{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-bead75b0f9233e05", "name": "No API endpoints detected", "shortDescription": {"text": "No API endpoints detected"}, "fullDescription": {"text": "The scanner did not find FastAPI/Flask/Express/NestJS/GraphQL/gRPC routes. If this repo exposes APIs, the framework may be unsupported."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8f9229c20185e3e2", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 src/components/JsonLd.tsx:16", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 src/components/JsonLd.tsx:16"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-05434b22f96969a5", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 src/components/Analytics.tsx:60", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 src/components/Analytics.tsx:60"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6987b6849740db5a", "name": "`truncate` class without `title=` for hover reveal \u2014 src/components/blog/EbookReader.tsx:86", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/blog/EbookReader.tsx:86"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c2ed098edc7c9116", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 src/components/blog/BlogPostPage.tsx:74", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 src/components/blog/BlogPostPage.tsx:74"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-38db9e4ec6a8047b", "name": "Stray `console.log` in TS/JS \u2014 src/components/home/AboutPreviewSection.tsx:36", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/components/home/AboutPreviewSection.tsx:36"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b6538583e0889e32", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 src/app/layout.tsx:109", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 src/app/layout.tsx:109"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3cce7d2fda2c9e42", "name": "Stray `console.log` in TS/JS \u2014 src/app/api/pagamento/webhook/route.ts:15", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/app/api/pagamento/webhook/route.ts:15"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-16f65b88194e53d1", "name": "Stray `console.log` in TS/JS \u2014 src/app/api/pagamento/checkout/route.ts:91", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/app/api/pagamento/checkout/route.ts:91"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8bce3007fff7bfa9", "name": "TODO/FIXME marker in shipping code \u2014 src/app/api/contacto/route.ts:7", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 src/app/api/contacto/route.ts:7"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-96757bb1f2d93ac2", "name": "`truncate` class without `title=` for hover reveal \u2014 src/app/admin/page.tsx:198", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/app/admin/page.tsx:198"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-711145ee3e8b09bf", "name": "`truncate` class without `title=` for hover reveal \u2014 src/app/admin/blog/page.tsx:301", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/app/admin/blog/page.tsx:301"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3704e3dc4c4ee0f8", "name": "`truncate` class without `title=` for hover reveal \u2014 src/app/admin/certificacoes/page.tsx:226", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/app/admin/certificacoes/page.tsx:226"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a9190bcbd89451fa", "name": "`truncate` class without `title=` for hover reveal \u2014 src/app/admin/clientes/page.tsx:94", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/app/admin/clientes/page.tsx:94"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a83b16c957437cfc", "name": "`truncate` class without `title=` for hover reveal \u2014 src/app/admin/lista-espera/page.tsx:269", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/app/admin/lista-espera/page.tsx:269"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6859c1086bae06f0", "name": "`truncate` class without `title=` for hover reveal \u2014 src/app/admin/definicoes/page.tsx:919", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/app/admin/definicoes/page.tsx:919"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bf8ced0bb6e48772", "name": "`truncate` class without `title=` for hover reveal \u2014 src/app/admin/galeria/page.tsx:233", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/app/admin/galeria/page.tsx:233"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1b67715d5ef9c587", "name": "Stray `console.log` in TS/JS \u2014 src/app/admin/galeria/page.tsx:120", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/app/admin/galeria/page.tsx:120"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6bb5f4bf1ccb1e65", "name": "`truncate` class without `title=` for hover reveal \u2014 src/app/admin/referencias/page.tsx:204", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/app/admin/referencias/page.tsx:204"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-80a6246e24ab3d79", "name": "`truncate` class without `title=` for hover reveal \u2014 src/app/admin/diagnostico/page.tsx:223", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/app/admin/diagnostico/page.tsx:223"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c87fe3a11eb2fd39", "name": "`truncate` class without `title=` for hover reveal \u2014 src/app/admin/agenda/page.tsx:501", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/app/admin/agenda/page.tsx:501"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1d3ec7b6e931914e", "name": "`truncate` class without `title=` for hover reveal \u2014 src/app/admin/consultas-virtuais/page.tsx:204", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/app/admin/consultas-virtuais/page.tsx:204"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-25b184c05fc1d654", "name": "`truncate` class without `title=` for hover reveal \u2014 src/app/admin/acompanhamento/page.tsx:322", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/app/admin/acompanhamento/page.tsx:322"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b487265ffd2c2347", "name": "`truncate` class without `title=` for hover reveal \u2014 src/app/acompanhamento/[id]/page.tsx:344", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/app/acompanhamento/[id]/page.tsx:344"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8acc7d36ebac298d", "name": "Insecure pattern 'dangerous_innerhtml' in src/components/JsonLd.tsx:16", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in src/components/JsonLd.tsx:16"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e8d0c45368c390d6", "name": "Insecure pattern 'dangerous_innerhtml' in src/components/Analytics.tsx:60", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in src/components/Analytics.tsx:60"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d7250913e0ae2a1c", "name": "Insecure pattern 'dangerous_innerhtml' in src/components/blog/BlogPostPage.tsx:74", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in src/components/blog/BlogPostPage.tsx:74"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c75c02d21010508b", "name": "Insecure pattern 'dangerous_innerhtml' in src/app/layout.tsx:109", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in src/app/layout.tsx:109"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "4 test file(s) for 158 source file(s) (ratio 0.03). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-faccb9061e9b52a0", "name": "No README detected", "shortDescription": {"text": "No README detected"}, "fullDescription": {"text": "No README file was found. Generated repos without README context are hard to operate, validate, or safely hand off."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 11 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 112 placeholder/mock markers across 24 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci, operator-readme. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license, ci, operator-readme. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b5ff8cbda03cd3ec", "name": "Agent instruction contains unpinned remote install: .claude/settings.local.json", "shortDescription": {"text": "Agent instruction contains unpinned remote install: .claude/settings.local.json"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2c5f98b152cddb6d", "name": "Agent authority lacks a verifier contract: .claude/launch.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/launch.