chains with dispatch dicts or polymorphism. SonarQube's threshold for 'should refactor' is 15 \u2014 yours is 8."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "low", "confidence": 0.95, "cwe": "", "owasp": ""}}, {"id": "MINED115", "name": "Action `actions/checkout` pinned to mutable ref `@v2`", "shortDescription": {"text": "Action `actions/checkout` pinned to mutable ref `@v2`"}, "fullDescription": {"text": "`uses: actions/checkout@v2` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"scanner": "repobility-supply-chain", "category": "dependency", "severity": "low", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "DKR002", "name": "Dockerfile base image is selected through a build variable", "shortDescription": {"text": "Dockerfile base image is selected through a build variable"}, "fullDescription": {"text": "Variable-selected base images can be safe, but Repobility cannot verify that the resolved image is pinned."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "info", "confidence": 0.48, "cwe": "", "owasp": ""}}, {"id": "MINED064", "name": "[MINED064] Python Input Call: input() blocks for stdin. Inappropriate in services.", "shortDescription": {"text": "[MINED064] Python Input Call: input() blocks for stdin. Inappropriate in services."}, "fullDescription": {"text": "Review and fix per the pattern semantics."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED049", "name": "[MINED049] Print Pii: Logging password/token/email/ssn directly to stdout.", "shortDescription": {"text": "[MINED049] Print Pii: Logging password/token/email/ssn directly to stdout."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-532 / A09:2021 for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC020", "name": "[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequen", "shortDescription": {"text": "[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequent AI-assisted coding failure: the helper exposes the exact value needed for troubleshooting."}, "fullDescription": {"text": "Log only redacted, hashed, or last-four-style metadata. Rotate any secret that may have reached logs."}, "properties": {"scanner": "repobility-threat-engine", "category": "credential_exposure", "severity": "info", "confidence": 0.15, "cwe": "", "owasp": ""}}, {"id": "SEC045", "name": "[SEC045] eval()/exec() on stored or user-supplied data (and 5 more): Same pattern found in 5 additional files. Review if", "shortDescription": {"text": "[SEC045] eval()/exec() on stored or user-supplied data (and 5 more): Same pattern found in 5 additional files. Review if needed."}, "fullDescription": {"text": "For literal data structures: use ast.literal_eval(text) \u2014 only parses literals, raises on code.\nFor formula evaluation: use asteval or simpleeval (purpose-built sandboxes with allow-lists).\nFor Odoo: use odoo.tools.safe_eval(expr, locals_dict, mode='exec').\nIf you genuinely need to execute admin-stored code: require explicit super-admin permission AND log every execution with a stack trace."}, "properties": {"scanner": "repobility-threat-engine", "category": "injection", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "MINED050", "name": "[MINED050] Stub Only Function: Function declared but body is just pass, return None, raise NotImplementedError, or TODO ", "shortDescription": {"text": "[MINED050] Stub Only Function: Function declared but body is just pass, return None, raise NotImplementedError, or TODO comment."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-1188 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC128", "name": "[SEC128] Async function without await \u2014 fire-and-forget Promise (AI mistake) (and 6 more): Same pattern found in 6 addit", "shortDescription": {"text": "[SEC128] Async function without await \u2014 fire-and-forget Promise (AI mistake) (and 6 more): Same pattern found in 6 additional files. Review if needed."}, "fullDescription": {"text": "Add `await` before each async call, or chain with `.then`. If you intentionally want fire-and-forget, prefix with `void` (TS) or assign to `_` (Python with `asyncio.create_task`) to make the intent explicit and survive lint."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "PYSEC-2025-218", "name": "transformers: PYSEC-2025-218", "shortDescription": {"text": "transformers: PYSEC-2025-218"}, "fullDescription": {"text": "Hugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of weights. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28309."}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "PYSEC-2025-217", "name": "transformers: PYSEC-2025-217", "shortDescription": {"text": "transformers: PYSEC-2025-217"}, "fullDescription": {"text": "Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of checkpoints. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28308."}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "PYSEC-2025-216", "name": "transformers: PYSEC-2025-216", "shortDescription": {"text": "transformers: PYSEC-2025-216"}, "fullDescription": {"text": "Hugging Face Transformers HuBERT convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must convert a malicious checkpoint.\n\nThe specific flaw exists within the convert_config function. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-28253."}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "PYSEC-2025-215", "name": "transformers: PYSEC-2025-215", "shortDescription": {"text": "transformers: PYSEC-2025-215"}, "fullDescription": {"text": "Hugging Face Transformers SEW-D convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must convert a malicious checkpoint.\n\nThe specific flaw exists within the convert_config function. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of the current user.\n\n. Was ZDI-CAN-28252."}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "PYSEC-2025-214", "name": "transformers: PYSEC-2025-214", "shortDescription": {"text": "transformers: PYSEC-2025-214"}, "fullDescription": {"text": "Hugging Face Transformers SEW convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must convert a malicious checkpoint.\n\nThe specific flaw exists within the convert_config function. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-28251."}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "PYSEC-2025-213", "name": "transformers: PYSEC-2025-213", "shortDescription": {"text": "transformers: PYSEC-2025-213"}, "fullDescription": {"text": "Hugging Face Transformers megatron_gpt2 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of checkpoints. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27984."}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "PYSEC-2025-212", "name": "transformers: PYSEC-2025-212", "shortDescription": {"text": "transformers: PYSEC-2025-212"}, "fullDescription": {"text": "Hugging Face Transformers Transformer-XL Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of model files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-25424."}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "PYSEC-2025-211", "name": "transformers: PYSEC-2025-211", "shortDescription": {"text": "transformers: PYSEC-2025-211"}, "fullDescription": {"text": "Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of model files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-25423."}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "SEC103", "name": "[SEC103] LDAP injection \u2014 non-constant search filter: User input concatenated into an LDAP search filter. Attackers inje", "shortDescription": {"text": "[SEC103] LDAP injection \u2014 non-constant search filter: User input concatenated into an LDAP search filter. Attackers inject `*)(uid=*` style payloads to bypass auth or enumerate accounts."}, "fullDescription": {"text": "Escape with javax.naming.ldap.Rdn.escapeValue or equivalent. For python-ldap, use ldap.filter.escape_filter_chars. Better: use parameterized search APIs (Spring LdapTemplate filter encoders)."}, "properties": {"scanner": "repobility-threat-engine", "category": "injection", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED021", "name": "[MINED021] Path Traversal Os Join: os.path.join(user_dir, filename) where filename can contain \"../\" \u2014 directory escape.", "shortDescription": {"text": "[MINED021] Path Traversal Os Join: os.path.join(user_dir, filename) where filename can contain \"../\" \u2014 directory escape."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-22 / A01:2021 for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC114", "name": "[SEC114] path.join / Path() on user-controlled segment without containment check: filepath.Clean / path.Join on attacker", "shortDescription": {"text": "[SEC114] path.join / Path() on user-controlled segment without containment check: filepath.Clean / path.Join on attacker-supplied segments does NOT prevent escape from the base directory. `../../../etc/passwd` resolves cleanly."}, "fullDescription": {"text": "After joining, re-check containment: `if !strings.HasPrefix(filepath.Clean(joined), filepath.Clean(baseDir)+string(os.PathSeparator)) { error }`. In Node: `path.resolve(base, x); if (!resolved.startsWith(base + path.sep)) throw`."}, "properties": {"scanner": "repobility-threat-engine", "category": "path_traversal", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC013", "name": "[SEC013] Path Traversal \u2014 User Input in File Path: User-controlled input used in file path without sanitization. Allows ", "shortDescription": {"text": "[SEC013] Path Traversal \u2014 User Input in File Path: User-controlled input used in file path without sanitization. Allows reading arbitrary files."}, "fullDescription": {"text": "Use os.path.realpath() and verify the path starts with your expected base directory. Use secure_filename() for uploads."}, "properties": {"scanner": "repobility-threat-engine", "category": "path_traversal", "severity": "high", "confidence": 0.8, "cwe": "", "owasp": ""}}, {"id": "MINED001", "name": "[MINED001] Bare Except Pass: except: pass or except Exception: pass \u2014 silently swallows everything including KeyboardInt", "shortDescription": {"text": "[MINED001] Bare Except Pass: except: pass or except Exception: pass \u2014 silently swallows everything including KeyboardInterrupt and bugs."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-755 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "CORE_NO_TESTS", "name": "No test files found", "shortDescription": {"text": "No test files found"}, "fullDescription": {"text": "Add a test directory (tests/ or __tests__/) with unit tests for core functionality. Use pytest (Python), Jest (JS/TS), or go test (Go). Start with tests for critical business logic and security-sensitive functions."}, "properties": {"scanner": "repobility-core", "category": "testing", "severity": "high", "confidence": null, "cwe": "", "owasp": ""}}, {"id": "generic-api-key", "name": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", "shortDescription": {"text": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations."}, "fullDescription": {"text": "Gitleaks detected a committed secret or credential pattern."}, "properties": {"scanner": "gitleaks", "category": "credential_exposure", "severity": "critical", "confidence": 0.95, "cwe": "", "owasp": ""}}, {"id": "MINED107", "name": "Missing import: `platform` used but not imported", "shortDescription": {"text": "Missing import: `platform` used but not imported"}, "fullDescription": {"text": "The file uses `platform.something(...)` but never imports `platform`. This raises NameError at runtime the first time the line executes."}, "properties": {"scanner": "repobility-ast-engine", "category": "quality", "severity": "critical", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "scanner-371c7227881a4276", "name": "Possibly dead Python function: collate_fn", "shortDescription": {"text": "Possibly dead Python function: collate_fn"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cca1eef32e5afe94", "name": "Possibly dead Python function: augment_and_transform_batch", "shortDescription": {"text": "Possibly dead Python function: augment_and_transform_batch"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e35ccd2db17936fd", "name": "Possibly dead Python function: collate_fn", "shortDescription": {"text": "Possibly dead Python function: collate_fn"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a5dabc82af0c3ac4", "name": "Possibly dead Python function: tfm", "shortDescription": {"text": "Possibly dead Python function: tfm"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9ff08adcaadd58ae", "name": "Possibly dead Python function: compute_metrics", "shortDescription": {"text": "Possibly dead Python function: compute_metrics"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-151ef59142683deb", "name": "Possibly dead Python function: data_collator", "shortDescription": {"text": "Possibly dead Python function: data_collator"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ceaf17c946f09c52", "name": "Possibly dead Python function: apply_train", "shortDescription": {"text": "Possibly dead Python function: apply_train"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-80610bee2c77067e", "name": "Possibly dead Python function: apply_eval", "shortDescription": {"text": "Possibly dead Python function: apply_eval"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6762da365579f2b0", "name": "Possibly dead Python function: compute_metrics", "shortDescription": {"text": "Possibly dead Python function: compute_metrics"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fcd91a9f8d0b47a3", "name": "CVE-2025-1194: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/r", "shortDescription": {"text": "CVE-2025-1194: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "fullDescription": {"text": "Transformers Regular Expression Denial of Service (ReDoS) vulnerability\n\nA Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, specifically in the file `tokenization_gpt_neox_japanese.py` of the GPT-NeoX-Japanese model. The vulnerability occurs in the SubWordJapaneseTokenizer class, where regular expressions process specially crafted inputs. The issue stems from a regex exhibiting exponential complexity under certain conditions, leading to excessive backtracking. This can result in high CPU usage and pote\n\nPackage: transformers\nInstalled: 4.49.0\nFixed in: 4.50.0\nSeverity: MEDIUM\nFix: Upgrade transformers to 4.50.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-91029630397a556b", "name": "CVE-2025-2099: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/r", "shortDescription": {"text": "CVE-2025-2099: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "fullDescription": {"text": "transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers\n\nA vulnerability in the `preprocess_string()` function of the `transformers.testing_utils` module in huggingface/transformers version v4.48.3 allows for a Regular Expression Denial of Service (ReDoS) attack. The regular expression used to process code blocks in docstrings contains nested quantifiers, leading to exponential backtracking when processing input with a large number of newline characters. An attacker can exploit this by providing a specially crafted payload, causing high CPU usage and \n\nPackage: transformers\nInstalled: 4.49.0\nFixed in: 4.50.0\nSeverity: MEDIUM\nFix: Upgrade transformers to 4.50.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-775b96e5e7eeb627", "name": "CVE-2025-3262: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/r", "shortDescription": {"text": "CVE-2025-3262: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "fullDescription": {"text": "transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers\n\nA Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the huggingface/transformers repository, specifically in version 4.49.0. The vulnerability is due to inefficient regular expression complexity in the `SETTING_RE` variable within the `transformers/commands/chat.py` file. The regex contains repetition groups and non-optimized quantifiers, leading to exponential backtracking when processing 'almost matching' payloads. This can degrade application performance and potenti\n\nPackage: transformers\nInstalled: 4.49.0\nFixed in: 4.51.0\nSeverity: MEDIUM\nFix: Upgrade transformers to 4.51.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b0c3509f22b587a4", "name": "CVE-2025-3263: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/r", "shortDescription": {"text": "CVE-2025-3263: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "fullDescription": {"text": "transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers\n\nA Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically in the `get_configuration_file()` function within the `transformers.configuration_utils` module. The affected version is 4.49.0, and the issue is resolved in version 4.51.0. The vulnerability arises from the use of a regular expression pattern `config\\.(.*)\\.json` that can be exploited to cause excessive CPU consumption through crafted input strings, leading to catas\n\nPackage: transformers\nInstalled: 4.49.0\nFixed in: 4.51.0\nSeverity: MEDIUM\nFix: Upgrade transformers to 4.51.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-45f3da00475472d6", "name": "CVE-2025-3264: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/r", "shortDescription": {"text": "CVE-2025-3264: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "fullDescription": {"text": "transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers\n\nA Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically in the `get_imports()` function within `dynamic_module_utils.py`. This vulnerability affects versions 4.49.0 and is fixed in version 4.51.0. The issue arises from a regular expression pattern `\\s*try\\s*:.*?except.*?:` used to filter out try/except blocks from Python code, which can be exploited to cause excessive CPU consumption through crafted input strings due to c\n\nPackage: transformers\nInstalled: 4.49.0\nFixed in: 4.51.0\nSeverity: MEDIUM\nFix: Upgrade transformers to 4.51.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8e858f2beb7f253a", "name": "CVE-2025-3933: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/r", "shortDescription": {"text": "CVE-2025-3933: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "fullDescription": {"text": "transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers\n\nA Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically within the DonutProcessor class's `token2json()` method. This vulnerability affects versions 4.50.3 and earlier, and is fixed in version 4.52.1. The issue arises from the regex pattern `<s_(.*?)>` which can be exploited to cause excessive CPU consumption through crafted input strings due to catastrophic backtracking. This vulnerability can lead to service disruption,\n\nPackage: transformers\nInstalled: 4.49.0\nFixed in: 4.52.1\nSeverity: MEDIUM\nFix: Upgrade transformers to 4.52.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8058d5cae8953ff7", "name": "CVE-2025-5197: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/r", "shortDescription": {"text": "CVE-2025-5197: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "fullDescription": {"text": "transformers: Transformers ReDoS Vulnerability\n\nA Regular Expression Denial of Service (ReDoS) vulnerability exists in the Hugging Face Transformers library, specifically in the `convert_tf_weight_name_to_pt_weight_name()` function. This function, responsible for converting TensorFlow weight names to PyTorch format, uses a regex pattern `/[^/]*___([^/]*)/` that can be exploited to cause excessive CPU consumption through crafted input strings due to catastrophic backtracking. The vulnerability affects versions up to 4.51.3 and is fixed in vers\n\nPackage: transformers\nInstalled: 4.49.0\nFixed in: 4.53.0\nSeverity: MEDIUM\nFix: Upgrade transformers to 4.53.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f0d56f013359e128", "name": "CVE-2025-6051: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/r", "shortDescription": {"text": "CVE-2025-6051: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "fullDescription": {"text": "transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers\n\nA Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically within the `normalize_numbers()` method of the `EnglishNormalizer` class. This vulnerability affects versions up to 4.52.4 and is fixed in version 4.53.0. The issue arises from the method's handling of numeric strings, which can be exploited using crafted input strings containing long sequences of digits, leading to excessive CPU consumption. This vulnerability impac\n\nPackage: transformers\nInstalled: 4.49.0\nFixed in: 4.53.0\nSeverity: MEDIUM\nFix: Upgrade transformers to 4.53.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c1416fb6148ceacb", "name": "CVE-2025-6638: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/r", "shortDescription": {"text": "CVE-2025-6638: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "fullDescription": {"text": "transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers\n\nA Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically affecting the MarianTokenizer's `remove_language_code()` method. This vulnerability is present in version 4.52.4 and has been fixed in version 4.53.0. The issue arises from inefficient regex processing, which can be exploited by crafted input strings containing malformed language code patterns, leading to excessive CPU consumption and potential denial of service.\n\nPackage: transformers\nInstalled: 4.49.0\nFixed in: 4.53.0\nSeverity: MEDIUM\nFix: Upgrade transformers to 4.53.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8889d21c7ec501ea", "name": "CVE-2025-6921: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/r", "shortDescription": {"text": "CVE-2025-6921: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "fullDescription": {"text": "transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers\n\nThe huggingface/transformers library, versions prior to 4.53.0, is vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer. The vulnerability arises from the _do_use_weight_decay method, which processes user-controlled regular expressions in the include_in_weight_decay and exclude_from_weight_decay lists. Malicious regular expressions can cause catastrophic backtracking during the re.search call, leading to 100% CPU utilization and a denial of service. This is\n\nPackage: transformers\nInstalled: 4.49.0\nFixed in: 4.53.0\nSeverity: MEDIUM\nFix: Upgrade transformers to 4.53.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0f20d3e8586f577a", "name": "CVE-2026-1839: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/r", "shortDescription": {"text": "CVE-2026-1839: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "fullDescription": {"text": "transformers: HuggingFace Transformers: Arbitrary code execution via malicious checkpoint file\n\nA vulnerability in the HuggingFace Transformers library, specifically in the `Trainer` class, allows for arbitrary code execution. The `_load_rng_state()` method in `src/transformers/trainer.py` at line 3059 calls `torch.load()` without the `weights_only=True` parameter. This issue affects all versions of the library supporting `torch>=2.2` when used with PyTorch versions below 2.6, as the `safe_globals()` context manager provides no protection in these versions. An attacker can exploit this vul\n\nPackage: transformers\nInstalled: 4.49.0\nFixed in: 5.0.0rc3\nSeverity: MEDIUM\nFix: Upgrade transformers to 5.0.0rc3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-06cda97642f19bb2", "name": "CVE-2025-3777: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/r", "shortDescription": {"text": "CVE-2025-3777: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "fullDescription": {"text": "transformers: Improper Input Validation in huggingface/transformers\n\nHugging Face Transformers versions up to 4.49.0 are affected by an improper input validation vulnerability in the `image_utils.py` file. The vulnerability arises from insecure URL validation using the `startswith()` method, which can be bypassed through URL username injection. This allows attackers to craft URLs that appear to be from YouTube but resolve to malicious domains, potentially leading to phishing attacks, malware distribution, or data exfiltration. The issue is fixed in version 4.52.1\n\nPackage: transformers\nInstalled: 4.49.0\nFixed in: 4.52.1\nSeverity: LOW\nFix: Upgrade transformers to 4.52.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9ed8d5397ec21a01", "name": "CVE-2025-1194: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/req", "shortDescription": {"text": "CVE-2025-1194: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requirements.txt"}, "fullDescription": {"text": "Transformers Regular Expression Denial of Service (ReDoS) vulnerability\n\nA Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, specifically in the file `tokenization_gpt_neox_japanese.py` of the GPT-NeoX-Japanese model. The vulnerability occurs in the SubWordJapaneseTokenizer class, where regular expressions process specially crafted inputs. The issue stems from a regex exhibiting exponential complexity under certain conditions, leading to excessive backtracking. This can result in high CPU usage and pote\n\nPackage: transformers\nInstalled: 4.49.0\nFixed in: 4.50.0\nSeverity: MEDIUM\nFix: Upgrade transformers to 4.50.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-44d61e1891667b64", "name": "CVE-2025-2099: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/req", "shortDescription": {"text": "CVE-2025-2099: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requirements.txt"}, "fullDescription": {"text": "transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers\n\nA vulnerability in the `preprocess_string()` function of the `transformers.testing_utils` module in huggingface/transformers version v4.48.3 allows for a Regular Expression Denial of Service (ReDoS) attack. The regular expression used to process code blocks in docstrings contains nested quantifiers, leading to exponential backtracking when processing input with a large number of newline characters. An attacker can exploit this by providing a specially crafted payload, causing high CPU usage and \n\nPackage: transformers\nInstalled: 4.49.0\nFixed in: 4.50.0\nSeverity: MEDIUM\nFix: Upgrade transformers to 4.50.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ba7e5e21b4916abc", "name": "CVE-2025-3262: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/req", "shortDescription": {"text": "CVE-2025-3262: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requirements.txt"}, "fullDescription": {"text": "transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers\n\nA Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the huggingface/transformers repository, specifically in version 4.49.0. The vulnerability is due to inefficient regular expression complexity in the `SETTING_RE` variable within the `transformers/commands/chat.py` file. The regex contains repetition groups and non-optimized quantifiers, leading to exponential backtracking when processing 'almost matching' payloads. This can degrade application performance and potenti\n\nPackage: transformers\nInstalled: 4.49.0\nFixed in: 4.51.0\nSeverity: MEDIUM\nFix: Upgrade transformers to 4.51.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9b1bda8185983e4f", "name": "CVE-2025-3263: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/req", "shortDescription": {"text": "CVE-2025-3263: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requirements.txt"}, "fullDescription": {"text": "transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers\n\nA Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically in the `get_configuration_file()` function within the `transformers.configuration_utils` module. The affected version is 4.49.0, and the issue is resolved in version 4.51.0. The vulnerability arises from the use of a regular expression pattern `config\\.(.*)\\.json` that can be exploited to cause excessive CPU consumption through crafted input strings, leading to catas\n\nPackage: transformers\nInstalled: 4.49.0\nFixed in: 4.51.0\nSeverity: MEDIUM\nFix: Upgrade transformers to 4.51.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b8a1217f3ea37dae", "name": "CVE-2025-3264: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/req", "shortDescription": {"text": "CVE-2025-3264: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requirements.txt"}, "fullDescription": {"text": "transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers\n\nA Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically in the `get_imports()` function within `dynamic_module_utils.py`. This vulnerability affects versions 4.49.0 and is fixed in version 4.51.0. The issue arises from a regular expression pattern `\\s*try\\s*:.*?except.*?:` used to filter out try/except blocks from Python code, which can be exploited to cause excessive CPU consumption through crafted input strings due to c\n\nPackage: transformers\nInstalled: 4.49.0\nFixed in: 4.51.0\nSeverity: MEDIUM\nFix: Upgrade transformers to 4.51.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4bb71f2ae26134ff", "name": "CVE-2025-3933: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/req", "shortDescription": {"text": "CVE-2025-3933: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requirements.txt"}, "fullDescription": {"text": "transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers\n\nA Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically within the DonutProcessor class's `token2json()` method. This vulnerability affects versions 4.50.3 and earlier, and is fixed in version 4.52.1. The issue arises from the regex pattern `<s_(.*?)>` which can be exploited to cause excessive CPU consumption through crafted input strings due to catastrophic backtracking. This vulnerability can lead to service disruption,\n\nPackage: transformers\nInstalled: 4.49.0\nFixed in: 4.52.1\nSeverity: MEDIUM\nFix: Upgrade transformers to 4.52.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4339c8958a6fda07", "name": "CVE-2025-5197: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/req", "shortDescription": {"text": "CVE-2025-5197: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requirements.txt"}, "fullDescription": {"text": "transformers: Transformers ReDoS Vulnerability\n\nA Regular Expression Denial of Service (ReDoS) vulnerability exists in the Hugging Face Transformers library, specifically in the `convert_tf_weight_name_to_pt_weight_name()` function. This function, responsible for converting TensorFlow weight names to PyTorch format, uses a regex pattern `/[^/]*___([^/]*)/` that can be exploited to cause excessive CPU consumption through crafted input strings due to catastrophic backtracking. The vulnerability affects versions up to 4.51.3 and is fixed in vers\n\nPackage: transformers\nInstalled: 4.49.0\nFixed in: 4.53.0\nSeverity: MEDIUM\nFix: Upgrade transformers to 4.53.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-47ecef47b739fcd2", "name": "CVE-2025-6051: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/req", "shortDescription": {"text": "CVE-2025-6051: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requirements.txt"}, "fullDescription": {"text": "transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers\n\nA Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically within the `normalize_numbers()` method of the `EnglishNormalizer` class. This vulnerability affects versions up to 4.52.4 and is fixed in version 4.53.0. The issue arises from the method's handling of numeric strings, which can be exploited using crafted input strings containing long sequences of digits, leading to excessive CPU consumption. This vulnerability impac\n\nPackage: transformers\nInstalled: 4.49.0\nFixed in: 4.53.0\nSeverity: MEDIUM\nFix: Upgrade transformers to 4.53.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-aef934d403200b4b", "name": "CVE-2025-6638: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/req", "shortDescription": {"text": "CVE-2025-6638: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requirements.txt"}, "fullDescription": {"text": "transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers\n\nA Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically affecting the MarianTokenizer's `remove_language_code()` method. This vulnerability is present in version 4.52.4 and has been fixed in version 4.53.0. The issue arises from inefficient regex processing, which can be exploited by crafted input strings containing malformed language code patterns, leading to excessive CPU consumption and potential denial of service.\n\nPackage: transformers\nInstalled: 4.49.0\nFixed in: 4.53.0\nSeverity: MEDIUM\nFix: Upgrade transformers to 4.53.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-815cb414d69be81d", "name": "CVE-2025-6921: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/req", "shortDescription": {"text": "CVE-2025-6921: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requirements.txt"}, "fullDescription": {"text": "transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers\n\nThe huggingface/transformers library, versions prior to 4.53.0, is vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer. The vulnerability arises from the _do_use_weight_decay method, which processes user-controlled regular expressions in the include_in_weight_decay and exclude_from_weight_decay lists. Malicious regular expressions can cause catastrophic backtracking during the re.search call, leading to 100% CPU utilization and a denial of service. This is\n\nPackage: transformers\nInstalled: 4.49.0\nFixed in: 4.53.0\nSeverity: MEDIUM\nFix: Upgrade transformers to 4.53.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bf61642f276c63d1", "name": "CVE-2026-1839: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/req", "shortDescription": {"text": "CVE-2026-1839: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requirements.txt"}, "fullDescription": {"text": "transformers: HuggingFace Transformers: Arbitrary code execution via malicious checkpoint file\n\nA vulnerability in the HuggingFace Transformers library, specifically in the `Trainer` class, allows for arbitrary code execution. The `_load_rng_state()` method in `src/transformers/trainer.py` at line 3059 calls `torch.load()` without the `weights_only=True` parameter. This issue affects all versions of the library supporting `torch>=2.2` when used with PyTorch versions below 2.6, as the `safe_globals()` context manager provides no protection in these versions. An attacker can exploit this vul\n\nPackage: transformers\nInstalled: 4.49.0\nFixed in: 5.0.0rc3\nSeverity: MEDIUM\nFix: Upgrade transformers to 5.0.0rc3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-595a4966a4255682", "name": "CVE-2025-3777: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/req", "shortDescription": {"text": "CVE-2025-3777: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requirements.txt"}, "fullDescription": {"text": "transformers: Improper Input Validation in huggingface/transformers\n\nHugging Face Transformers versions up to 4.49.0 are affected by an improper input validation vulnerability in the `image_utils.py` file. The vulnerability arises from insecure URL validation using the `startswith()` method, which can be bypassed through URL username injection. This allows attackers to craft URLs that appear to be from YouTube but resolve to malicious domains, potentially leading to phishing attacks, malware distribution, or data exfiltration. The issue is fixed in version 4.52.1\n\nPackage: transformers\nInstalled: 4.49.0\nFixed in: 4.52.1\nSeverity: LOW\nFix: Upgrade transformers to 4.52.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6c65b7a016262cdd", "name": "CVE-2025-1194: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103", "shortDescription": {"text": "CVE-2025-1194: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/requirements.txt"}, "fullDescription": {"text": "Transformers Regular Expression Denial of Service (ReDoS) vulnerability\n\nA Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, specifically in the file `tokenization_gpt_neox_japanese.py` of the GPT-NeoX-Japanese model. The vulnerability occurs in the SubWordJapaneseTokenizer class, where regular expressions process specially crafted inputs. The issue stems from a regex exhibiting exponential complexity under certain conditions, leading to excessive backtracking. This can result in high CPU usage and pote\n\nPackage: transformers\nInstalled: 4.49.0\nFixed in: 4.50.0\nSeverity: MEDIUM\nFix: Upgrade transformers to 4.50.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c96a580217643008", "name": "CVE-2025-2099: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103", "shortDescription": {"text": "CVE-2025-2099: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/requirements.txt"}, "fullDescription": {"text": "transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers\n\nA vulnerability in the `preprocess_string()` function of the `transformers.testing_utils` module in huggingface/transformers version v4.48.3 allows for a Regular Expression Denial of Service (ReDoS) attack. The regular expression used to process code blocks in docstrings contains nested quantifiers, leading to exponential backtracking when processing input with a large number of newline characters. An attacker can exploit this by providing a specially crafted payload, causing high CPU usage and \n\nPackage: transformers\nInstalled: 4.49.0\nFixed in: 4.50.0\nSeverity: MEDIUM\nFix: Upgrade transformers to 4.50.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0a8d090d72f69b3b", "name": "CVE-2025-3262: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103", "shortDescription": {"text": "CVE-2025-3262: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/requirements.txt"}, "fullDescription": {"text": "transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers\n\nA Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the huggingface/transformers repository, specifically in version 4.49.0. The vulnerability is due to inefficient regular expression complexity in the `SETTING_RE` variable within the `transformers/commands/chat.py` file. The regex contains repetition groups and non-optimized quantifiers, leading to exponential backtracking when processing 'almost matching' payloads. This can degrade application performance and potenti\n\nPackage: transformers\nInstalled: 4.49.0\nFixed in: 4.51.0\nSeverity: MEDIUM\nFix: Upgrade transformers to 4.51.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-705470dd640bfbbc", "name": "CVE-2025-3263: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103", "shortDescription": {"text": "CVE-2025-3263: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/requirements.txt"}, "fullDescription": {"text": "transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers\n\nA Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically in the `get_configuration_file()` function within the `transformers.configuration_utils` module. The affected version is 4.49.0, and the issue is resolved in version 4.51.0. The vulnerability arises from the use of a regular expression pattern `config\\.(.*)\\.json` that can be exploited to cause excessive CPU consumption through crafted input strings, leading to catas\n\nPackage: transformers\nInstalled: 4.49.0\nFixed in: 4.51.0\nSeverity: MEDIUM\nFix: Upgrade transformers to 4.51.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2a2afb957b24e364", "name": "CVE-2025-3264: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103", "shortDescription": {"text": "CVE-2025-3264: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/requirements.txt"}, "fullDescription": {"text": "transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers\n\nA Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically in the `get_imports()` function within `dynamic_module_utils.py`. This vulnerability affects versions 4.49.0 and is fixed in version 4.51.0. The issue arises from a regular expression pattern `\\s*try\\s*:.*?except.*?:` used to filter out try/except blocks from Python code, which can be exploited to cause excessive CPU consumption through crafted input strings due to c\n\nPackage: transformers\nInstalled: 4.49.0\nFixed in: 4.51.0\nSeverity: MEDIUM\nFix: Upgrade transformers to 4.51.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-72d87ecaf34d53bf", "name": "CVE-2025-3933: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103", "shortDescription": {"text": "CVE-2025-3933: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/requirements.txt"}, "fullDescription": {"text": "transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers\n\nA Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically within the DonutProcessor class's `token2json()` method. This vulnerability affects versions 4.50.3 and earlier, and is fixed in version 4.52.1. The issue arises from the regex pattern `<s_(.*?)>` which can be exploited to cause excessive CPU consumption through crafted input strings due to catastrophic backtracking. This vulnerability can lead to service disruption,\n\nPackage: transformers\nInstalled: 4.49.0\nFixed in: 4.52.1\nSeverity: MEDIUM\nFix: Upgrade transformers to 4.52.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-70e30d322d638eb8", "name": "CVE-2025-5197: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103", "shortDescription": {"text": "CVE-2025-5197: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/requirements.txt"}, "fullDescription": {"text": "transformers: Transformers ReDoS Vulnerability\n\nA Regular Expression Denial of Service (ReDoS) vulnerability exists in the Hugging Face Transformers library, specifically in the `convert_tf_weight_name_to_pt_weight_name()` function. This function, responsible for converting TensorFlow weight names to PyTorch format, uses a regex pattern `/[^/]*___([^/]*)/` that can be exploited to cause excessive CPU consumption through crafted input strings due to catastrophic backtracking. The vulnerability affects versions up to 4.51.3 and is fixed in vers\n\nPackage: transformers\nInstalled: 4.49.0\nFixed in: 4.53.0\nSeverity: MEDIUM\nFix: Upgrade transformers to 4.53.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-04c79502c38253cf", "name": "CVE-2025-6051: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103", "shortDescription": {"text": "CVE-2025-6051: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/requirements.txt"}, "fullDescription": {"text": "transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers\n\nA Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically within the `normalize_numbers()` method of the `EnglishNormalizer` class. This vulnerability affects versions up to 4.52.4 and is fixed in version 4.53.0. The issue arises from the method's handling of numeric strings, which can be exploited using crafted input strings containing long sequences of digits, leading to excessive CPU consumption. This vulnerability impac\n\nPackage: transformers\nInstalled: 4.49.0\nFixed in: 4.53.0\nSeverity: MEDIUM\nFix: Upgrade transformers to 4.53.