github/spec-kit

Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.

60 of your 77 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.

Scan timing: clone 3.01s · analysis 4.96s · 4.2 MB · GitHub API rate-limit (preflight)

https://github.com/github/spec-kit · scanned 2026-06-11 23:26 UTC (1 day, 10 hours ago) · 10 languages

735 raw signals (72 security + 663 graph) 99th percentile · Python · medium (20-100K LoC)

File as issue Image

UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 1 day, 10 hours ago · v8 · 92 actionable findings from 2 signal sources. 90 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON

88.9% cov · 62 findings

Score breakdown â 2026-05-18-v5

Component	Sub-score	Weight	Contribution
`structure_score`	85.0	0.15	12.75
`security_score`	100.0	0.25	25.00
`testing_score`	100.0	0.20	20.00
`documentation_score`	100.0	0.15	15.00
`practices_score`	89.0	0.15	13.35
`code_quality`	38.3	0.10	3.83
Overall		1.00	89.9

Severity distribution — click a segment to filter

Active filters: excluding tests × Reset all

Severity: Critical 0 High 3 Medium 3 Low 41 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 30 System graph 62 Crowd 0 Layer: Quality 73 Security 2 Cicd 3 Software 12 Api 1 Frontend 1

Exclude dismissed / FP Exclude test files

All 3900 nodes from the latest scan, grouped by kind. Each node is a unit the engine identified (file, function, endpoint, table…). Most users won't need this view — it's primarily for debugging the engine's graph extraction or for AI agents that want to enumerate the project structure.