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ad3c372f41687a8", "name": "Agent instruction contains unpinned remote install: .claude/skills/firebase-app-hosting-basics/SKILL.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-app-hosting-basics/SKILL.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1694fd9e78967791", "name": "Agent instruction contains unpinned remote install: .claude/skills/firebase-app-hosting-basics/references/emulation.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-app-hosting-basics/references/emulation.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-87bf892716592594", "name": "Agent instruction/config may expose a secret: .claude/skills/firebase-app-hosting-basics/references/configuration.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/skills/firebase-app-hosting-basics/references/configuration.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f80dfb004be03113", "name": "Agent instruction contains unpinned remote install: .claude/skills/firebase-app-hosting-basics/references/configuration.", "shortDescription": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-app-hosting-basics/references/configuration.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e48551abaaf68713", "name": "Agent authority lacks a verifier contract: .claude/skills/firebase-app-hosting-basics/references/cli_commands.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/firebase-app-hosting-basics/references/cli_commands.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f4218dc4191d353a", "name": "Agent instruction contains unpinned remote install: .claude/skills/firebase-app-hosting-basics/references/cli_commands.m", "shortDescription": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-app-hosting-basics/references/cli_commands.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-62096886c65a24c2", "name": "Agent instruction contains unpinned remote install: .claude/skills/firebase-basics/SKILL.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-basics/SKILL.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-687959c943d3b8da", "name": "Agent authority lacks a verifier contract: .claude/skills/firebase-basics/references/firebase-service-init.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/firebase-basics/references/firebase-service-init.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6108f508bc68f661", "name": "Agent instruction contains unpinned remote install: .claude/skills/firebase-basics/references/firebase-service-init.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-basics/references/firebase-service-init.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-36fceee0e689b2e7", "name": "Agent instruction contains unpinned remote install: .claude/skills/firebase-basics/references/local-env-setup.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-basics/references/local-env-setup.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fd1b9d8d6449839a", "name": "Agent authority lacks a verifier contract: .claude/skills/firebase-basics/references/web_setup.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/firebase-basics/references/web_setup.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-996af8edc54dbe50", "name": "Agent instruction contains unpinned remote install: .claude/skills/firebase-basics/references/web_setup.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-basics/references/web_setup.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-be19db3974cc288c", "name": "Agent authority lacks a verifier contract: .claude/skills/firebase-basics/references/firebase-cli-guide.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/firebase-basics/references/firebase-cli-guide.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9cbe30a60e059db9", "name": "Agent instruction contains unpinned remote install: .claude/skills/firebase-basics/references/firebase-cli-guide.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-basics/references/firebase-cli-guide.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4cbb68f5ffedb027", "name": "Agent authority lacks a verifier contract: .claude/skills/firebase-basics/references/refresh/claude.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/firebase-basics/references/refresh/claude.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bf07e304e55a98d0", "name": "Agent authority lacks a verifier contract: .claude/skills/firebase-basics/references/refresh/other-agents.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/firebase-basics/references/refresh/other-agents.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9051b10528febad6", "name": "Agent instruction contains unpinned remote install: .claude/skills/firebase-basics/references/refresh/other-agents.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-basics/references/refresh/other-agents.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7210c0d586eab161", "name": "Agent authority lacks a verifier contract: .claude/skills/firebase-basics/references/refresh/antigravity.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/firebase-basics/references/refresh/antigravity.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7f8d7dc8062d1657", "name": "Agent instruction contains unpinned remote install: .claude/skills/firebase-basics/references/refresh/antigravity.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-basics/references/refresh/antigravity.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-27b3dd19664d5f81", "name": "Agent authority lacks a verifier contract: .claude/skills/firebase-basics/references/refresh/gemini-cli.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/firebase-basics/references/refresh/gemini-cli.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9ebdd2d391d6fba3", "name": "Agent instruction contains unpinned remote install: .claude/skills/firebase-basics/references/setup/gemini_cli.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-basics/references/setup/gemini_cli.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bf65b144c77c1591", "name": "Agent instruction contains unpinned remote install: .claude/skills/developing-genkit-dart/SKILL.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: .claude/skills/developing-genkit-dart/SKILL.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7cf26a294d50030f", "name": "Agent instruction/config may expose a secret: .claude/skills/developing-genkit-dart/references/genkit_anthropic.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/skills/developing-genkit-dart/references/genkit_anthropic.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-402849d30a8d8eb6", "name": "Agent authority lacks a verifier contract: .claude/skills/developing-genkit-dart/references/genkit_mcp.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/developing-genkit-dart/references/genkit_mcp.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-63a94659936bdc40", "name": "Agent instruction/config may expose a secret: .claude/skills/developing-genkit-dart/references/genkit_openai.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/skills/developing-genkit-dart/references/genkit_openai.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-45fac71e946928a3", "name": "Agent authority lacks a verifier contract: .claude/skills/developing-genkit-dart/references/genkit_middleware.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/developing-genkit-dart/references/genkit_middleware.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3d16fd697cfd8559", "name": "Agent authority lacks a verifier contract: .claude/skills/developing-genkit-dart/references/genkit.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/developing-genkit-dart/references/genkit.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-229696d1b5c5d68b", "name": "Agent instruction contains unpinned remote install: .claude/skills/developing-genkit-go/SKILL.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: .claude/skills/developing-genkit-go/SKILL.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-77ab6d7f4b061663", "name": "Agent instruction contains unpinned remote install: .claude/skills/developing-genkit-go/references/getting-started.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: .claude/skills/developing-genkit-go/references/getting-started.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ce5c5e37420d6221", "name": "Agent authority lacks a verifier contract: .claude/skills/developing-genkit-go/references/tools.