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7665ea0b18fa6ae9", "name": "CVE-2025-6638: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103", "shortDescription": {"text": "CVE-2025-6638: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/requirements.txt"}, "fullDescription": {"text": "transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers\n\nA Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically affecting the MarianTokenizer's `remove_language_code()` method. This vulnerability is present in version 4.52.4 and has been fixed in version 4.53.0. The issue arises from inefficient regex processing, which can be exploited by crafted input strings containing malformed language code patterns, leading to excessive CPU consumption and potential denial of service.\n\nPackage: transformers\nInstalled: 4.49.0\nFixed in: 4.53.0\nSeverity: MEDIUM\nFix: Upgrade transformers to 4.53.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a75510d1690ebeea", "name": "CVE-2025-6921: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103", "shortDescription": {"text": "CVE-2025-6921: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/requirements.txt"}, "fullDescription": {"text": "transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers\n\nThe huggingface/transformers library, versions prior to 4.53.0, is vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer. The vulnerability arises from the _do_use_weight_decay method, which processes user-controlled regular expressions in the include_in_weight_decay and exclude_from_weight_decay lists. Malicious regular expressions can cause catastrophic backtracking during the re.search call, leading to 100% CPU utilization and a denial of service. This is\n\nPackage: transformers\nInstalled: 4.49.0\nFixed in: 4.53.0\nSeverity: MEDIUM\nFix: Upgrade transformers to 4.53.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-34e6b5a4dabcad33", "name": "CVE-2026-1839: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103", "shortDescription": {"text": "CVE-2026-1839: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/requirements.txt"}, "fullDescription": {"text": "transformers: HuggingFace Transformers: Arbitrary code execution via malicious checkpoint file\n\nA vulnerability in the HuggingFace Transformers library, specifically in the `Trainer` class, allows for arbitrary code execution. The `_load_rng_state()` method in `src/transformers/trainer.py` at line 3059 calls `torch.load()` without the `weights_only=True` parameter. This issue affects all versions of the library supporting `torch>=2.2` when used with PyTorch versions below 2.6, as the `safe_globals()` context manager provides no protection in these versions. An attacker can exploit this vul\n\nPackage: transformers\nInstalled: 4.49.0\nFixed in: 5.0.0rc3\nSeverity: MEDIUM\nFix: Upgrade transformers to 5.0.0rc3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-afb6f7c352029496", "name": "CVE-2025-3777: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103", "shortDescription": {"text": "CVE-2025-3777: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/requirements.txt"}, "fullDescription": {"text": "transformers: Improper Input Validation in huggingface/transformers\n\nHugging Face Transformers versions up to 4.49.0 are affected by an improper input validation vulnerability in the `image_utils.py` file. The vulnerability arises from insecure URL validation using the `startswith()` method, which can be bypassed through URL username injection. This allows attackers to craft URLs that appear to be from YouTube but resolve to malicious domains, potentially leading to phishing attacks, malware distribution, or data exfiltration. The issue is fixed in version 4.52.1\n\nPackage: transformers\nInstalled: 4.49.0\nFixed in: 4.52.1\nSeverity: LOW\nFix: Upgrade transformers to 4.52.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3b7cca0e8570107a", "name": "CVE-2025-1194: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requ", "shortDescription": {"text": "CVE-2025-1194: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requirements.txt"}, "fullDescription": {"text": "Transformers Regular Expression Denial of Service (ReDoS) vulnerability\n\nA Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, specifically in the file `tokenization_gpt_neox_japanese.py` of the GPT-NeoX-Japanese model. The vulnerability occurs in the SubWordJapaneseTokenizer class, where regular expressions process specially crafted inputs. The issue stems from a regex exhibiting exponential complexity under certain conditions, leading to excessive backtracking. This can result in high CPU usage and pote\n\nPackage: transformers\nInstalled: 4.49.0\nFixed in: 4.50.0\nSeverity: MEDIUM\nFix: Upgrade transformers to 4.50.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-34190a0ecf24e5d6", "name": "CVE-2025-2099: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requ", "shortDescription": {"text": "CVE-2025-2099: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requirements.txt"}, "fullDescription": {"text": "transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers\n\nA vulnerability in the `preprocess_string()` function of the `transformers.testing_utils` module in huggingface/transformers version v4.48.3 allows for a Regular Expression Denial of Service (ReDoS) attack. The regular expression used to process code blocks in docstrings contains nested quantifiers, leading to exponential backtracking when processing input with a large number of newline characters. An attacker can exploit this by providing a specially crafted payload, causing high CPU usage and \n\nPackage: transformers\nInstalled: 4.49.0\nFixed in: 4.50.0\nSeverity: MEDIUM\nFix: Upgrade transformers to 4.50.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-085f490c43c42752", "name": "CVE-2025-3262: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requ", "shortDescription": {"text": "CVE-2025-3262: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requirements.txt"}, "fullDescription": {"text": "transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers\n\nA Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the huggingface/transformers repository, specifically in version 4.49.0. The vulnerability is due to inefficient regular expression complexity in the `SETTING_RE` variable within the `transformers/commands/chat.py` file. The regex contains repetition groups and non-optimized quantifiers, leading to exponential backtracking when processing 'almost matching' payloads. This can degrade application performance and potenti\n\nPackage: transformers\nInstalled: 4.49.0\nFixed in: 4.51.0\nSeverity: MEDIUM\nFix: Upgrade transformers to 4.51.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f3406e2e70f59e58", "name": "CVE-2025-3263: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requ", "shortDescription": {"text": "CVE-2025-3263: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requirements.txt"}, "fullDescription": {"text": "transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers\n\nA Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically in the `get_configuration_file()` function within the `transformers.configuration_utils` module. The affected version is 4.49.0, and the issue is resolved in version 4.51.0. The vulnerability arises from the use of a regular expression pattern `config\\.(.*)\\.json` that can be exploited to cause excessive CPU consumption through crafted input strings, leading to catas\n\nPackage: transformers\nInstalled: 4.49.0\nFixed in: 4.51.0\nSeverity: MEDIUM\nFix: Upgrade transformers to 4.51.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-abd2c4e3ab0fbe69", "name": "CVE-2025-3264: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requ", "shortDescription": {"text": "CVE-2025-3264: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requirements.txt"}, "fullDescription": {"text": "transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers\n\nA Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically in the `get_imports()` function within `dynamic_module_utils.py`. This vulnerability affects versions 4.49.0 and is fixed in version 4.51.0. The issue arises from a regular expression pattern `\\s*try\\s*:.*?except.*?:` used to filter out try/except blocks from Python code, which can be exploited to cause excessive CPU consumption through crafted input strings due to c\n\nPackage: transformers\nInstalled: 4.49.0\nFixed in: 4.51.0\nSeverity: MEDIUM\nFix: Upgrade transformers to 4.51.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a3bf1309322ade6b", "name": "CVE-2025-3933: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requ", "shortDescription": {"text": "CVE-2025-3933: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requirements.txt"}, "fullDescription": {"text": "transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers\n\nA Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically within the DonutProcessor class's `token2json()` method. This vulnerability affects versions 4.50.3 and earlier, and is fixed in version 4.52.1. The issue arises from the regex pattern `<s_(.*?)>` which can be exploited to cause excessive CPU consumption through crafted input strings due to catastrophic backtracking. This vulnerability can lead to service disruption,\n\nPackage: transformers\nInstalled: 4.49.0\nFixed in: 4.52.1\nSeverity: MEDIUM\nFix: Upgrade transformers to 4.52.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b5d82bd674443ab3", "name": "CVE-2025-5197: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requ", "shortDescription": {"text": "CVE-2025-5197: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requirements.txt"}, "fullDescription": {"text": "transformers: Transformers ReDoS Vulnerability\n\nA Regular Expression Denial of Service (ReDoS) vulnerability exists in the Hugging Face Transformers library, specifically in the `convert_tf_weight_name_to_pt_weight_name()` function. This function, responsible for converting TensorFlow weight names to PyTorch format, uses a regex pattern `/[^/]*___([^/]*)/` that can be exploited to cause excessive CPU consumption through crafted input strings due to catastrophic backtracking. The vulnerability affects versions up to 4.51.3 and is fixed in vers\n\nPackage: transformers\nInstalled: 4.49.0\nFixed in: 4.53.0\nSeverity: MEDIUM\nFix: Upgrade transformers to 4.53.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2a403b1216d5a445", "name": "CVE-2025-6051: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requ", "shortDescription": {"text": "CVE-2025-6051: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requirements.txt"}, "fullDescription": {"text": "transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers\n\nA Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically within the `normalize_numbers()` method of the `EnglishNormalizer` class. This vulnerability affects versions up to 4.52.4 and is fixed in version 4.53.0. The issue arises from the method's handling of numeric strings, which can be exploited using crafted input strings containing long sequences of digits, leading to excessive CPU consumption. This vulnerability impac\n\nPackage: transformers\nInstalled: 4.49.0\nFixed in: 4.53.0\nSeverity: MEDIUM\nFix: Upgrade transformers to 4.53.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ca672f31b3b949e2", "name": "CVE-2025-6638: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requ", "shortDescription": {"text": "CVE-2025-6638: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requirements.txt"}, "fullDescription": {"text": "transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers\n\nA Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically affecting the MarianTokenizer's `remove_language_code()` method. This vulnerability is present in version 4.52.4 and has been fixed in version 4.53.0. The issue arises from inefficient regex processing, which can be exploited by crafted input strings containing malformed language code patterns, leading to excessive CPU consumption and potential denial of service.\n\nPackage: transformers\nInstalled: 4.49.0\nFixed in: 4.53.0\nSeverity: MEDIUM\nFix: Upgrade transformers to 4.53.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-013ff285e329322b", "name": "CVE-2025-6921: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requ", "shortDescription": {"text": "CVE-2025-6921: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requirements.txt"}, "fullDescription": {"text": "transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers\n\nThe huggingface/transformers library, versions prior to 4.53.0, is vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer. The vulnerability arises from the _do_use_weight_decay method, which processes user-controlled regular expressions in the include_in_weight_decay and exclude_from_weight_decay lists. Malicious regular expressions can cause catastrophic backtracking during the re.search call, leading to 100% CPU utilization and a denial of service. This is\n\nPackage: transformers\nInstalled: 4.49.0\nFixed in: 4.53.0\nSeverity: MEDIUM\nFix: Upgrade transformers to 4.53.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-05be21e762ae047e", "name": "CVE-2026-1839: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requ", "shortDescription": {"text": "CVE-2026-1839: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requirements.txt"}, "fullDescription": {"text": "transformers: HuggingFace Transformers: Arbitrary code execution via malicious checkpoint file\n\nA vulnerability in the HuggingFace Transformers library, specifically in the `Trainer` class, allows for arbitrary code execution. The `_load_rng_state()` method in `src/transformers/trainer.py` at line 3059 calls `torch.load()` without the `weights_only=True` parameter. This issue affects all versions of the library supporting `torch>=2.2` when used with PyTorch versions below 2.6, as the `safe_globals()` context manager provides no protection in these versions. An attacker can exploit this vul\n\nPackage: transformers\nInstalled: 4.49.0\nFixed in: 5.0.0rc3\nSeverity: MEDIUM\nFix: Upgrade transformers to 5.0.0rc3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-743506cc68eeadfc", "name": "CVE-2025-3777: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requ", "shortDescription": {"text": "CVE-2025-3777: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requirements.txt"}, "fullDescription": {"text": "transformers: Improper Input Validation in huggingface/transformers\n\nHugging Face Transformers versions up to 4.49.0 are affected by an improper input validation vulnerability in the `image_utils.py` file. The vulnerability arises from insecure URL validation using the `startswith()` method, which can be bypassed through URL username injection. This allows attackers to craft URLs that appear to be from YouTube but resolve to malicious domains, potentially leading to phishing attacks, malware distribution, or data exfiltration. The issue is fixed in version 4.52.1\n\nPackage: transformers\nInstalled: 4.49.0\nFixed in: 4.52.1\nSeverity: LOW\nFix: Upgrade transformers to 4.52.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1cb2b6e020b82e6d", "name": "DS-0002: Image user should not be 'root' \u2014 skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cif", "shortDescription": {"text": "DS-0002: Image user should not be 'root' \u2014 skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/Dockerfile"}, "fullDescription": {"text": "Image user should not be 'root'\n\nSpecify at least 1 USER command in Dockerfile with non-root user as argument\n\nRule: DS-0002\nSeverity: HIGH\nTarget: skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a4d9855dd8ce1f09", "name": "DS-0026: No HEALTHCHECK defined \u2014 skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/Dock", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/Dockerfile"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e17a74004d84f52c", "name": "DS-0002: Image user should not be 'root' \u2014 skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cpp", "shortDescription": {"text": "DS-0002: Image user should not be 'root' \u2014 skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/Dockerfile"}, "fullDescription": {"text": "Image user should not be 'root'\n\nSpecify at least 1 USER command in Dockerfile with non-root user as argument\n\nRule: DS-0002\nSeverity: HIGH\nTarget: skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b52affe3e9e1e9da", "name": "DS-0026: No HEALTHCHECK defined \u2014 skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/Docker", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/Dockerfile"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f1a7c04e0bafb212", "name": "DS-0002: Image user should not be 'root' \u2014 skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-food", "shortDescription": {"text": "DS-0002: Image user should not be 'root' \u2014 skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/Dockerfile"}, "fullDescription": {"text": "Image user should not be 'root'\n\nSpecify at least 1 USER command in Dockerfile with non-root user as argument\n\nRule: DS-0002\nSeverity: HIGH\nTarget: skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7f60733beaa0a77c", "name": "DS-0026: No HEALTHCHECK defined \u2014 skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/Do", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/Dockerfile"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b0b7b05e2a884026", "name": "DS-0002: Image user should not be 'root' \u2014 skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav", "shortDescription": {"text": "DS-0002: Image user should not be 'root' \u2014 skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/Dockerfile"}, "fullDescription": {"text": "Image user should not be 'root'\n\nSpecify at least 1 USER command in Dockerfile with non-root user as argument\n\nRule: DS-0002\nSeverity: HIGH\nTarget: skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f1728f878d097b1c", "name": "DS-0026: No HEALTHCHECK defined \u2014 skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/Dockerf", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/Dockerfile"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cb9c07679726de6c", "name": "Agent authority lacks a verifier contract: templates/skill-skeleton/minimal/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: templates/skill-skeleton/minimal/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-806fc17148da09c3", "name": "Agent authority lacks a verifier contract: templates/skill-skeleton/platform/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: templates/skill-skeleton/platform/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-09f02b9250442005", "name": "Agent authority lacks a verifier contract: templates/skill-skeleton/model/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: templates/skill-skeleton/model/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-df050e68e2ac4aef", "name": "Agent authority lacks a verifier contract: skills/models/tao-train-pose-classification/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/models/tao-train-pose-classification/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-aa3bf9fc01909bc9", "name": "Agent authority lacks a verifier contract: skills/models/tao-train-dino/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/models/tao-train-dino/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3e041b1209defa33", "name": "Agent authority lacks a verifier contract: skills/models/tao-train-oneformer/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/models/tao-train-oneformer/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-314402e1c43e06a4", "name": "Agent authority lacks a verifier contract: skills/models/tao-train-metric-learning-recognition/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/models/tao-train-metric-learning-recognition/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c59fd20b782308f0", "name": "Agent authority lacks a verifier contract: skills/models/tao-train-image-classification/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/models/tao-train-image-classification/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d47fc416b1cb54b0", "name": "Agent authority lacks a verifier contract: skills/models/tao-train-segformer/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/models/tao-train-segformer/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c49d3e989260ad9c", "name": "Agent authority lacks a verifier contract: skills/models/tao-train-mask2former/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/models/tao-train-mask2former/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a3d88fd048f642d5", "name": "Agent authority lacks a verifier contract: skills/models/tao-train-nvdinov2/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/models/tao-train-nvdinov2/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-85d08c1e4f04a3ad", "name": "Agent authority lacks a verifier contract: skills/models/tao-train-mask-auto-label/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/models/tao-train-mask-auto-label/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e4d8b89f0c219c11", "name": "Agent authority lacks a verifier contract: skills/models/tao-train-foundation-stereo/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/models/tao-train-foundation-stereo/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4a8ca4c88548b8f9", "name": "Agent authority lacks a verifier contract: skills/models/tao-finetune-cosmos-embed/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/models/tao-finetune-cosmos-embed/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b3d6a0d0f2e2131a", "name": "Agent authority lacks a verifier contract: skills/models/tao-train-visual-changenet/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/models/tao-train-visual-changenet/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fb753955e15133e2", "name": "Agent authority lacks a verifier contract: skills/models/tao-train-deformable-detr/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/models/tao-train-deformable-detr/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-71772348f8c12698", "name": "Agent authority lacks a verifier contract: skills/models/tao-train-bevfusion/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/models/tao-train-bevfusion/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1e9502a2006d775f", "name": "Agent authority lacks a verifier contract: skills/models/tao-train-grounding-dino/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/models/tao-train-grounding-dino/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-36bfa9d960508023", "name": "Agent authority lacks a verifier contract: skills/models/tao-train-rtdetr/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/models/tao-train-rtdetr/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2b8521a942da9595", "name": "Agent instruction/config may expose a secret: skills/platform/tao-run-on-kubernetes/SKILL.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: skills/platform/tao-run-on-kubernetes/SKILL.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-27ca0a0e3eb73713", "name": "Agent authority lacks a verifier contract: skills/platform/tao-run-platform/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/platform/tao-run-platform/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-abb9e9d3b72973fb", "name": "Agent authority lacks a verifier contract: skills/platform/tao-run-on-docker/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/platform/tao-run-on-docker/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f0dcc0b93f52aec6", "name": "Agent instruction/config may expose a secret: skills/core/tao-launch-workflow/SKILL.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: skills/core/tao-launch-workflow/SKILL.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-81ee391e284ff04e", "name": "Agent authority lacks a verifier contract: skills/applications/tao-run-deft-aoi/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/applications/tao-run-deft-aoi/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-38b18067e2c5cc41", "name": "Agent authority lacks a verifier contract: skills/applications/tao-finetune-huggingface-model/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/applications/tao-finetune-huggingface-model/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-09a66f4774867929", "name": "Agent authority lacks a verifier contract: skills/applications/tao-port-huggingface-model/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/applications/tao-port-huggingface-model/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-24783c328b9a3689", "name": "SkillSpector LP3 (mcp-least-priv) in skills/applications/tao-analyze-changenet-rca/SKILL.md", "shortDescription": {"text": "SkillSpector LP3 (mcp-least-priv) in skills/applications/tao-analyze-changenet-rca/SKILL.md"}, "fullDescription": {"text": "MCP Least Privilege\n\nWithout declared permissions the skill's intent is opaque and cannot be validated.\n\nSkill: tao-analyze-changenet-rca\nRule: LP3  Category: mcp-least-priv\nSeverity: MEDIUM  Confidence: 0.70\n\nRemediation: Add a 'permissions' field to SKILL.md listing the capabilities this skill requires."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-fc8062b664c86851", "name": "SkillSpector SC3 (supply-chain) in skills/applications/tao-analyze-changenet-rca/skill.oms.sig", "shortDescription": {"text": "SkillSpector SC3 (supply-chain) in skills/applications/tao-analyze-changenet-rca/skill.oms.sig"}, "fullDescription": {"text": "\"MIICgzCCAgmgAwIBAgIUKIyS7SxNteQIiWzK1dWj85E6520wCgYIKoZIzj0EAwMwVTELMAkGA1UEBhMCVVMxGzAZBgNVBAoMEk5WSURJQSBDb3Jwb3JhdGlvbjEpMCcGA1UEAwwgTlZJRElBIEFnZW50IENhcGFiaWxpdGllcyBJQ0EgMDEwHhcNMjYwNDAxMDAwMDA\n\nCode contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.\n\nSkill: tao-analyze-changenet-rca\nRule: SC3  Category: supply-chain\nSeverity: HIGH  Confidence: 0.50\n\nRemediation: Remove obfuscated code. Use plain, readable implementations. Obfuscation hinders security review and raises trust concerns."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.5}}, {"id": "scanner-b530bf3b0baafa07", "name": "SkillSpector LP3 (mcp-least-priv) in skills/applications/tao-finetune-huggingface-model/SKILL.md", "shortDescription": {"text": "SkillSpector LP3 (mcp-least-priv) in skills/applications/tao-finetune-huggingface-model/SKILL.md"}, "fullDescription": {"text": "MCP Least Privilege\n\nWithout declared permissions the skill's intent is opaque and cannot be validated.\n\nSkill: tao-finetune-huggingface-model\nRule: LP3  Category: mcp-least-priv\nSeverity: MEDIUM  Confidence: 0.70\n\nRemediation: Add a 'permissions' field to SKILL.md listing the capabilities this skill requires."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-cbc971ab2c9963b9", "name": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/infer.", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/infer.py"}, "fullDescription": {"text": "os.environ.get(\"HF_TOKEN\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: tao-finetune-huggingface-model\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-afe696047672bc5c", "name": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/prepar", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/prepare_data.py"}, "fullDescription": {"text": "os.environ.get(\"HF_TOKEN\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: tao-finetune-huggingface-model\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-12dca48b48b1be5b", "name": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/run_ev", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/run_eval.py"}, "fullDescription": {"text": "os.environ.get(\"HF_TOKEN\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: tao-finetune-huggingface-model\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-3627f29d264d6e0b", "name": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/train.", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/train.py"}, "fullDescription": {"text": "os.environ.get(\"HF_TOKEN\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: tao-finetune-huggingface-model\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-403665feafc38714", "name": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/infer.py", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/infer.py"}, "fullDescription": {"text": "os.environ.get(\"HF_TOKEN\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: tao-finetune-huggingface-model\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-dde3df4515001ec3", "name": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/prepare_", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/prepare_data.py"}, "fullDescription": {"text": "os.environ.get(\"HF_TOKEN\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: tao-finetune-huggingface-model\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-86e4f7200601c447", "name": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/run_eval", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/run_eval.py"}, "fullDescription": {"text": "os.environ.get(\"HF_TOKEN\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: tao-finetune-huggingface-model\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-f3497c7e3510f836", "name": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/train.py", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/train.py"}, "fullDescription": {"text": "os.environ.get(\"HF_TOKEN\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: tao-finetune-huggingface-model\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-d648612e4328651f", "name": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/infe", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/infer.py"}, "fullDescription": {"text": "os.environ.get(\"HF_TOKEN\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: tao-finetune-huggingface-model\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-1d5bf6be878b0ba9", "name": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/prep", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/prepare_data.py"}, "fullDescription": {"text": "os.environ.get(\"HF_TOKEN\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: tao-finetune-huggingface-model\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-bc0ec44eb5804283", "name": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/run_", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/run_eval.py"}, "fullDescription": {"text": "os.environ.get(\"HF_TOKEN\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: tao-finetune-huggingface-model\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-0e00ebdd316a673a", "name": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/trai", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/train.py"}, "fullDescription": {"text": "os.environ.get(\"HF_TOKEN\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: tao-finetune-huggingface-model\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-bd396fe4804fdd9e", "name": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/infer.py", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/infer.py"}, "fullDescription": {"text": "os.environ.get(\"HF_TOKEN\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: tao-finetune-huggingface-model\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-a0aa2f08bc5a126f", "name": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/merge_lor", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/merge_lora.py"}, "fullDescription": {"text": "os.environ.get(\"HF_TOKEN\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: tao-finetune-huggingface-model\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-fba1311619457daf", "name": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/prepare_d", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/prepare_data.py"}, "fullDescription": {"text": "os.environ.get(\"HF_TOKEN\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: tao-finetune-huggingface-model\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-ff81bbff559cdc01", "name": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/run_eval.", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/run_eval.py"}, "fullDescription": {"text": "os.environ.get(\"HF_TOKEN\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: tao-finetune-huggingface-model\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-2313438a4bfd0b94", "name": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/train.py", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/train.py"}, "fullDescription": {"text": "os.environ.get(\"HF_TOKEN\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: tao-finetune-huggingface-model\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-cd13fc3fcebb3c3d", "name": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/references/cv-scripts.md", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/references/cv-scripts.md"}, "fullDescription": {"text": "os.environ.get(\"HF_TOKEN\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: tao-finetune-huggingface-model\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-2e37a797dc6e4b42", "name": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/references/dataset-patterns.md", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/references/dataset-patterns.md"}, "fullDescription": {"text": "os.environ.get(\"HF_TOKEN\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: tao-finetune-huggingface-model\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-5b24e919d1d4f5fd", "name": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/references/dataset-sources.md", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/references/dataset-sources.md"}, "fullDescription": {"text": "os.environ.get(\"HF_TOKEN\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: tao-finetune-huggingface-model\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-9ab5d62f5b4084ef", "name": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/references/hub-push.md", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/references/hub-push.md"}, "fullDescription": {"text": "os.environ[\"HF_TOKEN\"]\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: tao-finetune-huggingface-model\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.80\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.8}}, {"id": "scanner-7b95cb18b9169350", "name": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/references/testing.md", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/references/testing.md"}, "fullDescription": {"text": "os.environ.get(\"HF_TOKEN\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: tao-finetune-huggingface-model\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-035cd06a46bb9c77", "name": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/references/vlm-scripts.md", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/references/vlm-scripts.md"}, "fullDescription": {"text": "os.environ.get(\"HF_TOKEN\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: tao-finetune-huggingface-model\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-997e8a42d58d78bd", "name": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/references/workflow-intake-preflight.", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/references/workflow-intake-preflight.md"}, "fullDescription": {"text": "os.environ.get(\"HF_TOKEN\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: tao-finetune-huggingface-model\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-59e64bde376a87a3", "name": "SkillSpector EA2 (excessive-agency) in skills/applications/tao-finetune-huggingface-model/SKILL.md", "shortDescription": {"text": "SkillSpector EA2 (excessive-agency) in skills/applications/tao-finetune-huggingface-model/SKILL.md"}, "fullDescription": {"text": "without approval\n\nSkill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.\n\nSkill: tao-finetune-huggingface-model\nRule: EA2  Category: excessive-agency\nSeverity: MEDIUM  Confidence: 0.75\n\nRemediation: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.75}}, {"id": "scanner-122009374201d01a", "name": "SkillSpector EA2 (excessive-agency) in skills/applications/tao-finetune-huggingface-model/references/compat-workarounds.", "shortDescription": {"text": "SkillSpector EA2 (excessive-agency) in skills/applications/tao-finetune-huggingface-model/references/compat-workarounds.md"}, "fullDescription": {"text": "without checking\n\nSkill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.\n\nSkill: tao-finetune-huggingface-model\nRule: EA2  Category: excessive-agency\nSeverity: MEDIUM  Confidence: 0.75\n\nRemediation: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.75}}, {"id": "scanner-9bfcbf0901392251", "name": "SkillSpector EA2 (excessive-agency) in skills/applications/tao-finetune-huggingface-model/references/workflow-intake-pre", "shortDescription": {"text": "SkillSpector EA2 (excessive-agency) in skills/applications/tao-finetune-huggingface-model/references/workflow-intake-preflight.md"}, "fullDescription": {"text": "without approval\n\nSkill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.\n\nSkill: tao-finetune-huggingface-model\nRule: EA2  Category: excessive-agency\nSeverity: MEDIUM  Confidence: 0.75\n\nRemediation: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.75}}, {"id": "scanner-bb2d25e747ff3fea", "name": "SkillSpector OH3 (output-handling) in skills/applications/tao-finetune-huggingface-model/references/compat-workarounds.m", "shortDescription": {"text": "SkillSpector OH3 (output-handling) in skills/applications/tao-finetune-huggingface-model/references/compat-workarounds.md"}, "fullDescription": {"text": "No truncation\n\nOutput size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.\n\nSkill: tao-finetune-huggingface-model\nRule: OH3  Category: output-handling\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Set explicit limits on output length, generation count, and rate. Use max_tokens and truncation to prevent unbounded output."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-cb98f1aa12384f9c", "name": "SkillSpector PE3 (priv-esc) in skills/applications/tao-finetune-huggingface-model/references/deliverables.md", "shortDescription": {"text": "SkillSpector PE3 (priv-esc) in skills/applications/tao-finetune-huggingface-model/references/deliverables.md"}, "fullDescription": {"text": ".env\n\nCode accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.\n\nSkill: tao-finetune-huggingface-model\nRule: PE3  Category: priv-esc\nSeverity: HIGH  Confidence: 0.60\n\nRemediation: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.6}}, {"id": "scanner-65d4798517ba0a38", "name": "SkillSpector PE2 (priv-esc) in skills/applications/tao-finetune-huggingface-model/references/docker-runs.md", "shortDescription": {"text": "SkillSpector PE2 (priv-esc) in skills/applications/tao-finetune-huggingface-model/references/docker-runs.md"}, "fullDescription": {"text": "sudo\n\nCommands invoke sudo or root privileges. Verify this elevated access is necessary and justified.\n\nSkill: tao-finetune-huggingface-model\nRule: PE2  Category: priv-esc\nSeverity: MEDIUM  Confidence: 0.70\n\nRemediation: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-eb538a9ae0ac7de5", "name": "SkillSpector P2 (prompt-injection) in skills/applications/tao-finetune-huggingface-model/references/deliverables.md", "shortDescription": {"text": "SkillSpector P2 (prompt-injection) in skills/applications/tao-finetune-huggingface-model/references/deliverables.md"}, "fullDescription": {"text": "<!--\nCopyright (c) 2026, NVIDIA CORPORATION.  All rights reserved.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou\n\nHidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.\n\nSkill: tao-finetune-huggingface-model\nRule: P2  Category: prompt-injection\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-53ae791bc9501dba", "name": "SkillSpector P2 (prompt-injection) in skills/applications/tao-finetune-huggingface-model/references/pipeline-skill-templ", "shortDescription": {"text": "SkillSpector P2 (prompt-injection) in skills/applications/tao-finetune-huggingface-model/references/pipeline-skill-template.md"}, "fullDescription": {"text": "<!--\nCopyright (c) 2026, NVIDIA CORPORATION.  All rights reserved.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou\n\nHidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.\n\nSkill: tao-finetune-huggingface-model\nRule: P2  Category: prompt-injection\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-3db97eae246e6450", "name": "SkillSpector SC1 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/req", "shortDescription": {"text": "SkillSpector SC1 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "fullDescription": {"text": "pillow\n\nDependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.\n\nSkill: tao-finetune-huggingface-model\nRule: SC1  Category: supply-chain\nSeverity: LOW  Confidence: 0.60\n\nRemediation: Pin all dependency versions in requirements.txt or pyproject.toml. Use exact versions (==) or compatible ranges. Run pip-audit regularly."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.6}}, {"id": "scanner-1497517d30079834", "name": "SkillSpector SC1 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requi", "shortDescription": {"text": "SkillSpector SC1 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requirements.txt"}, "fullDescription": {"text": "pillow\n\nDependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.\n\nSkill: tao-finetune-huggingface-model\nRule: SC1  Category: supply-chain\nSeverity: LOW  Confidence: 0.60\n\nRemediation: Pin all dependency versions in requirements.txt or pyproject.toml. Use exact versions (==) or compatible ranges. Run pip-audit regularly."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.6}}, {"id": "scanner-7aa253e2f44de2ec", "name": "SkillSpector SC1 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/r", "shortDescription": {"text": "SkillSpector SC1 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/requirements.txt"}, "fullDescription": {"text": "pillow\n\nDependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.\n\nSkill: tao-finetune-huggingface-model\nRule: SC1  Category: supply-chain\nSeverity: LOW  Confidence: 0.60\n\nRemediation: Pin all dependency versions in requirements.txt or pyproject.toml. Use exact versions (==) or compatible ranges. Run pip-audit regularly."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.6}}, {"id": "scanner-65d2833ba0e8e1ec", "name": "SkillSpector SC1 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requir", "shortDescription": {"text": "SkillSpector SC1 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requirements.txt"}, "fullDescription": {"text": "pillow\n\nDependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.