Label	Layer	Status	Path
`test_merge_json_files_type_mismatch_preservation`	software	healthy	`tests/test_merge.py:8`
`test_merge_json_files_deep_nesting`	software	healthy	`tests/test_merge.py:23`
`test_merge_json_files_empty_existing`	software	healthy	`tests/test_merge.py:50`
`test_merge_vscode_realistic_scenario`	software	healthy	`tests/test_merge.py:61`
`test_merge_json_files_with_bom`	software	healthy	`tests/test_merge.py:101`
`test_merge_json_files_not_a_dictionary_template`	software	healthy	`tests/test_merge.py:112`
`test_merge_json_files_unparseable_existing`	software	healthy	`tests/test_merge.py:120`
`test_merge_json_files_list_preservation`	software	healthy	`tests/test_merge.py:128`
`test_merge_json_files_no_changes`	software	healthy	`tests/test_merge.py:142`
`test_merge_json_files_type_mismatch_no_op`	software	healthy	`tests/test_merge.py:155`
`test_handle_vscode_settings_preserves_mode_on_atomic_write`	software	healthy	`tests/test_merge.py:168`
`project_dir`	software	healthy	`tests/test_extension_registration.py:6`
`test_register_extension_new`	software	healthy	`tests/test_extension_registration.py:16`
`test_register_extension_sorting`	software	healthy	`tests/test_extension_registration.py:25`
`test_register_extension_idempotency`	software	healthy	`tests/test_extension_registration.py:35`
`test_unregister_extension`	software	healthy	`tests/test_extension_registration.py:45`
`test_unregister_extension_not_present`	software	healthy	`tests/test_extension_registration.py:56`
`test_register_hooks_triggers_registration`	software	healthy	`tests/test_extension_registration.py:67`
`test_missing_installed_key_initialization`	software	healthy	`tests/test_extension_registration.py:100`
`test_unregister_hooks_full_workflow`	software	healthy	`tests/test_extension_registration.py:115`
`test_unregister_hooks_no_hooks_key`	software	healthy	`tests/test_extension_registration.py:157`
`test_unregister_hooks_corrupted_config`	software	healthy	`tests/test_extension_registration.py:173`
`test_unregister_hooks_with_multiple_extensions`	software	healthy	`tests/test_extension_registration.py:189`
`test_register_hooks_no_hooks_still_registers`	software	healthy	`tests/test_extension_registration.py:257`
`test_register_extension_mixed_type_installed`	software	healthy	`tests/test_extension_registration.py:284`
`test_unregister_hooks_null_hook_values`	software	healthy	`tests/test_extension_registration.py:302`
`test_register_hooks_corrupted_hook_values`	software	healthy	`tests/test_extension_registration.py:319`
`test_register_extension_already_present_in_corrupted_list`	software	healthy	`tests/test_extension_registration.py:360`
`test_register_extension_with_dict_entry`	software	healthy	`tests/test_extension_registration.py:377`
`test_unregister_extension_with_dict_entry`	software	healthy	`tests/test_extension_registration.py:395`
`test_unregister_extension_corrupted_installed`	software	healthy	`tests/test_extension_registration.py:411`
`test_register_hooks_mixed_type_hook_list`	software	healthy	`tests/test_extension_registration.py:425`
`test_unregister_extension_scalar_root`	software	healthy	`tests/test_extension_registration.py:468`
`test_unregister_hooks_scalar_hook_values`	software	healthy	`tests/test_extension_registration.py:482`
`test_installer_ok_but_verify_returns_old_version`	software	healthy	`tests/test_self_upgrade_verification.py:30`
`test_verify_nonzero_exit_is_not_treated_as_success`	software	healthy	`tests/test_self_upgrade_verification.py:53`
`test_verify_accepts_pep440_equivalent_rc_version`	software	healthy	`tests/test_self_upgrade_verification.py:75`
`test_verify_accepts_specify_cli_binary_name_in_version_outp…`	software	healthy	`tests/test_self_upgrade_verification.py:95`
`test_verify_accepts_capitalized_binary_name_in_version_outp…`	software	healthy	`tests/test_self_upgrade_verification.py:115`
`test_verify_rejects_output_without_parseable_version`	software	healthy	`tests/test_self_upgrade_verification.py:135`
`test_verify_uses_current_entrypoint_when_not_on_path`	software	healthy	`tests/test_self_upgrade_verification.py:157`
`test_verify_falls_back_to_path_when_current_entrypoint_is_n…`	software	healthy	`tests/test_self_upgrade_verification.py:188`
`test_verify_ignores_python_entrypoint_and_falls_back_to_spe…`	software	healthy	`tests/test_self_upgrade_verification.py:214`
`test_verify_accepts_specify_cli_named_current_entrypoint`	software	healthy	`tests/test_self_upgrade_verification.py:245`
`test_offline_exits_1_with_phase1_string`	software	healthy	`tests/test_self_upgrade_verification.py:278`
`test_rate_limited_exits_1`	software	healthy	`tests/test_self_upgrade_verification.py:287`
`test_http_500_exits_1`	software	healthy	`tests/test_self_upgrade_verification.py:303`
`test_http_error_categorization`	software	healthy	`tests/test_self_upgrade_verification.py:330`
`test_unparseable_resolved_release_tag_exits_1_without_trace…`	software	healthy	`tests/test_self_upgrade_verification.py:345`
`test_valid_stable_tag`	software	healthy	`tests/test_self_upgrade_verification.py:367`

Showing first 50 of this kind. Full payload available via the JSON button at the top of the page.