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/developing-genkit-go/references/tools.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4982591464f9b06f", "name": "Agent authority lacks a verifier contract: .claude/skills/developing-genkit-go/references/flows-and-http.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/developing-genkit-go/references/flows-and-http.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-82e5c2fe8f83e9a6", "name": "Agent authority lacks a verifier contract: .claude/skills/developing-genkit-go/references/prompts.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/developing-genkit-go/references/prompts.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-edcceaad54ef3899", "name": "Agent instruction contains unpinned remote install: .claude/skills/developing-genkit-js/SKILL.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: .claude/skills/developing-genkit-js/SKILL.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-79c760b9a6315da8", "name": "Agent authority lacks a verifier contract: .claude/skills/developing-genkit-js/references/docs-and-cli.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/developing-genkit-js/references/docs-and-cli.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a90f6d48d2ddf502", "name": "Agent instruction contains unpinned remote install: .claude/skills/developing-genkit-js/references/docs-and-cli.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: .claude/skills/developing-genkit-js/references/docs-and-cli.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-013f5c5f403f8065", "name": "Agent authority lacks a verifier contract: .claude/skills/developing-genkit-js/references/setup.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/developing-genkit-js/references/setup.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-693b0b3c0c59a0f7", "name": "Agent authority lacks a verifier contract: .claude/skills/developing-genkit-js/references/examples.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/developing-genkit-js/references/examples.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-49ac4035da5638ba", "name": "Agent authority lacks a verifier contract: .claude/skills/developing-genkit-js/references/best-practices.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/developing-genkit-js/references/best-practices.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-600982beceaeec77", "name": "Agent authority lacks a verifier contract: .claude/skills/firebase-data-connect/templates.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/firebase-data-connect/templates.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a0d196f10f97f21a", "name": "Agent instruction contains unpinned remote install: .claude/skills/firebase-data-connect/templates.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-data-connect/templates.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-56e4fc81dccbc3c1", "name": "Agent instruction contains unpinned remote install: .claude/skills/firebase-data-connect/SKILL.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-data-connect/SKILL.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f1244d8372fa6c47", "name": "Agent authority lacks a verifier contract: .claude/skills/firebase-data-connect/reference/advanced.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/firebase-data-connect/reference/advanced.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8bb2873eda2e57e6", "name": "Agent instruction contains unpinned remote install: .claude/skills/firebase-data-connect/reference/advanced.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-data-connect/reference/advanced.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-83c4efa2dc0d8ee3", "name": "Agent instruction contains unpinned remote install: .claude/skills/firebase-data-connect/reference/sdks.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-data-connect/reference/sdks.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d812d8da6203bc4d", "name": "Agent instruction/config may expose a secret: .claude/skills/firebase-data-connect/reference/operations.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/skills/firebase-data-connect/reference/operations.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6d05a1c005711b5b", "name": "Agent instruction contains unpinned remote install: .claude/skills/firebase-data-connect/reference/config.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-data-connect/reference/config.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-faa728c2c7fd3f24", "name": "Agent authority lacks a verifier contract: .claude/skills/firebase-ai-logic/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/firebase-ai-logic/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e487d96f03901522", "name": "Agent instruction contains unpinned remote install: .claude/skills/firebase-ai-logic/SKILL.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-ai-logic/SKILL.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dbc41a397b0007ba", "name": "Agent instruction contains unpinned remote install: .claude/skills/firebase-firestore-standard/SKILL.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-firestore-standard/SKILL.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-64551b5c0f65955d", "name": "Agent authority lacks a verifier contract: .claude/skills/firebase-firestore-standard/references/indexes.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/firebase-firestore-standard/references/indexes.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-245d39730a847826", "name": "Agent instruction contains unpinned remote install: .claude/skills/firebase-firestore-standard/references/indexes.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-firestore-standard/references/indexes.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-80fd6a211072dc3b", "name": "Agent instruction contains unpinned remote install: .claude/skills/firebase-firestore-standard/references/web_sdk_usage.", "shortDescription": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-firestore-standard/references/web_sdk_usage.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-03dcc77a81bd3669", "name": "Agent authority lacks a verifier contract: .claude/skills/firebase-firestore-standard/references/provisioning.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/firebase-firestore-standard/references/provisioning.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-55f6f98e017f15c5", "name": "Agent instruction contains unpinned remote install: .claude/skills/firebase-firestore-standard/references/provisioning.m", "shortDescription": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-firestore-standard/references/provisioning.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8be16d6ceb4602ee", "name": "Agent instruction contains unpinned remote install: .claude/skills/firebase-firestore-enterprise-native-mode/SKILL.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-firestore-enterprise-native-mode/SKILL.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e59905ac186b28af", "name": "Agent authority lacks a verifier contract: .claude/skills/firebase-firestore-enterprise-native-mode/references/indexes.m", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/firebase-firestore-enterprise-native-mode/references/indexes.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c3438085ed6bdc6a", "name": "Agent authority lacks a verifier contract: .claude/skills/firebase-firestore-enterprise-native-mode/references/web_sdk_u", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/firebase-firestore-enterprise-native-mode/references/web_sdk_usage.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-78bd01c4d4667b41", "name": "Agent authority lacks a verifier contract: .claude/skills/firebase-firestore-enterprise-native-mode/references/provision", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/firebase-firestore-enterprise-native-mode/references/provisioning.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0bec6cbce49896b7", "name": "Agent instruction contains unpinned remote install: .claude/skills/firebase-firestore-enterprise-native-mode/references/", "shortDescription": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-firestore-enterprise-native-mode/references/provisioning.