\n\nSkill: tao-finetune-huggingface-model\nRule: SC1  Category: supply-chain\nSeverity: LOW  Confidence: 0.60\n\nRemediation: Pin all dependency versions in requirements.txt or pyproject.toml. Use exact versions (==) or compatible ranges. Run pip-audit regularly."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.6}}, {"id": "scanner-b3fb7d833ee37ac6", "name": "SkillSpector SC3 (supply-chain) in skills/applications/tao-finetune-huggingface-model/skill.oms.sig", "shortDescription": {"text": "SkillSpector SC3 (supply-chain) in skills/applications/tao-finetune-huggingface-model/skill.oms.sig"}, "fullDescription": {"text": "\"MIICgzCCAgmgAwIBAgIUKIyS7SxNteQIiWzK1dWj85E6520wCgYIKoZIzj0EAwMwVTELMAkGA1UEBhMCVVMxGzAZBgNVBAoMEk5WSURJQSBDb3Jwb3JhdGlvbjEpMCcGA1UEAwwgTlZJRElBIEFnZW50IENhcGFiaWxpdGllcyBJQ0EgMDEwHhcNMjYwNDAxMDAwMDA\n\nCode contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.\n\nSkill: tao-finetune-huggingface-model\nRule: SC3  Category: supply-chain\nSeverity: HIGH  Confidence: 0.50\n\nRemediation: Remove obfuscated code. Use plain, readable implementations. Obfuscation hinders security review and raises trust concerns."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.5}}, {"id": "scanner-86f7f4366b2215a6", "name": "SkillSpector SC4 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/req", "shortDescription": {"text": "SkillSpector SC4 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "fullDescription": {"text": "transformers==4.49.0\n\nDependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.\n\nSkill: tao-finetune-huggingface-model\nRule: SC4  Category: supply-chain\nSeverity: LOW  Confidence: 0.60\n\nRemediation: Update the dependency to a patched version that addresses the known CVE. Check OSV (osv.dev) or NVD for details on the vulnerability."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.6}}, {"id": "scanner-db8b3e37557dd3fe", "name": "SkillSpector SC4 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requi", "shortDescription": {"text": "SkillSpector SC4 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requirements.txt"}, "fullDescription": {"text": "transformers==4.49.0\n\nDependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.\n\nSkill: tao-finetune-huggingface-model\nRule: SC4  Category: supply-chain\nSeverity: LOW  Confidence: 0.60\n\nRemediation: Update the dependency to a patched version that addresses the known CVE. Check OSV (osv.dev) or NVD for details on the vulnerability."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.6}}, {"id": "scanner-c3892b922921ead7", "name": "SkillSpector SC4 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/r", "shortDescription": {"text": "SkillSpector SC4 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/requirements.txt"}, "fullDescription": {"text": "transformers==4.49.0\n\nDependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.\n\nSkill: tao-finetune-huggingface-model\nRule: SC4  Category: supply-chain\nSeverity: LOW  Confidence: 0.60\n\nRemediation: Update the dependency to a patched version that addresses the known CVE. Check OSV (osv.dev) or NVD for details on the vulnerability."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.6}}, {"id": "scanner-ae4c33f44ad20a4a", "name": "SkillSpector SC4 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requir", "shortDescription": {"text": "SkillSpector SC4 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requirements.txt"}, "fullDescription": {"text": "transformers==4.49.0\n\nDependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.\n\nSkill: tao-finetune-huggingface-model\nRule: SC4  Category: supply-chain\nSeverity: LOW  Confidence: 0.60\n\nRemediation: Update the dependency to a patched version that addresses the known CVE. Check OSV (osv.dev) or NVD for details on the vulnerability."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.6}}, {"id": "scanner-58282b029847bd6a", "name": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/SKILL.md", "shortDescription": {"text": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/SKILL.md"}, "fullDescription": {"text": "rm -rf \"$OUTPUT_DIR/\n\nTool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).\n\nSkill: tao-finetune-huggingface-model\nRule: TM1  Category: tool-misuse\nSeverity: HIGH  Confidence: 0.85\n\nRemediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.85}}, {"id": "scanner-4e80f0a2c7683d59", "name": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/deliverables.md", "shortDescription": {"text": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/deliverables.md"}, "fullDescription": {"text": "rm` for one-shots; keep `ENTRYPOINT [\"/bin/\n\nTool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).\n\nSkill: tao-finetune-huggingface-model\nRule: TM1  Category: tool-misuse\nSeverity: HIGH  Confidence: 0.85\n\nRemediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.85}}, {"id": "scanner-21cbbb5ab8784982", "name": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/docker-runs.md", "shortDescription": {"text": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/docker-runs.md"}, "fullDescription": {"text": "rm --gpus all --shm-size=16g --entrypoint /bin/\n\nTool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).\n\nSkill: tao-finetune-huggingface-model\nRule: TM1  Category: tool-misuse\nSeverity: LOW  Confidence: 0.15\n\nRemediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.15}}, {"id": "scanner-971c8984f5e68723", "name": "SkillSpector TM3 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/docker-runs.md", "shortDescription": {"text": "SkillSpector TM3 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/docker-runs.md"}, "fullDescription": {"text": "world-readable\n\nTool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.\n\nSkill: tao-finetune-huggingface-model\nRule: TM3  Category: tool-misuse\nSeverity: MEDIUM  Confidence: 0.70\n\nRemediation: Override unsafe defaults with secure settings (verify=True, auth required, restrictive permissions). Review and harden all tool configurations."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-2b2d02346c9e941f", "name": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/error-playbook.md", "shortDescription": {"text": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/error-playbook.md"}, "fullDescription": {"text": "rm` for one-shots; `ENTRYPOINT [\"/bin/\n\nTool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).\n\nSkill: tao-finetune-huggingface-model\nRule: TM1  Category: tool-misuse\nSeverity: HIGH  Confidence: 0.85\n\nRemediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.85}}, {"id": "scanner-ac2d03c825203c7b", "name": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/pipeline-skill-template.", "shortDescription": {"text": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/pipeline-skill-template.md"}, "fullDescription": {"text": "rm --gpus all --shm-size=16g --entrypoint /bin/\n\nTool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).\n\nSkill: tao-finetune-huggingface-model\nRule: TM1  Category: tool-misuse\nSeverity: LOW  Confidence: 0.15\n\nRemediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.15}}, {"id": "scanner-0761bf467234cabc", "name": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/tao-rerun-convnext-cifar", "shortDescription": {"text": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/tao-rerun-convnext-cifar10.md"}, "fullDescription": {"text": "rm --gpus all --shm-size=16g --entrypoint /bin/\n\nTool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).\n\nSkill: tao-finetune-huggingface-model\nRule: TM1  Category: tool-misuse\nSeverity: LOW  Confidence: 0.15\n\nRemediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.15}}, {"id": "scanner-4ddbcee3885c9f59", "name": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/tao-rerun-detr-cppe5.md", "shortDescription": {"text": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/tao-rerun-detr-cppe5.md"}, "fullDescription": {"text": "rm --gpus all --shm-size=16g --entrypoint /bin/\n\nTool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).\n\nSkill: tao-finetune-huggingface-model\nRule: TM1  Category: tool-misuse\nSeverity: LOW  Confidence: 0.15\n\nRemediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.15}}, {"id": "scanner-442ac9cbe912f904", "name": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/tao-rerun-segformer-food", "shortDescription": {"text": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/tao-rerun-segformer-foodseg103.md"}, "fullDescription": {"text": "rm --gpus all --shm-size=16g --entrypoint /bin/\n\nTool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).\n\nSkill: tao-finetune-huggingface-model\nRule: TM1  Category: tool-misuse\nSeverity: LOW  Confidence: 0.15\n\nRemediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.15}}, {"id": "scanner-481333897a00480c", "name": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/tao-rerun-smolvlm-vqav2.", "shortDescription": {"text": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/tao-rerun-smolvlm-vqav2.md"}, "fullDescription": {"text": "rm --gpus all --shm-size=16g --entrypoint /bin/\n\nTool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).\n\nSkill: tao-finetune-huggingface-model\nRule: TM1  Category: tool-misuse\nSeverity: LOW  Confidence: 0.15\n\nRemediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.15}}, {"id": "scanner-b1368e6a80496759", "name": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/workflow-intake-prefligh", "shortDescription": {"text": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/workflow-intake-preflight.md"}, "fullDescription": {"text": "rm -rf \"$OUTPUT_DIR/\n\nTool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).\n\nSkill: tao-finetune-huggingface-model\nRule: TM1  Category: tool-misuse\nSeverity: HIGH  Confidence: 0.85\n\nRemediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.85}}, {"id": "scanner-823274bdd8ce18e0", "name": "SkillSpector E2 (data-exfil) in skills/applications/tao-port-huggingface-model/references/phase-1-inspection.md", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-port-huggingface-model/references/phase-1-inspection.md"}, "fullDescription": {"text": "os.environ.get(\"HF_TOKEN\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: tao-port-huggingface-model\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-f4ccebabadc54b54", "name": "SkillSpector OH1 (output-handling) in skills/applications/tao-port-huggingface-model/references/phase-5-packaging.md", "shortDescription": {"text": "SkillSpector OH1 (output-handling) in skills/applications/tao-port-huggingface-model/references/phase-5-packaging.md"}, "fullDescription": {"text": "subprocess.run(cmd, shell=True, capture_output\n\nModel output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.\n\nSkill: tao-port-huggingface-model\nRule: OH1  Category: output-handling\nSeverity: HIGH  Confidence: 0.85\n\nRemediation: Validate and sanitize all model output before using it in downstream contexts. Use parameterized queries for SQL, shell quoting for commands, and HTML encoding for web output."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.85}}, {"id": "scanner-35c50309f5bc3d63", "name": "SkillSpector OH1 (output-handling) in skills/applications/tao-port-huggingface-model/references/tao-patterns.md", "shortDescription": {"text": "SkillSpector OH1 (output-handling) in skills/applications/tao-port-huggingface-model/references/tao-patterns.md"}, "fullDescription": {"text": "subprocess.run(cmd, shell=True, capture_output\n\nModel output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.\n\nSkill: tao-port-huggingface-model\nRule: OH1  Category: output-handling\nSeverity: HIGH  Confidence: 0.85\n\nRemediation: Validate and sanitize all model output before using it in downstream contexts. Use parameterized queries for SQL, shell quoting for commands, and HTML encoding for web output."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.85}}, {"id": "scanner-6c9ca7e2cc081646", "name": "SkillSpector PE2 (priv-esc) in skills/applications/tao-port-huggingface-model/references/cross-cutting.md", "shortDescription": {"text": "SkillSpector PE2 (priv-esc) in skills/applications/tao-port-huggingface-model/references/cross-cutting.md"}, "fullDescription": {"text": "sudo\n\nCommands invoke sudo or root privileges. Verify this elevated access is necessary and justified.\n\nSkill: tao-port-huggingface-model\nRule: PE2  Category: priv-esc\nSeverity: MEDIUM  Confidence: 0.70\n\nRemediation: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-6621808ae0cc9fc6", "name": "SkillSpector SC3 (supply-chain) in skills/applications/tao-port-huggingface-model/skill.oms.sig", "shortDescription": {"text": "SkillSpector SC3 (supply-chain) in skills/applications/tao-port-huggingface-model/skill.oms.sig"}, "fullDescription": {"text": "\"MIICgzCCAgmgAwIBAgIUKIyS7SxNteQIiWzK1dWj85E6520wCgYIKoZIzj0EAwMwVTELMAkGA1UEBhMCVVMxGzAZBgNVBAoMEk5WSURJQSBDb3Jwb3JhdGlvbjEpMCcGA1UEAwwgTlZJRElBIEFnZW50IENhcGFiaWxpdGllcyBJQ0EgMDEwHhcNMjYwNDAxMDAwMDA\n\nCode contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.\n\nSkill: tao-port-huggingface-model\nRule: SC3  Category: supply-chain\nSeverity: HIGH  Confidence: 0.50\n\nRemediation: Remove obfuscated code. Use plain, readable implementations. Obfuscation hinders security review and raises trust concerns."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.5}}, {"id": "scanner-ef124698926ab1a4", "name": "SkillSpector TM2 (tool-misuse) in skills/applications/tao-port-huggingface-model/references/docker-patterns.md", "shortDescription": {"text": "SkillSpector TM2 (tool-misuse) in skills/applications/tao-port-huggingface-model/references/docker-patterns.md"}, "fullDescription": {"text": "| xargs -I'{}' python -m pip install '{}' && rm\n\nTool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.\n\nSkill: tao-port-huggingface-model\nRule: TM2  Category: tool-misuse\nSeverity: HIGH  Confidence: 0.75\n\nRemediation: Limit tool chaining depth and validate the output of each tool before passing it to the next. Require explicit user approval for multi-step chains."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.75}}, {"id": "scanner-946b8360648eba92", "name": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-port-huggingface-model/references/phase-1-inspection.md", "shortDescription": {"text": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-port-huggingface-model/references/phase-1-inspection.md"}, "fullDescription": {"text": "rm -f tao-hf-inspect 2>/dev/\n\nTool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).\n\nSkill: tao-port-huggingface-model\nRule: TM1  Category: tool-misuse\nSeverity: HIGH  Confidence: 0.85\n\nRemediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.85}}, {"id": "scanner-03d9c3e3d691ab57", "name": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-port-huggingface-model/references/phase-5-packaging.md", "shortDescription": {"text": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-port-huggingface-model/references/phase-5-packaging.md"}, "fullDescription": {"text": "subprocess.run(cmd, shell=True\n\nTool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).\n\nSkill: tao-port-huggingface-model\nRule: TM1  Category: tool-misuse\nSeverity: HIGH  Confidence: 0.80\n\nRemediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.8}}, {"id": "scanner-7ac4b8ea4ea64cf0", "name": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-port-huggingface-model/references/tao-patterns.md", "shortDescription": {"text": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-port-huggingface-model/references/tao-patterns.md"}, "fullDescription": {"text": "subprocess.run(cmd, shell=True\n\nTool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).\n\nSkill: tao-port-huggingface-model\nRule: TM1  Category: tool-misuse\nSeverity: HIGH  Confidence: 0.80\n\nRemediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.8}}, {"id": "scanner-d81ed666c8ebb249", "name": "SkillSpector YR4 (yara) in skills/applications/tao-port-huggingface-model/references/workflow-consistency.md", "shortDescription": {"text": "SkillSpector YR4 (yara) in skills/applications/tao-port-huggingface-model/references/workflow-consistency.md"}, "fullDescription": {"text": "Hydra args: `--config-p\n\nYARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).\n\nSkill: tao-port-huggingface-model\nRule: YR4  Category: yara\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Remove offensive tool references and exploit code. Legitimate agent skills should not contain penetration testing tools, exploit frameworks, or reconnaissance utilities."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-5d9a6b4e3fb12a08", "name": "SkillSpector E2 (data-exfil) in skills/applications/tao-run-automl/references/automl-examples.md", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-run-automl/references/automl-examples.md"}, "fullDescription": {"text": "os.environ[\"AUTOML_LLM_API_KEY\"]\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: tao-run-automl\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.80\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.8}}, {"id": "scanner-75ab996fb8c0afac", "name": "SkillSpector EA2 (excessive-agency) in skills/applications/tao-run-automl/references/automl-intent-algorithms.md", "shortDescription": {"text": "SkillSpector EA2 (excessive-agency) in skills/applications/tao-run-automl/references/automl-intent-algorithms.md"}, "fullDescription": {"text": "without asking\n\nSkill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.\n\nSkill: tao-run-automl\nRule: EA2  Category: excessive-agency\nSeverity: MEDIUM  Confidence: 0.75\n\nRemediation: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.75}}, {"id": "scanner-9d9ed1f5eb243e2e", "name": "SkillSpector EA3 (excessive-agency) in skills/applications/tao-run-automl/references/automl-intent-algorithms.md", "shortDescription": {"text": "SkillSpector EA3 (excessive-agency) in skills/applications/tao-run-automl/references/automl-intent-algorithms.md"}, "fullDescription": {"text": "Also run any\n\nSkill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.\n\nSkill: tao-run-automl\nRule: EA3  Category: excessive-agency\nSeverity: LOW  Confidence: 0.65\n\nRemediation: Limit the skill's scope to its documented purpose. Remove instructions that enable the agent to perform actions outside its stated functionality."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.65}}, {"id": "scanner-1095596cd4361635", "name": "SkillSpector RA2 (rogue-agent) in skills/applications/tao-run-automl/references/automl-preflight-concepts.md", "shortDescription": {"text": "SkillSpector RA2 (rogue-agent) in skills/applications/tao-run-automl/references/automl-preflight-concepts.md"}, "fullDescription": {"text": "create runner files, workspaces, state files, logs, compatibility shims, or install dependencies until the selected platform's credentials, access check, dataset visibility, model credentials, contain\n\nSkill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.\n\nSkill: tao-run-automl\nRule: RA2  Category: rogue-agent\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-5d93de17ccea5910", "name": "SkillSpector SC3 (supply-chain) in skills/applications/tao-run-automl/skill.oms.sig", "shortDescription": {"text": "SkillSpector SC3 (supply-chain) in skills/applications/tao-run-automl/skill.oms.sig"}, "fullDescription": {"text": "\"MIICgzCCAgmgAwIBAgIUKIyS7SxNteQIiWzK1dWj85E6520wCgYIKoZIzj0EAwMwVTELMAkGA1UEBhMCVVMxGzAZBgNVBAoMEk5WSURJQSBDb3Jwb3JhdGlvbjEpMCcGA1UEAwwgTlZJRElBIEFnZW50IENhcGFiaWxpdGllcyBJQ0EgMDEwHhcNMjYwNDAxMDAwMDA\n\nCode contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.\n\nSkill: tao-run-automl\nRule: SC3  Category: supply-chain\nSeverity: HIGH  Confidence: 0.50\n\nRemediation: Remove obfuscated code. Use plain, readable implementations. Obfuscation hinders security review and raises trust concerns."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.5}}, {"id": "scanner-82bfc76969de878d", "name": "SkillSpector EA2 (excessive-agency) in skills/applications/tao-run-automl-deft-pipeline/references/consolidated-prefligh", "shortDescription": {"text": "SkillSpector EA2 (excessive-agency) in skills/applications/tao-run-automl-deft-pipeline/references/consolidated-preflight.md"}, "fullDescription": {"text": "auto-approve\n\nSkill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.\n\nSkill: tao-run-automl-deft-pipeline\nRule: EA2  Category: excessive-agency\nSeverity: MEDIUM  Confidence: 0.85\n\nRemediation: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-1a405015492bbd1d", "name": "SkillSpector SC3 (supply-chain) in skills/applications/tao-run-automl-deft-pipeline/skill.oms.sig", "shortDescription": {"text": "SkillSpector SC3 (supply-chain) in skills/applications/tao-run-automl-deft-pipeline/skill.oms.sig"}, "fullDescription": {"text": "\"MIICgzCCAgmgAwIBAgIUKIyS7SxNteQIiWzK1dWj85E6520wCgYIKoZIzj0EAwMwVTELMAkGA1UEBhMCVVMxGzAZBgNVBAoMEk5WSURJQSBDb3Jwb3JhdGlvbjEpMCcGA1UEAwwgTlZJRElBIEFnZW50IENhcGFiaWxpdGllcyBJQ0EgMDEwHhcNMjYwNDAxMDAwMDA\n\nCode contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.\n\nSkill: tao-run-automl-deft-pipeline\nRule: SC3  Category: supply-chain\nSeverity: HIGH  Confidence: 0.50\n\nRemediation: Remove obfuscated code. Use plain, readable implementations. Obfuscation hinders security review and raises trust concerns."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.5}}, {"id": "scanner-a343c6aff08f79fb", "name": "SkillSpector TT2 (taint) in skills/applications/tao-run-deft-aoi/scripts/stage_backbone.py", "shortDescription": {"text": "SkillSpector TT2 (taint) in skills/applications/tao-run-deft-aoi/scripts/stage_backbone.py"}, "fullDescription": {"text": "shutil.copy(src, dest)\n\nData from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.\n\nSkill: tao-run-deft-aoi\nRule: TT2  Category: taint\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Validate tainted variables before passing them to sinks. Use allowlists, type checks, or sanitization functions on data from external sources."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-2d8aea4d0f3a173b", "name": "SkillSpector LP3 (mcp-least-priv) in skills/applications/tao-run-deft-aoi/SKILL.md", "shortDescription": {"text": "SkillSpector LP3 (mcp-least-priv) in skills/applications/tao-run-deft-aoi/SKILL.md"}, "fullDescription": {"text": "MCP Least Privilege\n\nWithout declared permissions the skill's intent is opaque and cannot be validated.\n\nSkill: tao-run-deft-aoi\nRule: LP3  Category: mcp-least-priv\nSeverity: MEDIUM  Confidence: 0.70\n\nRemediation: Add a 'permissions' field to SKILL.md listing the capabilities this skill requires."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-ca1448ba79e5789d", "name": "SkillSpector E2 (data-exfil) in skills/applications/tao-run-deft-aoi/scripts/stage_backbone.py", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-run-deft-aoi/scripts/stage_backbone.py"}, "fullDescription": {"text": "os.environ.get(\"HF_TOKEN\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: tao-run-deft-aoi\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-33c48f96c2e34068", "name": "SkillSpector EA2 (excessive-agency) in skills/applications/tao-run-deft-aoi/SKILL.md", "shortDescription": {"text": "SkillSpector EA2 (excessive-agency) in skills/applications/tao-run-deft-aoi/SKILL.md"}, "fullDescription": {"text": "without asking\n\nSkill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.\n\nSkill: tao-run-deft-aoi\nRule: EA2  Category: excessive-agency\nSeverity: MEDIUM  Confidence: 0.75\n\nRemediation: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.75}}, {"id": "scanner-8762074fab3b3614", "name": "SkillSpector PE3 (priv-esc) in skills/applications/tao-run-deft-aoi/references/paidf-anomalygen.md", "shortDescription": {"text": "SkillSpector PE3 (priv-esc) in skills/applications/tao-run-deft-aoi/references/paidf-anomalygen.md"}, "fullDescription": {"text": "/etc/passwd\n\nCode accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.\n\nSkill: tao-run-deft-aoi\nRule: PE3  Category: priv-esc\nSeverity: HIGH  Confidence: 0.60\n\nRemediation: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.6}}, {"id": "scanner-72b72ee7a030a6b5", "name": "SkillSpector P2 (prompt-injection) in skills/applications/tao-run-deft-aoi/agents/reporter.md", "shortDescription": {"text": "SkillSpector P2 (prompt-injection) in skills/applications/tao-run-deft-aoi/agents/reporter.md"}, "fullDescription": {"text": "<!--\\n====')`); do **not** use a `<!--.*?-->` regex \u2014 it stops at the first `-->` inside the block and leaves the rest as visible text.\n\n### Step 4 \u2014 Compute every placeholder value\n\nBuild a single Py\n\nHidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.\n\nSkill: tao-run-deft-aoi\nRule: P2  Category: prompt-injection\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-96c120a600206a49", "name": "SkillSpector P2 (prompt-injection) in skills/applications/tao-run-deft-aoi/references/DEFT_Loop_Report.html", "shortDescription": {"text": "SkillSpector P2 (prompt-injection) in skills/applications/tao-run-deft-aoi/references/DEFT_Loop_Report.html"}, "fullDescription": {"text": "<!--\n================================================================================\n  DEFT Loop Final Report \u2014 TEMPLATE\n==============================================================================\n\nHidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.\n\nSkill: tao-run-deft-aoi\nRule: P2  Category: prompt-injection\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-d82672d456a7068c", "name": "SkillSpector RA2 (rogue-agent) in skills/applications/tao-run-deft-aoi/eval.config", "shortDescription": {"text": "SkillSpector RA2 (rogue-agent) in skills/applications/tao-run-deft-aoi/eval.config"}, "fullDescription": {"text": "write a \\\"what would happen next\\\" placeholder, do NOT decide the run is \\\"too expensive\\\" or \\\"too long\\\". Do not preemptively shorten the work.\\n\\n**No human is in the loop.** Do not ask for confirm\n\nSkill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.\n\nSkill: tao-run-deft-aoi\nRule: RA2  Category: rogue-agent\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-244f7fa28c702126", "name": "SkillSpector RA2 (rogue-agent) in skills/applications/tao-run-deft-aoi/references/SCRIPT_USAGE.md", "shortDescription": {"text": "SkillSpector RA2 (rogue-agent) in skills/applications/tao-run-deft-aoi/references/SCRIPT_USAGE.md"}, "fullDescription": {"text": "write `loop_log.jsonl` with `echo`, heredocs, or inline `jq`. The writer must compute `seq` from the live tail through `next_seq()`.\n\n## Aligning Per-Stage Token Usage (Post-Loop)\n\n`log_stage.py` cann\n\nSkill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.\n\nSkill: tao-run-deft-aoi\nRule: RA2  Category: rogue-agent\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-4d20b34df98b9b9e", "name": "SkillSpector RA2 (rogue-agent) in skills/applications/tao-run-deft-aoi/references/pipeline-and-state.md", "shortDescription": {"text": "SkillSpector RA2 (rogue-agent) in skills/applications/tao-run-deft-aoi/references/pipeline-and-state.md"}, "fullDescription": {"text": "write time; backfilled at loop end by align_token_usage.py>,\n  \"tokens\":         <object added at loop end: input, output, cache_read, cache_create, n_messages, models>\n}\n```\n\n`context_tokens` is a pl\n\nSkill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.\n\nSkill: tao-run-deft-aoi\nRule: RA2  Category: rogue-agent\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-b8bf8de1c4761438", "name": "SkillSpector RA2 (rogue-agent) in skills/applications/tao-run-deft-aoi/scripts/align_token_usage.py", "shortDescription": {"text": "SkillSpector RA2 (rogue-agent) in skills/applications/tao-run-deft-aoi/scripts/align_token_usage.py"}, "fullDescription": {"text": "create\n      \"models\": [str]               # distinct model IDs seen in this stage\n    }\n\"\"\"\n\nfrom __future__ import annotations\n\nimport argparse\nimport datetime\nimport json\nimport os\nimport pathlib\ni\n\nSkill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.\n\nSkill: tao-run-deft-aoi\nRule: RA2  Category: rogue-agent\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-422f80ab78e80646", "name": "SkillSpector SC3 (supply-chain) in skills/applications/tao-run-deft-aoi/skill.oms.sig", "shortDescription": {"text": "SkillSpector SC3 (supply-chain) in skills/applications/tao-run-deft-aoi/skill.oms.sig"}, "fullDescription": {"text": "\"MIICgzCCAgmgAwIBAgIUKIyS7SxNteQIiWzK1dWj85E6520wCgYIKoZIzj0EAwMwVTELMAkGA1UEBhMCVVMxGzAZBgNVBAoMEk5WSURJQSBDb3Jwb3JhdGlvbjEpMCcGA1UEAwwgTlZJRElBIEFnZW50IENhcGFiaWxpdGllcyBJQ0EgMDEwHhcNMjYwNDAxMDAwMDA\n\nCode contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.\n\nSkill: tao-run-deft-aoi\nRule: SC3  Category: supply-chain\nSeverity: HIGH  Confidence: 0.50\n\nRemediation: Remove obfuscated code. Use plain, readable implementations. Obfuscation hinders security review and raises trust concerns."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.5}}, {"id": "scanner-f8061cd6cf230a7b", "name": "SkillSpector TM3 (tool-misuse) in skills/applications/tao-run-deft-aoi/SKILL.md", "shortDescription": {"text": "SkillSpector TM3 (tool-misuse) in skills/applications/tao-run-deft-aoi/SKILL.md"}, "fullDescription": {"text": "world-writable\n\nTool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.\n\nSkill: tao-run-deft-aoi\nRule: TM3  Category: tool-misuse\nSeverity: MEDIUM  Confidence: 0.70\n\nRemediation: Override unsafe defaults with secure settings (verify=True, auth required, restrictive permissions). Review and harden all tool configurations."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-b66ba7bb9ad6a446", "name": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-run-deft-aoi/references/paidf-anomalygen.md", "shortDescription": {"text": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-run-deft-aoi/references/paidf-anomalygen.md"}, "fullDescription": {"text": "chmod 777\n\nTool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).\n\nSkill: tao-run-deft-aoi\nRule: TM1  Category: tool-misuse\nSeverity: HIGH  Confidence: 0.80\n\nRemediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.8}}, {"id": "scanner-75b11339ff4b852a", "name": "SkillSpector TM3 (tool-misuse) in skills/applications/tao-run-deft-aoi/references/scripts-and-agents.md", "shortDescription": {"text": "SkillSpector TM3 (tool-misuse) in skills/applications/tao-run-deft-aoi/references/scripts-and-agents.md"}, "fullDescription": {"text": "world-writable\n\nTool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.\n\nSkill: tao-run-deft-aoi\nRule: TM3  Category: tool-misuse\nSeverity: MEDIUM  Confidence: 0.70\n\nRemediation: Override unsafe defaults with secure settings (verify=True, auth required, restrictive permissions). Review and harden all tool configurations."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-9a24142bfb9b9c50", "name": "SkillSpector E1 (data-exfil) in skills/applications/tao-run-inference-service/references/request.yaml", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in skills/applications/tao-run-inference-service/references/request.yaml"}, "fullDescription": {"text": "curl -s \\\n      -H \"Content-Type: application/json\" \\\n      --data-raw\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: tao-run-inference-service\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-f5cea8c534006c7f", "name": "SkillSpector RA1 (rogue-agent) in skills/applications/tao-run-inference-service/references/service.yaml", "shortDescription": {"text": "SkillSpector RA1 (rogue-agent) in skills/applications/tao-run-inference-service/references/service.yaml"}, "fullDescription": {"text": "update SKILL\n\nSkill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.\n\nSkill: tao-run-inference-service\nRule: RA1  Category: rogue-agent\nSeverity: HIGH  Confidence: 0.85\n\nRemediation: Prevent the skill from modifying its own code, SKILL.md, or configuration files. Treat skill files as read-only at runtime."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.85}}, {"id": "scanner-7d54981025f592d8", "name": "SkillSpector SC3 (supply-chain) in skills/applications/tao-run-inference-service/skill.oms.sig", "shortDescription": {"text": "SkillSpector SC3 (supply-chain) in skills/applications/tao-run-inference-service/skill.oms.sig"}, "fullDescription": {"text": "\"MIICgzCCAgmgAwIBAgIUKIyS7SxNteQIiWzK1dWj85E6520wCgYIKoZIzj0EAwMwVTELMAkGA1UEBhMCVVMxGzAZBgNVBAoMEk5WSURJQSBDb3Jwb3JhdGlvbjEpMCcGA1UEAwwgTlZJRElBIEFnZW50IENhcGFiaWxpdGllcyBJQ0EgMDEwHhcNMjYwNDAxMDAwMDA\n\nCode contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.\n\nSkill: tao-run-inference-service\nRule: SC3  Category: supply-chain\nSeverity: HIGH  Confidence: 0.50\n\nRemediation: Remove obfuscated code. Use plain, readable implementations. Obfuscation hinders security review and raises trust concerns."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.5}}, {"id": "scanner-9182c93e978784f8", "name": "SkillSpector SC3 (supply-chain) in skills/applications/tao-train-single-step/skill.oms.sig", "shortDescription": {"text": "SkillSpector SC3 (supply-chain) in skills/applications/tao-train-single-step/skill.oms.sig"}, "fullDescription": {"text": "\"MIICgzCCAgmgAwIBAgIUKIyS7SxNteQIiWzK1dWj85E6520wCgYIKoZIzj0EAwMwVTELMAkGA1UEBhMCVVMxGzAZBgNVBAoMEk5WSURJQSBDb3Jwb3JhdGlvbjEpMCcGA1UEAwwgTlZJRElBIEFnZW50IENhcGFiaWxpdGllcyBJQ0EgMDEwHhcNMjYwNDAxMDAwMDA\n\nCode contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.\n\nSkill: tao-train-single-step\nRule: SC3  Category: supply-chain\nSeverity: HIGH  Confidence: 0.50\n\nRemediation: Remove obfuscated code. Use plain, readable implementations. Obfuscation hinders security review and raises trust concerns."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.5}}, {"id": "scanner-471b0dd78b0eaad0", "name": "SkillSpector EA2 (excessive-agency) in skills/core/tao-launch-workflow/SKILL.md", "shortDescription": {"text": "SkillSpector EA2 (excessive-agency) in skills/core/tao-launch-workflow/SKILL.md"}, "fullDescription": {"text": "Do not ask the\nuser\n\nSkill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.\n\nSkill: tao-launch-workflow\nRule: EA2  Category: excessive-agency\nSeverity: MEDIUM  Confidence: 0.80\n\nRemediation: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.8}}, {"id": "scanner-ae4486ec1cef53b0", "name": "SkillSpector PE2 (priv-esc) in skills/core/tao-launch-workflow/SKILL.md", "shortDescription": {"text": "SkillSpector PE2 (priv-esc) in skills/core/tao-launch-workflow/SKILL.md"}, "fullDescription": {"text": "chmod 600\n\nCommands invoke sudo or root privileges. Verify this elevated access is necessary and justified.\n\nSkill: tao-launch-workflow\nRule: PE2  Category: priv-esc\nSeverity: MEDIUM  Confidence: 0.80\n\nRemediation: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.8}}, {"id": "scanner-0181cc166ed85c67", "name": "SkillSpector PE3 (priv-esc) in skills/core/tao-launch-workflow/SKILL.md", "shortDescription": {"text": "SkillSpector PE3 (priv-esc) in skills/core/tao-launch-workflow/SKILL.md"}, "fullDescription": {"text": "~/.ssh/id_ed25519\n\nCode accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.\n\nSkill: tao-launch-workflow\nRule: PE3  Category: priv-esc\nSeverity: HIGH  Confidence: 0.90\n\nRemediation: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.9}}, {"id": "scanner-66baa4ac376ed016", "name": "SkillSpector RA2 (rogue-agent) in skills/core/tao-launch-workflow/SKILL.md", "shortDescription": {"text": "SkillSpector RA2 (rogue-agent) in skills/core/tao-launch-workflow/SKILL.md"}, "fullDescription": {"text": "create runner scripts, launch scripts, compatibility shims,\nworkspace folders, state files, logs, or dependency-install side effects until\nthe launch preflight passes.\n\nPreflight passes only after all\n\nSkill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.\n\nSkill: tao-launch-workflow\nRule: RA2  Category: rogue-agent\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-d445de24b21fb8a7", "name": "SkillSpector SC3 (supply-chain) in skills/core/tao-launch-workflow/skill.oms.sig", "shortDescription": {"text": "SkillSpector SC3 (supply-chain) in skills/core/tao-launch-workflow/skill.oms.sig"}, "fullDescription": {"text": "\"MIICgzCCAgmgAwIBAgIUKIyS7SxNteQIiWzK1dWj85E6520wCgYIKoZIzj0EAwMwVTELMAkGA1UEBhMCVVMxGzAZBgNVBAoMEk5WSURJQSBDb3Jwb3JhdGlvbjEpMCcGA1UEAwwgTlZJRElBIEFnZW50IENhcGFiaWxpdGllcyBJQ0EgMDEwHhcNMjYwNDAxMDAwMDA\n\nCode contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.\n\nSkill: tao-launch-workflow\nRule: SC3  Category: supply-chain\nSeverity: HIGH  Confidence: 0.50\n\nRemediation: Remove obfuscated code. Use plain, readable implementations. Obfuscation hinders security review and raises trust concerns."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.5}}, {"id": "scanner-48a9f51dfe914c98", "name": "SkillSpector SC3 (supply-chain) in skills/core/tao-list-capabilities/skill.oms.sig", "shortDescription": {"text": "SkillSpector SC3 (supply-chain) in skills/core/tao-list-capabilities/skill.oms.sig"}, "fullDescription": {"text": "\"MIICgzCCAgmgAwIBAgIUKIyS7SxNteQIiWzK1dWj85E6520wCgYIKoZIzj0EAwMwVTELMAkGA1UEBhMCVVMxGzAZBgNVBAoMEk5WSURJQSBDb3Jwb3JhdGlvbjEpMCcGA1UEAwwgTlZJRElBIEFnZW50IENhcGFiaWxpdGllcyBJQ0EgMDEwHhcNMjYwNDAxMDAwMDA\n\nCode contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.\n\nSkill: tao-list-capabilities\nRule: SC3  Category: supply-chain\nSeverity: HIGH  Confidence: 0.50\n\nRemediation: Remove obfuscated code. Use plain, readable implementations. Obfuscation hinders security review and raises trust concerns."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.5}}, {"id": "scanner-1210fcc495755b8c", "name": "SkillSpector SC3 (supply-chain) in skills/models/tao-finetune-clip/skill.oms.sig", "shortDescription": {"text": "SkillSpector SC3 (supply-chain) in skills/models/tao-finetune-clip/skill.oms.sig"}, "fullDescription": {"text": "\"MIICgzCCAgmgAwIBAgIUKIyS7SxNteQIiWzK1dWj85E6520wCgYIKoZIzj0EAwMwVTELMAkGA1UEBhMCVVMxGzAZBgNVBAoMEk5WSURJQSBDb3Jwb3JhdGlvbjEpMCcGA1UEAwwgTlZJRElBIEFnZW50IENhcGFiaWxpdGllcyBJQ0EgMDEwHhcNMjYwNDAxMDAwMDA\n\nCode contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.\n\nSkill: tao-finetune-clip\nRule: SC3  Category: supply-chain\nSeverity: HIGH  Confidence: 0.50\n\nRemediation: Remove obfuscated code. Use plain, readable implementations. Obfuscation hinders security review and raises trust concerns."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.5}}, {"id": "scanner-f22eaf2bf3b8b777", "name": "SkillSpector SC3 (supply-chain) in skills/models/tao-finetune-cosmos-embed/skill.oms.sig", "shortDescription": {"text": "SkillSpector SC3 (supply-chain) in skills/models/tao-finetune-cosmos-embed/skill.oms.sig"}, "fullDescription": {"text": "\"MIICgzCCAgmgAwIBAgIUKIyS7SxNteQIiWzK1dWj85E6520wCgYIKoZIzj0EAwMwVTELMAkGA1UEBhMCVVMxGzAZBgNVBAoMEk5WSURJQSBDb3Jwb3JhdGlvbjEpMCcGA1UEAwwgTlZJRElBIEFnZW50IENhcGFiaWxpdGllcyBJQ0EgMDEwHhcNMjYwNDAxMDAwMDA\n\nCode contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.\n\nSkill: tao-finetune-cosmos-embed\nRule: SC3  Category: supply-chain\nSeverity: HIGH  Confidence: 0.50\n\nRemediation: Remove obfuscated code. Use plain, readable implementations. Obfuscation hinders security review and raises trust concerns."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.5}}, {"id": "scanner-76d5cd1f1ce02387", "name": "SkillSpector AST4 (behavioral-ast) in skills/models/tao-finetune-cosmos-reason/scripts/prepare_cosmos3_vlm_checkpoint.py", "shortDescription": {"text": "SkillSpector AST4 (behavioral-ast) in skills/models/tao-finetune-cosmos-reason/scripts/prepare_cosmos3_vlm_checkpoint.py"}, "fullDescription": {"text": "subprocess.run(cmd, cwd=cwd, check=True)\n\nsubprocess module calls execute external commands. Without careful input validation, this enables command injection.\n\nSkill: tao-finetune-cosmos-reason\nRule: AST4  Category: behavioral-ast\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Use subprocess.run() with shell=False and an explicit argument list. Validate all inputs and avoid passing user-controlled data to commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-97eba579ba688c55", "name": "SkillSpector LP3 (mcp-least-priv) in skills/models/tao-finetune-cosmos-reason/SKILL.md", "shortDescription": {"text": "SkillSpector LP3 (mcp-least-priv) in skills/models/tao-finetune-cosmos-reason/SKILL.md"}, "fullDescription": {"text": "MCP Least Privilege\n\nWithout declared permissions the skill's intent is opaque and cannot be validated.\n\nSkill: tao-finetune-cosmos-reason\nRule: LP3  Category: mcp-least-priv\nSeverity: MEDIUM  Confidence: 0.70\n\nRemediation: Add a 'permissions' field to SKILL.md listing the capabilities this skill requires."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-281108d9fe662710", "name": "SkillSpector PE3 (priv-esc) in skills/models/tao-finetune-cosmos-reason/SKILL.md", "shortDescription": {"text": "SkillSpector PE3 (priv-esc) in skills/models/tao-finetune-cosmos-reason/SKILL.md"}, "fullDescription": {"text": "access token\n\nCode accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.\n\nSkill: tao-finetune-cosmos-reason\nRule: PE3  Category: priv-esc\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-99ba63d26ca368ec", "name": "SkillSpector PE3 (priv-esc) in skills/models/tao-finetune-cosmos-reason/references/cosmos-data-specs.md", "shortDescription": {"text": "SkillSpector PE3 (priv-esc) in skills/models/tao-finetune-cosmos-reason/references/cosmos-data-specs.md"}, "fullDescription": {"text": "access token\n\nCode accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.\n\nSkill: tao-finetune-cosmos-reason\nRule: PE3  Category: priv-esc\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-f3fb70501b6a8861", "name": "SkillSpector PE3 (priv-esc) in skills/models/tao-finetune-cosmos-reason/scripts/prepare_cosmos3_vlm_checkpoint.py", "shortDescription": {"text": "SkillSpector PE3 (priv-esc) in skills/models/tao-finetune-cosmos-reason/scripts/prepare_cosmos3_vlm_checkpoint.py"}, "fullDescription": {"text": "secrets.env\n\nCode accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.\n\nSkill: tao-finetune-cosmos-reason\nRule: PE3  Category: priv-esc\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-d7d78ef99745fbe3", "name": "SkillSpector SC3 (supply-chain) in skills/models/tao-finetune-cosmos-reason/skill.oms.sig", "shortDescription": {"text": "SkillSpector SC3 (supply-chain) in skills/models/tao-finetune-cosmos-reason/skill.oms.sig"}, "fullDescription": {"text": "\"MIICgzCCAgmgAwIBAgIUKIyS7SxNteQIiWzK1dWj85E6520wCgYIKoZIzj0EAwMwVTELMAkGA1UEBhMCVVMxGzAZBgNVBAoMEk5WSURJQSBDb3Jwb3JhdGlvbjEpMCcGA1UEAwwgTlZJRElBIEFnZW50IENhcGFiaWxpdGllcyBJQ0EgMDEwHhcNMjYwNDAxMDAwMDA\n\nCode contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.\n\nSkill: tao-finetune-cosmos-reason\nRule: SC3  Category: supply-chain\nSeverity: HIGH  Confidence: 0.50\n\nRemediation: Remove obfuscated code. Use plain, readable implementations. Obfuscation hinders security review and raises trust concerns."