Label	Layer	Status	Path
`TestExtensionRegistration`	software	healthy	`tests/test_extension_registration.py:13`
`TestVerificationMismatch`	software	healthy	`tests/test_self_upgrade_verification.py:27`
`TestResolutionFailures`	software	healthy	`tests/test_self_upgrade_verification.py:275`
`TestTagValidation`	software	healthy	`tests/test_self_upgrade_verification.py:364`
`TestUnknownCurrent`	software	healthy	`tests/test_self_upgrade_verification.py:475`
`TestTokenScrubbing`	software	healthy	`tests/test_self_upgrade_verification.py:520`
`TestStepRegistry`	software	healthy	`tests/test_workflows.py:91`
`EmptyStep`	software	healthy	`tests/test_workflows.py:131`
`TestBaseClasses`	software	healthy	`tests/test_workflows.py:142`
`TestExpressions`	software	healthy	`tests/test_workflows.py:199`
`TestBuildExecArgs`	software	healthy	`tests/test_workflows.py:378`
`TestCommandStep`	software	healthy	`tests/test_workflows.py:483`
`TestPromptStep`	software	healthy	`tests/test_workflows.py:735`
`TestShellStep`	software	healthy	`tests/test_workflows.py:909`
`_StubStdin`	software	healthy	`tests/test_workflows.py:944`
`_FakeSys`	software	healthy	`tests/test_workflows.py:960`
`TestGateStep`	software	healthy	`tests/test_workflows.py:982`
`TestIfThenStep`	software	healthy	`tests/test_workflows.py:1197`
`TestSwitchStep`	software	healthy	`tests/test_workflows.py:1241`
`TestWhileStep`	software	healthy	`tests/test_workflows.py:1325`
`TestDoWhileStep`	software	healthy	`tests/test_workflows.py:1380`
`TestFanOutStep`	software	healthy	`tests/test_workflows.py:1454`
`TestFanInStep`	software	healthy	`tests/test_workflows.py:1513`
`TestWorkflowDefinition`	software	healthy	`tests/test_workflows.py:1587`
`TestWorkflowValidation`	software	healthy	`tests/test_workflows.py:1623`
`TestWorkflowEngine`	software	healthy	`tests/test_workflows.py:1750`
`TestContextRunId`	software	healthy	`tests/test_workflows.py:2579`
`TestContinueOnError`	software	healthy	`tests/test_workflows.py:2767`
`TestRunState`	software	healthy	`tests/test_workflows.py:3047`
`TestListRuns`	software	healthy	`tests/test_workflows.py:3206`
`TestWorkflowRegistry`	software	healthy	`tests/test_workflows.py:3240`
`TestWorkflowCatalog`	software	healthy	`tests/test_workflows.py:3297`
`TestWorkflowIntegration`	software	healthy	`tests/test_workflows.py:3407`
`TestWorkflowJsonOutput`	software	healthy	`tests/test_workflows.py:3500`
`TestResumeWithInputs`	software	healthy	`tests/test_workflows.py:3652`
`TestWorkflowAddUrlResolution`	software	healthy	`tests/test_workflows.py:3767`
`FakeResponse`	software	healthy	`tests/test_workflows.py:3886`
`TestUvxEphemeral`	software	healthy	`tests/test_self_upgrade_guidance.py:18`
`TestSourceCheckout`	software	healthy	`tests/test_self_upgrade_guidance.py:53`
`TestUnsupported`	software	healthy	`tests/test_self_upgrade_guidance.py:102`
`TestDryRunNonUpgradablePaths`	software	healthy	`tests/test_self_upgrade_guidance.py:157`
`TestCheckToolClaude`	software	healthy	`tests/test_check_tool.py:19`
`TestCheckToolOther`	software	healthy	`tests/test_check_tool.py:95`
`TestCheckTip`	software	healthy	`tests/test_check_tool.py:124`
`TestWorkflowRunWithoutProject`	software	healthy	`tests/test_workflow_run_without_project.py:9`
`TestVersionFlag`	software	healthy	`tests/test_cli_version.py:14`
`TestVersionCommand`	software	healthy	`tests/test_cli_version.py:39`
`TestDetectionUvTool`	software	healthy	`tests/test_self_upgrade_detection.py:26`
`TestPrefixExpansion`	software	healthy	`tests/test_self_upgrade_detection.py:283`
`TestArgv0Resolution`	software	healthy	`tests/test_self_upgrade_detection.py:304`

Showing first 50 of this kind. Full payload available via the JSON button at the top of the page.