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b08f2c6512423650", "name": "Agent authority lacks a verifier contract: .claude/skills/firebase-firestore-enterprise-native-mode/references/python_sd", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/firebase-firestore-enterprise-native-mode/references/python_sdk_usage.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-be4aa241f2ad93e3", "name": "Agent instruction contains unpinned remote install: .claude/skills/firebase-auth-basics/SKILL.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-auth-basics/SKILL.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-93c9e79cf3f60cbe", "name": "Agent instruction/config may expose a secret: .claude/skills/firebase-auth-basics/references/client_sdk_web.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/skills/firebase-auth-basics/references/client_sdk_web.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-27b5c1bc7c9d6885", "name": "Agent instruction contains unpinned remote install: .claude/skills/firebase-hosting-basics/SKILL.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-hosting-basics/SKILL.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-aa97c546358f7ba7", "name": "Agent instruction contains unpinned remote install: .claude/skills/firebase-hosting-basics/references/deploying.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-hosting-basics/references/deploying.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-38341b543ddb011b", "name": "Agent authority lacks a verifier contract: .claude/skills/firebase-hosting-basics/references/configuration.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/firebase-hosting-basics/references/configuration.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-91bc318a6f1dd149", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/api/lista-espera/notificar/route.ts:19", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/api/lista-espera/notificar/route.ts:19"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-777e1ce100d13c9f", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/api/contacto/route.ts:19", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/api/contacto/route.ts:19"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b51f7b8db57ca3a7", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/api/consentimentos/enviar-link/route.ts:55", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/api/consentimentos/enviar-link/route.ts:55"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3802099733317dc7", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/api/fiberbrows-waitlist/route.ts:15", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/api/fiberbrows-waitlist/route.ts:15"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e1566628dc62aac2", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/api/consulta-virtual/agendar/route.ts:74", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/api/consulta-virtual/agendar/route.ts:74"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fdb2942e60606675", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/admin/definicoes/page.tsx:312", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/admin/definicoes/page.tsx:312"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ce7ac9362e6e140c", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/admin/agenda/page.tsx:76", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/admin/agenda/page.tsx:76"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-74105a620f1b307b", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/acompanhamento/[id]/page.tsx:81", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/acompanhamento/[id]/page.tsx:81"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b17f00d083a74ee9", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/lib/email.ts:30", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/lib/email.ts:30"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1b5a76780c3df9aa", "name": "1 env vars used in code but missing from .env.example", "shortDescription": {"text": "1 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `GOOGLE_CALENDAR_WEBHOOK_SECRET`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/19850"}, "properties": {"repository": "sliha/-francielly-costa-site", "repoUrl": "https://github.com/sliha/-francielly-costa-site", "branch": "main"}, "results": [{"ruleId": "scanner-bead75b0f9233e05", "level": "none", "message": {"text": "No API endpoints detected"}, "properties": {"repobilityId": "0f8bb852027c38f8", "scanner": "scanner-primary", "fingerprint": "bead75b0f9233e05", "layer": "api", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-8f9229c20185e3e2", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 src/components/JsonLd.tsx:16"}, "properties": {"repobilityId": "63d1555414765036", "scanner": "scanner-primary", "fingerprint": "8f9229c20185e3e2", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-05434b22f96969a5", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 src/components/Analytics.tsx:60"}, "properties": {"repobilityId": "ba4f009eb116741a", "scanner": "scanner-primary", "fingerprint": "05434b22f96969a5", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-6987b6849740db5a", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/blog/EbookReader.tsx:86"}, "properties": {"repobilityId": "8a240231570dfe76", "scanner": "scanner-primary", "fingerprint": "6987b6849740db5a", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-c2ed098edc7c9116", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 src/components/blog/BlogPostPage.tsx:74"}, "properties": {"repobilityId": "518e8f78c94049de", "scanner": "scanner-primary", "fingerprint": "c2ed098edc7c9116", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-38db9e4ec6a8047b", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/components/home/AboutPreviewSection.tsx:36"}, "properties": {"repobilityId": "22dd6aa2e1559816", "scanner": "scanner-primary", "fingerprint": "38db9e4ec6a8047b", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-b6538583e0889e32", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 src/app/layout.tsx:109"}, "properties": {"repobilityId": "0d72350965068f5b", "scanner": "scanner-primary", "fingerprint": "b6538583e0889e32", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-3cce7d2fda2c9e42", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/app/api/pagamento/webhook/route.ts:15"}, "properties": {"repobilityId": "a07d0857a06ff5aa", "scanner": "scanner-primary", "fingerprint": "3cce7d2fda2c9e42", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-16f65b88194e53d1", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/app/api/pagamento/checkout/route.ts:91"}, "properties": {"repobilityId": "fb1fbc2012be0fdc", "scanner": "scanner-primary", "fingerprint": "16f65b88194e53d1", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-8bce3007fff7bfa9", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 src/app/api/contacto/route.ts:7"}, "properties": {"repobilityId": "74547e9350f73a94", "scanner": "scanner-primary", "fingerprint": "8bce3007fff7bfa9", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-96757bb1f2d93ac2", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/app/admin/page.tsx:198"}, "properties": {"repobilityId": "8d313b2589100140", "scanner": "scanner-primary", "fingerprint": "96757bb1f2d93ac2", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-711145ee3e8b09bf", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/app/admin/blog/page.tsx:301"}, "properties": {"repobilityId": "32cc67fa3e91f9f2", "scanner": "scanner-primary", "fingerprint": "711145ee3e8b09bf", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-3704e3dc4c4ee0f8", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/app/admin/certificacoes/page.tsx:226"}, "properties": {"repobilityId": "d6cdb39c9276028c", "scanner": "scanner-primary", "fingerprint": "3704e3dc4c4ee0f8", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-a9190bcbd89451fa", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/app/admin/clientes/page.tsx:94"}, "properties": {"repobilityId": "d6ef020cb8f2558e", "scanner": "scanner-primary", "fingerprint": "a9190bcbd89451fa", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-a83b16c957437cfc", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/app/admin/lista-espera/page.tsx:269"}, "properties": {"repobilityId": "6d9e6d93bd35330a