konedana-dotcom/skills-getting-started-with-github-copilot

Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.

Scan timing: clone 2.72s · analysis 0.1s · 2.6 MB · GitHub API rate-limit (preflight)

konedana-dotcom/skills-getting-started-with-github-copilot

https://github.com/konedana-dotcom/skills-getting-started-with-github-copilot.git · scanned 2026-05-28 21:58 UTC (2 weeks, 1 day ago) · 10 languages

172 raw signals (38 security + 134 graph) 85th percentile · Javascript · tiny (<2K LoC) System graph score 84 (lower by 5)

File as issue Image

UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 2 weeks, 1 day ago · v2 · 19 actionable findings from 2 signal sources. 86 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON

66.7% cov · 9 findings

Score breakdown â 2026-05-18-v5

Component	Sub-score	Weight	Contribution
`structure_score`	70.0	0.15	10.50
`security_score`	95.5	0.25	23.88
`testing_score`	70.0	0.20	14.00
`documentation_score`	75.0	0.15	11.25
`practices_score`	77.0	0.15	11.55
`code_quality`	80.0	0.10	8.00
Overall		1.00	79.2

Severity distribution — click a segment to filter

Active filters: severity: info × excluding tests × Reset all

Severity: Critical 0 High 3 Medium 9 Low 3 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 10 System graph 9 Crowd 0 Layer: Quality 5 Security 5 Software 2 Cicd 5 Frontend 1 Api 1

Exclude dismissed / FP Exclude test files

Scan summary Quality grade B+ (79/100). Dimensions: security 96, maintainability 70. 38 findings (32 security). 153 lines analyzed.

Showing 4 of 19 actionable findings. 105 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

info Security checks software Xss conf 1.00 [SEC040] innerHTML XSS — template literal with server-supplied data: Setting .innerHTML with a template literal that interpolates server-supplied or user-supplied data is the canonical stored/reflected XSS vector. The browser parses the HTML and executes any <script> or event-handler attributes in the data. CWE-79. Especially dangerous when the data comes from a CV parser, profile field, or any user-input pipeline.

For plain text: use el.textContent = data.value (auto-escapes). For HTML you need to render: el.innerHTML = DOMPurify.sanitize(html). For React/Vue/Svelte: stop using innerHTML; use the framework's binding. When data comes from CV/PDF parsers, sanitize at the parser boundary too.

src/static/app.js:23

info Security checks quality Quality conf 1.00 [SEC135] Auth/permission check missing on AI-generated endpoint: Mutating HTTP endpoint generated by an AI agent without an auth decorator or middleware. The number-one production-incident pattern we see in AI-generated SaaS code: the AI builds the route, builds the handler, and forgets to wire the auth check that the rest of the codebase uses. CWE-862 (missing authorization). High-severity because the route is fully functional, just unprotected — attackers can call it directly.

Add the project's auth decorator/middleware: `@login_required` (Django/Flask), `@permission_classes([IsAuthenticated])` (DRF), `Depends(get_current_user)` (FastAPI), `requireAuth` middleware (Express). For genuinely public endpoints, add a `# public-endpoint` marker comment so future scans skip the…

src/app.py:55

info Security checks quality Quality conf 1.00 ✓ Repobility [MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed.

Review and fix per the pattern semantics. See CWE-532 / for context.

src/static/app.js:40

info System graph frontend Coverage conf 1.00 No frontend routes/components detected

No React/Vue/Next routes were found. This is fine for backend-only repos.

For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.

For AI agents + API integrations

Email me when this repo regresses

Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.

API access

This page is publicly accessible at: https://repobility.com/scan/e904f344-0165-4eac-89b3-c5dc2dbddab0/

To check status programmatically (no auth required):

curl -s https://repobility.com/api/v1/public/scan/e904f344-0165-4eac-89b3-c5dc2dbddab0/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.