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.5}}, {"id": "scanner-e637c415447867e4", "name": "Run SkillSpector's LLM-backed analysis in your own pipeline", "shortDescription": {"text": "Run SkillSpector's LLM-backed analysis in your own pipeline"}, "fullDescription": {"text": "Repobility ran SkillSpector's static rules server-side. The deeper LLM-backed analyzers \u2014 tool-poisoning (TP*), semantic security discovery (SSD*), developer-intent mismatch (SDI*) \u2014 are meant to run on YOUR machine with YOUR model; repobility never sends your code to an LLM. Recipe:\n\n# 1. Install SkillSpector in your own isolated env\npipx install \"skillspector @ git+https://github.com/NVIDIA/SkillSpector.git\"\n\n# 2. Point it at YOUR LLM pipeline (pick one) - your code stays on your machine\nexport SKILLSPECTOR_PROVIDER=anthropic && export ANTHROPIC_API_KEY=sk-ant-...\n# export SKILLSPECTOR_PROVIDER=openai   && export OPENAI_API_KEY=sk-...\n# export SKILLSPECTOR_PROVIDER=openai OPENAI_API_KEY=ollama OPENAI_BASE_URL=http://localhost:11434/v1 SKILLSPECTOR_MODEL=llama3.1:8b\n# export SKILLSPECTOR_PROVIDER=nv_build && export NVIDIA_INFERENCE_KEY=nvapi-...\n\n# 3. Run the LLM-backed scan per skill (omit --no-llm to enable the LLM analyzers)\nskillspector scan skills/applications/tao-analyze-changen"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b00014a8d3bb8a95", "name": "Privileged port 23 in use", "shortDescription": {"text": "Privileged port 23 in use"}, "fullDescription": {"text": "Port 23 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b7421fa8c43fbbd2", "name": "Privileged port 30 in use", "shortDescription": {"text": "Privileged port 30 in use"}, "fullDescription": {"text": "Port 30 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b917d0f267936137", "name": "Dockerfile runs as root: skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d04565802a8281e8", "name": "Dockerfile runs as root: skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0f6345592b30e9ad", "name": "Dockerfile runs as root: skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-48ed58f92e624a2a", "name": "Dockerfile runs as root: skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-54a70107acefbf2b", "name": "Insecure pattern 'eval_used' in skills/applications/tao-finetune-huggingface-model/SKILL.md:303", "shortDescription": {"text": "Insecure pattern 'eval_used' in skills/applications/tao-finetune-huggingface-model/SKILL.md:303"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-85976d47266fb99b", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v2 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4777f07ee63f1f4f", "name": "GitHub Action tracks a moving branch", "shortDescription": {"text": "GitHub Action tracks a moving branch"}, "fullDescription": {"text": "NVIDIA/blossom-action@main can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "high", "confidence": 1.0}}, {"id": "scanner-94408ca156c1a63a", "name": "GitHub Action tracks a moving branch", "shortDescription": {"text": "GitHub Action tracks a moving branch"}, "fullDescription": {"text": "NVIDIA/skills/.github/workflows/team-request.yml@main can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5f87087bd6234b8a", "name": "Very large file: scripts/check_tao_launch_preflight.py (1626 lines)", "shortDescription": {"text": "Very large file: scripts/check_tao_launch_preflight.py (1626 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "0 test file(s) for 36 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 259 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-11825279136b53a3", "name": "CI is configured but no tests are detected", "shortDescription": {"text": "CI is configured but no tests are detected"}, "fullDescription": {"text": "A CI pipeline exists, but the scan found no test files to gate. Opus labeled this generated-code pattern as config theater: release machinery exists, but it has little behavioral signal."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing tests. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3eaa9582404edef7", "name": "Network/subprocess call without timeout or try/except \u2014 skills/models/tao-finetune-cosmos-reason/scripts/prepare_cosmos3", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 skills/models/tao-finetune-cosmos-reason/scripts/prepare_cosmos3_vlm_checkpoint.py:32"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-271c3a957028ea63", "name": "Commented-code block (5 lines) in skills/applications/tao-run-deft-aoi/scripts/align_token_usage.py:328", "shortDescription": {"text": "Commented-code block (5 lines) in skills/applications/tao-run-deft-aoi/scripts/align_token_usage.py:328"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-33a6b62e30ce7ab4", "name": "Near-duplicate function bodies in 6 places", "shortDescription": {"text": "Near-duplicate function bodies in 6 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nscripts/list_automl_support.py:parse_args, scripts/list_tao_capabilities.py:parse_args, scripts/resolve_tao_image.py:parse_args, scripts/list_tao_models.py:parse_args\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nscripts/list_tao_capabilities.py:load_json_object, scripts/list_tao_models.py:load_json\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nskills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/train.py:main, skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/train.py:main, skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/train.py:main\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49c98f7cedd9c977", "name": "Near-duplicate function bodies in 4 places", "shortDescription": {"text": "Near-duplicate function bodies in 4 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nskills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/infer.py:main, skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/infer.py:main, skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/infer.py:main, skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/infer.py:main\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/30734"}, "properties": {"repository": "NVIDIA-TAO/tao-skills-bank", "repoUrl": "https://github.com/NVIDIA-TAO/tao-skills-bank.git", "branch": "main"}, "results": [{"ruleId": "JRN012", "level": "warning", "message": {"text": "Runtime environment contract is missing referenced variables"}, "properties": {"repobilityId": 469650, "scanner": "repobility-journey-contract", "fingerprint": "0470a03bf04fd1bc7a8dc667b17a7e6ac664dbc93906063028ad4246f4997976", "category": "quality", "severity": "medium", "confidence": 0.72, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Source code references runtime environment variables that are absent from env templates or deployment docs.", "evidence": {"rule_id": "JRN012", "scanner": "repobility-journey-contract", "references": ["https://repobility.com/library/authorization/"], "correlation_key": "fp|0470a03bf04fd1bc7a8dc667b17a7e6ac664dbc93906063028ad4246f4997976", "missing_env_vars": ["DOCKER_HOST", "KUBECONFIG", "SLURM_PARTITION", "SLURM_TIMEOUT_HOURS", "SLURM_TIME_HOURS", "SSH_KEY_PATH", "TAO_GPU_SMOKE_IMAGE", "TAO_K8S_CONTEXT", "TAO_K8S_NAMESPACE", "WANDB_ENTITY", "WANDB_RUN_NAME"], "documented_env_vars": ["ACCESS_KEY", "ACES", "AGENTS", "BREV_API_TOKEN", "CLOUD_REGION", "HF_TOKEN", "LEPTON_AUTH_TOKEN", "LEPTON_WORKSPACE_ID", "NGC_KEY", "NO_PASS", "NVIDIA", "PASS", "README", "S3_BUCKET_NAME", "S3_ENDPOINT_URL", "SB", "SECRET_KEY", "SKILL", "SLURM", "TAO_SKILL_BANK_MARKETPLACE", "TAO_SKILL_BANK_PATH", "TAO_SKILL_BANK_REF", "WANDB_API_KEY", "WANDB_PROJECT"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/check_tao_launch_preflight.py"}, "region": {"startLine": 651}}}]}, {"ruleId": "GHSA-rcv9-qm8p-9p6j", "level": "warning", "message": {"text": "transformers: GHSA-rcv9-qm8p-9p6j"}, "properties": {"repobilityId": 469649, "scanner": "osv-scanner", "fingerprint": "25e220a655897c2f0ae033527fbd76d0bcaa80ba2cbb87eaeb3abf30b32ba0bb", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "Collapsed 3 duplicate scanner signal(s) for the same underlying issue.", "evidence": {"match": "", "aliases": ["CVE-2025-6051"], "package": "transformers", "rule_id": "GHSA-rcv9-qm8p-9p6j", "scanner": "osv-scanner", "correlation_key": "vuln|transformers|CVE-2025-6051|token", "duplicate_count": 3, "duplicate_rule_ids": ["GHSA-rcv9-qm8p-9p6j"], "duplicate_scanners": ["osv-scanner"], "duplicate_fingerprints": ["25e220a655897c2f0ae033527fbd76d0bcaa80ba2cbb87eaeb3abf30b32ba0bb", "2fdc0ae39a4ee14666e30ec1fa77d731b2000c83290990be84708daced2ca73d", "857f3a1d5dd46e6d8263f0a3e39a7577f1700ea2d1abb0f9c0582df44f7e90a1", "a271900515329d0e80e6e6066b6613417870130c972b9817cf100d644d284a0a"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-qq3j-4f4f-9583", "level": "warning", "message": {"text": "transformers: GHSA-qq3j-4f4f-9583"}, "properties": {"repobilityId": 469648, "scanner": "osv-scanner", "fingerprint": "c78e5519227d12461a86a051f635fa85b4f4c31bac71cff9b063b9d21ee34801", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "Collapsed 3 duplicate scanner signal(s) for the same underlying issue.", "evidence": {"match": "", "aliases": ["CVE-2025-2099", "PYSEC-2025-40"], "package": "transformers", "rule_id": "GHSA-qq3j-4f4f-9583", "scanner": "osv-scanner", "correlation_key": "vuln|transformers|CVE-2025-2099|token", "duplicate_count": 3, "duplicate_rule_ids": ["GHSA-qq3j-4f4f-9583"], "duplicate_scanners": ["osv-scanner"], "duplicate_fingerprints": ["c0f10a9bf60a0cd577b9c52a78a53627c4de52a872abbac50f3c8de0b1dcb5b2", "c61dcfc488a3e9286961e39e9912699714c55ab6539946b8f228930a60e76ccf", "c78e5519227d12461a86a051f635fa85b4f4c31bac71cff9b063b9d21ee34801", "fa38d8469ee7b6ce86a6deaad4e1c6a43c42b7754aab9f38c6caae4bf84925c3"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-q2wp-rjmx-x6x9", "level": "warning", "message": {"text": "transformers: GHSA-q2wp-rjmx-x6x9"}, "properties": {"repobilityId": 469647, "scanner": "osv-scanner", "fingerprint": "efc1497aacab66a4b6b8f802f03a6937bf08b1d28ff69bd58f6f8b05a27028a6", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "Collapsed 3 duplicate scanner signal(s) for the same underlying issue.", "evidence": {"match": "", "aliases": ["CVE-2025-3263"], "package": "transformers", "rule_id": "GHSA-q2wp-rjmx-x6x9", "scanner": "osv-scanner", "correlation_key": "vuln|transformers|CVE-2025-3263|token", "duplicate_count": 3, "duplicate_rule_ids": ["GHSA-q2wp-rjmx-x6x9"], "duplicate_scanners": ["osv-scanner"], "duplicate_fingerprints": ["01da3c373bf9ed701468532a6ed11af17d5b93f3f3a1abcdced8e0ed734dfc5a", "6f3373534b3594df47f01567f01eaea0fd2e8ba835fdefa58b0a47c7e0d429ab", "a50b079eacdb634c24d2774073efb0831491d5f166e1c1a6826a01545a53be3c", "efc1497aacab66a4b6b8f802f03a6937bf08b1d28ff69bd58f6f8b05a27028a6"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-jjph-296x-mrcr", "level": "warning", "message": {"text": "transformers: GHSA-jjph-296x-mrcr"}, "properties": {"repobilityId": 469645, "scanner": "osv-scanner", "fingerprint": "5e43eb85988517a7a1eceaf37f585a203baf1c7dc0462c8ad8b53735d31906bb", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "Collapsed 3 duplicate scanner signal(s) for the same underlying issue.", "evidence": {"match": "", "aliases": ["CVE-2025-3264"], "package": "transformers", "rule_id": "GHSA-jjph-296x-mrcr", "scanner": "osv-scanner", "correlation_key": "vuln|transformers|CVE-2025-3264|token", "duplicate_count": 3, "duplicate_rule_ids": ["GHSA-jjph-296x-mrcr"], "duplicate_scanners": ["osv-scanner"], "duplicate_fingerprints": ["2724deac980afd703d7fa05dcecb63d08534071e00bc7ba48c24bf1370beff97", "5e43eb85988517a7a1eceaf37f585a203baf1c7dc0462c8ad8b53735d31906bb", "b673f22ba0a05bf38e5d5807825487a1c2ece2ca744c9c6ae00cf98430b83fba", "dd0836de7e15532fa20e4f131781c022dbd244c050b9ddcf8cd7dae24ecc13f5"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-fpwr-67px-3qhx", "level": "warning", "message": {"text": "transformers: GHSA-fpwr-67px-3qhx"}, "properties": {"repobilityId": 469644, "scanner": "osv-scanner", "fingerprint": "44726202445e2d2bc1810d2b11ecaf775c6f33cb60acc7d66f41d0c7323a8469", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "Collapsed 3 duplicate scanner signal(s) for the same underlying issue.", "evidence": {"match": "", "aliases": ["CVE-2025-1194"], "package": "transformers", "rule_id": "GHSA-fpwr-67px-3qhx", "scanner": "osv-scanner", "correlation_key": "vuln|transformers|CVE-2025-1194|token", "duplicate_count": 3, "duplicate_rule_ids": ["GHSA-fpwr-67px-3qhx"], "duplicate_scanners": ["osv-scanner"], "duplicate_fingerprints": ["08eba4528c7c31261ef2af5c29be8831a914aacdbd1128ab7cb0bad46952e671", "0a54a346796369da9e379f5b27a37c0bbd96f7b2ab4ed2b2509a76aa4aa531f5", "323e4b3843370458ff175e23b6e0276d7905b3fe38e849a663be9470ba3bbd8b", "44726202445e2d2bc1810d2b11ecaf775c6f33cb60acc7d66f41d0c7323a8469"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-9356-575x-2w9m", "level": "warning", "message": {"text": "transformers: GHSA-9356-575x-2w9m"}, "properties": {"repobilityId": 469643, "scanner": "osv-scanner", "fingerprint": "be206333dda3654bb22b30415cc4b03dd4dba28ce76417704876f01ab11aea26", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "Collapsed 3 duplicate scanner signal(s) for the same underlying issue.", "evidence": {"match": "", "aliases": ["CVE-2025-5197"], "package": "transformers", "rule_id": "GHSA-9356-575x-2w9m", "scanner": "osv-scanner", "correlation_key": "vuln|transformers|CVE-2025-5197|token", "duplicate_count": 3, "duplicate_rule_ids": ["GHSA-9356-575x-2w9m"], "duplicate_scanners": ["osv-scanner"], "duplicate_fingerprints": ["a88b0ca1bb73cd85ab992c85f1bead3fc9baa6e1423040466366fbdc25fbc69f", "bdd33e5e7a2e7b5fc5d978d274d3b192b64631807b605c52501b0311e08b8cc9", "be206333dda3654bb22b30415cc4b03dd4dba28ce76417704876f01ab11aea26", "e4cc8f22f7ddc1212051b2d3a61b2976ba235acc5dd219210163bcee58ef8206"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-69w3-r845-3855", "level": "warning", "message": {"text": "transformers: GHSA-69w3-r845-3855"}, "properties": {"repobilityId": 469642, "scanner": "osv-scanner", "fingerprint": "c92eaf27e2e9712a49810205bbf903daa10ce4312e0ce88fbb196acb4886541c", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "Collapsed 3 duplicate scanner signal(s) for the same underlying issue.", "evidence": {"match": "", "aliases": ["CVE-2026-1839"], "package": "transformers", "rule_id": "GHSA-69w3-r845-3855", "scanner": "osv-scanner", "correlation_key": "vuln|transformers|CVE-2026-1839|token", "duplicate_count": 3, "duplicate_rule_ids": ["GHSA-69w3-r845-3855"], "duplicate_scanners": ["osv-scanner"], "duplicate_fingerprints": ["07e03d4c512f84a4d887a0e2fb7273cd2a3d1015691b7a6801e2f7e99449ee6f", "b631be8b9086fba691c0740147e0005e397da8f9c9b7aa16f647db4e2eef59dc", "c92eaf27e2e9712a49810205bbf903daa10ce4312e0ce88fbb196acb4886541c", "cfa92711da344b0a6fdd68eee26852b04961a3025c8a2db88a1b7ce3f13e17ff"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-59p9-h35m-wg4g", "level": "warning", "message": {"text": "transformers: GHSA-59p9-h35m-wg4g"}, "properties": {"repobilityId": 469641, "scanner": "osv-scanner", "fingerprint": "fe1dfa5747bc99e1beb6b16bec1e1575b647fca9c8b239cb17b94a9364f09764", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "Collapsed 3 duplicate scanner signal(s) for the same underlying issue.", "evidence": {"match": "", "aliases": ["CVE-2025-6638"], "package": "transformers", "rule_id": "GHSA-59p9-h35m-wg4g", "scanner": "osv-scanner", "correlation_key": "vuln|transformers|CVE-2025-6638|token", "duplicate_count": 3, "duplicate_rule_ids": ["GHSA-59p9-h35m-wg4g"], "duplicate_scanners": ["osv-scanner"], "duplicate_fingerprints": ["a6b31caaac67f05fb837134fe9cd1188a8b7b317e6942b184cd8962a61551e07", "aefd96dda7696229f00fbd7464d6dc3aafb3cf26390cd3799ea094c216ea1fd9", "f094c28a889b5c23cbc9298a356bd4312b363d91e1201220cc61a55db4473cbd", "fe1dfa5747bc99e1beb6b16bec1e1575b647fca9c8b239cb17b94a9364f09764"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-4w7r-h757-3r74", "level": "warning", "message": {"text": "transformers: GHSA-4w7r-h757-3r74"}, "properties": {"repobilityId": 469640, "scanner": "osv-scanner", "fingerprint": "f8cb8b468a1cff36fc80c45f7efab134456382f1480f822f005dc93c80fcba35", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "Collapsed 3 duplicate scanner signal(s) for the same underlying issue.", "evidence": {"match": "", "aliases": ["CVE-2025-6921"], "package": "transformers", "rule_id": "GHSA-4w7r-h757-3r74", "scanner": "osv-scanner", "correlation_key": "vuln|transformers|CVE-2025-6921|token", "duplicate_count": 3, "duplicate_rule_ids": ["GHSA-4w7r-h757-3r74"], "duplicate_scanners": ["osv-scanner"], "duplicate_fingerprints": ["3430baa47fd3662b90965e39e82911790370586fb601c0d7789c25523193977e", "8d71413d7960bd6c964576cb846059a674062d85155b69e1245ca060c774c1e4", "a2e0578ff82a637194588e8e07e02ca5607a90f73f06d5962c23aeff56544d74", "f8cb8b468a1cff36fc80c45f7efab134456382f1480f822f005dc93c80fcba35"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-489j-g2vx-39wf", "level": "warning", "message": {"text": "transformers: GHSA-489j-g2vx-39wf"}, "properties": {"repobilityId": 469639, "scanner": "osv-scanner", "fingerprint": "9ecc7212ccf673b6dde49313d755323c114d170ad2cf2896309f2c55d49ab15f", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "Collapsed 3 duplicate scanner signal(s) for the same underlying issue.", "evidence": {"match": "", "aliases": ["CVE-2025-3262"], "package": "transformers", "rule_id": "GHSA-489j-g2vx-39wf", "scanner": "osv-scanner", "correlation_key": "vuln|transformers|CVE-2025-3262|token", "duplicate_count": 3, "duplicate_rule_ids": ["GHSA-489j-g2vx-39wf"], "duplicate_scanners": ["osv-scanner"], "duplicate_fingerprints": ["0ea44075e538254a74a8de2e353d129020cc323244af88e819ca8ff80794da6e", "138581da8e2b2a81c951ffe0778c392ebf9d79196e9f8f962b88345a3af7669a", "2860e352a140c18e3c2a5508007fa45b3daf1dfa0f5a9016cb92aacaed9c721d", "9ecc7212ccf673b6dde49313d755323c114d170ad2cf2896309f2c55d49ab15f"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-37mw-44qp-f5jm", "level": "warning", "message": {"text": "transformers: GHSA-37mw-44qp-f5jm"}, "properties": {"repobilityId": 469638, "scanner": "osv-scanner", "fingerprint": "5b93c49cdca59115f5a405199d9b23f894bd87157ae06328849a552a9eb7e2e5", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "Collapsed 3 duplicate scanner signal(s) for the same underlying issue.", "evidence": {"match": "", "aliases": ["CVE-2025-3933"], "package": "transformers", "rule_id": "GHSA-37mw-44qp-f5jm", "scanner": "osv-scanner", "correlation_key": "vuln|transformers|CVE-2025-3933|token", "duplicate_count": 3, "duplicate_rule_ids": ["GHSA-37mw-44qp-f5jm"], "duplicate_scanners": ["osv-scanner"], "duplicate_fingerprints": ["5b93c49cdca59115f5a405199d9b23f894bd87157ae06328849a552a9eb7e2e5", "608b6aacf9cea5a53153241c6857fbc68651f56350bf1bc90f7f70cce5a2ba15", "6a7b178eaedcffe5ad585829691f67ae04e9418957a764f1dc2bf65369819096", "b374fe145c868e0ba395a6fdc978a08008cbee6a814f711f841f7bd4677f4d7c"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "DKR001", "level": "warning", "message": {"text": "Docker final stage has no non-root USER"}, "properties": {"repobilityId": 469625, "scanner": "repobility-docker", "fingerprint": "aa635302cf7c6503512fa2d2aaff1d7032d3162776fc6e62074c27c77e88cae6", "category": "docker", "severity": "medium", "confidence": 0.82, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "No USER directive was found in the final runtime stage.", "evidence": {"rule_id": "DKR001", "scanner": "repobility-docker", "final_base": "${NGC_IMAGE}", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html", "https://github.com/hadolint/hadolint"], "correlation_key": "fp|aa635302cf7c6503512fa2d2aaff1d7032d3162776fc6e62074c27c77e88cae6"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/Dockerfile"}, "region": {"startLine": 16}}}]}, {"ruleId": "DKR001", "level": "warning", "message": {"text": "Docker final stage has no non-root USER"}, "properties": {"repobilityId": 469623, "scanner": "repobility-docker", "fingerprint": "a09278aa83a5f16e3585df9c7b6519bfaec736bb4d1d306156981629ecd85b34", "category": "docker", "severity": "medium", "confidence": 0.82, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "No USER directive was found in the final runtime stage.", "evidence": {"rule_id": "DKR001", "scanner": "repobility-docker", "final_base": "${NGC_IMAGE}", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html", "https://github.com/hadolint/hadolint"], "correlation_key": "fp|a09278aa83a5f16e3585df9c7b6519bfaec736bb4d1d306156981629ecd85b34"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/Dockerfile"}, "region": {"startLine": 16}}}]}, {"ruleId": "DKR001", "level": "warning", "message": {"text": "Docker final stage has no non-root USER"}, "properties": {"repobilityId": 469621, "scanner": "repobility-docker", "fingerprint": "49eaf4f28b8f3852ef46f0f0d21b7ebe4d3f6180c423f5b0bdf3d960114663b4", "category": "docker", "severity": "medium", "confidence": 0.82, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "No USER directive was found in the final runtime stage.", "evidence": {"rule_id": "DKR001", "scanner": "repobility-docker", "final_base": "${NGC_IMAGE}", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html", "https://github.com/hadolint/hadolint"], "correlation_key": "fp|49eaf4f28b8f3852ef46f0f0d21b7ebe4d3f6180c423f5b0bdf3d960114663b4"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/Dockerfile"}, "region": {"startLine": 16}}}]}, {"ruleId": "DKR007", "level": "warning", "message": {"text": "Docker build context has no .dockerignore"}, "properties": {"repobilityId": 469619, "scanner": "repobility-docker", "fingerprint": "c98378cf8c37e4866e89d6ca06a24b7e8c44654aa34e6e4bf1367c4a4c0c5b44", "category": "docker", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Dockerfile exists but repository root has no .dockerignore.", "evidence": {"rule_id": "DKR007", "scanner": "repobility-docker", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/"], "correlation_key": "fp|c98378cf8c37e4866e89d6ca06a24b7e8c44654aa34e6e4bf1367c4a4c0c5b44"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".dockerignore"}, "region": {"startLine": 1}}}]}, {"ruleId": "DKR001", "level": "warning", "message": {"text": "Docker final stage has no non-root USER"}, "properties": {"repobilityId": 469618, "scanner": "repobility-docker", "fingerprint": "d8985d4d80c657e1de3943b73e931df14c4768044cde80288bc8e54a3cc95180", "category": "docker", "severity": "medium", "confidence": 0.82, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "No USER directive was found in the final runtime stage.", "evidence": {"rule_id": "DKR001", "scanner": "repobility-docker", "final_base": "${NGC_IMAGE}", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html", "https://github.com/hadolint/hadolint"], "correlation_key": "fp|d8985d4d80c657e1de3943b73e931df14c4768044cde80288bc8e54a3cc95180"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/Dockerfile"}, "region": {"startLine": 16}}}]}, {"ruleId": "SEC011", "level": "warning", "message": {"text": "[SEC011] Unsafe PyTorch Model Loading: torch.load() uses pickle internally and can execute arbitrary code from untrusted model files."}, "properties": {"repobilityId": 469615, "scanner": "repobility-threat-engine", "fingerprint": "f1d1e240bd7330727d0d7500a4dbbe8b06002f6f87bbcf9e425c1b49dfd94847", "category": "deserialization", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "torch.load(", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC011", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "code|deserialization|token|7|sec011"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-deft-aoi/scripts/stage_backbone.py"}, "region": {"startLine": 7}}}]}, {"ruleId": "DEPCUR-PY", "level": "warning", "message": {"text": "Python package `transformers` is 1 major version(s) behind (4.49.0 -> 5.12.1)"}, "properties": {"repobilityId": 469590, "scanner": "repobility-dependency-currency", "fingerprint": "5f626bde0fc0571ef55220f577f4874e9da6b12bb2d4e4b0ff6502bc291b8502", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "1 major version(s) behind", "signal": "currency", "cwe_ids": [], "package": "transformers", "scanner": "repobility-dependency-currency", "ecosystem": "pypi", "languages": ["python"], "latest_version": "5.12.1", "correlation_key": "fp|5f626bde0fc0571ef55220f577f4874e9da6b12bb2d4e4b0ff6502bc291b8502", "current_version": "4.49.0"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requirements.txt"}, "region": {"startLine": 16}}}]}, {"ruleId": "DEPCUR-PY", "level": "warning", "message": {"text": "Python package `transformers` is 1 major version(s) behind (4.49.0 -> 5.12.1)"}, "properties": {"repobilityId": 469589, "scanner": "repobility-dependency-currency", "fingerprint": "2d3ead264010678cf58a69c91ae7201c7c90377720017897739146a3f99f9255", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "1 major version(s) behind", "signal": "currency", "cwe_ids": [], "package": "transformers", "scanner": "repobility-dependency-currency", "ecosystem": "pypi", "languages": ["python"], "latest_version": "5.12.1", "correlation_key": "fp|2d3ead264010678cf58a69c91ae7201c7c90377720017897739146a3f99f9255", "current_version": "4.49.0"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requirements.txt"}, "region": {"startLine": 16}}}]}, {"ruleId": "DEPCUR-PY", "level": "warning", "message": {"text": "Python package `transformers` is 1 major version(s) behind (4.49.0 -> 5.12.1)"}, "properties": {"repobilityId": 469588, "scanner": "repobility-dependency-currency", "fingerprint": "2c474b986a82b47451c60af7e6de3fc019d74cbc36e907ce70ad8be845ea1fde", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "1 major version(s) behind", "signal": "currency", "cwe_ids": [], "package": "transformers", "scanner": "repobility-dependency-currency", "ecosystem": "pypi", "languages": ["python"], "latest_version": "5.12.1", "correlation_key": "fp|2c474b986a82b47451c60af7e6de3fc019d74cbc36e907ce70ad8be845ea1fde", "current_version": "4.49.0"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/requirements.txt"}, "region": {"startLine": 15}}}]}, {"ruleId": "DEPCUR-PY", "level": "warning", "message": {"text": "Python package `transformers` is 1 major version(s) behind (4.49.0 -> 5.12.1)"}, "properties": {"repobilityId": 469587, "scanner": "repobility-dependency-currency", "fingerprint": "9232e48eaa6bf69e7c1bcd7c4db8dcb3509fe40cac8365c882a1b9d6efe390e4", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "1 major version(s) behind", "signal": "currency", "cwe_ids": [], "package": "transformers", "scanner": "repobility-dependency-currency", "ecosystem": "pypi", "languages": ["python"], "latest_version": "5.12.1", "correlation_key": "fp|9232e48eaa6bf69e7c1bcd7c4db8dcb3509fe40cac8365c882a1b9d6efe390e4", "current_version": "4.49.0"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "region": {"startLine": 17}}}]}, {"ruleId": "MINED124", "level": "warning", "message": {"text": "requirements.txt: `numpy<2` has no version pin"}, "properties": {"repobilityId": 469583, "scanner": "repobility-supply-chain", "fingerprint": "dcda4304a5a2e10af8bcba1657929757db887e1ce88e32d930efd93ae4507b13", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "unpinned-pip-requirement", "owasp": null, "cwe_ids": ["CWE-1357"], "languages": ["python"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|dcda4304a5a2e10af8bcba1657929757db887e1ce88e32d930efd93ae4507b13"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requirements.txt"}, "region": {"startLine": 25}}}]}, {"ruleId": "MINED124", "level": "warning", "message": {"text": "requirements.txt: `sentencepiece` has no version pin"}, "properties": {"repobilityId": 469582, "scanner": "repobility-supply-chain", "fingerprint": "641059aa8ca0eb6faa9da5ab664c8af418bf35c673163ef223e000c6941a7bcb", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "unpinned-pip-requirement", "owasp": null, "cwe_ids": ["CWE-1357"], "languages": ["python"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|641059aa8ca0eb6faa9da5ab664c8af418bf35c673163ef223e000c6941a7bcb"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requirements.txt"}, "region": {"startLine": 24}}}]}, {"ruleId": "MINED124", "level": "warning", "message": {"text": "requirements.txt: `pillow` has no version pin"}, "properties": {"repobilityId": 469581, "scanner": "repobility-supply-chain", "fingerprint": "acd1c875e7912264a221f9baf6fa4d83e3a23c6dba2727e113a89819206d9baa", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "unpinned-pip-requirement", "owasp": null, "cwe_ids": ["CWE-1357"], "languages": ["python"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|acd1c875e7912264a221f9baf6fa4d83e3a23c6dba2727e113a89819206d9baa"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requirements.txt"}, "region": {"startLine": 23}}}]}, {"ruleId": "MINED124", "level": "warning", "message": {"text": "requirements.txt: `pillow` has no version pin"}, "properties": {"repobilityId": 469580, "scanner": "repobility-supply-chain", "fingerprint": "ba097d9fbd18b3df7f7983fab5906b6bb647ed0dc61eadadeff275c712270fd3", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "unpinned-pip-requirement", "owasp": null, "cwe_ids": ["CWE-1357"], "languages": ["python"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|ba097d9fbd18b3df7f7983fab5906b6bb647ed0dc61eadadeff275c712270fd3"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requirements.txt"}, "region": {"startLine": 27}}}]}, {"ruleId": "MINED124", "level": "warning", "message": {"text": "requirements.txt: `numpy<2` has no version pin"}, "properties": {"repobilityId": 469579, "scanner": "repobility-supply-chain", "fingerprint": "892b1796c2e4ea1701922c76e5270238b02cef273c4e9ae28d8a37e5252a661f", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "unpinned-pip-requirement", "owasp": null, "cwe_ids": ["CWE-1357"], "languages": ["python"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|892b1796c2e4ea1701922c76e5270238b02cef273c4e9ae28d8a37e5252a661f"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requirements.txt"}, "region": {"startLine": 19}}}]}, {"ruleId": "MINED124", "level": "warning", "message": {"text": "requirements.txt: `numpy<2` has no version pin"}, "properties": {"repobilityId": 469578, "scanner": "repobility-supply-chain", "fingerprint": "b3dddf5ade107dcc66085ac61081882d394c403b961b53552bfb071f18cd799b", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "unpinned-pip-requirement", "owasp": null, "cwe_ids": ["CWE-1357"], "languages": ["python"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|b3dddf5ade107dcc66085ac61081882d394c403b961b53552bfb071f18cd799b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/requirements.txt"}, "region": {"startLine": 22}}}]}, {"ruleId": "MINED124", "level": "warning", "message": {"text": "requirements.txt: `pillow` has no version pin"}, "properties": {"repobilityId": 469577, "scanner": "repobility-supply-chain", "fingerprint": "f42bf87937de6b1cea5ba64a0e2907b6161655807a7e793de22ab62b895795f3", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "unpinned-pip-requirement", "owasp": null, "cwe_ids": ["CWE-1357"], "languages": ["python"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|f42bf87937de6b1cea5ba64a0e2907b6161655807a7e793de22ab62b895795f3"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/requirements.txt"}, "region": {"startLine": 21}}}]}, {"ruleId": "MINED124", "level": "warning", "message": {"text": "requirements.txt: `scikit-learn` has no version pin"}, "properties": {"repobilityId": 469576, "scanner": "repobility-supply-chain", "fingerprint": "18d94d5b77e083451c5b8375d8e6c366b1902c69c6cd9b5ebe92ad2ccd7f7746", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "unpinned-pip-requirement", "owasp": null, "cwe_ids": ["CWE-1357"], "languages": ["python"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|18d94d5b77e083451c5b8375d8e6c366b1902c69c6cd9b5ebe92ad2ccd7f7746"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "region": {"startLine": 24}}}]}, {"ruleId": "MINED124", "level": "warning", "message": {"text": "requirements.txt: `pillow` has no version pin"}, "properties": {"repobilityId": 469575, "scanner": "repobility-supply-chain", "fingerprint": "2a498f2d37baa7203e4c3452c28d818191fd9f5fc199cf870648cd8b062defcd", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "unpinned-pip-requirement", "owasp": null, "cwe_ids": ["CWE-1357"], "languages": ["python"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|2a498f2d37baa7203e4c3452c28d818191fd9f5fc199cf870648cd8b062defcd"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "region": {"startLine": 23}}}]}, {"ruleId": "MINED111", "level": "warning", "message": {"text": "Bare except continues silently"}, "properties": {"repobilityId": 469574, "scanner": "repobility-ast-engine", "fingerprint": "73b6b69a64d4a8d024cb72c4a0f6115db0b90f616bfc7633c02418b81adc9442", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "bare-except-without-pass", "owasp": null, "cwe_ids": [], "languages": ["python"], "observations_count": 21610}, "scanner": "repobility-ast-engine", "correlation_key": "fp|73b6b69a64d4a8d024cb72c4a0f6115db0b90f616bfc7633c02418b81adc9442"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/infer.py"}, "region": {"startLine": 53}}}]}, {"ruleId": "MINED111", "level": "warning", "message": {"text": "Bare except continues silently"}, "properties": {"repobilityId": 469573, "scanner": "repobility-ast-engine", "fingerprint": "429b1cff417e955941f63ac93fc0d43fd81d4622ef664130e79573415cad72c7", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "bare-except-without-pass", "owasp": null, "cwe_ids": [], "languages": ["python"], "observations_count": 21610}, "scanner": "repobility-ast-engine", "correlation_key": "fp|429b1cff417e955941f63ac93fc0d43fd81d4622ef664130e79573415cad72c7"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/infer.py"}, "region": {"startLine": 47}}}]}, {"ruleId": "MINED111", "level": "warning", "message": {"text": "Bare except continues silently"}, "properties": {"repobilityId": 469572, "scanner": "repobility-ast-engine", "fingerprint": "37eae2d74e3a50c6f780830a10e7a3bb28fe9e545d38f3714a281767497fc904", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "bare-except-without-pass", "owasp": null, "cwe_ids": [], "languages": ["python"], "observations_count": 21610}, "scanner": "repobility-ast-engine", "correlation_key": "fp|37eae2d74e3a50c6f780830a10e7a3bb28fe9e545d38f3714a281767497fc904"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/infer.py"}, "region": {"startLine": 45}}}]}, {"ruleId": "MINED111", "level": "warning", "message": {"text": "Bare except continues silently"}, "properties": {"repobilityId": 469571, "scanner": "repobility-ast-engine", "fingerprint": "cb4682d0299f70dd81bcf435ccb8b8992e7800cfd4e991f8acc2908d09a2b41d", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "bare-except-without-pass", "owasp": null, "cwe_ids": [], "languages": ["python"], "observations_count": 21610}, "scanner": "repobility-ast-engine", "correlation_key": "fp|cb4682d0299f70dd81bcf435ccb8b8992e7800cfd4e991f8acc2908d09a2b41d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-deft-aoi/scripts/stage_backbone.py"}, "region": {"startLine": 103}}}]}, {"ruleId": "MINED111", "level": "warning", "message": {"text": "Bare except continues silently"}, "properties": {"repobilityId": 469569, "scanner": "repobility-ast-engine", "fingerprint": "27919727d597b53cfd5119caaac37a31c71797f10b2aa8a0a21d6509bcdcbdb0", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "bare-except-without-pass", "owasp": null, "cwe_ids": [], "languages": ["python"], "observations_count": 21610}, "scanner": "repobility-ast-engine", "correlation_key": "fp|27919727d597b53cfd5119caaac37a31c71797f10b2aa8a0a21d6509bcdcbdb0"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/generate_dataclass_schemas.py"}, "region": {"startLine": 282}}}]}, {"ruleId": "MINED111", "level": "warning", "message": {"text": "Bare except continues silently"}, "properties": {"repobilityId": 469568, "scanner": "repobility-ast-engine", "fingerprint": "59e9a04836c38708f04ea3ffe167edd85c9687cf13602ed05151ca781e29c14a", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "bare-except-without-pass", "owasp": null, "cwe_ids": [], "languages": ["python"], "observations_count": 21610}, "scanner": "repobility-ast-engine", "correlation_key": "fp|59e9a04836c38708f04ea3ffe167edd85c9687cf13602ed05151ca781e29c14a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/check_tao_launch_preflight.py"}, "region": {"startLine": 839}}}]}, {"ruleId": "MINED111", "level": "warning", "message": {"text": "Bare except continues silently"}, "properties": {"repobilityId": 469567, "scanner": "repobility-ast-engine", "fingerprint": "ee412174d5bb46adb038c16bf73bc3876b99dfdeac1ec413645abd75cc21b8b1", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "bare-except-without-pass", "owasp": null, "cwe_ids": [], "languages": ["python"], "observations_count": 21610}, "scanner": "repobility-ast-engine", "correlation_key": "fp|ee412174d5bb46adb038c16bf73bc3876b99dfdeac1ec413645abd75cc21b8b1"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/check_tao_launch_preflight.py"}, "region": {"startLine": 603}}}]}, {"ruleId": "MINED111", "level": "warning", "message": {"text": "Bare except continues silently"}, "properties": {"repobilityId": 469565, "scanner": "repobility-ast-engine", "fingerprint": "a6078814d31cad8529aeefe95f7adbc346dafa2cd280d499b122aab58f7f06ab", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "bare-except-without-pass", "owasp": null, "cwe_ids": [], "languages": ["python"], "observations_count": 21610}, "scanner": "repobility-ast-engine", "correlation_key": "fp|a6078814d31cad8529aeefe95f7adbc346dafa2cd280d499b122aab58f7f06ab"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/resolve_tao_image.py"}, "region": {"startLine": 118}}}]}, {"ruleId": "GHSA-phhr-52qp-3mj4", "level": "note", "message": {"text": "transformers: GHSA-phhr-52qp-3mj4"}, "properties": {"repobilityId": 469646, "scanner": "osv-scanner", "fingerprint": "d6754a07571f40cea046fab9c87b9d86c5043b79f1797a2fa59c0a5ca171f9d6", "category": "dependency", "severity": "low", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "Collapsed 3 duplicate scanner signal(s) for the same underlying issue.", "evidence": {"match": "", "aliases": ["CVE-2025-3777"], "package": "transformers", "rule_id": "GHSA-phhr-52qp-3mj4", "scanner": "osv-scanner", "correlation_key": "vuln|transformers|CVE-2025-3777|token", "duplicate_count": 3, "duplicate_rule_ids": ["GHSA-phhr-52qp-3mj4"], "duplicate_scanners": ["osv-scanner"], "duplicate_fingerprints": ["434aa2dcd75ee05fd2c8f7e47d7b3a562c0f9714390e5cedfd630f112c61e5f0", "8b661c1643e0805a3bb2738f95701c4cf106aea48d2e31f51a586b6a2fa1dd6c", "bbf07094b2092a6fd39d3b963da263df6d50d82fafd4be236e2ceb8ebbfbd081", "d6754a07571f40cea046fab9c87b9d86c5043b79f1797a2fa59c0a5ca171f9d6"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "COMP001", "level": "note", "message": {"text": "[COMP001] High cognitive complexity: Function `format_capabilities_text` has cognitive complexity 8 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand \u2014 nested branches, boolean chains, and recursion all weigh in. Breakdown: else=1, for=4, if=1, nested_bonus=1, ternary=1."}, "properties": {"repobilityId": 469593, "scanner": "repobility-threat-engine", "fingerprint": "a028f9cc462e968c1af3749b2fe7fc81cdd7193169d0e05c6173dfa6db542252", "category": "quality", "severity": "low", "confidence": 0.95, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "AST-derived cognitive complexity score = 8 (severity threshold for low: 8+).", "evidence": {"scanner": "repobility-threat-engine", "function": "format_capabilities_text", "breakdown": {"if": 1, "for": 4, "else": 1, "ternary": 1, "nested_bonus": 1}, "complexity": 8, "correlation_key": "fp|a028f9cc462e968c1af3749b2fe7fc81cdd7193169d0e05c6173dfa6db542252"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/list_tao_capabilities.py"}, "region": {"startLine": 227}}}]}, {"ruleId": "COMP001", "level": "note", "message": {"text": "[COMP001] High cognitive complexity: Function `skill_capability_record` has cognitive complexity 9 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand \u2014 nested branches, boolean chains, and recursion all weigh in. Breakdown: elif=1, else=1, if=3, or=4."}, "properties": {"repobilityId": 469592, "scanner": "repobility-threat-engine", "fingerprint": "76f4ad6e13ab392e1de5a96e80fabbe296269b1eae7194899ddbc16f17fddd2a", "category": "quality", "severity": "low", "confidence": 0.95, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "AST-derived cognitive complexity score = 9 (severity threshold for low: 8+).", "evidence": {"scanner": "repobility-threat-engine", "function": "skill_capability_record", "breakdown": {"if": 3, "or": 4, "elif": 1, "else": 1}, "complexity": 9, "correlation_key": "fp|76f4ad6e13ab392e1de5a96e80fabbe296269b1eae7194899ddbc16f17fddd2a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/list_tao_capabilities.py"}, "region": {"startLine": 115}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "Action `actions/checkout` pinned to mutable ref `@v2`"}, "properties": {"repobilityId": 469584, "scanner": "repobility-supply-chain", "fingerprint": "d13388a117fd770b123f6ce0fd637a065a158b34be8d01647615b9accc12d19b", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|d13388a117fd770b123f6ce0fd637a065a158b34be8d01647615b9accc12d19b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/blossom-ci.yml"}, "region": {"startLine": 52}}}]}, {"ruleId": "DKR002", "level": "none", "message": {"text": "Dockerfile base image is selected through a build variable"}, "properties": {"repobilityId": 469624, "scanner": "repobility-docker", "fingerprint": "9e837fae5179af35cc5d17afd45d1360d5b3c563a1e569feab299d8488511ae9", "category": "docker", "severity": "info", "confidence": 0.48, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Base image contains a variable; manual review is needed to avoid false positives.", "evidence": {"image": "${NGC_IMAGE}", "rule_id": "DKR002", "scanner": "repobility-docker", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://docs.docker.com/scout/policy/"], "correlation_key": "fp|9e837fae5179af35cc5d17afd45d1360d5b3c563a1e569feab299d8488511ae9"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/Dockerfile"}, "region": {"startLine": 16}}}]}, {"ruleId": "DKR002", "level": "none", "message": {"text": "Dockerfile base image is selected through a build variable"}, "properties": {"repobilityId": 469622, "scanner": "repobility-docker", "fingerprint": "7eb31ca601f2ba9fd334dd7c222611928fa8b5e6c31ded27163c6effe2250ec3", "category": "docker", "severity": "info", "confidence": 0.48, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Base image contains a variable; manual review is needed to avoid false positives.", "evidence": {"image": "${NGC_IMAGE}", "rule_id": "DKR002", "scanner": "repobility-docker", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://docs.docker.com/scout/policy/"], "correlation_key": "fp|7eb31ca601f2ba9fd334dd7c222611928fa8b5e6c31ded27163c6effe2250ec3"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/Dockerfile"}, "region": {"startLine": 16}}}]}, {"ruleId": "DKR002", "level": "none", "message": {"text": "Dockerfile base image is selected through a build variable"}, "properties": {"repobilityId": 469620, "scanner": "repobility-docker", "fingerprint": "ec7ccc706dabe7af8a69c517dfd48dae66438197b7dd711c73410cb6aad79b81", "category": "docker", "severity": "info", "confidence": 0.48, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Base image contains a variable; manual review is needed to avoid false positives.", "evidence": {"image": "${NGC_IMAGE}", "rule_id": "DKR002", "scanner": "repobility-docker", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://docs.docker.com/scout/policy/"], "correlation_key": "fp|ec7ccc706dabe7af8a69c517dfd48dae66438197b7dd711c73410cb6aad79b81"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/Dockerfile"}, "region": {"startLine": 16}}}]}, {"ruleId": "DKR002", "level": "none", "message": {"text": "Dockerfile base image is selected through a build variable"}, "properties": {"repobilityId": 469617, "scanner": "repobility-docker", "fingerprint": "fdc770f40c414eed6248abac6fb8cfa3092ea381e725afc9ca5bac7d3adf0f3b", "category": "docker", "severity": "info", "confidence": 0.48, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Base image contains a variable; manual review is needed to avoid false positives.", "evidence": {"image": "${NGC_IMAGE}", "rule_id": "DKR002", "scanner": "repobility-docker", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://docs.docker.com/scout/policy/"], "correlation_key": "fp|fdc770f40c414eed6248abac6fb8cfa3092ea381e725afc9ca5bac7d3adf0f3b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/Dockerfile"}, "region": {"startLine": 16}}}]}, {"ruleId": "MINED064", "level": "none", "message": {"text": "[MINED064] Python Input Call: input() blocks for stdin. Inappropriate in services."