", "scanner": "scanner-primary", "fingerprint": "a83b16c957437cfc", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-6859c1086bae06f0", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/app/admin/definicoes/page.tsx:919"}, "properties": {"repobilityId": "f779dbb13cc38a30", "scanner": "scanner-primary", "fingerprint": "6859c1086bae06f0", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-bf8ced0bb6e48772", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/app/admin/galeria/page.tsx:233"}, "properties": {"repobilityId": "1f4143700c6547b0", "scanner": "scanner-primary", "fingerprint": "bf8ced0bb6e48772", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-1b67715d5ef9c587", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/app/admin/galeria/page.tsx:120"}, "properties": {"repobilityId": "268ff3aacaacff9c", "scanner": "scanner-primary", "fingerprint": "1b67715d5ef9c587", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-6bb5f4bf1ccb1e65", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/app/admin/referencias/page.tsx:204"}, "properties": {"repobilityId": "27c4e349fb9a919a", "scanner": "scanner-primary", "fingerprint": "6bb5f4bf1ccb1e65", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-80a6246e24ab3d79", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/app/admin/diagnostico/page.tsx:223"}, "properties": {"repobilityId": "c18747151ac9943f", "scanner": "scanner-primary", "fingerprint": "80a6246e24ab3d79", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-c87fe3a11eb2fd39", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/app/admin/agenda/page.tsx:501"}, "properties": {"repobilityId": "221c0ff2eef556b8", "scanner": "scanner-primary", "fingerprint": "c87fe3a11eb2fd39", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-1d3ec7b6e931914e", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/app/admin/consultas-virtuais/page.tsx:204"}, "properties": {"repobilityId": "2e7094e594f131b7", "scanner": "scanner-primary", "fingerprint": "1d3ec7b6e931914e", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-25b184c05fc1d654", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/app/admin/acompanhamento/page.tsx:322"}, "properties": {"repobilityId": "95de49ad56bcacba", "scanner": "scanner-primary", "fingerprint": "25b184c05fc1d654", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-b487265ffd2c2347", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/app/acompanhamento/[id]/page.tsx:344"}, "properties": {"repobilityId": "abde5f33a8293afa", "scanner": "scanner-primary", "fingerprint": "b487265ffd2c2347", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-8acc7d36ebac298d", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in src/components/JsonLd.tsx:16"}, "properties": {"repobilityId": "a28d03af2ac862d0", "scanner": "scanner-primary", "fingerprint": "8acc7d36ebac298d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/components/JsonLd.tsx"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-e8d0c45368c390d6", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in src/components/Analytics.tsx:60"}, "properties": {"repobilityId": "c0052b79ed398039", "scanner": "scanner-primary", "fingerprint": "e8d0c45368c390d6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/components/Analytics.tsx"}, "region": {"startLine": 60}}}]}, {"ruleId": "scanner-d7250913e0ae2a1c", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in src/components/blog/BlogPostPage.tsx:74"}, "properties": {"repobilityId": "d31792e5cdd3b959", "scanner": "scanner-primary", "fingerprint": "d7250913e0ae2a1c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/components/blog/BlogPostPage.tsx"}, "region": {"startLine": 74}}}]}, {"ruleId": "scanner-c75c02d21010508b", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in src/app/layout.tsx:109"}, "properties": {"repobilityId": "0bca654fa2052eb0", "scanner": "scanner-primary", "fingerprint": "c75c02d21010508b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app/layout.tsx"}, "region": {"startLine": 109}}}]}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "03218d047d0fe452", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-faccb9061e9b52a0", "level": "note", "message": {"text": "No README detected"}, "properties": {"repobilityId": "4e203e05071cb59e", "scanner": "scanner-primary", "fingerprint": "faccb9061e9b52a0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["docs", "readme", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "bac694d27309936e", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "2c1a88b0e53a0f2d", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "4779b59a29d7e230", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "warning", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "cdd86fa94ed62186", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "857da8fc79fd68f7", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "d8049743199a3447", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "97bc46ab9ac4598e", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-b5ff8cbda03cd3ec", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: .claude/settings.local.json"}, "properties": {"repobilityId": "b05139c0c155b49c", "scanner": "scanner-primary", "fingerprint": "b5ff8cbda03cd3ec", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/settings.local.json"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-2c5f98b152cddb6d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/launch.json"}, "properties": {"repobilityId": "0de48c0f4ab303d8", "scanner": "scanner-primary", "fingerprint": "2c5f98b152cddb6d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/launch.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ad3c372f41687a8", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-app-hosting-basics/SKILL.md"}, "properties": {"repobilityId": "d5dd8e7040f3bbba", "scanner": "scanner-primary", "fingerprint": "3ad3c372f41687a8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/firebase-app-hosting-basics/SKILL.md"}, "region": {"startLine": 47}}}]}, {"ruleId": "scanner-1694fd9e78967791", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-app-hosting-basics/references/emulation.md"}, "properties": {"repobilityId": "c8d5c9a6495f992d", "scanner": "scanner-primary", "fingerprint": "1694fd9e78967791", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/firebase-app-hosting-basics/references/emulation.md"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-87bf892716592594", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/skills/firebase-app-hosting-basics/references/configuration.md"}, "properties": {"repobilityId": "19368558de99aaaf", "scanner": "scanner-primary", "fingerprint": "87bf892716592594", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/firebase-app-hosting-basics/references/configuration.md"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-f80dfb004be03113", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-app-hosting-basics/references/configuration.md"}, "properties": {"repobilityId": "44234b68150dc406", "scanner": "scanner-primary", "fingerprint": "f80dfb004be03113", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/firebase-app-hosting-basics/references/configuration.md"}, "region": {"startLine": 47}}}]}, {"ruleId": "scanner-e48551abaaf68713", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/firebase-app-hosting-basics/references/cli_commands.md"}, "properties": {"repobilityId": "272ee8f943186500", "scanner": "scanner-primary", "fingerprint": "e48551abaaf68713", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/firebase-app-hosting-basics/references/cli_commands.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f4218dc4191d353a", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-app-hosting-basics/references/cli_commands.md"}, "properties": {"repobilityId": "bf2829b9dbd8b569", "scanner": "scanner-primary", "fingerprint": "f4218dc4191d353a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/firebase-app-hosting-basics/references/cli_commands.md"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-62096886c65a24c2", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-basics/SKILL.md"}, "properties": {"repobilityId": "b4f5a037a31db538", "scanner": "scanner-primary", "fingerprint": "62096886c65a24c2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/firebase-basics/SKILL.md"}, "region": {"startLine": 6}}}]}, {"ruleId": "scanner-687959c943d3b8da", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/firebase-basics/references/firebase-service-init.md"}, "properties": {"repobilityId": "48c3cc4711841ada", "scanner": "scanner-primary", "fingerprint": "687959c943d3b8da", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/firebase-basics/references/firebase-service-init.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6108f508bc68f661", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-basics/references/firebase-service-init.md"}, "properties": {"repobilityId": "bc396717c37b6cab", "scanner": "scanner-primary", "fingerprint": "6108f508bc68f661", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/firebase-basics/references/firebase-service-init.md"}, "region": {"startLine": 12}}}]}, {"ruleId": "scanner-36fceee0e689b2e7", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-basics/references/local-env-setup.md"}, "properties": {"repobilityId": "8bbf3c7c4a108d60", "scanner": "scanner-primary", "fingerprint": "36fceee0e689b2e7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/firebase-basics/references/local-env-setup.md"}, "region": {"startLine": 44}}}]}, {"ruleId": "scanner-fd1b9d8d6449839a", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/firebase-basics/references/web_setup.md"}, "properties": {"repobilityId": "cf8bb6e0e94f88a6", "scanner": "scanner-primary", "fingerprint": "fd1b9d8d6449839a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/firebase-basics/references/web_setup.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-996af8edc54dbe50", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-basics/references/web_setup.md"}, "properties": {"repobilityId": "627511430ffa292d", "scanner": "scanner-primary", "fingerprint": "996af8edc54dbe50", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/firebase-basics/references/web_setup.md"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-be19db3974cc288c", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/firebase-basics/references/firebase-cli-guide.md"}, "properties": {"repobilityId": "f454e422e6b9632c", "scanner": "scanner-primary", "fingerprint": "be19db3974cc288c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/firebase-basics/references/firebase-cli-guide.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9cbe30a60e059db9", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-basics/references/firebase-cli-guide.md"}, "properties": {"repobilityId": "6f02865063c88852", "scanner": "scanner-primary", "fingerprint": "9cbe30a60e059db9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/firebase-basics/references/firebase-cli-guide.md"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-4cbb68f5ffedb027", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/firebase-basics/references/refresh/claude.md"}, "properties": {"repobilityId": "d4c705fb106418e0", "scanner": "scanner-primary", "fingerprint": "4cbb68f5ffedb027", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/firebase-basics/references/refresh/claude.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bf07e304e55a98d0", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/firebase-basics/references/refresh/other-agents.md"}, "properties": {"repobilityId": "ade289eda6b704d9", "scanner": "scanner-primary", "fingerprint": "bf07e304e55a98d0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/firebase-basics/references/refresh/other-agents.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9051b10528febad6", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-basics/references/refresh/other-agents.md"}, "properties": {"repobilityId": "5fd254ceeafdfab7", "scanner": "scanner-primary", "fingerprint": "9051b10528febad6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/firebase-basics/references/refresh/other-agents.md"}, "region": {"startLine": 11}}}]}, {"ruleId": "scanner-7210c0d586eab161", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/firebase-basics/references/refresh/antigravity.md"}, "properties": {"repobilityId": "94434dfb180d35e9", "scanner": "scanner-primary", "fingerprint": "7210c0d586eab161", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/firebase-basics/references/refresh/antigravity.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7f8d7dc8062d1657", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-basics/references/refresh/antigravity.md"}, "properties": {"repobilityId": "7d5102bd82595066", "scanner": "scanner-primary", "fingerprint": "7f8d7dc8062d1657", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/firebase-basics/references/refresh/antigravity.md"}, "region": {"startLine": 9}}}]}, {"ruleId": "scanner-27b3dd19664d5f81", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/firebase-basics/references/refresh/gemini-cli.md"}, "properties": {"repobilityId": "c08818547e845eb2", "scanner": "scanner-primary", "fingerprint": "27b3dd19664d5f81", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/firebase-basics/references/refresh/gemini-cli.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9ebdd2d391d6fba3", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-basics/references/setup/gemini_cli.md"}, "properties": {"repobilityId": "d9c025c2b3993991", "scanner": "scanner-primary", "fingerprint": "9ebdd2d391d6fba3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/firebase-basics/references/setup/gemini_cli.md"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-bf65b144c77c1591", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: .claude/skills/developing-genkit-dart/SKILL.md"}, "properties": {"repobilityId": "8f1b0d8e618060f2", "scanner": "scanner-primary", "fingerprint": "bf65b144c77c1591", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/developing-genkit-dart/SKILL.md"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-7cf26a294d50030f", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/skills/developing-genkit-dart/references/genkit_anthropic.md"}, "properties": {"repobilityId": "d041856d65176b97", "scanner": "scanner-primary", "fingerprint": "7cf26a294d50030f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/developing-genkit-dart/references/genkit_anthropic.md"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-402849d30a8d8eb6", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/developing-genkit-dart/references/genkit_mcp.md"}, "properties": {"repobilityId": "90f765919f14ec7c", "scanner": "scanner-primary", "fingerprint": "402849d30a8d8eb6", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/developing-genkit-dart/references/genkit_mcp.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-63a94659936bdc40", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/skills/developing-genkit-dart/references/genkit_openai.md"}, "properties": {"repobilityId": "0191deb102743b6a", "scanner": "scanner-primary", "fingerprint": "63a94659936bdc40", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/developing-genkit-dart/references/genkit_openai.md"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-45fac71e946928a3", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/developing-genkit-dart/references/genkit_middleware.md"}, "properties": {"repobilityId": "ba7a82650631a357", "scanner": "scanner-primary", "fingerprint": "45fac71e946928a3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/developing-genkit-dart/references/genkit_middleware.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3d16fd697cfd8559", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/developing-genkit-dart/references/genkit.md"}, "properties": {"repobilityId": "cb7dd8e92bf8839d", "scanner": "scanner-primary", "fingerprint": "3d16fd697cfd8559", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/developing-genkit-dart/references/genkit.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-229696d1b5c5d68b", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: .claude/skills/developing-genkit-go/SKILL.md"}, "properties": {"repobilityId": "186710e23b4f2b43", "scanner": "scanner-primary", "fingerprint": "229696d1b5c5d68b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/developing-genkit-go/SKILL.md"}, "region": {"startLine": 67}}}]}, {"ruleId": "scanner-77ab6d7f4b061663", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: .claude/skills/developing-genkit-go/references/getting-started.md"}, "properties": {"repobilityId": "f474a6b42d3005f6", "scanner": "scanner-primary", "fingerprint": "77ab6d7f4b061663", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/developing-genkit-go/references/getting-started.md"}, "region": {"startLine": 93}}}]}, {"ruleId": "scanner-ce5c5e37420d6221", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/developing-genkit-go/references/tools.md"}, "properties": {"repobilityId": "c1e920fb289b8630", "scanner": "scanner-primary", "fingerprint": "ce5c5e37420d6221", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/developing-genkit-go/references/tools.