}, "properties": {"repobilityId": 469614, "scanner": "repobility-threat-engine", "fingerprint": "5e8d6d20fb272a3e94ac43cbdf1d54e60cb3073ec213ef92b79599c102019fdd", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "python-input-call", "owasp": null, "cwe_ids": [], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348050+00:00", "triaged_in_corpus": 12, "observations_count": 66378, "ai_coder_pattern_id": 124}, "scanner": "repobility-threat-engine", "correlation_key": "fp|5e8d6d20fb272a3e94ac43cbdf1d54e60cb3073ec213ef92b79599c102019fdd"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-deft-aoi/scripts/changenet_data_pair_prepare.py"}, "region": {"startLine": 211}}}]}, {"ruleId": "MINED049", "level": "none", "message": {"text": "[MINED049] Print Pii: Logging password/token/email/ssn directly to stdout."}, "properties": {"repobilityId": 469610, "scanner": "repobility-threat-engine", "fingerprint": "afacc7ac6d03f6a6cede7896e31cccc223a3c52b9f79d3ddb92ffc1240c45c21", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "print-pii", "owasp": "A09:2021", "cwe_ids": ["CWE-532"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348015+00:00", "triaged_in_corpus": 12, "observations_count": 676566, "ai_coder_pattern_id": 26}, "scanner": "repobility-threat-engine", "correlation_key": "fp|afacc7ac6d03f6a6cede7896e31cccc223a3c52b9f79d3ddb92ffc1240c45c21"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-deft-aoi/scripts/align_token_usage.py"}, "region": {"startLine": 99}}}]}, {"ruleId": "SEC020", "level": "none", "message": {"text": "[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequent AI-assisted coding failure: the helper exposes the exact value needed for troubleshooting."}, "properties": {"repobilityId": 469609, "scanner": "repobility-threat-engine", "fingerprint": "48fc61b6aa2d2e338098e7ad4191628386aef48cc329dea41534d7b0eabb351d", "category": "credential_exposure", "severity": "info", "confidence": 0.15, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Log message mentions credential-related metadata but does not print a credential-bearing value", "evidence": {"match": "print(f\"align_token_usage: skipping non-file {p}\", file=sys.stderr)", "reason": "Log message mentions credential-related metadata but does not print a credential-bearing value", "rule_id": "SEC020", "scanner": "repobility-threat-engine", "confidence": 0.15, "correlation_key": "secret|token|9|print f align_token_usage: skipping non-file p file sys.stderr"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-deft-aoi/scripts/align_token_usage.py"}, "region": {"startLine": 99}}}]}, {"ruleId": "SEC045", "level": "none", "message": {"text": "[SEC045] eval()/exec() on stored or user-supplied data (and 5 more): Same pattern found in 5 additional files. Review if needed."}, "properties": {"repobilityId": 469608, "scanner": "repobility-threat-engine", "fingerprint": "7ad821c68fd7d69c56ceaf843dc975879999279796dea3d5e69af832688addea", "category": "injection", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 5 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 5 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "SEC045", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|7ad821c68fd7d69c56ceaf843dc975879999279796dea3d5e69af832688addea"}}}, {"ruleId": "SEC045", "level": "none", "message": {"text": "[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data \u2014 even admin-stored data \u2014 is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ cleared) are escapable: attackers use object introspection (().__class__.__mro__[-1].__subclasses__()) to reach os.system. CWE-95 (eval injection)."}, "properties": {"repobilityId": 469607, "scanner": "repobility-threat-engine", "fingerprint": "761aed865ae5e3f05bc0e08f9db3f872843623882ec7ac1f404cfc8b0cab0214", "category": "injection", "severity": "info", "confidence": 0.1, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Safe pattern '\\.eval\\(' detected on same line", "evidence": {"match": ".eval(", "reason": "Safe pattern '\\.eval\\(' detected on same line", "rule_id": "SEC045", "scanner": "repobility-threat-engine", "confidence": 0.1, "correlation_key": "code|injection|token|29|sec045"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/infer.py"}, "region": {"startLine": 29}}}]}, {"ruleId": "SEC045", "level": "none", "message": {"text": "[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data \u2014 even admin-stored data \u2014 is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ cleared) are escapable: attackers use object introspection (().__class__.__mro__[-1].__subclasses__()) to reach os.system. CWE-95 (eval injection)."}, "properties": {"repobilityId": 469606, "scanner": "repobility-threat-engine", "fingerprint": "588344cd788a989d08e09e88e1381fb1f0e0e7d8448d8a3a4b1bc4c6cadd455b", "category": "injection", "severity": "info", "confidence": 0.1, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Safe pattern '\\.eval\\(' detected on same line", "evidence": {"match": ".eval(", "reason": "Safe pattern '\\.eval\\(' detected on same line", "rule_id": "SEC045", "scanner": "repobility-threat-engine", "confidence": 0.1, "correlation_key": "code|injection|token|33|sec045"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/run_eval.py"}, "region": {"startLine": 33}}}]}, {"ruleId": "SEC045", "level": "none", "message": {"text": "[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data \u2014 even admin-stored data \u2014 is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ cleared) are escapable: attackers use object introspection (().__class__.__mro__[-1].__subclasses__()) to reach os.system. CWE-95 (eval injection)."}, "properties": {"repobilityId": 469605, "scanner": "repobility-threat-engine", "fingerprint": "e25ace43681f96075844ac8dba1da63028ae629ac9d64d1430e0632c0e86222e", "category": "injection", "severity": "info", "confidence": 0.1, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Safe pattern '\\.eval\\(' detected on same line", "evidence": {"match": ".eval(", "reason": "Safe pattern '\\.eval\\(' detected on same line", "rule_id": "SEC045", "scanner": "repobility-threat-engine", "confidence": 0.1, "correlation_key": "code|injection|token|25|sec045"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/infer.py"}, "region": {"startLine": 25}}}]}, {"ruleId": "MINED050", "level": "none", "message": {"text": "[MINED050] Stub Only Function: Function declared but body is just pass, return None, raise NotImplementedError, or TODO comment."}, "properties": {"repobilityId": 469604, "scanner": "repobility-threat-engine", "fingerprint": "490350c2203cd9c80ac4da6163ad4fb4b0ce1598f0af3316b6f146042c900fd2", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "stub-only-function", "owasp": null, "cwe_ids": ["CWE-1188"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348017+00:00", "triaged_in_corpus": 12, "observations_count": 633513, "ai_coder_pattern_id": 2}, "scanner": "repobility-threat-engine", "correlation_key": "fp|490350c2203cd9c80ac4da6163ad4fb4b0ce1598f0af3316b6f146042c900fd2"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-deft-aoi/scripts/init_deft_state.py"}, "region": {"startLine": 176}}}]}, {"ruleId": "MINED050", "level": "none", "message": {"text": "[MINED050] Stub Only Function: Function declared but body is just pass, return None, raise NotImplementedError, or TODO comment."}, "properties": {"repobilityId": 469603, "scanner": "repobility-threat-engine", "fingerprint": "a696b8a6ed9fa53720c61083b155ced247d70fa619dbd3e1f981bfee561202ce", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "stub-only-function", "owasp": null, "cwe_ids": ["CWE-1188"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348017+00:00", "triaged_in_corpus": 12, "observations_count": 633513, "ai_coder_pattern_id": 2}, "scanner": "repobility-threat-engine", "correlation_key": "fp|a696b8a6ed9fa53720c61083b155ced247d70fa619dbd3e1f981bfee561202ce"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-deft-aoi/scripts/align_token_usage.py"}, "region": {"startLine": 234}}}]}, {"ruleId": "MINED050", "level": "none", "message": {"text": "[MINED050] Stub Only Function: Function declared but body is just pass, return None, raise NotImplementedError, or TODO comment."}, "properties": {"repobilityId": 469602, "scanner": "repobility-threat-engine", "fingerprint": "0f1988c0b585ac496c43c09cf9c43828f265b8b26d06464c099ad1eadaebfc91", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "stub-only-function", "owasp": null, "cwe_ids": ["CWE-1188"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348017+00:00", "triaged_in_corpus": 12, "observations_count": 633513, "ai_coder_pattern_id": 2}, "scanner": "repobility-threat-engine", "correlation_key": "fp|0f1988c0b585ac496c43c09cf9c43828f265b8b26d06464c099ad1eadaebfc91"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/migrate-frontmatter.py"}, "region": {"startLine": 82}}}]}, {"ruleId": "SEC128", "level": "none", "message": {"text": "[SEC128] Async function without await \u2014 fire-and-forget Promise (AI mistake) (and 6 more): Same pattern found in 6 additional files. Review if needed."}, "properties": {"repobilityId": 469598, "scanner": "repobility-threat-engine", "fingerprint": "719f16a1467677730b367baa2144dabfe702dd229dc13e6f3e8747ec0afa970d", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 6 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 6 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "SEC128", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|719f16a1467677730b367baa2144dabfe702dd229dc13e6f3e8747ec0afa970d"}}}, {"ruleId": "COMP001", "level": "none", "message": {"text": "[COMP001] High cognitive complexity (and 23 more): Same pattern found in 23 additional files. Review if needed."}, "properties": {"repobilityId": 469594, "scanner": "repobility-threat-engine", "fingerprint": "94788d2fc96d60b37971e8a2e1600ce225881eda253654cbff5e03de9189cc6a", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 23 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"scanner": "repobility-threat-engine", "function": "parse_frontmatter", "breakdown": {"if": 7, "for": 1, "break": 2, "while": 2, "continue": 3, "nested_bonus": 12}, "aggregated": true, "complexity": 27, "correlation_key": "fp|94788d2fc96d60b37971e8a2e1600ce225881eda253654cbff5e03de9189cc6a", "aggregated_count": 23}}}, {"ruleId": "PYSEC-2025-218", "level": "error", "message": {"text": "transformers: PYSEC-2025-218"}, "properties": {"repobilityId": 469637, "scanner": "osv-scanner", "fingerprint": "c9d1ada50321d6c9db115ad67d0754143db4e3f06066d3ea8379266bbdf86d22", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "Collapsed 3 duplicate scanner signal(s) for the same underlying issue.", "evidence": {"match": "", "aliases": ["CVE-2025-14930"], "package": "transformers", "rule_id": "PYSEC-2025-218", "scanner": "osv-scanner", "correlation_key": "vuln|transformers|CVE-2025-14930|token", "duplicate_count": 3, "duplicate_rule_ids": ["PYSEC-2025-218"], "duplicate_scanners": ["osv-scanner"], "duplicate_fingerprints": ["42bd8acbba10b79ce4bb74acf69312023f390e901d41691fee42389d52019f61", "8d6fcc8268ec3d4afcb29c14237dd021fc17ddaca374bc2d1e6210bfe7866a15", "acfbdf81a0b7a55acaeed6e7f3537fbc635d0f99dcb435afe3eb393952d2c924", "c9d1ada50321d6c9db115ad67d0754143db4e3f06066d3ea8379266bbdf86d22"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "PYSEC-2025-217", "level": "error", "message": {"text": "transformers: PYSEC-2025-217"}, "properties": {"repobilityId": 469636, "scanner": "osv-scanner", "fingerprint": "5924bf3631ed6ac82a40187e11a4ecc6926258d2c12e5414e7fc5ded12f93f55", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "Collapsed 3 duplicate scanner signal(s) for the same underlying issue.", "evidence": {"match": "", "aliases": ["CVE-2025-14929"], "package": "transformers", "rule_id": "PYSEC-2025-217", "scanner": "osv-scanner", "correlation_key": "vuln|transformers|CVE-2025-14929|token", "duplicate_count": 3, "duplicate_rule_ids": ["PYSEC-2025-217"], "duplicate_scanners": ["osv-scanner"], "duplicate_fingerprints": ["27dc91acd7020a0a3045ca2dbcbf26fe0f42ad0ebfe08192de793aa9b14c945d", "5924bf3631ed6ac82a40187e11a4ecc6926258d2c12e5414e7fc5ded12f93f55", "70d56a0acafa77ee982e100322189dde927e7d5fb6375389050b8d2356258b4a", "a69e31924ab189ead58bd44699afa76cd719f777152616c5b2cd0328f355567c"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "PYSEC-2025-216", "level": "error", "message": {"text": "transformers: PYSEC-2025-216"}, "properties": {"repobilityId": 469635, "scanner": "osv-scanner", "fingerprint": "4831295e9cbbfef6bae25a4481880eb567a9703e3acc090126dff1610094044e", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "Collapsed 3 duplicate scanner signal(s) for the same underlying issue.", "evidence": {"match": "", "aliases": ["CVE-2025-14928"], "package": "transformers", "rule_id": "PYSEC-2025-216", "scanner": "osv-scanner", "correlation_key": "vuln|transformers|CVE-2025-14928|token", "duplicate_count": 3, "duplicate_rule_ids": ["PYSEC-2025-216"], "duplicate_scanners": ["osv-scanner"], "duplicate_fingerprints": ["443b649adb0f963ae253dc741b00bf486b1605307aa53adbb102a9a072b603d4", "4831295e9cbbfef6bae25a4481880eb567a9703e3acc090126dff1610094044e", "4b44339aa89e8dfc919787c1e76b5ce42562f185abbd8033339c2f9122251612", "a807ba2ea5ab07398ef40e17f367df15635cd6b318d1bd35fe5e26eab2124b36"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "PYSEC-2025-215", "level": "error", "message": {"text": "transformers: PYSEC-2025-215"}, "properties": {"repobilityId": 469634, "scanner": "osv-scanner", "fingerprint": "c9d34789f98a532a0a346a228b4dbc97334dc61ca84eec8747f8c7a78d90d28f", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "Collapsed 3 duplicate scanner signal(s) for the same underlying issue.", "evidence": {"match": "", "aliases": ["CVE-2025-14927"], "package": "transformers", "rule_id": "PYSEC-2025-215", "scanner": "osv-scanner", "correlation_key": "vuln|transformers|CVE-2025-14927|token", "duplicate_count": 3, "duplicate_rule_ids": ["PYSEC-2025-215"], "duplicate_scanners": ["osv-scanner"], "duplicate_fingerprints": ["23f70acc5d10f47eb177fb089ccb8f53ff1e3416642e7a2f3def0eb806c946de", "ad5bb0ef64afaf6cfd5991ef69a27ea91d3d99d6ae1a143f50c91cf715f07abe", "c9d34789f98a532a0a346a228b4dbc97334dc61ca84eec8747f8c7a78d90d28f", "f32764d96372c951b5c70b35399ee459b01f5da375c48df4c67b522acdee672b"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "PYSEC-2025-214", "level": "error", "message": {"text": "transformers: PYSEC-2025-214"}, "properties": {"repobilityId": 469633, "scanner": "osv-scanner", "fingerprint": "3bf3801b7fc283a08053ddf8991ab1e18a074d31254e8873b6ae377047bc8858", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "Collapsed 3 duplicate scanner signal(s) for the same underlying issue.", "evidence": {"match": "", "aliases": ["CVE-2025-14926"], "package": "transformers", "rule_id": "PYSEC-2025-214", "scanner": "osv-scanner", "correlation_key": "vuln|transformers|CVE-2025-14926|token", "duplicate_count": 3, "duplicate_rule_ids": ["PYSEC-2025-214"], "duplicate_scanners": ["osv-scanner"], "duplicate_fingerprints": ["3bf3801b7fc283a08053ddf8991ab1e18a074d31254e8873b6ae377047bc8858", "69f0c91709bd2252af052f86b50bca60be942bd8b62ce97ae5886f6c13f4e0e5", "8250b641d07d7393941af26fbb31b8145813c74e8b13162fa03ce66605843111", "a6d6984637f05ad872b24edbf55000761d3660cd8dfc34ea5192ea005d27627d"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "PYSEC-2025-213", "level": "error", "message": {"text": "transformers: PYSEC-2025-213"}, "properties": {"repobilityId": 469632, "scanner": "osv-scanner", "fingerprint": "61f5ac1eaa9f707702f794fa361f714a8913c0847f43ddab1b24a0a01a382a29", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "Collapsed 3 duplicate scanner signal(s) for the same underlying issue.", "evidence": {"match": "", "aliases": ["CVE-2025-14924"], "package": "transformers", "rule_id": "PYSEC-2025-213", "scanner": "osv-scanner", "correlation_key": "vuln|transformers|CVE-2025-14924|token", "duplicate_count": 3, "duplicate_rule_ids": ["PYSEC-2025-213"], "duplicate_scanners": ["osv-scanner"], "duplicate_fingerprints": ["49608159ec1a7f2612ff541b44e4eedf7d7361769c304ea74d42cd082efa03d5", "55c76b6fbb34b0bdac9f8093f2e04ad05e4993d0ffb6d2091e3d1a99c4fa6498", "61f5ac1eaa9f707702f794fa361f714a8913c0847f43ddab1b24a0a01a382a29", "8ca7d73f0b5435664c8c2330d30796bbd5ccc2b4c1a3d5ad7ad49b23097e14ab"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "PYSEC-2025-212", "level": "error", "message": {"text": "transformers: PYSEC-2025-212"}, "properties": {"repobilityId": 469631, "scanner": "osv-scanner", "fingerprint": "b68b39144b9d25aefb0c122a9da466eb6ec8b44f1108da7a3b1fecf656370633", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "Collapsed 3 duplicate scanner signal(s) for the same underlying issue.", "evidence": {"match": "", "aliases": ["CVE-2025-14921"], "package": "transformers", "rule_id": "PYSEC-2025-212", "scanner": "osv-scanner", "correlation_key": "vuln|transformers|CVE-2025-14921|token", "duplicate_count": 3, "duplicate_rule_ids": ["PYSEC-2025-212"], "duplicate_scanners": ["osv-scanner"], "duplicate_fingerprints": ["7c95520df23d3628e0104b45a415e6e48b44066e52743cfcac092dcb33042de8", "afd548118b30ec762e1c886f6f7e4839a3a4eeb654273781512bbb549a2bb2a8", "b68b39144b9d25aefb0c122a9da466eb6ec8b44f1108da7a3b1fecf656370633", "c398a0cfdab0567a629d4dcf9f897edd56a1f18b0e04824ef58337002733b030"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "PYSEC-2025-211", "level": "error", "message": {"text": "transformers: PYSEC-2025-211"}, "properties": {"repobilityId": 469630, "scanner": "osv-scanner", "fingerprint": "811decc26c08ba0fe017ce2f9888ae4a6a135da90ba775621d9f6bc1aee523f6", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "Collapsed 3 duplicate scanner signal(s) for the same underlying issue.", "evidence": {"match": "", "aliases": ["CVE-2025-14920"], "package": "transformers", "rule_id": "PYSEC-2025-211", "scanner": "osv-scanner", "correlation_key": "vuln|transformers|CVE-2025-14920|token", "duplicate_count": 3, "duplicate_rule_ids": ["PYSEC-2025-211"], "duplicate_scanners": ["osv-scanner"], "duplicate_fingerprints": ["5dc83de0d68f2142c34f53c44c73534703535e6ee6cd54f1eb3170fd10d63cc9", "811decc26c08ba0fe017ce2f9888ae4a6a135da90ba775621d9f6bc1aee523f6", "8535068da5f3ff646670ba86ad3f6ef34aede876cc3ae23222f82f30eb858983", "e372a6ca0d9831b3d8207af3cbc1515622b8a0f4af9e1095e0eae957a202922e"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "SEC103", "level": "error", "message": {"text": "[SEC103] LDAP injection \u2014 non-constant search filter: User input concatenated into an LDAP search filter. Attackers inject `*)(uid=*` style payloads to bypass auth or enumerate accounts."}, "properties": {"repobilityId": 469616, "scanner": "repobility-threat-engine", "fingerprint": "1a09d35b23270c548d715ecad2ae5109bb9763257c10d7d8003958f26b88293c", "category": "injection", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": ".search(rf'{key}\\s*=\\s*([^\\s\\\\]+)", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC103", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "code|injection|token|66|sec103"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/data/tao-mine-aoi-images/hooks/mining-script-check.sh"}, "region": {"startLine": 66}}}]}, {"ruleId": "MINED021", "level": "error", "message": {"text": "[MINED021] Path Traversal Os Join: os.path.join(user_dir, filename) where filename can contain \"../\" \u2014 directory escape."}, "properties": {"repobilityId": 469613, "scanner": "repobility-threat-engine", "fingerprint": "8a87017671182586fd527d27b6d3ed9d4a87e11ae959f5d7eff2c5bf113e8fb2", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "path-traversal-os-join", "owasp": "A01:2021", "cwe_ids": ["CWE-22"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347947+00:00", "triaged_in_corpus": 15, "observations_count": 45678, "ai_coder_pattern_id": 31}, "scanner": "repobility-threat-engine", "correlation_key": "fp|8a87017671182586fd527d27b6d3ed9d4a87e11ae959f5d7eff2c5bf113e8fb2"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-deft-aoi/scripts/changenet_data_pair_prepare.py"}, "region": {"startLine": 82}}}]}, {"ruleId": "SEC114", "level": "error", "message": {"text": "[SEC114] path.join / Path() on user-controlled segment without containment check: filepath.Clean / path.Join on attacker-supplied segments does NOT prevent escape from the base directory. `../../../etc/passwd` resolves cleanly."}, "properties": {"repobilityId": 469612, "scanner": "repobility-threat-engine", "fingerprint": "151f4c305cd22e93275005fe593aa7922c50774b56f3f216ca702859f7d423ff", "category": "path_traversal", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "path.join(input", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC114", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "code|path_traversal|token|82|sec114"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-deft-aoi/scripts/changenet_data_pair_prepare.py"}, "region": {"startLine": 82}}}]}, {"ruleId": "SEC013", "level": "error", "message": {"text": "[SEC013] Path Traversal \u2014 User Input in File Path: User-controlled input used in file path without sanitization. Allows reading arbitrary files."}, "properties": {"repobilityId": 469611, "scanner": "repobility-threat-engine", "fingerprint": "cabdcaf86d69d7d46458622df7cc4f65411c1f0f16d29e163d4bb26217087df4", "category": "path_traversal", "severity": "high", "confidence": 0.8, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "User-controlled input detected in file path construction", "evidence": {"match": "os.path.join(input", "reason": "User-controlled input detected in file path construction", "rule_id": "SEC013", "scanner": "repobility-threat-engine", "confidence": 0.8, "correlation_key": "code|path_traversal|token|82|sec013"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-deft-aoi/scripts/changenet_data_pair_prepare.py"}, "region": {"startLine": 82}}}]}, {"ruleId": "MINED001", "level": "error", "message": {"text": "[MINED001] Bare Except Pass: except: pass or except Exception: pass \u2014 silently swallows everything including KeyboardInterrupt and bugs."}, "properties": {"repobilityId": 469601, "scanner": "repobility-threat-engine", "fingerprint": "bf7a94783eadaaf61ed4642743578dc8aa275d762368d35e6d73fc161418f295", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "bare-except-pass", "owasp": null, "cwe_ids": ["CWE-755"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347744+00:00", "triaged_in_corpus": 15, "observations_count": 1550824, "ai_coder_pattern_id": 6}, "scanner": "repobility-threat-engine", "correlation_key": "fp|bf7a94783eadaaf61ed4642743578dc8aa275d762368d35e6d73fc161418f295"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-deft-aoi/scripts/init_deft_state.py"}, "region": {"startLine": 175}}}]}, {"ruleId": "MINED001", "level": "error", "message": {"text": "[MINED001] Bare Except Pass: except: pass or except Exception: pass \u2014 silently swallows everything including KeyboardInterrupt and bugs."}, "properties": {"repobilityId": 469600, "scanner": "repobility-threat-engine", "fingerprint": "15a04ec5a7db0bb860f1a72b957c0f501ad7ff42c2eb4bf848c11b18d305f3d2", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "bare-except-pass", "owasp": null, "cwe_ids": ["CWE-755"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347744+00:00", "triaged_in_corpus": 15, "observations_count": 1550824, "ai_coder_pattern_id": 6}, "scanner": "repobility-threat-engine", "correlation_key": "fp|15a04ec5a7db0bb860f1a72b957c0f501ad7ff42c2eb4bf848c11b18d305f3d2"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-deft-aoi/scripts/align_token_usage.py"}, "region": {"startLine": 233}}}]}, {"ruleId": "MINED001", "level": "error", "message": {"text": "[MINED001] Bare Except Pass: except: pass or except Exception: pass \u2014 silently swallows everything including KeyboardInterrupt and bugs."}, "properties": {"repobilityId": 469599, "scanner": "repobility-threat-engine", "fingerprint": "79d045036a21eb7e529344980506982e927219be009e9c2a5e8547c1782db8ee", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "bare-except-pass", "owasp": null, "cwe_ids": ["CWE-755"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347744+00:00", "triaged_in_corpus": 15, "observations_count": 1550824, "ai_coder_pattern_id": 6}, "scanner": "repobility-threat-engine", "correlation_key": "fp|79d045036a21eb7e529344980506982e927219be009e9c2a5e8547c1782db8ee"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/migrate-frontmatter.py"}, "region": {"startLine": 81}}}]}, {"ruleId": "SEC128", "level": "error", "message": {"text": "[SEC128] Async function without await \u2014 fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work completes \u2014 DB writes lost, emails not sent, race conditions. This is one of the top-3 errors AI coders make: they understand async-shape but drop the await keyword when chaining multiple ops. Surfaces as flaky tests or silently dropped data in production."}, "properties": {"repobilityId": 469597, "scanner": "repobility-threat-engine", "fingerprint": "44b10f70c58056add35c6093fea8593d39b26e3913f54380e466fcd9aee06418", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "img.save(out / f\"sample_{i}_input.jpg\", quality=90)", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC128", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|44b10f70c58056add35c6093fea8593d39b26e3913f54380e466fcd9aee06418"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/infer.py"}, "region": {"startLine": 43}}}]}, {"ruleId": "SEC128", "level": "error", "message": {"text": "[SEC128] Async function without await \u2014 fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work completes \u2014 DB writes lost, emails not sent, race conditions. This is one of the top-3 errors AI coders make: they understand async-shape but drop the await keyword when chaining multiple ops. Surfaces as flaky tests or silently dropped data in production."}, "properties": {"repobilityId": 469596, "scanner": "repobility-threat-engine", "fingerprint": "6861d86000524653bc9332feba6fafcb77e262b0ad54a21f6fea3a1a632a45ab", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "img.save(out / f\"sample_{i}_input.jpg\", quality=90)", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC128", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|6861d86000524653bc9332feba6fafcb77e262b0ad54a21f6fea3a1a632a45ab"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/infer.py"}, "region": {"startLine": 38}}}]}, {"ruleId": "SEC128", "level": "error", "message": {"text": "[SEC128] Async function without await \u2014 fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work completes \u2014 DB writes lost, emails not sent, race conditions. This is one of the top-3 errors AI coders make: they understand async-shape but drop the await keyword when chaining multiple ops. Surfaces as flaky tests or silently dropped data in production."}, "properties": {"repobilityId": 469595, "scanner": "repobility-threat-engine", "fingerprint": "53445af733155fd6e3451574f9bf5e542b06155d710723e622b71f4be2aba2b8", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "merged.update(item)", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC128", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|53445af733155fd6e3451574f9bf5e542b06155d710723e622b71f4be2aba2b8"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/list_tao_platforms.py"}, "region": {"startLine": 91}}}]}, {"ruleId": "COMP001", "level": "error", "message": {"text": "[COMP001] High cognitive complexity: Function `parse_frontmatter` has cognitive complexity 27 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand \u2014 nested branches, boolean chains, and recursion all weigh in. Breakdown: break=2, continue=3, for=1, if=7, nested_bonus=12, while=2."}, "properties": {"repobilityId": 469591, "scanner": "repobility-threat-engine", "fingerprint": "212cc4432ea3d2853c85778373f6728e6a9c9d085bd88f34c6509ad22f2cd6af", "category": "quality", "severity": "high", "confidence": 0.95, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "AST-derived cognitive complexity score = 27 (severity threshold for high: 25+).", "evidence": {"scanner": "repobility-threat-engine", "function": "parse_frontmatter", "breakdown": {"if": 7, "for": 1, "break": 2, "while": 2, "continue": 3, "nested_bonus": 12}, "complexity": 27, "correlation_key": "fp|212cc4432ea3d2853c85778373f6728e6a9c9d085bd88f34c6509ad22f2cd6af"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/list_tao_capabilities.py"}, "region": {"startLine": 43}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "Action `NVIDIA/skills/.github/workflows/team-request.yml` tracks moving branch `@main`"}, "properties": {"repobilityId": 469586, "scanner": "repobility-supply-chain", "fingerprint": "cb61846d2967f8cfdb6d67a264b123ce913205df7e72cc6c64a6eca0d4f01999", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|cb61846d2967f8cfdb6d67a264b123ce913205df7e72cc6c64a6eca0d4f01999"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/request-nvskills-ci.yml"}, "region": {"startLine": 20}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "Action `NVIDIA/blossom-action` tracks moving branch `@main`"}, "properties": {"repobilityId": 469585, "scanner": "repobility-supply-chain", "fingerprint": "723079b47079bde30d16beeb7378fbeabe350ef6195764b9b556ff3d58086e60", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|723079b47079bde30d16beeb7378fbeabe350ef6195764b9b556ff3d58086e60"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/blossom-ci.yml"}, "region": {"startLine": 72}}}]}, {"ruleId": "CORE_NO_TESTS", "level": "error", "message": {"text": "No test files found"}, "properties": {"repobilityId": 469563, "scanner": "repobility-core", "fingerprint": "0200e9918bc2a7bf9c116d0907e50ac3df640c758b93852cf1890ec6e14d870d", "category": "testing", "severity": "high", "confidence": null, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"rule_id": "CORE_NO_TESTS", "scanner": "repobility-core", "correlation_key": "repo|testing|core_no_tests"}}}, {"ruleId": "generic-api-key", "level": "error", "message": {"text": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations."}, "properties": {"repobilityId": 469629, "scanner": "gitleaks", "fingerprint": "106708fdacc70e7822660f58c8af3074d12cc25efa82497c4da193c604d66b65", "category": "credential_exposure", "severity": "critical", "confidence": 0.95, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "Key defaults: `REDACTED`", "rule_id": "generic-api-key", "scanner": "gitleaks", "detector": "generic-api-key", "correlation_key": "secret|token|12|key defaults: redacted"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/models/tao-train-dino/SKILL.md"}, "region": {"startLine": 129}}}]}, {"ruleId": "generic-api-key", "level": "error", "message": {"text": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations."}, "properties": {"repobilityId": 469628, "scanner": "gitleaks", "fingerprint": "800accfed33b6e35eb5fc818a3e963e619767b2d82cc6c30a37bf63ad6ed93f2", "category": "credential_exposure", "severity": "critical", "confidence": 0.95, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "tokenizer_model_name\": \"REDACTED\"", "rule_id": "generic-api-key", "scanner": "gitleaks", "detector": "generic-api-key", "correlation_key": "secret|token|36|tokenizer_model_name : redacted"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/models/tao-finetune-cosmos-reason/schemas/evaluate.schema.json"}, "region": {"startLine": 362}}}]}, {"ruleId": "generic-api-key", "level": "error", "message": {"text": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations."}, "properties": {"repobilityId": 469627, "scanner": "gitleaks", "fingerprint": "52d65af253baf8ba03af2cfe239a33694804a85409b7d3fc8833cc80322cb68c", "category": "credential_exposure", "severity": "critical", "confidence": 0.95, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "tokenizer_model_name\": \"REDACTED\"", "rule_id": "generic-api-key", "scanner": "gitleaks", "detector": "generic-api-key", "correlation_key": "secret|token|6|tokenizer_model_name : redacted"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/models/tao-finetune-cosmos-reason/schemas/evaluate.schema.json"}, "region": {"startLine": 62}}}]}, {"ruleId": "generic-api-key", "level": "error", "message": {"text": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations."}, "properties": {"repobilityId": 469626, "scanner": "gitleaks", "fingerprint": "cef1315b2f5c0b53b3baa12b222936874e4b705e6d34e7eb09f085337c78b60e", "category": "credential_exposure", "severity": "critical", "confidence": 0.95, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "tokenizer_model_name: REDACTED", "rule_id": "generic-api-key", "scanner": "gitleaks", "detector": "generic-api-key", "correlation_key": "secret|token|1|tokenizer_model_name: redacted"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/models/tao-finetune-cosmos-reason/references/spec_template_evaluate.yaml"}, "region": {"startLine": 13}}}]}, {"ruleId": "MINED107", "level": "error", "message": {"text": "Missing import: `platform` used but not imported"}, "properties": {"repobilityId": 469570, "scanner": "repobility-ast-engine", "fingerprint": "7722b41774c541fd2439afa8c07a85ebab8e97d859ccfba1101bd7790a6295a1", "category": "quality", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "missing-import-python", "owasp": "A06:2021", "cwe_ids": ["CWE-1075"], "languages": ["python"], "observations_count": 2192}, "scanner": "repobility-ast-engine", "correlation_key": "fp|7722b41774c541fd2439afa8c07a85ebab8e97d859ccfba1101bd7790a6295a1"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/list_tao_platforms.py"}, "region": {"startLine": 102}}}]}, {"ruleId": "MINED107", "level": "error", "message": {"text": "Missing import: `platform` used but not imported"}, "properties": {"repobilityId": 469566, "scanner": "repobility-ast-engine", "fingerprint": "3436e7369dafe5ecdc5ed6d26b13ddd80f1a40712e164ce73cf1f8f909dfc074", "category": "quality", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "missing-import-python", "owasp": "A06:2021", "cwe_ids": ["CWE-1075"], "languages": ["python"], "observations_count": 2192}, "scanner": "repobility-ast-engine", "correlation_key": "fp|3436e7369dafe5ecdc5ed6d26b13ddd80f1a40712e164ce73cf1f8f909dfc074"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/check_tao_launch_preflight.py"}, "region": {"startLine": 312}}}]}, {"ruleId": "MINED107", "level": "error", "message": {"text": "Missing import: `platform` used but not imported"}, "properties": {"repobilityId": 469564, "scanner": "repobility-ast-engine", "fingerprint": "541cadc3e21d35defdf6de0b5481f6980e65dcb0d0d03eb37f7ef42af3bf11f8", "category": "quality", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "missing-import-python", "owasp": "A06:2021", "cwe_ids": ["CWE-1075"], "languages": ["python"], "observations_count": 2192}, "scanner": "repobility-ast-engine", "correlation_key": "fp|541cadc3e21d35defdf6de0b5481f6980e65dcb0d0d03eb37f7ef42af3bf11f8"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/list_tao_capabilities.py"}, "region": {"startLine": 318}}}]}, {"ruleId": "scanner-371c7227881a4276", "level": "note", "message": {"text": "Possibly dead Python function: collate_fn"}, "properties": {"repobilityId": "9c99e6b70f0137af", "scanner": "scanner-primary", "fingerprint": "371c7227881a4276", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/train.py:15"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cca1eef32e5afe94", "level": "note", "message": {"text": "Possibly dead Python function: augment_and_transform_batch"}, "properties": {"repobilityId": "645d73b7652a8409", "scanner": "scanner-primary", "fingerprint": "cca1eef32e5afe94", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/train.py:31"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e35ccd2db17936fd", "level": "note", "message": {"text": "Possibly dead Python function: collate_fn"}, "properties": {"repobilityId": "9c99e6b70f0137af", "scanner": "scanner-primary", "fingerprint": "e35ccd2db17936fd", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/train.py:45"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a5dabc82af0c3ac4", "level": "note", "message": {"text": "Possibly dead Python function: tfm"}, "properties": {"repobilityId": "338adc392f4f1c92", "scanner": "scanner-primary", "fingerprint": "a5dabc82af0c3ac4", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/train.py:37"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9ff08adcaadd58ae", "level": "note", "message": {"text": "Possibly dead Python function: compute_metrics"}, "properties": {"repobilityId": "601ab656627d3342", "scanner": "scanner-primary", "fingerprint": "9ff08adcaadd58ae", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/train.py:59"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-151ef59142683deb", "level": "note", "message": {"text": "Possibly dead Python function: data_collator"}, "properties": {"repobilityId": "da0ed07e4e087f8a", "scanner": "scanner-primary", "fingerprint": "151ef59142683deb", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/train.py:145"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ceaf17c946f09c52", "level": "note", "message": {"text": "Possibly dead Python function: apply_train"}, "properties": {"repobilityId": "f04d1cfa818a209b", "scanner": "scanner-primary", "fingerprint": "ceaf17c946f09c52", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/train.py:60"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-80610bee2c77067e", "level": "note", "message": {"text": "Possibly dead Python function: apply_eval"}, "properties": {"repobilityId": "d82b8210ed2a89b3", "scanner": "scanner-primary", "fingerprint": "80610bee2c77067e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/train.py:64"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6762da365579f2b0", "level": "note", "message": {"text": "Possibly dead Python function: compute_metrics"}, "properties": {"repobilityId": "601ab656627d3342", "scanner": "scanner-primary", "fingerprint": "6762da365579f2b0", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/train.py:84"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fcd91a9f8d0b47a3", "level": "warning", "message": {"text": "CVE-2025-1194: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "properties": {"repobilityId": "c577396ffac4cd8f", "scanner": "scanner-primary", "fingerprint": "fcd91a9f8d0b47a3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-1194"]}}, {"ruleId": "scanner-91029630397a556b", "level": "warning", "message": {"text": "CVE-2025-2099: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "properties": {"repobilityId": "43b542b9b31dbce7", "scanner": "scanner-primary", "fingerprint": "91029630397a556b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-2099"]}}, {"ruleId": "scanner-775b96e5e7eeb627", "level": "warning", "message": {"text": "CVE-2025-3262: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "properties": {"repobilityId": "131cec32f910659b", "scanner": "scanner-primary", "fingerprint": "775b96e5e7eeb627", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-3262"]}}, {"ruleId": "scanner-b0c3509f22b587a4", "level": "warning", "message": {"text": "CVE-2025-3263: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "properties": {"repobilityId": "76c537331b90ec93", "scanner": "scanner-primary", "fingerprint": "b0c3509f22b587a4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-3263"]}}, {"ruleId": "scanner-45f3da00475472d6", "level": "warning", "message": {"text": "CVE-2025-3264: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "properties": {"repobilityId": "42becf128da5f363", "scanner": "scanner-primary", "fingerprint": "45f3da00475472d6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-3264"]}}, {"ruleId": "scanner-8e858f2beb7f253a", "level": "warning", "message": {"text": "CVE-2025-3933: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "properties": {"repobilityId": "e94d2ee97f4a56ac", "scanner": "scanner-primary", "fingerprint": "8e858f2beb7f253a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-3933"]}}, {"ruleId": "scanner-8058d5cae8953ff7", "level": "warning", "message": {"text": "CVE-2025-5197: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "properties": {"repobilityId": "1201b738fe2c94bd", "scanner": "scanner-primary", "fingerprint": "8058d5cae8953ff7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-5197"]}}, {"ruleId": "scanner-f0d56f013359e128", "level": "warning", "message": {"text": "CVE-2025-6051: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "properties": {"repobilityId": "a3be465142f7d2c2", "scanner": "scanner-primary", "fingerprint": "f0d56f013359e128", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-6051"]}}, {"ruleId": "scanner-c1416fb6148ceacb", "level": "warning", "message": {"text": "CVE-2025-6638: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "properties": {"repobilityId": "f7ce8a058141be15", "scanner": "scanner-primary", "fingerprint": "c1416fb6148ceacb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-6638"]}}, {"ruleId": "scanner-8889d21c7ec501ea", "level": "warning", "message": {"text": "CVE-2025-6921: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "properties": {"repobilityId": "cf970679fc561cfe", "scanner": "scanner-primary", "fingerprint": "8889d21c7ec501ea", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-6921"]}}, {"ruleId": "scanner-0f20d3e8586f577a", "level": "warning", "message": {"text": "CVE-2026-1839: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "properties": {"repobilityId": "d8421a24ae7d0cff", "scanner": "scanner-primary", "fingerprint": "0f20d3e8586f577a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-1839"]}}, {"ruleId": "scanner-06cda97642f19bb2", "level": "note", "message": {"text": "CVE-2025-3777: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "properties": {"repobilityId": "b532809b5f7a3526", "scanner": "scanner-primary", "fingerprint": "06cda97642f19bb2", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-3777"]}}, {"ruleId": "scanner-9ed8d5397ec21a01", "level": "warning", "message": {"text": "CVE-2025-1194: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requirements.txt"}, "properties": {"repobilityId": "76746d46b04ccfbd", "scanner": "scanner-primary", "fingerprint": "9ed8d5397ec21a01", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-1194"]}}, {"ruleId": "scanner-44d61e1891667b64", "level": "warning", "message": {"text": "CVE-2025-2099: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requirements.txt"}, "properties": {"repobilityId": "bdaa3e91efa6f6d8", "scanner": "scanner-primary", "fingerprint": "44d61e1891667b64", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-2099"]}}, {"ruleId": "scanner-ba7e5e21b4916abc", "level": "warning", "message": {"text": "CVE-2025-3262: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requirements.txt"}, "properties": {"repobilityId": "edc7db289248155d", "scanner": "scanner-primary", "fingerprint": "ba7e5e21b4916abc", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-3262"]}}, {"ruleId": "scanner-9b1bda8185983e4f", "level": "warning", "message": {"text": "CVE-2025-3263: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requirements.txt"}, "properties": {"repobilityId": "a479ea85b555a936", "scanner": "scanner-primary", "fingerprint": "9b1bda8185983e4f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-3263"]}}, {"ruleId": "scanner-b8a1217f3ea37dae", "level": "warning", "message": {"text": "CVE-2025-3264: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requirements.txt"}, "properties": {"repobilityId": "6c9de6f48fffdfa0", "scanner": "scanner-primary", "fingerprint": "b8a1217f3ea37dae", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-3264"]}}, {"ruleId": "scanner-4bb71f2ae26134ff", "level": "warning", "message": {"text": "CVE-2025-3933: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requirements.txt"}, "properties": {"repobilityId": "6563e041a4962d6c", "scanner": "scanner-primary", "fingerprint": "4bb71f2ae26134ff", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-3933"]}}, {"ruleId": "scanner-4339c8958a6fda07", "level": "warning", "message": {"text": "CVE-2025-5197: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requirements.txt"}, "properties": {"repobilityId": "136798fe5daa359a", "scanner": "scanner-primary", "fingerprint": "4339c8958a6fda07", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-5197"]}}, {"ruleId": "scanner-47ecef47b739fcd2", "level": "warning", "message": {"text": "CVE-2025-6051: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requirements.txt"}, "properties": {"repobilityId": "e1773a689a9e92c9", "scanner": "scanner-primary", "fingerprint": "47ecef47b739fcd2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-6051"]}}, {"ruleId": "scanner-aef934d403200b4b", "level": "warning", "message": {"text": "CVE-2025-6638: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requirements.txt"}, "properties": {"repobilityId": "b95fa30bf55f2ba6", "scanner": "scanner-primary", "fingerprint": "aef934d403200b4b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-6638"]}}, {"ruleId": "scanner-815cb414d69be81d", "level": "warning", "message": {"text": "CVE-2025-6921: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requirements.txt"}, "properties": {"repobilityId": "eb7351633f73e452", "scanner": "scanner-primary", "fingerprint": "815cb414d69be81d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-6921"]}}, {"ruleId": "scanner-bf61642f276c63d1", "level": "warning", "message": {"text": "CVE-2026-1839: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requirements.txt"}, "properties": {"repobilityId": "18fb12383b2df804", "scanner": "scanner-primary", "fingerprint": "bf61642f276c63d1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-1839"]}}, {"ruleId": "scanner-595a4966a4255682", "level": "note", "message": {"text": "CVE-2025-3777: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requirements.txt"}, "properties": {"repobilityId": "b7e6b0556cb4b8ce", "scanner": "scanner-primary", "fingerprint": "595a4966a4255682", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-3777"]}}, {"ruleId": "scanner-6c65b7a016262cdd", "level": "warning", "message": {"text": "CVE-2025-1194: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/requirements.txt"}, "properties": {"repobilityId": "717d528ed8d01b4f", "scanner": "scanner-primary", "fingerprint": "6c65b7a016262cdd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-1194"]}}, {"ruleId": "scanner-c96a580217643008", "level": "warning", "message": {"text": "CVE-2025-2099: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/requirements.txt"}, "properties": {"repobilityId": "cdd7c02c31d41f3b", "scanner": "scanner-primary", "fingerprint": "c96a580217643008", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-2099"]}}, {"ruleId": "scanner-0a8d090d72f69b3b", "level": "warning", "message": {"text": "CVE-2025-3262: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/requirements.txt"}, "properties": {"repobilityId": "0c8c6d2bfd39afe5", "scanner": "scanner-primary", "fingerprint": "0a8d090d72f69b3b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-3262"]}}, {"ruleId": "scanner-705470dd640bfbbc", "level": "warning", "message": {"text": "CVE-2025-3263: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/requirements.txt"}, "properties": {"repobilityId": "47ca7a2cae6b8a98", "scanner": "scanner-primary", "fingerprint": "705470dd640bfbbc", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-3263"]}}, {"ruleId": "scanner-2a2afb957b24e364", "level": "warning", "message": {"text": "CVE-2025-3264: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/requirements.txt"}, "properties": {"repobilityId": "3724957aa120ccb1", "scanner": "scanner-primary", "fingerprint": "2a2afb957b24e364", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-3264"]}}, {"ruleId": "scanner-72d87ecaf34d53bf", "level": "warning", "message": {"text": "CVE-2025-3933: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/requirements.txt"}, "properties": {"repobilityId": "0d8884912a0bf577", "scanner": "scanner-primary", "fingerprint": "72d87ecaf34d53bf", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-3933"]}}, {"ruleId": "scanner-70e30d322d638eb8", "level": "warning", "message": {"text": "CVE-2025-5197: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/requirements.txt"}, "properties": {"repobilityId": "945e28d24765a729", "scanner": "scanner-primary", "fingerprint": "70e30d322d638eb8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-5197"]}}, {"ruleId": "scanner-04c79502c38253cf", "level": "warning", "message": {"text": "CVE-2025-6051: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/requirements.txt"}, "properties": {"repobilityId": "d794c2361e6c48fc", "scanner": "scanner-primary", "fingerprint": "04c79502c38253cf", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-6051"]}}, {"ruleId": "scanner-7665ea0b18fa6ae9", "level": "warning", "message": {"text": "CVE-2025-6638: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/requirements.txt"}, "properties": {"repobilityId": "935fcfbddd9efd17", "scanner": "scanner-primary", "fingerprint": "7665ea0b18fa6ae9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-6638"]}}, {"ruleId": "scanner-a75510d1690ebeea", "level": "warning", "message": {"text": "CVE-2025-6921: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/requirements.txt"}, "properties": {"repobilityId": "275aa8005deffba3", "scanner": "scanner-primary", "fingerprint": "a75510d1690ebeea", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-6921"]}}, {"ruleId": "scanner-34e6b5a4dabcad33", "level": "warning", "message": {"text": "CVE-2026-1839: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/requirements.txt"}, "properties": {"repobilityId": "0fde052322027e25", "scanner": "scanner-primary", "fingerprint": "34e6b5a4dabcad33", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-1839"]}}, {"ruleId": "scanner-afb6f7c352029496", "level": "note", "message": {"text": "CVE-2025-3777: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/requirements.txt"}, "properties": {"repobilityId": "951574db5b5745d7", "scanner": "scanner-primary", "fingerprint": "afb6f7c352029496", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-3777"]}}, {"ruleId": "scanner-3b7cca0e8570107a", "level": "warning", "message": {"text": "CVE-2025-1194: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requirements.txt"}, "properties": {"repobilityId": "5fd7bcb965349023", "scanner": "scanner-primary", "fingerprint": "3b7cca0e8570107a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-1194"]}}, {"ruleId": "scanner-34190a0ecf24e5d6", "level": "warning", "message": {"text": "CVE-2025-2099: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requirements.txt"}, "properties": {"repobilityId": "da07b63198ebfac6", "scanner": "scanner-primary", "fingerprint": "34190a0ecf24e5d6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-2099"]}}, {"ruleId": "scanner-085f490c43c42752", "level": "warning", "message": {"text": "CVE-2025-3262: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requirements.txt"}, "properties": {"repobilityId": "8f869f20687681b1", "scanner": "scanner-primary", "fingerprint": "085f490c43c42752", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-3262"]}}, {"ruleId": "scanner-f3406e2e70f59e58", "level": "warning", "message": {"text": "CVE-2025-3263: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requirements.txt"}, "properties": {"repobilityId": "eae5616220abee12", "scanner": "scanner-primary", "fingerprint": "f3406e2e70f59e58", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-3263"]}}, {"ruleId": "scanner-abd2c4e3ab0fbe69", "level": "warning", "message": {"text": "CVE-2025-3264: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requirements.txt"}, "properties": {"repobilityId": "2a56a5da791a6db8", "scanner": "scanner-primary", "fingerprint": "abd2c4e3ab0fbe69", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-3264"]}}, {"ruleId": "scanner-a3bf1309322ade6b", "level": "warning", "message": {"text": "CVE-2025-3933: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requirements.txt"}, "properties": {"repobilityId": "8f515ab9bd694117", "scanner": "scanner-primary", "fingerprint": "a3bf1309322ade6b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-3933"]}}, {"ruleId": "scanner-b5d82bd674443ab3", "level": "warning", "message": {"text": "CVE-2025-5197: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requirements.txt"}, "properties": {"repobilityId": "baac69b07a6bee1a", "scanner": "scanner-primary", "fingerprint": "b5d82bd674443ab3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-5197"]}}, {"ruleId": "scanner-2a403b1216d5a445", "level": "warning", "message": {"text": "CVE-2025-6051: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requirements.txt"}, "properties": {"repobilityId": "0481cf6028e90406", "scanner": "scanner-primary", "fingerprint": "2a403b1216d5a445", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-6051"]}}, {"ruleId": "scanner-ca672f31b3b949e2", "level": "warning", "message": {"text": "CVE-2025-6638: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requirements.txt"}, "properties": {"repobilityId": "16d16eba5cbbe909", "scanner": "scanner-primary", "fingerprint": "ca672f31b3b949e2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-6638"]}}, {"ruleId": "scanner-013ff285e329322b", "level": "warning", "message": {"text": "CVE-2025-6921: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requirements.txt"}, "properties": {"repobilityId": "233f20fddf5cc372", "scanner": "scanner-primary", "fingerprint": "013ff285e329322b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-6921"]}}, {"ruleId": "scanner-05be21e762ae047e", "level": "warning", "message": {"text": "CVE-2026-1839: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requirements.txt"}, "properties": {"repobilityId": "16cfdf4823abdcfe", "scanner": "scanner-primary", "fingerprint": "05be21e762ae047e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-1839"]}}, {"ruleId": "scanner-743506cc68eeadfc", "level": "note", "message": {"text": "CVE-2025-3777: transformers 4.49.0 \u2014 skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requirements.txt"}, "properties": {"repobilityId": "5c567f548f882727", "scanner": "scanner-primary", "fingerprint": "743506cc68eeadfc", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-3777"]}}, {"ruleId": "scanner-1cb2b6e020b82e6d", "level": "error", "message": {"text": "DS-0002: Image user should not be 'root' \u2014 skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/Dockerfile"}, "properties": {"repobilityId": "4db130ccd8bad68a", "scanner": "scanner-primary", "fingerprint": "1cb2b6e020b82e6d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-a4d9855dd8ce1f09", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/Dockerfile"}, "properties": {"repobilityId": "8551070490aac2fc", "scanner": "scanner-primary", "fingerprint": "a4d9855dd8ce1f09", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-e17a74004d84f52c", "level": "error", "message": {"text": "DS-0002: Image user should not be 'root' \u2014 skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/Dockerfile"}, "properties": {"repobilityId": "069f1f6c05dc1f32", "scanner": "scanner-primary", "fingerprint": "e17a74004d84f52c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-b52affe3e9e1e9da", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/Dockerfile"}, "properties": {"repobilityId": "3816dca72fa98f5a", "scanner": "scanner-primary", "fingerprint": "b52affe3e9e1e9da", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-f1a7c04e0bafb212", "level": "error", "message": {"text": "DS-0002: Image user should not be 'root' \u2014 skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/Dockerfile"}, "properties": {"repobilityId": "a4aaeb4230d9641d", "scanner": "scanner-primary", "fingerprint": "f1a7c04e0bafb212", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-7f60733beaa0a77c", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/Dockerfile"}, "properties": {"repobilityId": "05d1a3a3947d2b5f", "scanner": "scanner-primary", "fingerprint": "7f60733beaa0a77c", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-b0b7b05e2a884026", "level": "error", "message": {"text": "DS-0002: Image user should not be 'root' \u2014 skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/Dockerfile"}, "properties": {"repobilityId": "2d25d9f1b9dbb4da", "scanner": "scanner-primary", "fingerprint": "b0b7b05e2a884026", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-f1728f878d097b1c", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/Dockerfile"}, "properties": {"repobilityId": "1ce76aa865af0144", "scanner": "scanner-primary", "fingerprint": "f1728f878d097b1c", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-cb9c07679726de6c", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: templates/skill-skeleton/minimal/SKILL.md"}, "properties": {"repobilityId": "db14bb5fc2174e53", "scanner": "scanner-primary", "fingerprint": "cb9c07679726de6c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/skill-skeleton/minimal/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-806fc17148da09c3", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: templates/skill-skeleton/platform/SKILL.md"}, "properties": {"repobilityId": "eef2acaf49725ae0", "scanner": "scanner-primary", "fingerprint": "806fc17148da09c3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/skill-skeleton/platform/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-09f02b9250442005", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: templates/skill-skeleton/model/SKILL.md"}, "properties": {"repobilityId": "1d6fe12fb8a8b45f", "scanner": "scanner-primary", "fingerprint": "09f02b9250442005", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/skill-skeleton/model/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-df050e68e2ac4aef", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/models/tao-train-pose-classification/SKILL.md"}, "properties": {"repobilityId": "0308bf8574e5766f", "scanner": "scanner-primary", "fingerprint": "df050e68e2ac4aef", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/models/tao-train-pose-classification/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-aa3bf9fc01909bc9", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/models/tao-train-dino/SKILL.md"}, "properties": {"repobilityId": "b5230edb8d75983f", "scanner": "scanner-primary", "fingerprint": "aa3bf9fc01909bc9", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/models/tao-train-dino/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3e041b1209defa33", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/models/tao-train-oneformer/SKILL.md"}, "properties": {"repobilityId": "ac698e40819a7e35", "scanner": "scanner-primary", "fingerprint": "3e041b1209defa33", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/models/tao-train-oneformer/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-314402e1c43e06a4", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/models/tao-train-metric-learning-recognition/SKILL.md"}, "properties": {"repobilityId": "99e88fc552139a08", "scanner": "scanner-primary", "fingerprint": "314402e1c43e06a4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/models/tao-train-metric-learning-recognition/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c59fd20b782308f0", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/models/tao-train-image-classification/SKILL.md"}, "properties": {"repobilityId": "67b6eed48bf87476", "scanner": "scanner-primary", "fingerprint": "c59fd20b782308f0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/models/tao-train-image-classification/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d47fc416b1cb54b0", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/models/tao-train-segformer/SKILL.md"}, "properties": {"repobilityId": "2bb36c75dea47741", "scanner": "scanner-primary", "fingerprint": "d47fc416b1cb54b0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/models/tao-train-segformer/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c49d3e989260ad9c", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/models/tao-train-mask2former/SKILL.md"}, "properties": {"repobilityId": "88ff1bf8532811ed", "scanner": "scanner-primary", "fingerprint": "c49d3e989260ad9c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/models/tao-train-mask2former/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a3d88fd048f642d5", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/models/tao-train-nvdinov2/SKILL.md"}, "properties": {"repobilityId": "8354701b5181951e", "scanner": "scanner-primary", "fingerprint": "a3d88fd048f642d5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/models/tao-train-nvdinov2/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-85d08c1e4f04a3ad", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/models/tao-train-mask-auto-label/SKILL.md"}, "properties": {"repobilityId": "a16cb9955ed67c18", "scanner": "scanner-primary", "fingerprint": "85d08c1e4f04a3ad", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/models/tao-train-mask-auto-label/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e4d8b89f0c219c11", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/models/tao-train-foundation-stereo/SKILL.md"}, "properties": {"repobilityId": "70bf2b34ea3205ac", "scanner": "scanner-primary", "fingerprint": "e4d8b89f0c219c11", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/models/tao-train-foundation-stereo/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4a8ca4c88548b8f9", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/models/tao-finetune-cosmos-embed/SKILL.md"}, "properties": {"repobilityId": "d613ba863c10b9bc", "scanner": "scanner-primary", "fingerprint": "4a8ca4c88548b8f9", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/models/tao-finetune-cosmos-embed/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b3d6a0d0f2e2131a", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/models/tao-train-visual-changenet/SKILL.md"}, "properties": {"repobilityId": "f9b5d6ca2903adbb", "scanner": "scanner-primary", "fingerprint": "b3d6a0d0f2e2131a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/models/tao-train-visual-changenet/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fb753955e15133e2", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/models/tao-train-deformable-detr/SKILL.md"}, "properties": {"repobilityId": "02d5a545aa309dcd", "scanner": "scanner-primary", "fingerprint": "fb753955e15133e2", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/models/tao-train-deformable-detr/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-71772348f8c12698", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/models/tao-train-bevfusion/SKILL.md"}, "properties": {"repobilityId": "8a720c0275ca40da", "scanner": "scanner-primary", "fingerprint": "71772348f8c12698", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/models/tao-train-bevfusion/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1e9502a2006d775f", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/models/tao-train-grounding-dino/SKILL.md"}, "properties": {"repobilityId": "9d6b6ca8d75c8f39", "scanner": "scanner-primary", "fingerprint": "1e9502a2006d775f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/models/tao-train-grounding-dino/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-36bfa9d960508023", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/models/tao-train-rtdetr/SKILL.md"}, "properties": {"repobilityId": "e889ec0b22945958", "scanner": "scanner-primary", "fingerprint": "36bfa9d960508023", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/models/tao-train-rtdetr/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2b8521a942da9595", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: skills/platform/tao-run-on-kubernetes/SKILL.md"}, "properties": {"repobilityId": "b40e2fb1d33e6c3c", "scanner": "scanner-primary", "fingerprint": "2b8521a942da9595", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/platform/tao-run-on-kubernetes/SKILL.md"}, "region": {"startLine": 127}}}]}, {"ruleId": "scanner-27ca0a0e3eb73713", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/platform/tao-run-platform/SKILL.md"}, "properties": {"repobilityId": "e9affd90e4c589d9", "scanner": "scanner-primary", "fingerprint": "27ca0a0e3eb73713", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/platform/tao-run-platform/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-abb9e9d3b72973fb", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/platform/tao-run-on-docker/SKILL.md"}, "properties": {"repobilityId": "244f565f96c14519", "scanner": "scanner-primary", "fingerprint": "abb9e9d3b72973fb", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/platform/tao-run-on-docker/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f0dcc0b93f52aec6", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: skills/core/tao-launch-workflow/SKILL.md"}, "properties": {"repobilityId": "d4952f118b8726b2", "scanner": "scanner-primary", "fingerprint": "f0dcc0b93f52aec6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/core/tao-launch-workflow/SKILL.md"}, "region": {"startLine": 346}}}]}, {"ruleId": "scanner-81ee391e284ff04e", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/applications/tao-run-deft-aoi/SKILL.md"}, "properties": {"repobilityId": "582f19ef0b09cb70", "scanner": "scanner-primary", "fingerprint": "81ee391e284ff04e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-deft-aoi/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-38b18067e2c5cc41", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/applications/tao-finetune-huggingface-model/SKILL.md"}, "properties": {"repobilityId": "da7ac6e2066d4ba1", "scanner": "scanner-primary", "fingerprint": "38b18067e2c5cc41", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-09a66f4774867929", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/applications/tao-port-huggingface-model/SKILL.md"}, "properties": {"repobilityId": "61090d192eaa36e0", "scanner": "scanner-primary", "fingerprint": "09a66f4774867929", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-port-huggingface-model/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-24783c328b9a3689", "level": "warning", "message": {"text": "SkillSpector LP3 (mcp-least-priv) in skills/applications/tao-analyze-changenet-rca/SKILL.md"}, "properties": {"repobilityId": "129cc5f8ee63d219", "scanner": "scanner-primary", "fingerprint": "24783c328b9a3689", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "mcp-least-priv", "LP3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-analyze-changenet-rca/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fc8062b664c86851", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in skills/applications/tao-analyze-changenet-rca/skill.oms.sig"}, "properties": {"repobilityId": "d8e5707a48af248f", "scanner": "scanner-primary", "fingerprint": "fc8062b664c86851", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-analyze-changenet-rca/skill.oms.sig"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fc8062b664c86851", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in skills/applications/tao-analyze-changenet-rca/skill.oms.sig"}, "properties": {"repobilityId": "d8e5707a48af248f", "scanner": "scanner-primary", "fingerprint": "fc8062b664c86851", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-analyze-changenet-rca/skill.oms.sig"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fc8062b664c86851", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in skills/applications/tao-analyze-changenet-rca/skill.oms.sig"}, "properties": {"repobilityId": "d8e5707a48af248f", "scanner": "scanner-primary", "fingerprint": "fc8062b664c86851", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-analyze-changenet-rca/skill.oms.sig"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fc8062b664c86851", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in skills/applications/tao-analyze-changenet-rca/skill.oms.sig"}, "properties": {"repobilityId": "d8e5707a48af248f", "scanner": "scanner-primary", "fingerprint": "fc8062b664c86851", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-analyze-changenet-rca/skill.oms.sig"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b530bf3b0baafa07", "level": "warning", "message": {"text": "SkillSpector LP3 (mcp-least-priv) in skills/applications/tao-finetune-huggingface-model/SKILL.md"}, "properties": {"repobilityId": "58616df61145b58d", "scanner": "scanner-primary", "fingerprint": "b530bf3b0baafa07", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "mcp-least-priv", "LP3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cbc971ab2c9963b9", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/infer.py"}, "properties": {"repobilityId": "370aa04030465975", "scanner": "scanner-primary", "fingerprint": "cbc971ab2c9963b9", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/infer.py"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-afe696047672bc5c", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/prepare_data.py"}, "properties": {"repobilityId": "856bdde87acd5e24", "scanner": "scanner-primary", "fingerprint": "afe696047672bc5c", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/prepare_data.py"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-12dca48b48b1be5b", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/run_eval.py"}, "properties": {"repobilityId": "24c2760936b7074d", "scanner": "scanner-primary", "fingerprint": "12dca48b48b1be5b", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/run_eval.py"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-3627f29d264d6e0b", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/train.py"}, "properties": {"repobilityId": "ccdf13ca0befce94", "scanner": "scanner-primary", "fingerprint": "3627f29d264d6e0b", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/train.py"}, "region": {"startLine": 48}}}]}, {"ruleId": "scanner-403665feafc38714", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/infer.py"}, "properties": {"repobilityId": "80cc709e54c72dfd", "scanner": "scanner-primary", "fingerprint": "403665feafc38714", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/infer.py"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-dde3df4515001ec3", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/prepare_data.py"}, "properties": {"repobilityId": "4e88c5f7b0582504", "scanner": "scanner-primary", "fingerprint": "dde3df4515001ec3", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/prepare_data.py"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-86e4f7200601c447", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/run_eval.py"}, "properties": {"repobilityId": "bb5d910241e48910", "scanner": "scanner-primary", "fingerprint": "86e4f7200601c447", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/run_eval.py"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-f3497c7e3510f836", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/train.py"}, "properties": {"repobilityId": "1973121c3e1f6fe2", "scanner": "scanner-primary", "fingerprint": "f3497c7e3510f836", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/train.py"}, "region": {"startLine": 113}}}]}, {"ruleId": "scanner-d648612e4328651f", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/infer.py"}, "properties": {"repobilityId": "50d3951ea54df194", "scanner": "scanner-primary", "fingerprint": "d648612e4328651f", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/infer.py"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-1d5bf6be878b0ba9", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/prepare_data.py"}, "properties": {"repobilityId": "f40a3b091c199c40", "scanner": "scanner-primary", "fingerprint": "1d5bf6be878b0ba9", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/prepare_data.py"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-bc0ec44eb5804283", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/run_eval.py"}, "properties": {"repobilityId": "eed19bd2750b2fc6", "scanner": "scanner-primary", "fingerprint": "bc0ec44eb5804283", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/run_eval.py"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-0e00ebdd316a673a", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/train.py"}, "properties": {"repobilityId": "51e37cff2e3b328f", "scanner": "scanner-primary", "fingerprint": "0e00ebdd316a673a", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/train.py"}, "region": {"startLine": 95}}}]}, {"ruleId": "scanner-bd396fe4804fdd9e", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/infer.py"}, "properties": {"repobilityId": "64ccc331c71b0ab9", "scanner": "scanner-primary", "fingerprint": "bd396fe4804fdd9e", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/infer.py"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-a0aa2f08bc5a126f", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/merge_lora.py"}, "properties": {"repobilityId": "f5ce584e0a65c514", "scanner": "scanner-primary", "fingerprint": "a0aa2f08bc5a126f", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/merge_lora.py"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-fba1311619457daf", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/prepare_data.py"}, "properties": {"repobilityId": "5820de44ae5f15cf", "scanner": "scanner-primary", "fingerprint": "fba1311619457daf", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/prepare_data.py"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-ff81bbff559cdc01", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/run_eval.py"}, "properties": {"repobilityId": "499de411e8207a56", "scanner": "scanner-primary", "fingerprint": "ff81bbff559cdc01", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/run_eval.py"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-2313438a4bfd0b94", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/train.py"}, "properties": {"repobilityId": "eb233a804a825fdf", "scanner": "scanner-primary", "fingerprint": "2313438a4bfd0b94", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/train.py"}, "region": {"startLine": 47}}}]}, {"ruleId": "scanner-cd13fc3fcebb3c3d", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/references/cv-scripts.md"}, "properties": {"repobilityId": "843dd1b68102bac8", "scanner": "scanner-primary", "fingerprint": "cd13fc3fcebb3c3d", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/cv-scripts.md"}, "region": {"startLine": 419}}}]}, {"ruleId": "scanner-cd13fc3fcebb3c3d", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/references/cv-scripts.md"}, "properties": {"repobilityId": "843dd1b68102bac8", "scanner": "scanner-primary", "fingerprint": "cd13fc3fcebb3c3d", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/cv-scripts.md"}, "region": {"startLine": 684}}}]}, {"ruleId": "scanner-cd13fc3fcebb3c3d", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/references/cv-scripts.md"}, "properties": {"repobilityId": "843dd1b68102bac8", "scanner": "scanner-primary", "fingerprint": "cd13fc3fcebb3c3d", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/cv-scripts.md"}, "region": {"startLine": 688}}}]}, {"ruleId": "scanner-cd13fc3fcebb3c3d", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/references/cv-scripts.md"}, "properties": {"repobilityId": "843dd1b68102bac8", "scanner": "scanner-primary", "fingerprint": "cd13fc3fcebb3c3d", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/cv-scripts.md"}, "region": {"startLine": 690}}}]}, {"ruleId": "scanner-cd13fc3fcebb3c3d", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/references/cv-scripts.md"}, "properties": {"repobilityId": "843dd1b68102bac8", "scanner": "scanner-primary", "fingerprint": "cd13fc3fcebb3c3d", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/cv-scripts.md"}, "region": {"startLine": 694}}}]}, {"ruleId": "scanner-cd13fc3fcebb3c3d", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/references/cv-scripts.md"}, "properties": {"repobilityId": "843dd1b68102bac8", "scanner": "scanner-primary", "fingerprint": "cd13fc3fcebb3c3d", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/cv-scripts.md"}, "region": {"startLine": 696}}}]}, {"ruleId": "scanner-cd13fc3fcebb3c3d", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/references/cv-scripts.md"}, "properties": {"repobilityId": "843dd1b68102bac8", "scanner": "scanner-primary", "fingerprint": "cd13fc3fcebb3c3d", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/cv-scripts.md"}, "region": {"startLine": 700}}}]}, {"ruleId": "scanner-cd13fc3fcebb3c3d", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/references/cv-scripts.md"}, "properties": {"repobilityId": "843dd1b68102bac8", "scanner": "scanner-primary", "fingerprint": "cd13fc3fcebb3c3d", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/cv-scripts.md"}, "region": {"startLine": 702}}}]}, {"ruleId": "scanner-cd13fc3fcebb3c3d", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/references/cv-scripts.md"}, "properties": {"repobilityId": "843dd1b68102bac8", "scanner": "scanner-primary", "fingerprint": "cd13fc3fcebb3c3d", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/cv-scripts.md"}, "region": {"startLine": 774}}}]}, {"ruleId": "scanner-2e37a797dc6e4b42", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/references/dataset-patterns.md"}, "properties": {"repobilityId": "68442f04f58fefab", "scanner": "scanner-primary", "fingerprint": "2e37a797dc6e4b42", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/dataset-patterns.md"}, "region": {"startLine": 107}}}]}, {"ruleId": "scanner-5b24e919d1d4f5fd", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/references/dataset-sources.md"}, "properties": {"repobilityId": "46325aa6dcb0ac53", "scanner": "scanner-primary", "fingerprint": "5b24e919d1d4f5fd", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/dataset-sources.md"}, "region": {"startLine": 508}}}]}, {"ruleId": "scanner-9ab5d62f5b4084ef", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/references/hub-push.md"}, "properties": {"repobilityId": "2b44a4c7ee4acb79", "scanner": "scanner-primary", "fingerprint": "9ab5d62f5b4084ef", "layer": "security", "severity": "high", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/hub-push.md"}, "region": {"startLine": 74}}}]}, {"ruleId": "scanner-7b95cb18b9169350", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/references/testing.md"}, "properties": {"repobilityId": "adf1b336c52660a2", "scanner": "scanner-primary", "fingerprint": "7b95cb18b9169350", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/testing.md"}, "region": {"startLine": 190}}}]}, {"ruleId": "scanner-035cd06a46bb9c77", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/references/vlm-scripts.md"}, "properties": {"repobilityId": "a0d4fcc89b4d1bbb", "scanner": "scanner-primary", "fingerprint": "035cd06a46bb9c77", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/vlm-scripts.md"}, "region": {"startLine": 138}}}]}, {"ruleId": "scanner-035cd06a46bb9c77", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/references/vlm-scripts.md"}, "properties": {"repobilityId": "a0d4fcc89b4d1bbb", "scanner": "scanner-primary", "fingerprint": "035cd06a46bb9c77", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/vlm-scripts.md"}, "region": {"startLine": 530}}}]}, {"ruleId": "scanner-035cd06a46bb9c77", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/references/vlm-scripts.md"}, "properties": {"repobilityId": "a0d4fcc89b4d1bbb", "scanner": "scanner-primary", "fingerprint": "035cd06a46bb9c77", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/vlm-scripts.md"}, "region": {"startLine": 600}}}]}, {"ruleId": "scanner-035cd06a46bb9c77", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/references/vlm-scripts.md"}, "properties": {"repobilityId": "a0d4fcc89b4d1bbb", "scanner": "scanner-primary", "fingerprint": "035cd06a46bb9c77", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/vlm-scripts.md"}, "region": {"startLine": 695}}}]}, {"ruleId": "scanner-997e8a42d58d78bd", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/references/workflow-intake-preflight.md"}, "properties": {"repobilityId": "fea9d8e49acf1605", "scanner": "scanner-primary", "fingerprint": "997e8a42d58d78bd", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/workflow-intake-preflight.md"}, "region": {"startLine": 259}}}]}, {"ruleId": "scanner-997e8a42d58d78bd", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-finetune-huggingface-model/references/workflow-intake-preflight.md"}, "properties": {"repobilityId": "fea9d8e49acf1605", "scanner": "scanner-primary", "fingerprint": "997e8a42d58d78bd", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/workflow-intake-preflight.md"}, "region": {"startLine": 326}}}]}, {"ruleId": "scanner-59e64bde376a87a3", "level": "warning", "message": {"text": "SkillSpector EA2 (excessive-agency) in skills/applications/tao-finetune-huggingface-model/SKILL.md"}, "properties": {"repobilityId": "89720f9340fa149d", "scanner": "scanner-primary", "fingerprint": "59e64bde376a87a3", "layer": "security", "severity": "medium", "confidence": 0.75, "tags": ["skillspector", "mcp-skill", "excessive-agency", "EA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/SKILL.md"}, "region": {"startLine": 143}}}]}, {"ruleId": "scanner-122009374201d01a", "level": "warning", "message": {"text": "SkillSpector EA2 (excessive-agency) in skills/applications/tao-finetune-huggingface-model/references/compat-workarounds.md"}, "properties": {"repobilityId": "b5c4aa6e2ba4bd9a", "scanner": "scanner-primary", "fingerprint": "122009374201d01a", "layer": "security", "severity": "medium", "confidence": 0.75, "tags": ["skillspector", "mcp-skill", "excessive-agency", "EA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/compat-workarounds.md"}, "region": {"startLine": 109}}}]}, {"ruleId": "scanner-9bfcbf0901392251", "level": "warning", "message": {"text": "SkillSpector EA2 (excessive-agency) in skills/applications/tao-finetune-huggingface-model/references/workflow-intake-preflight.md"}, "properties": {"repobilityId": "c1b5170c4f883e66", "scanner": "scanner-primary", "fingerprint": "9bfcbf0901392251", "layer": "security", "severity": "medium", "confidence": 0.75, "tags": ["skillspector", "mcp-skill", "excessive-agency", "EA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/workflow-intake-preflight.md"}, "region": {"startLine": 180}}}]}, {"ruleId": "scanner-bb2d25e747ff3fea", "level": "warning", "message": {"text": "SkillSpector OH3 (output-handling) in skills/applications/tao-finetune-huggingface-model/references/compat-workarounds.md"}, "properties": {"repobilityId": "71a52e346c27a279", "scanner": "scanner-primary", "fingerprint": "bb2d25e747ff3fea", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "output-handling", "OH3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/compat-workarounds.md"}, "region": {"startLine": 213}}}]}, {"ruleId": "scanner-cb98f1aa12384f9c", "level": "error", "message": {"text": "SkillSpector PE3 (priv-esc) in skills/applications/tao-finetune-huggingface-model/references/deliverables.md"}, "properties": {"repobilityId": "6a7d4f6f285747a8", "scanner": "scanner-primary", "fingerprint": "cb98f1aa12384f9c", "layer": "security", "severity": "high", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "priv-esc", "PE3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/deliverables.md"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-cb98f1aa12384f9c", "level": "error", "message": {"text": "SkillSpector PE3 (priv-esc) in skills/applications/tao-finetune-huggingface-model/references/deliverables.md"}, "properties": {"repobilityId": "6a7d4f6f285747a8", "scanner": "scanner-primary", "fingerprint": "cb98f1aa12384f9c", "layer": "security", "severity": "high", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "priv-esc", "PE3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/deliverables.md"}, "region": {"startLine": 282}}}]}, {"ruleId": "scanner-cb98f1aa12384f9c", "level": "error", "message": {"text": "SkillSpector PE3 (priv-esc) in skills/applications/tao-finetune-huggingface-model/references/deliverables.md"}, "properties": {"repobilityId": "6a7d4f6f285747a8", "scanner": "scanner-primary", "fingerprint": "cb98f1aa12384f9c", "layer": "security", "severity": "high", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "priv-esc", "PE3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/deliverables.md"}, "region": {"startLine": 283}}}]}, {"ruleId": "scanner-cb98f1aa12384f9c", "level": "error", "message": {"text": "SkillSpector PE3 (priv-esc) in skills/applications/tao-finetune-huggingface-model/references/deliverables.md"}, "properties": {"repobilityId": "6a7d4f6f285747a8", "scanner": "scanner-primary", "fingerprint": "cb98f1aa12384f9c", "layer": "security", "severity": "high", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "priv-esc", "PE3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/deliverables.md"}, "region": {"startLine": 283}}}]}, {"ruleId": "scanner-65d4798517ba0a38", "level": "warning", "message": {"text": "SkillSpector PE2 (priv-esc) in skills/applications/tao-finetune-huggingface-model/references/docker-runs.md"}, "properties": {"repobilityId": "a5fec9e4bcd305c4", "scanner": "scanner-primary", "fingerprint": "65d4798517ba0a38", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "priv-esc", "PE2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/docker-runs.md"}, "region": {"startLine": 92}}}]}, {"ruleId": "scanner-eb538a9ae0ac7de5", "level": "error", "message": {"text": "SkillSpector P2 (prompt-injection) in skills/applications/tao-finetune-huggingface-model/references/deliverables.md"}, "properties": {"repobilityId": "0a24bbe08b4fad37", "scanner": "scanner-primary", "fingerprint": "eb538a9ae0ac7de5", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "prompt-injection", "P2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/deliverables.