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4982591464f9b06f", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/developing-genkit-go/references/flows-and-http.md"}, "properties": {"repobilityId": "ffb38eb59852cf5c", "scanner": "scanner-primary", "fingerprint": "4982591464f9b06f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/developing-genkit-go/references/flows-and-http.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-82e5c2fe8f83e9a6", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/developing-genkit-go/references/prompts.md"}, "properties": {"repobilityId": "18877371872bb9d1", "scanner": "scanner-primary", "fingerprint": "82e5c2fe8f83e9a6", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/developing-genkit-go/references/prompts.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-edcceaad54ef3899", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: .claude/skills/developing-genkit-js/SKILL.md"}, "properties": {"repobilityId": "a29ac0b8ae1d44d1", "scanner": "scanner-primary", "fingerprint": "edcceaad54ef3899", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/developing-genkit-js/SKILL.md"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-79c760b9a6315da8", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/developing-genkit-js/references/docs-and-cli.md"}, "properties": {"repobilityId": "667994aa291bd976", "scanner": "scanner-primary", "fingerprint": "79c760b9a6315da8", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/developing-genkit-js/references/docs-and-cli.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a90f6d48d2ddf502", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: .claude/skills/developing-genkit-js/references/docs-and-cli.md"}, "properties": {"repobilityId": "eba923baa2c0c507", "scanner": "scanner-primary", "fingerprint": "a90f6d48d2ddf502", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/developing-genkit-js/references/docs-and-cli.md"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-013f5c5f403f8065", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/developing-genkit-js/references/setup.md"}, "properties": {"repobilityId": "19d8b9387b41db79", "scanner": "scanner-primary", "fingerprint": "013f5c5f403f8065", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/developing-genkit-js/references/setup.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-693b0b3c0c59a0f7", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/developing-genkit-js/references/examples.md"}, "properties": {"repobilityId": "d276b4ab84921d4c", "scanner": "scanner-primary", "fingerprint": "693b0b3c0c59a0f7", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/developing-genkit-js/references/examples.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-49ac4035da5638ba", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/developing-genkit-js/references/best-practices.md"}, "properties": {"repobilityId": "a62099dee9c23140", "scanner": "scanner-primary", "fingerprint": "49ac4035da5638ba", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/developing-genkit-js/references/best-practices.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-600982beceaeec77", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/firebase-data-connect/templates.md"}, "properties": {"repobilityId": "335ef10aae17d332", "scanner": "scanner-primary", "fingerprint": "600982beceaeec77", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/firebase-data-connect/templates.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a0d196f10f97f21a", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-data-connect/templates.md"}, "properties": {"repobilityId": "a4118707bd370c2d", "scanner": "scanner-primary", "fingerprint": "a0d196f10f97f21a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/firebase-data-connect/templates.md"}, "region": {"startLine": 216}}}]}, {"ruleId": "scanner-56e4fc81dccbc3c1", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-data-connect/SKILL.md"}, "properties": {"repobilityId": "dffb9d5680614026", "scanner": "scanner-primary", "fingerprint": "56e4fc81dccbc3c1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/firebase-data-connect/SKILL.md"}, "region": {"startLine": 97}}}]}, {"ruleId": "scanner-f1244d8372fa6c47", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/firebase-data-connect/reference/advanced.md"}, "properties": {"repobilityId": "6de045dd122e14a9", "scanner": "scanner-primary", "fingerprint": "f1244d8372fa6c47", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/firebase-data-connect/reference/advanced.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8bb2873eda2e57e6", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-data-connect/reference/advanced.md"}, "properties": {"repobilityId": "a6b270c399b846b8", "scanner": "scanner-primary", "fingerprint": "8bb2873eda2e57e6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/firebase-data-connect/reference/advanced.md"}, "region": {"startLine": 299}}}]}, {"ruleId": "scanner-83c4efa2dc0d8ee3", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-data-connect/reference/sdks.md"}, "properties": {"repobilityId": "f859bf2d15c41f5a", "scanner": "scanner-primary", "fingerprint": "83c4efa2dc0d8ee3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/firebase-data-connect/reference/sdks.md"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-d812d8da6203bc4d", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/skills/firebase-data-connect/reference/operations.md"}, "properties": {"repobilityId": "8ba10c3c922c6e36", "scanner": "scanner-primary", "fingerprint": "d812d8da6203bc4d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/firebase-data-connect/reference/operations.md"}, "region": {"startLine": 291}}}]}, {"ruleId": "scanner-6d05a1c005711b5b", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-data-connect/reference/config.md"}, "properties": {"repobilityId": "4a6428f858143c07", "scanner": "scanner-primary", "fingerprint": "6d05a1c005711b5b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/firebase-data-connect/reference/config.md"}, "region": {"startLine": 106}}}]}, {"ruleId": "scanner-faa728c2c7fd3f24", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/firebase-ai-logic/SKILL.md"}, "properties": {"repobilityId": "e382651d6f2f401b", "scanner": "scanner-primary", "fingerprint": "faa728c2c7fd3f24", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/firebase-ai-logic/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e487d96f03901522", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-ai-logic/SKILL.md"}, "properties": {"repobilityId": "38555f152a11a17b", "scanner": "scanner-primary", "fingerprint": "e487d96f03901522", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/firebase-ai-logic/SKILL.md"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-dbc41a397b0007ba", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-firestore-standard/SKILL.md"}, "properties": {"repobilityId": "2a5be1a6ba65b1a7", "scanner": "scanner-primary", "fingerprint": "dbc41a397b0007ba", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/firebase-firestore-standard/SKILL.md"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-64551b5c0f65955d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/firebase-firestore-standard/references/indexes.md"}, "properties": {"repobilityId": "2ceefa44c3eb172a", "scanner": "scanner-primary", "fingerprint": "64551b5c0f65955d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/firebase-firestore-standard/references/indexes.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-245d39730a847826", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-firestore-standard/references/indexes.md"}, "properties": {"repobilityId": "f1a08b0b5bb9b5d9", "scanner": "scanner-primary", "fingerprint": "245d39730a847826", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/firebase-firestore-standard/references/indexes.md"}, "region": {"startLine": 81}}}]}, {"ruleId": "scanner-80fd6a211072dc3b", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-firestore-standard/references/web_sdk_usage.md"}, "properties": {"repobilityId": "be4377b02ad9cb97", "scanner": "scanner-primary", "fingerprint": "80fd6a211072dc3b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/firebase-firestore-standard/references/web_sdk_usage.md"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-03dcc77a81bd3669", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/firebase-firestore-standard/references/provisioning.md"}, "properties": {"repobilityId": "599a751d5cb880b3", "scanner": "scanner-primary", "fingerprint": "03dcc77a81bd3669", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/firebase-firestore-standard/references/provisioning.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-55f6f98e017f15c5", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-firestore-standard/references/provisioning.md"}, "properties": {"repobilityId": "7c5e7b429c9a53f3", "scanner": "scanner-primary", "fingerprint": "55f6f98e017f15c5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/firebase-firestore-standard/references/provisioning.md"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-8be16d6ceb4602ee", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-firestore-enterprise-native-mode/SKILL.md"}, "properties": {"repobilityId": "4645f59075d54066", "scanner": "scanner-primary", "fingerprint": "8be16d6ceb4602ee", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/firebase-firestore-enterprise-native-mode/SKILL.md"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-e59905ac186b28af", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/firebase-firestore-enterprise-native-mode/references/indexes.md"}, "properties": {"repobilityId": "0cafb375520b44b3", "scanner": "scanner-primary", "fingerprint": "e59905ac186b28af", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/firebase-firestore-enterprise-native-mode/references/indexes.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c3438085ed6bdc6a", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/firebase-firestore-enterprise-native-mode/references/web_sdk_usage.md"}, "properties": {"repobilityId": "0e34c6f5ee1ea84f", "scanner": "scanner-primary", "fingerprint": "c3438085ed6bdc6a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/firebase-firestore-enterprise-native-mode/references/web_sdk_usage.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-78bd01c4d4667b41", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/firebase-firestore-enterprise-native-mode/references/provisioning.md"}, "properties": {"repobilityId": "2e8e12d733477300", "scanner": "scanner-primary", "fingerprint": "78bd01c4d4667b41", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/firebase-firestore-enterprise-native-mode/references/provisioning.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0bec6cbce49896b7", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-firestore-enterprise-native-mode/references/provisioning.md"}, "properties": {"repobilityId": "588df75f78f43b0b", "scanner": "scanner-primary", "fingerprint": "0bec6cbce49896b7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/firebase-firestore-enterprise-native-mode/references/provisioning.md"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-b08f2c6512423650", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/firebase-firestore-enterprise-native-mode/references/python_sdk_usage.md"}, "properties": {"repobilityId": "00dce8b6dc0f47d5", "scanner": "scanner-primary", "fingerprint": "b08f2c6512423650", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/firebase-firestore-enterprise-native-mode/references/python_sdk_usage.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-be4aa241f2ad93e3", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-auth-basics/SKILL.md"}, "properties": {"repobilityId": "818c905793812c5f", "scanner": "scanner-primary", "fingerprint": "be4aa241f2ad93e3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/firebase-auth-basics/SKILL.md"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-93c9e79cf3f60cbe", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/skills/firebase-auth-basics/references/client_sdk_web.md"}, "properties": {"repobilityId": "074fdc5ac6d17c87", "scanner": "scanner-primary", "fingerprint": "93c9e79cf3f60cbe", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/firebase-auth-basics/references/client_sdk_web.md"}, "region": {"startLine": 59}}}]}, {"ruleId": "scanner-27b5c1bc7c9d6885", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-hosting-basics/SKILL.md"}, "properties": {"repobilityId": "d23c9557839a1160", "scanner": "scanner-primary", "fingerprint": "27b5c1bc7c9d6885", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/firebase-hosting-basics/SKILL.md"}, "region": {"startLine": 44}}}]}, {"ruleId": "scanner-aa97c546358f7ba7", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: .claude/skills/firebase-hosting-basics/references/deploying.md"}, "properties": {"repobilityId": "28888e126b494466", "scanner": "scanner-primary", "fingerprint": "aa97c546358f7ba7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/firebase-hosting-basics/references/deploying.md"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-38341b543ddb011b", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/firebase-hosting-basics/references/configuration.md"}, "properties": {"repobilityId": "1bf6004ef9212f43", "scanner": "scanner-primary", "fingerprint": "38341b543ddb011b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/firebase-hosting-basics/references/configuration.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-91bc318a6f1dd149", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/api/lista-espera/notificar/route.ts:19"}, "properties": {"repobilityId": "c6726da7e067ab0e", "scanner": "scanner-primary", "fingerprint": "91bc318a6f1dd149", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-777e1ce100d13c9f", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/api/contacto/route.ts:19"}, "properties": {"repobilityId": "b2e78e0a174c03e8", "scanner": "scanner-primary", "fingerprint": "777e1ce100d13c9f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-b51f7b8db57ca3a7", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/api/consentimentos/enviar-link/route.ts:55"}, "properties": {"repobilityId": "6e43f87d59f41ba2", "scanner": "scanner-primary", "fingerprint": "b51f7b8db57ca3a7", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-3802099733317dc7", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/api/fiberbrows-waitlist/route.ts:15"}, "properties": {"repobilityId": "49f5c7ab9e93cbe7", "scanner": "scanner-primary", "fingerprint": "3802099733317dc7", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-e1566628dc62aac2", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/api/consulta-virtual/agendar/route.ts:74"}, "properties": {"repobilityId": "6379cb46b8670d36", "scanner": "scanner-primary", "fingerprint": "e1566628dc62aac2", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-fdb2942e60606675", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/admin/definicoes/page.tsx:312"}, "properties": {"repobilityId": "21d3fc21ea21c39d", "scanner": "scanner-primary", "fingerprint": "fdb2942e60606675", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-ce7ac9362e6e140c", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/admin/agenda/page.tsx:76"}, "properties": {"repobilityId": "e12037617bfc0be6", "scanner": "scanner-primary", "fingerprint": "ce7ac9362e6e140c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-74105a620f1b307b", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/acompanhamento/[id]/page.tsx:81"}, "properties": {"repobilityId": "e1e0458a4c622ccd", "scanner": "scanner-primary", "fingerprint": "74105a620f1b307b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-b17f00d083a74ee9", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/lib/email.ts:30"}, "properties": {"repobilityId": "f1bd55cc2e576ab8", "scanner": "scanner-primary", "fingerprint": "b17f00d083a74ee9", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-1b5a76780c3df9aa", "level": "none", "message": {"text": "1 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "d04379b337b44a15", "scanner": "scanner-primary", "fingerprint": "1b5a76780c3df9aa", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}]}]}