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-53ae791bc9501dba", "level": "error", "message": {"text": "SkillSpector P2 (prompt-injection) in skills/applications/tao-finetune-huggingface-model/references/pipeline-skill-template.md"}, "properties": {"repobilityId": "3a4b87ab65bedc4f", "scanner": "scanner-primary", "fingerprint": "53ae791bc9501dba", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "prompt-injection", "P2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/pipeline-skill-template.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3db97eae246e6450", "level": "note", "message": {"text": "SkillSpector SC1 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "properties": {"repobilityId": "b773441a792d21c6", "scanner": "scanner-primary", "fingerprint": "3db97eae246e6450", "layer": "security", "severity": "low", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-3db97eae246e6450", "level": "note", "message": {"text": "SkillSpector SC1 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "properties": {"repobilityId": "b773441a792d21c6", "scanner": "scanner-primary", "fingerprint": "3db97eae246e6450", "layer": "security", "severity": "low", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-3db97eae246e6450", "level": "note", "message": {"text": "SkillSpector SC1 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "properties": {"repobilityId": "b773441a792d21c6", "scanner": "scanner-primary", "fingerprint": "3db97eae246e6450", "layer": "security", "severity": "low", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-3db97eae246e6450", "level": "note", "message": {"text": "SkillSpector SC1 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "properties": {"repobilityId": "b773441a792d21c6", "scanner": "scanner-primary", "fingerprint": "3db97eae246e6450", "layer": "security", "severity": "low", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-3db97eae246e6450", "level": "note", "message": {"text": "SkillSpector SC1 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "properties": {"repobilityId": "b773441a792d21c6", "scanner": "scanner-primary", "fingerprint": "3db97eae246e6450", "layer": "security", "severity": "low", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-3db97eae246e6450", "level": "note", "message": {"text": "SkillSpector SC1 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "properties": {"repobilityId": "b773441a792d21c6", "scanner": "scanner-primary", "fingerprint": "3db97eae246e6450", "layer": "security", "severity": "low", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-1497517d30079834", "level": "note", "message": {"text": "SkillSpector SC1 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requirements.txt"}, "properties": {"repobilityId": "b36df6bca4294e6d", "scanner": "scanner-primary", "fingerprint": "1497517d30079834", "layer": "security", "severity": "low", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requirements.txt"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-1497517d30079834", "level": "note", "message": {"text": "SkillSpector SC1 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requirements.txt"}, "properties": {"repobilityId": "b36df6bca4294e6d", "scanner": "scanner-primary", "fingerprint": "1497517d30079834", "layer": "security", "severity": "low", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requirements.txt"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-1497517d30079834", "level": "note", "message": {"text": "SkillSpector SC1 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requirements.txt"}, "properties": {"repobilityId": "b36df6bca4294e6d", "scanner": "scanner-primary", "fingerprint": "1497517d30079834", "layer": "security", "severity": "low", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requirements.txt"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-1497517d30079834", "level": "note", "message": {"text": "SkillSpector SC1 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requirements.txt"}, "properties": {"repobilityId": "b36df6bca4294e6d", "scanner": "scanner-primary", "fingerprint": "1497517d30079834", "layer": "security", "severity": "low", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requirements.txt"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-1497517d30079834", "level": "note", "message": {"text": "SkillSpector SC1 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requirements.txt"}, "properties": {"repobilityId": "b36df6bca4294e6d", "scanner": "scanner-primary", "fingerprint": "1497517d30079834", "layer": "security", "severity": "low", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requirements.txt"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-1497517d30079834", "level": "note", "message": {"text": "SkillSpector SC1 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requirements.txt"}, "properties": {"repobilityId": "b36df6bca4294e6d", "scanner": "scanner-primary", "fingerprint": "1497517d30079834", "layer": "security", "severity": "low", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requirements.txt"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-1497517d30079834", "level": "note", "message": {"text": "SkillSpector SC1 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requirements.txt"}, "properties": {"repobilityId": "b36df6bca4294e6d", "scanner": "scanner-primary", "fingerprint": "1497517d30079834", "layer": "security", "severity": "low", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requirements.txt"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-1497517d30079834", "level": "note", "message": {"text": "SkillSpector SC1 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requirements.txt"}, "properties": {"repobilityId": "b36df6bca4294e6d", "scanner": "scanner-primary", "fingerprint": "1497517d30079834", "layer": "security", "severity": "low", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requirements.txt"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-7aa253e2f44de2ec", "level": "note", "message": {"text": "SkillSpector SC1 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/requirements.txt"}, "properties": {"repobilityId": "792541b8b921cbb7", "scanner": "scanner-primary", "fingerprint": "7aa253e2f44de2ec", "layer": "security", "severity": "low", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/requirements.txt"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-7aa253e2f44de2ec", "level": "note", "message": {"text": "SkillSpector SC1 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/requirements.txt"}, "properties": {"repobilityId": "792541b8b921cbb7", "scanner": "scanner-primary", "fingerprint": "7aa253e2f44de2ec", "layer": "security", "severity": "low", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/requirements.txt"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-7aa253e2f44de2ec", "level": "note", "message": {"text": "SkillSpector SC1 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/requirements.txt"}, "properties": {"repobilityId": "792541b8b921cbb7", "scanner": "scanner-primary", "fingerprint": "7aa253e2f44de2ec", "layer": "security", "severity": "low", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/requirements.txt"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-7aa253e2f44de2ec", "level": "note", "message": {"text": "SkillSpector SC1 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/requirements.txt"}, "properties": {"repobilityId": "792541b8b921cbb7", "scanner": "scanner-primary", "fingerprint": "7aa253e2f44de2ec", "layer": "security", "severity": "low", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/requirements.txt"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-7aa253e2f44de2ec", "level": "note", "message": {"text": "SkillSpector SC1 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/requirements.txt"}, "properties": {"repobilityId": "792541b8b921cbb7", "scanner": "scanner-primary", "fingerprint": "7aa253e2f44de2ec", "layer": "security", "severity": "low", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/requirements.txt"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-65d2833ba0e8e1ec", "level": "note", "message": {"text": "SkillSpector SC1 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requirements.txt"}, "properties": {"repobilityId": "29a9270705b5ad5f", "scanner": "scanner-primary", "fingerprint": "65d2833ba0e8e1ec", "layer": "security", "severity": "low", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requirements.txt"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-65d2833ba0e8e1ec", "level": "note", "message": {"text": "SkillSpector SC1 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requirements.txt"}, "properties": {"repobilityId": "29a9270705b5ad5f", "scanner": "scanner-primary", "fingerprint": "65d2833ba0e8e1ec", "layer": "security", "severity": "low", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requirements.txt"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-65d2833ba0e8e1ec", "level": "note", "message": {"text": "SkillSpector SC1 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requirements.txt"}, "properties": {"repobilityId": "29a9270705b5ad5f", "scanner": "scanner-primary", "fingerprint": "65d2833ba0e8e1ec", "layer": "security", "severity": "low", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requirements.txt"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-65d2833ba0e8e1ec", "level": "note", "message": {"text": "SkillSpector SC1 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requirements.txt"}, "properties": {"repobilityId": "29a9270705b5ad5f", "scanner": "scanner-primary", "fingerprint": "65d2833ba0e8e1ec", "layer": "security", "severity": "low", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requirements.txt"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-65d2833ba0e8e1ec", "level": "note", "message": {"text": "SkillSpector SC1 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requirements.txt"}, "properties": {"repobilityId": "29a9270705b5ad5f", "scanner": "scanner-primary", "fingerprint": "65d2833ba0e8e1ec", "layer": "security", "severity": "low", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requirements.txt"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-65d2833ba0e8e1ec", "level": "note", "message": {"text": "SkillSpector SC1 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requirements.txt"}, "properties": {"repobilityId": "29a9270705b5ad5f", "scanner": "scanner-primary", "fingerprint": "65d2833ba0e8e1ec", "layer": "security", "severity": "low", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requirements.txt"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-b3fb7d833ee37ac6", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in skills/applications/tao-finetune-huggingface-model/skill.oms.sig"}, "properties": {"repobilityId": "5886d5bb62f15be7", "scanner": "scanner-primary", "fingerprint": "b3fb7d833ee37ac6", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/skill.oms.sig"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b3fb7d833ee37ac6", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in skills/applications/tao-finetune-huggingface-model/skill.oms.sig"}, "properties": {"repobilityId": "5886d5bb62f15be7", "scanner": "scanner-primary", "fingerprint": "b3fb7d833ee37ac6", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/skill.oms.sig"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b3fb7d833ee37ac6", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in skills/applications/tao-finetune-huggingface-model/skill.oms.sig"}, "properties": {"repobilityId": "5886d5bb62f15be7", "scanner": "scanner-primary", "fingerprint": "b3fb7d833ee37ac6", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/skill.oms.sig"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b3fb7d833ee37ac6", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in skills/applications/tao-finetune-huggingface-model/skill.oms.sig"}, "properties": {"repobilityId": "5886d5bb62f15be7", "scanner": "scanner-primary", "fingerprint": "b3fb7d833ee37ac6", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/skill.oms.sig"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-86f7f4366b2215a6", "level": "note", "message": {"text": "SkillSpector SC4 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "properties": {"repobilityId": "e7fbfe9cfa7db102", "scanner": "scanner-primary", "fingerprint": "86f7f4366b2215a6", "layer": "security", "severity": "low", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC4"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-86f7f4366b2215a6", "level": "error", "message": {"text": "SkillSpector SC4 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "properties": {"repobilityId": "e7fbfe9cfa7db102", "scanner": "scanner-primary", "fingerprint": "86f7f4366b2215a6", "layer": "security", "severity": "critical", "confidence": 0.9, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC4"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-86f7f4366b2215a6", "level": "error", "message": {"text": "SkillSpector SC4 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "properties": {"repobilityId": "e7fbfe9cfa7db102", "scanner": "scanner-primary", "fingerprint": "86f7f4366b2215a6", "layer": "security", "severity": "critical", "confidence": 0.9, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC4"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/requirements.txt"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-db8b3e37557dd3fe", "level": "note", "message": {"text": "SkillSpector SC4 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requirements.txt"}, "properties": {"repobilityId": "de5d761a2fcae84c", "scanner": "scanner-primary", "fingerprint": "db8b3e37557dd3fe", "layer": "security", "severity": "low", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC4"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requirements.txt"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-db8b3e37557dd3fe", "level": "error", "message": {"text": "SkillSpector SC4 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requirements.txt"}, "properties": {"repobilityId": "de5d761a2fcae84c", "scanner": "scanner-primary", "fingerprint": "db8b3e37557dd3fe", "layer": "security", "severity": "critical", "confidence": 0.9, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC4"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requirements.txt"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-db8b3e37557dd3fe", "level": "error", "message": {"text": "SkillSpector SC4 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requirements.txt"}, "properties": {"repobilityId": "de5d761a2fcae84c", "scanner": "scanner-primary", "fingerprint": "db8b3e37557dd3fe", "layer": "security", "severity": "critical", "confidence": 0.9, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC4"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/requirements.txt"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-c3892b922921ead7", "level": "note", "message": {"text": "SkillSpector SC4 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/requirements.txt"}, "properties": {"repobilityId": "38a2f5460fa8a7d4", "scanner": "scanner-primary", "fingerprint": "c3892b922921ead7", "layer": "security", "severity": "low", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC4"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/requirements.txt"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-c3892b922921ead7", "level": "error", "message": {"text": "SkillSpector SC4 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/requirements.txt"}, "properties": {"repobilityId": "38a2f5460fa8a7d4", "scanner": "scanner-primary", "fingerprint": "c3892b922921ead7", "layer": "security", "severity": "critical", "confidence": 0.9, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC4"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/requirements.txt"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-c3892b922921ead7", "level": "error", "message": {"text": "SkillSpector SC4 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/requirements.txt"}, "properties": {"repobilityId": "38a2f5460fa8a7d4", "scanner": "scanner-primary", "fingerprint": "c3892b922921ead7", "layer": "security", "severity": "critical", "confidence": 0.9, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC4"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/requirements.txt"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-ae4c33f44ad20a4a", "level": "note", "message": {"text": "SkillSpector SC4 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requirements.txt"}, "properties": {"repobilityId": "56b08d3ba46d4510", "scanner": "scanner-primary", "fingerprint": "ae4c33f44ad20a4a", "layer": "security", "severity": "low", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC4"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requirements.txt"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-ae4c33f44ad20a4a", "level": "error", "message": {"text": "SkillSpector SC4 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requirements.txt"}, "properties": {"repobilityId": "56b08d3ba46d4510", "scanner": "scanner-primary", "fingerprint": "ae4c33f44ad20a4a", "layer": "security", "severity": "critical", "confidence": 0.9, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC4"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requirements.txt"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-ae4c33f44ad20a4a", "level": "error", "message": {"text": "SkillSpector SC4 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requirements.txt"}, "properties": {"repobilityId": "56b08d3ba46d4510", "scanner": "scanner-primary", "fingerprint": "ae4c33f44ad20a4a", "layer": "security", "severity": "high", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC4"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requirements.txt"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-ae4c33f44ad20a4a", "level": "error", "message": {"text": "SkillSpector SC4 (supply-chain) in skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requirements.txt"}, "properties": {"repobilityId": "56b08d3ba46d4510", "scanner": "scanner-primary", "fingerprint": "ae4c33f44ad20a4a", "layer": "security", "severity": "critical", "confidence": 0.9, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC4"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/requirements.txt"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-58282b029847bd6a", "level": "error", "message": {"text": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/SKILL.md"}, "properties": {"repobilityId": "6bc912954b393bb3", "scanner": "scanner-primary", "fingerprint": "58282b029847bd6a", "layer": "security", "severity": "high", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/SKILL.md"}, "region": {"startLine": 186}}}]}, {"ruleId": "scanner-4e80f0a2c7683d59", "level": "error", "message": {"text": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/deliverables.md"}, "properties": {"repobilityId": "25f8782fa79730b5", "scanner": "scanner-primary", "fingerprint": "4e80f0a2c7683d59", "layer": "security", "severity": "high", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/deliverables.md"}, "region": {"startLine": 247}}}]}, {"ruleId": "scanner-4e80f0a2c7683d59", "level": "note", "message": {"text": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/deliverables.md"}, "properties": {"repobilityId": "25f8782fa79730b5", "scanner": "scanner-primary", "fingerprint": "4e80f0a2c7683d59", "layer": "security", "severity": "low", "confidence": 0.15, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/deliverables.md"}, "region": {"startLine": 322}}}]}, {"ruleId": "scanner-4e80f0a2c7683d59", "level": "error", "message": {"text": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/deliverables.md"}, "properties": {"repobilityId": "25f8782fa79730b5", "scanner": "scanner-primary", "fingerprint": "4e80f0a2c7683d59", "layer": "security", "severity": "high", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/deliverables.md"}, "region": {"startLine": 362}}}]}, {"ruleId": "scanner-21cbbb5ab8784982", "level": "note", "message": {"text": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/docker-runs.md"}, "properties": {"repobilityId": "36f69a2300e19ffe", "scanner": "scanner-primary", "fingerprint": "21cbbb5ab8784982", "layer": "security", "severity": "low", "confidence": 0.15, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/docker-runs.md"}, "region": {"startLine": 122}}}]}, {"ruleId": "scanner-21cbbb5ab8784982", "level": "note", "message": {"text": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/docker-runs.md"}, "properties": {"repobilityId": "36f69a2300e19ffe", "scanner": "scanner-primary", "fingerprint": "21cbbb5ab8784982", "layer": "security", "severity": "low", "confidence": 0.15, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/docker-runs.md"}, "region": {"startLine": 140}}}]}, {"ruleId": "scanner-21cbbb5ab8784982", "level": "note", "message": {"text": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/docker-runs.md"}, "properties": {"repobilityId": "36f69a2300e19ffe", "scanner": "scanner-primary", "fingerprint": "21cbbb5ab8784982", "layer": "security", "severity": "low", "confidence": 0.15, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/docker-runs.md"}, "region": {"startLine": 160}}}]}, {"ruleId": "scanner-21cbbb5ab8784982", "level": "note", "message": {"text": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/docker-runs.md"}, "properties": {"repobilityId": "36f69a2300e19ffe", "scanner": "scanner-primary", "fingerprint": "21cbbb5ab8784982", "layer": "security", "severity": "low", "confidence": 0.15, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/docker-runs.md"}, "region": {"startLine": 194}}}]}, {"ruleId": "scanner-21cbbb5ab8784982", "level": "note", "message": {"text": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/docker-runs.md"}, "properties": {"repobilityId": "36f69a2300e19ffe", "scanner": "scanner-primary", "fingerprint": "21cbbb5ab8784982", "layer": "security", "severity": "low", "confidence": 0.15, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/docker-runs.md"}, "region": {"startLine": 210}}}]}, {"ruleId": "scanner-21cbbb5ab8784982", "level": "note", "message": {"text": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/docker-runs.md"}, "properties": {"repobilityId": "36f69a2300e19ffe", "scanner": "scanner-primary", "fingerprint": "21cbbb5ab8784982", "layer": "security", "severity": "low", "confidence": 0.15, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/docker-runs.md"}, "region": {"startLine": 225}}}]}, {"ruleId": "scanner-971c8984f5e68723", "level": "warning", "message": {"text": "SkillSpector TM3 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/docker-runs.md"}, "properties": {"repobilityId": "5606d9e8611ebebf", "scanner": "scanner-primary", "fingerprint": "971c8984f5e68723", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/docker-runs.md"}, "region": {"startLine": 107}}}]}, {"ruleId": "scanner-2b2d02346c9e941f", "level": "error", "message": {"text": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/error-playbook.md"}, "properties": {"repobilityId": "5b5615b3ecab4acb", "scanner": "scanner-primary", "fingerprint": "2b2d02346c9e941f", "layer": "security", "severity": "high", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/error-playbook.md"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-ac2d03c825203c7b", "level": "note", "message": {"text": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/pipeline-skill-template.md"}, "properties": {"repobilityId": "5f5a3b7befd1db92", "scanner": "scanner-primary", "fingerprint": "ac2d03c825203c7b", "layer": "security", "severity": "low", "confidence": 0.15, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/pipeline-skill-template.md"}, "region": {"startLine": 142}}}]}, {"ruleId": "scanner-ac2d03c825203c7b", "level": "note", "message": {"text": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/pipeline-skill-template.md"}, "properties": {"repobilityId": "5f5a3b7befd1db92", "scanner": "scanner-primary", "fingerprint": "ac2d03c825203c7b", "layer": "security", "severity": "low", "confidence": 0.15, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/pipeline-skill-template.md"}, "region": {"startLine": 151}}}]}, {"ruleId": "scanner-ac2d03c825203c7b", "level": "note", "message": {"text": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/pipeline-skill-template.md"}, "properties": {"repobilityId": "5f5a3b7befd1db92", "scanner": "scanner-primary", "fingerprint": "ac2d03c825203c7b", "layer": "security", "severity": "low", "confidence": 0.15, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/pipeline-skill-template.md"}, "region": {"startLine": 160}}}]}, {"ruleId": "scanner-ac2d03c825203c7b", "level": "note", "message": {"text": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/pipeline-skill-template.md"}, "properties": {"repobilityId": "5f5a3b7befd1db92", "scanner": "scanner-primary", "fingerprint": "ac2d03c825203c7b", "layer": "security", "severity": "low", "confidence": 0.15, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/pipeline-skill-template.md"}, "region": {"startLine": 181}}}]}, {"ruleId": "scanner-ac2d03c825203c7b", "level": "note", "message": {"text": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/pipeline-skill-template.md"}, "properties": {"repobilityId": "5f5a3b7befd1db92", "scanner": "scanner-primary", "fingerprint": "ac2d03c825203c7b", "layer": "security", "severity": "low", "confidence": 0.15, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/pipeline-skill-template.md"}, "region": {"startLine": 197}}}]}, {"ruleId": "scanner-0761bf467234cabc", "level": "note", "message": {"text": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/tao-rerun-convnext-cifar10.md"}, "properties": {"repobilityId": "e5a8c5b52b35af52", "scanner": "scanner-primary", "fingerprint": "0761bf467234cabc", "layer": "security", "severity": "low", "confidence": 0.15, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/tao-rerun-convnext-cifar10.md"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-0761bf467234cabc", "level": "note", "message": {"text": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/tao-rerun-convnext-cifar10.md"}, "properties": {"repobilityId": "e5a8c5b52b35af52", "scanner": "scanner-primary", "fingerprint": "0761bf467234cabc", "layer": "security", "severity": "low", "confidence": 0.15, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/tao-rerun-convnext-cifar10.md"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-0761bf467234cabc", "level": "note", "message": {"text": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/tao-rerun-convnext-cifar10.md"}, "properties": {"repobilityId": "e5a8c5b52b35af52", "scanner": "scanner-primary", "fingerprint": "0761bf467234cabc", "layer": "security", "severity": "low", "confidence": 0.15, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/tao-rerun-convnext-cifar10.md"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-0761bf467234cabc", "level": "note", "message": {"text": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/tao-rerun-convnext-cifar10.md"}, "properties": {"repobilityId": "e5a8c5b52b35af52", "scanner": "scanner-primary", "fingerprint": "0761bf467234cabc", "layer": "security", "severity": "low", "confidence": 0.15, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/tao-rerun-convnext-cifar10.md"}, "region": {"startLine": 58}}}]}, {"ruleId": "scanner-4ddbcee3885c9f59", "level": "note", "message": {"text": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/tao-rerun-detr-cppe5.md"}, "properties": {"repobilityId": "4e8567624aa3ec0b", "scanner": "scanner-primary", "fingerprint": "4ddbcee3885c9f59", "layer": "security", "severity": "low", "confidence": 0.15, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/tao-rerun-detr-cppe5.md"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-4ddbcee3885c9f59", "level": "note", "message": {"text": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/tao-rerun-detr-cppe5.md"}, "properties": {"repobilityId": "4e8567624aa3ec0b", "scanner": "scanner-primary", "fingerprint": "4ddbcee3885c9f59", "layer": "security", "severity": "low", "confidence": 0.15, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/tao-rerun-detr-cppe5.md"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-4ddbcee3885c9f59", "level": "note", "message": {"text": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/tao-rerun-detr-cppe5.md"}, "properties": {"repobilityId": "4e8567624aa3ec0b", "scanner": "scanner-primary", "fingerprint": "4ddbcee3885c9f59", "layer": "security", "severity": "low", "confidence": 0.15, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/tao-rerun-detr-cppe5.md"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-4ddbcee3885c9f59", "level": "note", "message": {"text": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/tao-rerun-detr-cppe5.md"}, "properties": {"repobilityId": "4e8567624aa3ec0b", "scanner": "scanner-primary", "fingerprint": "4ddbcee3885c9f59", "layer": "security", "severity": "low", "confidence": 0.15, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/tao-rerun-detr-cppe5.md"}, "region": {"startLine": 47}}}]}, {"ruleId": "scanner-442ac9cbe912f904", "level": "note", "message": {"text": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/tao-rerun-segformer-foodseg103.md"}, "properties": {"repobilityId": "7c8cde0db2ef64c1", "scanner": "scanner-primary", "fingerprint": "442ac9cbe912f904", "layer": "security", "severity": "low", "confidence": 0.15, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/tao-rerun-segformer-foodseg103.md"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-442ac9cbe912f904", "level": "note", "message": {"text": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/tao-rerun-segformer-foodseg103.md"}, "properties": {"repobilityId": "7c8cde0db2ef64c1", "scanner": "scanner-primary", "fingerprint": "442ac9cbe912f904", "layer": "security", "severity": "low", "confidence": 0.15, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/tao-rerun-segformer-foodseg103.md"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-442ac9cbe912f904", "level": "note", "message": {"text": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/tao-rerun-segformer-foodseg103.md"}, "properties": {"repobilityId": "7c8cde0db2ef64c1", "scanner": "scanner-primary", "fingerprint": "442ac9cbe912f904", "layer": "security", "severity": "low", "confidence": 0.15, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/tao-rerun-segformer-foodseg103.md"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-442ac9cbe912f904", "level": "note", "message": {"text": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/tao-rerun-segformer-foodseg103.md"}, "properties": {"repobilityId": "7c8cde0db2ef64c1", "scanner": "scanner-primary", "fingerprint": "442ac9cbe912f904", "layer": "security", "severity": "low", "confidence": 0.15, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/tao-rerun-segformer-foodseg103.md"}, "region": {"startLine": 41}}}]}, {"ruleId": "scanner-481333897a00480c", "level": "note", "message": {"text": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/tao-rerun-smolvlm-vqav2.md"}, "properties": {"repobilityId": "9c8576fcb7d8266f", "scanner": "scanner-primary", "fingerprint": "481333897a00480c", "layer": "security", "severity": "low", "confidence": 0.15, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/tao-rerun-smolvlm-vqav2.md"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-481333897a00480c", "level": "note", "message": {"text": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/tao-rerun-smolvlm-vqav2.md"}, "properties": {"repobilityId": "9c8576fcb7d8266f", "scanner": "scanner-primary", "fingerprint": "481333897a00480c", "layer": "security", "severity": "low", "confidence": 0.15, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/tao-rerun-smolvlm-vqav2.md"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-481333897a00480c", "level": "note", "message": {"text": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/tao-rerun-smolvlm-vqav2.md"}, "properties": {"repobilityId": "9c8576fcb7d8266f", "scanner": "scanner-primary", "fingerprint": "481333897a00480c", "layer": "security", "severity": "low", "confidence": 0.15, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/tao-rerun-smolvlm-vqav2.md"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-481333897a00480c", "level": "note", "message": {"text": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/tao-rerun-smolvlm-vqav2.md"}, "properties": {"repobilityId": "9c8576fcb7d8266f", "scanner": "scanner-primary", "fingerprint": "481333897a00480c", "layer": "security", "severity": "low", "confidence": 0.15, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/tao-rerun-smolvlm-vqav2.md"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-b1368e6a80496759", "level": "error", "message": {"text": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-finetune-huggingface-model/references/workflow-intake-preflight.md"}, "properties": {"repobilityId": "7d3b5d5e0afadfc2", "scanner": "scanner-primary", "fingerprint": "b1368e6a80496759", "layer": "security", "severity": "high", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/references/workflow-intake-preflight.md"}, "region": {"startLine": 398}}}]}, {"ruleId": "scanner-823274bdd8ce18e0", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-port-huggingface-model/references/phase-1-inspection.md"}, "properties": {"repobilityId": "bd567d5233ba4d75", "scanner": "scanner-primary", "fingerprint": "823274bdd8ce18e0", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-port-huggingface-model/references/phase-1-inspection.md"}, "region": {"startLine": 136}}}]}, {"ruleId": "scanner-823274bdd8ce18e0", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-port-huggingface-model/references/phase-1-inspection.md"}, "properties": {"repobilityId": "bd567d5233ba4d75", "scanner": "scanner-primary", "fingerprint": "823274bdd8ce18e0", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-port-huggingface-model/references/phase-1-inspection.md"}, "region": {"startLine": 149}}}]}, {"ruleId": "scanner-823274bdd8ce18e0", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-port-huggingface-model/references/phase-1-inspection.md"}, "properties": {"repobilityId": "bd567d5233ba4d75", "scanner": "scanner-primary", "fingerprint": "823274bdd8ce18e0", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-port-huggingface-model/references/phase-1-inspection.md"}, "region": {"startLine": 169}}}]}, {"ruleId": "scanner-f4ccebabadc54b54", "level": "error", "message": {"text": "SkillSpector OH1 (output-handling) in skills/applications/tao-port-huggingface-model/references/phase-5-packaging.md"}, "properties": {"repobilityId": "e8a0e0d451592534", "scanner": "scanner-primary", "fingerprint": "f4ccebabadc54b54", "layer": "security", "severity": "high", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "output-handling", "OH1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-port-huggingface-model/references/phase-5-packaging.md"}, "region": {"startLine": 53}}}]}, {"ruleId": "scanner-35c50309f5bc3d63", "level": "error", "message": {"text": "SkillSpector OH1 (output-handling) in skills/applications/tao-port-huggingface-model/references/tao-patterns.md"}, "properties": {"repobilityId": "d25722784447304a", "scanner": "scanner-primary", "fingerprint": "35c50309f5bc3d63", "layer": "security", "severity": "high", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "output-handling", "OH1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-port-huggingface-model/references/tao-patterns.md"}, "region": {"startLine": 502}}}]}, {"ruleId": "scanner-6c9ca7e2cc081646", "level": "warning", "message": {"text": "SkillSpector PE2 (priv-esc) in skills/applications/tao-port-huggingface-model/references/cross-cutting.md"}, "properties": {"repobilityId": "9b36b4f4421d0d90", "scanner": "scanner-primary", "fingerprint": "6c9ca7e2cc081646", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "priv-esc", "PE2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-port-huggingface-model/references/cross-cutting.md"}, "region": {"startLine": 150}}}]}, {"ruleId": "scanner-6621808ae0cc9fc6", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in skills/applications/tao-port-huggingface-model/skill.oms.sig"}, "properties": {"repobilityId": "adf1cff4208c3fb7", "scanner": "scanner-primary", "fingerprint": "6621808ae0cc9fc6", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-port-huggingface-model/skill.oms.sig"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6621808ae0cc9fc6", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in skills/applications/tao-port-huggingface-model/skill.oms.sig"}, "properties": {"repobilityId": "adf1cff4208c3fb7", "scanner": "scanner-primary", "fingerprint": "6621808ae0cc9fc6", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-port-huggingface-model/skill.oms.sig"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6621808ae0cc9fc6", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in skills/applications/tao-port-huggingface-model/skill.oms.sig"}, "properties": {"repobilityId": "adf1cff4208c3fb7", "scanner": "scanner-primary", "fingerprint": "6621808ae0cc9fc6", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-port-huggingface-model/skill.oms.sig"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6621808ae0cc9fc6", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in skills/applications/tao-port-huggingface-model/skill.oms.sig"}, "properties": {"repobilityId": "adf1cff4208c3fb7", "scanner": "scanner-primary", "fingerprint": "6621808ae0cc9fc6", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-port-huggingface-model/skill.oms.sig"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ef124698926ab1a4", "level": "error", "message": {"text": "SkillSpector TM2 (tool-misuse) in skills/applications/tao-port-huggingface-model/references/docker-patterns.md"}, "properties": {"repobilityId": "add3f2b367e5aba1", "scanner": "scanner-primary", "fingerprint": "ef124698926ab1a4", "layer": "security", "severity": "high", "confidence": 0.75, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-port-huggingface-model/references/docker-patterns.md"}, "region": {"startLine": 223}}}]}, {"ruleId": "scanner-946b8360648eba92", "level": "error", "message": {"text": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-port-huggingface-model/references/phase-1-inspection.md"}, "properties": {"repobilityId": "33fc854c52b5a14e", "scanner": "scanner-primary", "fingerprint": "946b8360648eba92", "layer": "security", "severity": "high", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-port-huggingface-model/references/phase-1-inspection.md"}, "region": {"startLine": 91}}}]}, {"ruleId": "scanner-946b8360648eba92", "level": "error", "message": {"text": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-port-huggingface-model/references/phase-1-inspection.md"}, "properties": {"repobilityId": "33fc854c52b5a14e", "scanner": "scanner-primary", "fingerprint": "946b8360648eba92", "layer": "security", "severity": "high", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-port-huggingface-model/references/phase-1-inspection.md"}, "region": {"startLine": 208}}}]}, {"ruleId": "scanner-03d9c3e3d691ab57", "level": "error", "message": {"text": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-port-huggingface-model/references/phase-5-packaging.md"}, "properties": {"repobilityId": "b457b6934e1e070b", "scanner": "scanner-primary", "fingerprint": "03d9c3e3d691ab57", "layer": "security", "severity": "high", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-port-huggingface-model/references/phase-5-packaging.md"}, "region": {"startLine": 53}}}]}, {"ruleId": "scanner-7ac4b8ea4ea64cf0", "level": "error", "message": {"text": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-port-huggingface-model/references/tao-patterns.md"}, "properties": {"repobilityId": "8fa223b98b220169", "scanner": "scanner-primary", "fingerprint": "7ac4b8ea4ea64cf0", "layer": "security", "severity": "high", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-port-huggingface-model/references/tao-patterns.md"}, "region": {"startLine": 502}}}]}, {"ruleId": "scanner-d81ed666c8ebb249", "level": "error", "message": {"text": "SkillSpector YR4 (yara) in skills/applications/tao-port-huggingface-model/references/workflow-consistency.md"}, "properties": {"repobilityId": "f02a5e135f4d4e7d", "scanner": "scanner-primary", "fingerprint": "d81ed666c8ebb249", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "yara", "YR4"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-port-huggingface-model/references/workflow-consistency.md"}, "region": {"startLine": 95}}}]}, {"ruleId": "scanner-5d9a6b4e3fb12a08", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-run-automl/references/automl-examples.md"}, "properties": {"repobilityId": "177aee06fcb304da", "scanner": "scanner-primary", "fingerprint": "5d9a6b4e3fb12a08", "layer": "security", "severity": "high", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-automl/references/automl-examples.md"}, "region": {"startLine": 63}}}]}, {"ruleId": "scanner-5d9a6b4e3fb12a08", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-run-automl/references/automl-examples.md"}, "properties": {"repobilityId": "177aee06fcb304da", "scanner": "scanner-primary", "fingerprint": "5d9a6b4e3fb12a08", "layer": "security", "severity": "high", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-automl/references/automl-examples.md"}, "region": {"startLine": 92}}}]}, {"ruleId": "scanner-75ab996fb8c0afac", "level": "warning", "message": {"text": "SkillSpector EA2 (excessive-agency) in skills/applications/tao-run-automl/references/automl-intent-algorithms.md"}, "properties": {"repobilityId": "fd43ac4ee3762823", "scanner": "scanner-primary", "fingerprint": "75ab996fb8c0afac", "layer": "security", "severity": "medium", "confidence": 0.75, "tags": ["skillspector", "mcp-skill", "excessive-agency", "EA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-automl/references/automl-intent-algorithms.md"}, "region": {"startLine": 51}}}]}, {"ruleId": "scanner-9d9ed1f5eb243e2e", "level": "note", "message": {"text": "SkillSpector EA3 (excessive-agency) in skills/applications/tao-run-automl/references/automl-intent-algorithms.md"}, "properties": {"repobilityId": "7a05b0ba081e9e94", "scanner": "scanner-primary", "fingerprint": "9d9ed1f5eb243e2e", "layer": "security", "severity": "low", "confidence": 0.65, "tags": ["skillspector", "mcp-skill", "excessive-agency", "EA3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-automl/references/automl-intent-algorithms.md"}, "region": {"startLine": 99}}}]}, {"ruleId": "scanner-1095596cd4361635", "level": "warning", "message": {"text": "SkillSpector RA2 (rogue-agent) in skills/applications/tao-run-automl/references/automl-preflight-concepts.md"}, "properties": {"repobilityId": "2626bccdb5c1ef9f", "scanner": "scanner-primary", "fingerprint": "1095596cd4361635", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "rogue-agent", "RA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-automl/references/automl-preflight-concepts.md"}, "region": {"startLine": 63}}}]}, {"ruleId": "scanner-5d93de17ccea5910", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in skills/applications/tao-run-automl/skill.oms.sig"}, "properties": {"repobilityId": "ac400793c0d12571", "scanner": "scanner-primary", "fingerprint": "5d93de17ccea5910", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-automl/skill.oms.sig"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5d93de17ccea5910", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in skills/applications/tao-run-automl/skill.oms.sig"}, "properties": {"repobilityId": "ac400793c0d12571", "scanner": "scanner-primary", "fingerprint": "5d93de17ccea5910", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-automl/skill.oms.sig"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5d93de17ccea5910", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in skills/applications/tao-run-automl/skill.oms.sig"}, "properties": {"repobilityId": "ac400793c0d12571", "scanner": "scanner-primary", "fingerprint": "5d93de17ccea5910", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-automl/skill.oms.sig"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5d93de17ccea5910", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in skills/applications/tao-run-automl/skill.oms.sig"}, "properties": {"repobilityId": "ac400793c0d12571", "scanner": "scanner-primary", "fingerprint": "5d93de17ccea5910", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-automl/skill.oms.sig"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-82bfc76969de878d", "level": "warning", "message": {"text": "SkillSpector EA2 (excessive-agency) in skills/applications/tao-run-automl-deft-pipeline/references/consolidated-preflight.md"}, "properties": {"repobilityId": "38edccae8eb85a59", "scanner": "scanner-primary", "fingerprint": "82bfc76969de878d", "layer": "security", "severity": "medium", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "excessive-agency", "EA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-automl-deft-pipeline/references/consolidated-preflight.md"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-1a405015492bbd1d", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in skills/applications/tao-run-automl-deft-pipeline/skill.oms.sig"}, "properties": {"repobilityId": "1484741b1b738cd5", "scanner": "scanner-primary", "fingerprint": "1a405015492bbd1d", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-automl-deft-pipeline/skill.oms.sig"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1a405015492bbd1d", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in skills/applications/tao-run-automl-deft-pipeline/skill.oms.sig"}, "properties": {"repobilityId": "1484741b1b738cd5", "scanner": "scanner-primary", "fingerprint": "1a405015492bbd1d", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-automl-deft-pipeline/skill.oms.sig"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1a405015492bbd1d", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in skills/applications/tao-run-automl-deft-pipeline/skill.oms.sig"}, "properties": {"repobilityId": "1484741b1b738cd5", "scanner": "scanner-primary", "fingerprint": "1a405015492bbd1d", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-automl-deft-pipeline/skill.oms.sig"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1a405015492bbd1d", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in skills/applications/tao-run-automl-deft-pipeline/skill.oms.sig"}, "properties": {"repobilityId": "1484741b1b738cd5", "scanner": "scanner-primary", "fingerprint": "1a405015492bbd1d", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-automl-deft-pipeline/skill.oms.sig"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a343c6aff08f79fb", "level": "warning", "message": {"text": "SkillSpector TT2 (taint) in skills/applications/tao-run-deft-aoi/scripts/stage_backbone.py"}, "properties": {"repobilityId": "590b63b9d77a13be", "scanner": "scanner-primary", "fingerprint": "a343c6aff08f79fb", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "taint", "TT2", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-deft-aoi/scripts/stage_backbone.py"}, "region": {"startLine": 111}}}]}, {"ruleId": "scanner-2d8aea4d0f3a173b", "level": "warning", "message": {"text": "SkillSpector LP3 (mcp-least-priv) in skills/applications/tao-run-deft-aoi/SKILL.md"}, "properties": {"repobilityId": "e6852104926ea6ec", "scanner": "scanner-primary", "fingerprint": "2d8aea4d0f3a173b", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "mcp-least-priv", "LP3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-deft-aoi/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ca1448ba79e5789d", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in skills/applications/tao-run-deft-aoi/scripts/stage_backbone.py"}, "properties": {"repobilityId": "c01ad8a41015c45c", "scanner": "scanner-primary", "fingerprint": "ca1448ba79e5789d", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-deft-aoi/scripts/stage_backbone.py"}, "region": {"startLine": 100}}}]}, {"ruleId": "scanner-33c48f96c2e34068", "level": "warning", "message": {"text": "SkillSpector EA2 (excessive-agency) in skills/applications/tao-run-deft-aoi/SKILL.md"}, "properties": {"repobilityId": "a208a42dca657250", "scanner": "scanner-primary", "fingerprint": "33c48f96c2e34068", "layer": "security", "severity": "medium", "confidence": 0.75, "tags": ["skillspector", "mcp-skill", "excessive-agency", "EA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-deft-aoi/SKILL.md"}, "region": {"startLine": 98}}}]}, {"ruleId": "scanner-8762074fab3b3614", "level": "error", "message": {"text": "SkillSpector PE3 (priv-esc) in skills/applications/tao-run-deft-aoi/references/paidf-anomalygen.md"}, "properties": {"repobilityId": "926a488febe890ff", "scanner": "scanner-primary", "fingerprint": "8762074fab3b3614", "layer": "security", "severity": "high", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "priv-esc", "PE3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-deft-aoi/references/paidf-anomalygen.md"}, "region": {"startLine": 179}}}]}, {"ruleId": "scanner-8762074fab3b3614", "level": "error", "message": {"text": "SkillSpector PE3 (priv-esc) in skills/applications/tao-run-deft-aoi/references/paidf-anomalygen.md"}, "properties": {"repobilityId": "926a488febe890ff", "scanner": "scanner-primary", "fingerprint": "8762074fab3b3614", "layer": "security", "severity": "high", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "priv-esc", "PE3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-deft-aoi/references/paidf-anomalygen.md"}, "region": {"startLine": 179}}}]}, {"ruleId": "scanner-8762074fab3b3614", "level": "error", "message": {"text": "SkillSpector PE3 (priv-esc) in skills/applications/tao-run-deft-aoi/references/paidf-anomalygen.md"}, "properties": {"repobilityId": "926a488febe890ff", "scanner": "scanner-primary", "fingerprint": "8762074fab3b3614", "layer": "security", "severity": "high", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "priv-esc", "PE3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-deft-aoi/references/paidf-anomalygen.md"}, "region": {"startLine": 191}}}]}, {"ruleId": "scanner-8762074fab3b3614", "level": "error", "message": {"text": "SkillSpector PE3 (priv-esc) in skills/applications/tao-run-deft-aoi/references/paidf-anomalygen.md"}, "properties": {"repobilityId": "926a488febe890ff", "scanner": "scanner-primary", "fingerprint": "8762074fab3b3614", "layer": "security", "severity": "high", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "priv-esc", "PE3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-deft-aoi/references/paidf-anomalygen.md"}, "region": {"startLine": 191}}}]}, {"ruleId": "scanner-8762074fab3b3614", "level": "error", "message": {"text": "SkillSpector PE3 (priv-esc) in skills/applications/tao-run-deft-aoi/references/paidf-anomalygen.md"}, "properties": {"repobilityId": "926a488febe890ff", "scanner": "scanner-primary", "fingerprint": "8762074fab3b3614", "layer": "security", "severity": "high", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "priv-esc", "PE3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-deft-aoi/references/paidf-anomalygen.md"}, "region": {"startLine": 206}}}]}, {"ruleId": "scanner-8762074fab3b3614", "level": "error", "message": {"text": "SkillSpector PE3 (priv-esc) in skills/applications/tao-run-deft-aoi/references/paidf-anomalygen.md"}, "properties": {"repobilityId": "926a488febe890ff", "scanner": "scanner-primary", "fingerprint": "8762074fab3b3614", "layer": "security", "severity": "high", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "priv-esc", "PE3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-deft-aoi/references/paidf-anomalygen.md"}, "region": {"startLine": 206}}}]}, {"ruleId": "scanner-8762074fab3b3614", "level": "error", "message": {"text": "SkillSpector PE3 (priv-esc) in skills/applications/tao-run-deft-aoi/references/paidf-anomalygen.md"}, "properties": {"repobilityId": "926a488febe890ff", "scanner": "scanner-primary", "fingerprint": "8762074fab3b3614", "layer": "security", "severity": "high", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "priv-esc", "PE3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-deft-aoi/references/paidf-anomalygen.md"}, "region": {"startLine": 227}}}]}, {"ruleId": "scanner-8762074fab3b3614", "level": "error", "message": {"text": "SkillSpector PE3 (priv-esc) in skills/applications/tao-run-deft-aoi/references/paidf-anomalygen.md"}, "properties": {"repobilityId": "926a488febe890ff", "scanner": "scanner-primary", "fingerprint": "8762074fab3b3614", "layer": "security", "severity": "high", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "priv-esc", "PE3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-deft-aoi/references/paidf-anomalygen.md"}, "region": {"startLine": 227}}}]}, {"ruleId": "scanner-8762074fab3b3614", "level": "error", "message": {"text": "SkillSpector PE3 (priv-esc) in skills/applications/tao-run-deft-aoi/references/paidf-anomalygen.md"}, "properties": {"repobilityId": "926a488febe890ff", "scanner": "scanner-primary", "fingerprint": "8762074fab3b3614", "layer": "security", "severity": "high", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "priv-esc", "PE3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-deft-aoi/references/paidf-anomalygen.md"}, "region": {"startLine": 239}}}]}, {"ruleId": "scanner-8762074fab3b3614", "level": "error", "message": {"text": "SkillSpector PE3 (priv-esc) in skills/applications/tao-run-deft-aoi/references/paidf-anomalygen.md"}, "properties": {"repobilityId": "926a488febe890ff", "scanner": "scanner-primary", "fingerprint": "8762074fab3b3614", "layer": "security", "severity": "high", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "priv-esc", "PE3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-deft-aoi/references/paidf-anomalygen.md"}, "region": {"startLine": 239}}}]}, {"ruleId": "scanner-72b72ee7a030a6b5", "level": "error", "message": {"text": "SkillSpector P2 (prompt-injection) in skills/applications/tao-run-deft-aoi/agents/reporter.md"}, "properties": {"repobilityId": "4091e4665caad72a", "scanner": "scanner-primary", "fingerprint": "72b72ee7a030a6b5", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "prompt-injection", "P2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-deft-aoi/agents/reporter.md"}, "region": {"startLine": 38}}}]}, {"ruleId": "scanner-96c120a600206a49", "level": "error", "message": {"text": "SkillSpector P2 (prompt-injection) in skills/applications/tao-run-deft-aoi/references/DEFT_Loop_Report.html"}, "properties": {"repobilityId": "a0a7a05704aa20f3", "scanner": "scanner-primary", "fingerprint": "96c120a600206a49", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "prompt-injection", "P2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-deft-aoi/references/DEFT_Loop_Report.html"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-96c120a600206a49", "level": "error", "message": {"text": "SkillSpector P2 (prompt-injection) in skills/applications/tao-run-deft-aoi/references/DEFT_Loop_Report.html"}, "properties": {"repobilityId": "a0a7a05704aa20f3", "scanner": "scanner-primary", "fingerprint": "96c120a600206a49", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "prompt-injection", "P2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-deft-aoi/references/DEFT_Loop_Report.html"}, "region": {"startLine": 923}}}]}, {"ruleId": "scanner-96c120a600206a49", "level": "error", "message": {"text": "SkillSpector P2 (prompt-injection) in skills/applications/tao-run-deft-aoi/references/DEFT_Loop_Report.html"}, "properties": {"repobilityId": "a0a7a05704aa20f3", "scanner": "scanner-primary", "fingerprint": "96c120a600206a49", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "prompt-injection", "P2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-deft-aoi/references/DEFT_Loop_Report.html"}, "region": {"startLine": 947}}}]}, {"ruleId": "scanner-96c120a600206a49", "level": "error", "message": {"text": "SkillSpector P2 (prompt-injection) in skills/applications/tao-run-deft-aoi/references/DEFT_Loop_Report.html"}, "properties": {"repobilityId": "a0a7a05704aa20f3", "scanner": "scanner-primary", "fingerprint": "96c120a600206a49", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "prompt-injection", "P2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-deft-aoi/references/DEFT_Loop_Report.html"}, "region": {"startLine": 986}}}]}, {"ruleId": "scanner-d82672d456a7068c", "level": "warning", "message": {"text": "SkillSpector RA2 (rogue-agent) in skills/applications/tao-run-deft-aoi/eval.config"}, "properties": {"repobilityId": "01acc2c01b1f21e1", "scanner": "scanner-primary", "fingerprint": "d82672d456a7068c", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "rogue-agent", "RA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-deft-aoi/eval.config"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-244f7fa28c702126", "level": "warning", "message": {"text": "SkillSpector RA2 (rogue-agent) in skills/applications/tao-run-deft-aoi/references/SCRIPT_USAGE.md"}, "properties": {"repobilityId": "a09cd395e7ad32dc", "scanner": "scanner-primary", "fingerprint": "244f7fa28c702126", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "rogue-agent", "RA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-deft-aoi/references/SCRIPT_USAGE.md"}, "region": {"startLine": 57}}}]}, {"ruleId": "scanner-4d20b34df98b9b9e", "level": "warning", "message": {"text": "SkillSpector RA2 (rogue-agent) in skills/applications/tao-run-deft-aoi/references/pipeline-and-state.md"}, "properties": {"repobilityId": "868342c72c081bc4", "scanner": "scanner-primary", "fingerprint": "4d20b34df98b9b9e", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "rogue-agent", "RA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-deft-aoi/references/pipeline-and-state.md"}, "region": {"startLine": 52}}}]}, {"ruleId": "scanner-b8bf8de1c4761438", "level": "warning", "message": {"text": "SkillSpector RA2 (rogue-agent) in skills/applications/tao-run-deft-aoi/scripts/align_token_usage.py"}, "properties": {"repobilityId": "e5720e883f0bd2b3", "scanner": "scanner-primary", "fingerprint": "b8bf8de1c4761438", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "rogue-agent", "RA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-deft-aoi/scripts/align_token_usage.py"}, "region": {"startLine": 50}}}]}, {"ruleId": "scanner-422f80ab78e80646", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in skills/applications/tao-run-deft-aoi/skill.oms.sig"}, "properties": {"repobilityId": "f0f42befea33d2ba", "scanner": "scanner-primary", "fingerprint": "422f80ab78e80646", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-deft-aoi/skill.oms.sig"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-422f80ab78e80646", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in skills/applications/tao-run-deft-aoi/skill.oms.sig"}, "properties": {"repobilityId": "f0f42befea33d2ba", "scanner": "scanner-primary", "fingerprint": "422f80ab78e80646", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-deft-aoi/skill.oms.sig"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-422f80ab78e80646", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in skills/applications/tao-run-deft-aoi/skill.oms.sig"}, "properties": {"repobilityId": "f0f42befea33d2ba", "scanner": "scanner-primary", "fingerprint": "422f80ab78e80646", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-deft-aoi/skill.oms.sig"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-422f80ab78e80646", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in skills/applications/tao-run-deft-aoi/skill.oms.sig"}, "properties": {"repobilityId": "f0f42befea33d2ba", "scanner": "scanner-primary", "fingerprint": "422f80ab78e80646", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-deft-aoi/skill.oms.sig"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f8061cd6cf230a7b", "level": "warning", "message": {"text": "SkillSpector TM3 (tool-misuse) in skills/applications/tao-run-deft-aoi/SKILL.md"}, "properties": {"repobilityId": "11ead00c7b80eaa1", "scanner": "scanner-primary", "fingerprint": "f8061cd6cf230a7b", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-deft-aoi/SKILL.md"}, "region": {"startLine": 138}}}]}, {"ruleId": "scanner-b66ba7bb9ad6a446", "level": "error", "message": {"text": "SkillSpector TM1 (tool-misuse) in skills/applications/tao-run-deft-aoi/references/paidf-anomalygen.md"}, "properties": {"repobilityId": "b49424526d8aa35b", "scanner": "scanner-primary", "fingerprint": "b66ba7bb9ad6a446", "layer": "security", "severity": "high", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-deft-aoi/references/paidf-anomalygen.md"}, "region": {"startLine": 153}}}]}, {"ruleId": "scanner-75b11339ff4b852a", "level": "warning", "message": {"text": "SkillSpector TM3 (tool-misuse) in skills/applications/tao-run-deft-aoi/references/scripts-and-agents.md"}, "properties": {"repobilityId": "f1304750beb42bd6", "scanner": "scanner-primary", "fingerprint": "75b11339ff4b852a", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-deft-aoi/references/scripts-and-agents.md"}, "region": {"startLine": 65}}}]}, {"ruleId": "scanner-9a24142bfb9b9c50", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in skills/applications/tao-run-inference-service/references/request.yaml"}, "properties": {"repobilityId": "2108385076a19c8b", "scanner": "scanner-primary", "fingerprint": "9a24142bfb9b9c50", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-inference-service/references/request.yaml"}, "region": {"startLine": 260}}}]}, {"ruleId": "scanner-f5cea8c534006c7f", "level": "error", "message": {"text": "SkillSpector RA1 (rogue-agent) in skills/applications/tao-run-inference-service/references/service.yaml"}, "properties": {"repobilityId": "068ad2100417aed0", "scanner": "scanner-primary", "fingerprint": "f5cea8c534006c7f", "layer": "security", "severity": "high", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "rogue-agent", "RA1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-inference-service/references/service.yaml"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-7d54981025f592d8", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in skills/applications/tao-run-inference-service/skill.oms.sig"}, "properties": {"repobilityId": "fa97a8b76ebc4f80", "scanner": "scanner-primary", "fingerprint": "7d54981025f592d8", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-inference-service/skill.oms.sig"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7d54981025f592d8", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in skills/applications/tao-run-inference-service/skill.oms.sig"}, "properties": {"repobilityId": "fa97a8b76ebc4f80", "scanner": "scanner-primary", "fingerprint": "7d54981025f592d8", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-inference-service/skill.oms.sig"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7d54981025f592d8", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in skills/applications/tao-run-inference-service/skill.oms.sig"}, "properties": {"repobilityId": "fa97a8b76ebc4f80", "scanner": "scanner-primary", "fingerprint": "7d54981025f592d8", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-inference-service/skill.oms.sig"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7d54981025f592d8", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in skills/applications/tao-run-inference-service/skill.oms.sig"}, "properties": {"repobilityId": "fa97a8b76ebc4f80", "scanner": "scanner-primary", "fingerprint": "7d54981025f592d8", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-inference-service/skill.oms.sig"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9182c93e978784f8", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in skills/applications/tao-train-single-step/skill.oms.sig"}, "properties": {"repobilityId": "830f7918ca683782", "scanner": "scanner-primary", "fingerprint": "9182c93e978784f8", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-train-single-step/skill.oms.sig"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9182c93e978784f8", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in skills/applications/tao-train-single-step/skill.oms.sig"}, "properties": {"repobilityId": "830f7918ca683782", "scanner": "scanner-primary", "fingerprint": "9182c93e978784f8", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-train-single-step/skill.oms.sig"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9182c93e978784f8", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in skills/applications/tao-train-single-step/skill.oms.sig"}, "properties": {"repobilityId": "830f7918ca683782", "scanner": "scanner-primary", "fingerprint": "9182c93e978784f8", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-train-single-step/skill.oms.sig"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9182c93e978784f8", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in skills/applications/tao-train-single-step/skill.oms.sig"}, "properties": {"repobilityId": "830f7918ca683782", "scanner": "scanner-primary", "fingerprint": "9182c93e978784f8", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-train-single-step/skill.oms.sig"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-471b0dd78b0eaad0", "level": "warning", "message": {"text": "SkillSpector EA2 (excessive-agency) in skills/core/tao-launch-workflow/SKILL.md"}, "properties": {"repobilityId": "2ba7b297170f02cb", "scanner": "scanner-primary", "fingerprint": "471b0dd78b0eaad0", "layer": "security", "severity": "medium", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "excessive-agency", "EA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/core/tao-launch-workflow/SKILL.md"}, "region": {"startLine": 319}}}]}, {"ruleId": "scanner-ae4486ec1cef53b0", "level": "warning", "message": {"text": "SkillSpector PE2 (priv-esc) in skills/core/tao-launch-workflow/SKILL.md"}, "properties": {"repobilityId": "ad7646404eba3ea6", "scanner": "scanner-primary", "fingerprint": "ae4486ec1cef53b0", "layer": "security", "severity": "medium", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "priv-esc", "PE2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/core/tao-launch-workflow/SKILL.md"}, "region": {"startLine": 351}}}]}, {"ruleId": "scanner-0181cc166ed85c67", "level": "error", "message": {"text": "SkillSpector PE3 (priv-esc) in skills/core/tao-launch-workflow/SKILL.md"}, "properties": {"repobilityId": "3c7af87e3a89bc60", "scanner": "scanner-primary", "fingerprint": "0181cc166ed85c67", "layer": "security", "severity": "high", "confidence": 0.9, "tags": ["skillspector", "mcp-skill", "priv-esc", "PE3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/core/tao-launch-workflow/SKILL.md"}, "region": {"startLine": 351}}}]}, {"ruleId": "scanner-0181cc166ed85c67", "level": "error", "message": {"text": "SkillSpector PE3 (priv-esc) in skills/core/tao-launch-workflow/SKILL.md"}, "properties": {"repobilityId": "3c7af87e3a89bc60", "scanner": "scanner-primary", "fingerprint": "0181cc166ed85c67", "layer": "security", "severity": "high", "confidence": 0.9, "tags": ["skillspector", "mcp-skill", "priv-esc", "PE3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/core/tao-launch-workflow/SKILL.md"}, "region": {"startLine": 352}}}]}, {"ruleId": "scanner-66baa4ac376ed016", "level": "warning", "message": {"text": "SkillSpector RA2 (rogue-agent) in skills/core/tao-launch-workflow/SKILL.md"}, "properties": {"repobilityId": "1064dc38d9c50864", "scanner": "scanner-primary", "fingerprint": "66baa4ac376ed016", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "rogue-agent", "RA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/core/tao-launch-workflow/SKILL.md"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-d445de24b21fb8a7", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in skills/core/tao-launch-workflow/skill.oms.sig"}, "properties": {"repobilityId": "e7e708715b21232f", "scanner": "scanner-primary", "fingerprint": "d445de24b21fb8a7", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/core/tao-launch-workflow/skill.oms.sig"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d445de24b21fb8a7", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in skills/core/tao-launch-workflow/skill.oms.sig"}, "properties": {"repobilityId": "e7e708715b21232f", "scanner": "scanner-primary", "fingerprint": "d445de24b21fb8a7", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/core/tao-launch-workflow/skill.oms.sig"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d445de24b21fb8a7", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in skills/core/tao-launch-workflow/skill.oms.sig"}, "properties": {"repobilityId": "e7e708715b21232f", "scanner": "scanner-primary", "fingerprint": "d445de24b21fb8a7", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/core/tao-launch-workflow/skill.oms.sig"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d445de24b21fb8a7", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in skills/core/tao-launch-workflow/skill.oms.sig"}, "properties": {"repobilityId": "e7e708715b21232f", "scanner": "scanner-primary", "fingerprint": "d445de24b21fb8a7", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/core/tao-launch-workflow/skill.oms.sig"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-48a9f51dfe914c98", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in skills/core/tao-list-capabilities/skill.oms.sig"}, "properties": {"repobilityId": "ffc3139ceb6e7b95", "scanner": "scanner-primary", "fingerprint": "48a9f51dfe914c98", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/core/tao-list-capabilities/skill.oms.sig"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-48a9f51dfe914c98", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in skills/core/tao-list-capabilities/skill.oms.sig"}, "properties": {"repobilityId": "ffc3139ceb6e7b95", "scanner": "scanner-primary", "fingerprint": "48a9f51dfe914c98", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/core/tao-list-capabilities/skill.oms.sig"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-48a9f51dfe914c98", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in skills/core/tao-list-capabilities/skill.oms.sig"}, "properties": {"repobilityId": "ffc3139ceb6e7b95", "scanner": "scanner-primary", "fingerprint": "48a9f51dfe914c98", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/core/tao-list-capabilities/skill.oms.sig"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-48a9f51dfe914c98", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in skills/core/tao-list-capabilities/skill.oms.sig"}, "properties": {"repobilityId": "ffc3139ceb6e7b95", "scanner": "scanner-primary", "fingerprint": "48a9f51dfe914c98", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/core/tao-list-capabilities/skill.oms.sig"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1210fcc495755b8c", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in skills/models/tao-finetune-clip/skill.oms.sig"}, "properties": {"repobilityId": "e10e9f91d80553a4", "scanner": "scanner-primary", "fingerprint": "1210fcc495755b8c", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/models/tao-finetune-clip/skill.oms.sig"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1210fcc495755b8c", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in skills/models/tao-finetune-clip/skill.oms.sig"}, "properties": {"repobilityId": "e10e9f91d80553a4", "scanner": "scanner-primary", "fingerprint": "1210fcc495755b8c", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/models/tao-finetune-clip/skill.oms.sig"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1210fcc495755b8c", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in skills/models/tao-finetune-clip/skill.oms.sig"}, "properties": {"repobilityId": "e10e9f91d80553a4", "scanner": "scanner-primary", "fingerprint": "1210fcc495755b8c", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/models/tao-finetune-clip/skill.oms.sig"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1210fcc495755b8c", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in skills/models/tao-finetune-clip/skill.oms.sig"}, "properties": {"repobilityId": "e10e9f91d80553a4", "scanner": "scanner-primary", "fingerprint": "1210fcc495755b8c", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/models/tao-finetune-clip/skill.oms.sig"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f22eaf2bf3b8b777", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in skills/models/tao-finetune-cosmos-embed/skill.oms.sig"}, "properties": {"repobilityId": "798c92c11d2e4700", "scanner": "scanner-primary", "fingerprint": "f22eaf2bf3b8b777", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/models/tao-finetune-cosmos-embed/skill.oms.sig"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f22eaf2bf3b8b777", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in skills/models/tao-finetune-cosmos-embed/skill.oms.sig"}, "properties": {"repobilityId": "798c92c11d2e4700", "scanner": "scanner-primary", "fingerprint": "f22eaf2bf3b8b777", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/models/tao-finetune-cosmos-embed/skill.oms.sig"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f22eaf2bf3b8b777", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in skills/models/tao-finetune-cosmos-embed/skill.oms.sig"}, "properties": {"repobilityId": "798c92c11d2e4700", "scanner": "scanner-primary", "fingerprint": "f22eaf2bf3b8b777", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/models/tao-finetune-cosmos-embed/skill.oms.sig"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f22eaf2bf3b8b777", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in skills/models/tao-finetune-cosmos-embed/skill.oms.sig"}, "properties": {"repobilityId": "798c92c11d2e4700", "scanner": "scanner-primary", "fingerprint": "f22eaf2bf3b8b777", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/models/tao-finetune-cosmos-embed/skill.oms.sig"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-76d5cd1f1ce02387", "level": "warning", "message": {"text": "SkillSpector AST4 (behavioral-ast) in skills/models/tao-finetune-cosmos-reason/scripts/prepare_cosmos3_vlm_checkpoint.py"}, "properties": {"repobilityId": "25da783c53186d00", "scanner": "scanner-primary", "fingerprint": "76d5cd1f1ce02387", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST4", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/models/tao-finetune-cosmos-reason/scripts/prepare_cosmos3_vlm_checkpoint.py"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-97eba579ba688c55", "level": "warning", "message": {"text": "SkillSpector LP3 (mcp-least-priv) in skills/models/tao-finetune-cosmos-reason/SKILL.md"}, "properties": {"repobilityId": "86f98d9691698552", "scanner": "scanner-primary", "fingerprint": "97eba579ba688c55", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "mcp-least-priv", "LP3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/models/tao-finetune-cosmos-reason/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-281108d9fe662710", "level": "error", "message": {"text": "SkillSpector PE3 (priv-esc) in skills/models/tao-finetune-cosmos-reason/SKILL.md"}, "properties": {"repobilityId": "ad089629c2b81865", "scanner": "scanner-primary", "fingerprint": "281108d9fe662710", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "priv-esc", "PE3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/models/tao-finetune-cosmos-reason/SKILL.md"}, "region": {"startLine": 58}}}]}, {"ruleId": "scanner-99ba63d26ca368ec", "level": "error", "message": {"text": "SkillSpector PE3 (priv-esc) in skills/models/tao-finetune-cosmos-reason/references/cosmos-data-specs.md"}, "properties": {"repobilityId": "e221ff0ad807a3e3", "scanner": "scanner-primary", "fingerprint": "99ba63d26ca368ec", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "priv-esc", "PE3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/models/tao-finetune-cosmos-reason/references/cosmos-data-specs.md"}, "region": {"startLine": 49}}}]}, {"ruleId": "scanner-f3fb70501b6a8861", "level": "error", "message": {"text": "SkillSpector PE3 (priv-esc) in skills/models/tao-finetune-cosmos-reason/scripts/prepare_cosmos3_vlm_checkpoint.py"}, "properties": {"repobilityId": "a7120f14e2014ea6", "scanner": "scanner-primary", "fingerprint": "f3fb70501b6a8861", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "priv-esc", "PE3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/models/tao-finetune-cosmos-reason/scripts/prepare_cosmos3_vlm_checkpoint.py"}, "region": {"startLine": 277}}}]}, {"ruleId": "scanner-f3fb70501b6a8861", "level": "error", "message": {"text": "SkillSpector PE3 (priv-esc) in skills/models/tao-finetune-cosmos-reason/scripts/prepare_cosmos3_vlm_checkpoint.py"}, "properties": {"repobilityId": "a7120f14e2014ea6", "scanner": "scanner-primary", "fingerprint": "f3fb70501b6a8861", "layer": "security", "severity": "high", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "priv-esc", "PE3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/models/tao-finetune-cosmos-reason/scripts/prepare_cosmos3_vlm_checkpoint.py"}, "region": {"startLine": 277}}}]}, {"ruleId": "scanner-d7d78ef99745fbe3", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in skills/models/tao-finetune-cosmos-reason/skill.oms.sig"}, "properties": {"repobilityId": "abddc4387c7f9676", "scanner": "scanner-primary", "fingerprint": "d7d78ef99745fbe3", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/models/tao-finetune-cosmos-reason/skill.oms.sig"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d7d78ef99745fbe3", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in skills/models/tao-finetune-cosmos-reason/skill.oms.sig"}, "properties": {"repobilityId": "abddc4387c7f9676", "scanner": "scanner-primary", "fingerprint": "d7d78ef99745fbe3", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/models/tao-finetune-cosmos-reason/skill.oms.sig"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d7d78ef99745fbe3", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in skills/models/tao-finetune-cosmos-reason/skill.oms.sig"}, "properties": {"repobilityId": "abddc4387c7f9676", "scanner": "scanner-primary", "fingerprint": "d7d78ef99745fbe3", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/models/tao-finetune-cosmos-reason/skill.oms.sig"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d7d78ef99745fbe3", "level": "error", "message": {"text": "SkillSpector SC3 (supply-chain) in skills/models/tao-finetune-cosmos-reason/skill.oms.sig"}, "properties": {"repobilityId": "abddc4387c7f9676", "scanner": "scanner-primary", "fingerprint": "d7d78ef99745fbe3", "layer": "security", "severity": "high", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/models/tao-finetune-cosmos-reason/skill.oms.sig"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e637c415447867e4", "level": "none", "message": {"text": "Run SkillSpector's LLM-backed analysis in your own pipeline"}, "properties": {"repobilityId": "1936f198ff5212bf", "scanner": "scanner-primary", "fingerprint": "e637c415447867e4", "layer": "security", "severity": "info", "confidence": 1.0, "tags": ["skillspector", "mcp-skill", "llm-advisory", "ai-coder"]}}, {"ruleId": "scanner-b00014a8d3bb8a95", "level": "warning", "message": {"text": "Privileged port 23 in use"}, "properties": {"repobilityId": "a1230e3dfc4becfa", "scanner": "scanner-primary", "fingerprint": "b00014a8d3bb8a95", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-inference-service/references/service.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b7421fa8c43fbbd2", "level": "warning", "message": {"text": "Privileged port 30 in use"}, "properties": {"repobilityId": "54f172e7d16fc662", "scanner": "scanner-primary", "fingerprint": "b7421fa8c43fbbd2", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-run-inference-service/references/service.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b917d0f267936137", "level": "warning", "message": {"text": "Dockerfile runs as root: skills/applications/tao-finetune-huggingface-model/examples/smolvlm-256m-vqav2/Dockerfile"}, "properties": {"repobilityId": "e225a1f9d206c119", "scanner": "scanner-primary", "fingerprint": "b917d0f267936137", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-d04565802a8281e8", "level": "warning", "message": {"text": "Dockerfile runs as root: skills/applications/tao-finetune-huggingface-model/examples/detr-resnet50-cppe5/Dockerfile"}, "properties": {"repobilityId": "1781a7012e749ce7", "scanner": "scanner-primary", "fingerprint": "d04565802a8281e8", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-0f6345592b30e9ad", "level": "warning", "message": {"text": "Dockerfile runs as root: skills/applications/tao-finetune-huggingface-model/examples/segformer-b0-foodseg103/Dockerfile"}, "properties": {"repobilityId": "d5fc036e25095e2b", "scanner": "scanner-primary", "fingerprint": "0f6345592b30e9ad", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-48ed58f92e624a2a", "level": "warning", "message": {"text": "Dockerfile runs as root: skills/applications/tao-finetune-huggingface-model/examples/convnext-tiny-cifar10/Dockerfile"}, "properties": {"repobilityId": "1a88ebb1ad10f882", "scanner": "scanner-primary", "fingerprint": "48ed58f92e624a2a", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-54a70107acefbf2b", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in skills/applications/tao-finetune-huggingface-model/SKILL.md:303"}, "properties": {"repobilityId": "78fe75d2cfa6af95", "scanner": "scanner-primary", "fingerprint": "54a70107acefbf2b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/applications/tao-finetune-huggingface-model/SKILL.md"}, "region": {"startLine": 303}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-85976d47266fb99b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f1d1fb76ee2b501e", "scanner": "scanner-primary", "fingerprint": "85976d47266fb99b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/blossom-ci.yml"}, "region": {"startLine": 52}}}]}, {"ruleId": "scanner-4777f07ee63f1f4f", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "a93616853a42344e", "scanner": "scanner-primary", "fingerprint": "4777f07ee63f1f4f", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/blossom-ci.yml"}, "region": {"startLine": 72}}}]}, {"ruleId": "scanner-94408ca156c1a63a", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "64a3dd8054348d44", "scanner": "scanner-primary", "fingerprint": "94408ca156c1a63a", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/request-nvskills-ci.yml"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-5f87087bd6234b8a", "level": "note", "message": {"text": "Very large file: scripts/check_tao_launch_preflight.py (1626 lines)"}, "properties": {"repobilityId": "68d7c1244070d8fe", "scanner": "scanner-primary", "fingerprint": "5f87087bd6234b8a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "e57697732430644f", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-11825279136b53a3", "level": "warning", "message": {"text": "CI is configured but no tests are detected"}, "properties": {"repobilityId": "6edc8b2519d2cd52", "scanner": "scanner-primary", "fingerprint": "11825279136b53a3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "ci", "config-theater", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "9107d2b03c1d622e", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "a6cda7c445ee3f3c", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "ad9a0c7817318727", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-3eaa9582404edef7", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 skills/models/tao-finetune-cosmos-reason/scripts/prepare_cosmos3_vlm_checkpoint.py:32"}, "properties": {"repobilityId": "2eeac8b13817ee60", "scanner": "scanner-primary", "fingerprint": "3eaa9582404edef7", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-271c3a957028ea63", "level": "none", "message": {"text": "Commented-code block (5 lines) in skills/applications/tao-run-deft-aoi/scripts/align_token_usage.py:328"}, "properties": {"repobilityId": "7f1d19954cf38704", "scanner": "scanner-primary", "fingerprint": "271c3a957028ea63", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-33a6b62e30ce7ab4", "level": "note", "message": {"text": "Near-duplicate function bodies in 6 places"}, "properties": {"repobilityId": "55cad55b66e88d41", "scanner": "scanner-primary", "fingerprint": "33a6b62e30ce7ab4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "91333c14757362cc", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "d263d9354694faaf", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "0f2ecfb4b7ddb35a", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "c7b64085dd40b343", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "0c37d1685ce905e5", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "a50bb38e30f8e40a", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}]}]}