Label	Layer	Status	Path
`DEVELOPMENT.md`	software	healthy	`DEVELOPMENT.md`
`README.md`	software	healthy	`README.md`
`spec-driven.md`	software	healthy	`spec-driven.md`
`.zenodo.json`	software	healthy	`.zenodo.json`
`CONTRIBUTING.md`	software	healthy	`CONTRIBUTING.md`
`pyproject.toml`	software	healthy	`pyproject.toml`
`SUPPORT.md`	software	healthy	`SUPPORT.md`
`CODE_OF_CONDUCT.md`	software	healthy	`CODE_OF_CONDUCT.md`
`SECURITY.md`	software	healthy	`SECURITY.md`
`AGENTS.md`	software	healthy	`AGENTS.md`
`CHANGELOG.md`	software	healthy	`CHANGELOG.md`
`README.md`	software	healthy	`integrations/README.md`
`CONTRIBUTING.md`	software	healthy	`integrations/CONTRIBUTING.md`
`catalog.community.json`	software	healthy	`integrations/catalog.community.json`
`catalog.json`	software	healthy	`integrations/catalog.json`
`post-create.sh`	software	healthy	`.devcontainer/post-create.sh`
`devcontainer.json`	software	healthy	`.devcontainer/devcontainer.json`
`ARCHITECTURE.md`	software	healthy	`presets/ARCHITECTURE.md`
`README.md`	software	healthy	`presets/README.md`
`PUBLISHING.md`	software	healthy	`presets/PUBLISHING.md`
`catalog.community.json`	software	healthy	`presets/catalog.community.json`
`catalog.json`	software	healthy	`presets/catalog.json`
`preset.yml`	software	healthy	`presets/self-test/preset.yml`
`speckit.specify.md`	software	healthy	`presets/self-test/commands/speckit.specify.md`
`speckit.wrap-test.md`	software	healthy	`presets/self-test/commands/speckit.wrap-test.md`
`spec-template.md`	software	healthy	`presets/self-test/templates/spec-template.md`
`agent-file-template.md`	software	healthy	`presets/self-test/templates/agent-file-template.md`
`tasks-template.md`	software	healthy	`presets/self-test/templates/tasks-template.md`
`plan-template.md`	software	healthy	`presets/self-test/templates/plan-template.md`
`constitution-template.md`	software	healthy	`presets/self-test/templates/constitution-template.md`
`checklist-template.md`	software	healthy	`presets/self-test/templates/checklist-template.md`
`README.md`	software	healthy	`presets/lean/README.md`
`preset.yml`	software	healthy	`presets/lean/preset.yml`
`speckit.tasks.md`	software	healthy	`presets/lean/commands/speckit.tasks.md`
`speckit.specify.md`	software	healthy	`presets/lean/commands/speckit.specify.md`
`speckit.implement.md`	software	healthy	`presets/lean/commands/speckit.implement.md`
`speckit.constitution.md`	software	healthy	`presets/lean/commands/speckit.constitution.md`
`speckit.plan.md`	software	healthy	`presets/lean/commands/speckit.plan.md`
`README.md`	software	healthy	`presets/scaffold/README.md`
`preset.yml`	software	healthy	`presets/scaffold/preset.yml`
`speckit.specify.md`	software	healthy	`presets/scaffold/commands/speckit.specify.md`
`speckit.myext.myextcmd.md`	software	healthy	`presets/scaffold/commands/speckit.myext.myextcmd.md`
`myext-template.md`	software	healthy	`presets/scaffold/templates/myext-template.md`
`spec-template.md`	software	healthy	`presets/scaffold/templates/spec-template.md`
`test_merge.py`	software	healthy	`tests/test_merge.py`
`test_extension_registration.py`	software	healthy	`tests/test_extension_registration.py`
`test_self_upgrade_verification.py`	software	healthy	`tests/test_self_upgrade_verification.py`
`test_workflows.py`	software	healthy	`tests/test_workflows.py`
`test_self_upgrade_guidance.py`	software	healthy	`tests/test_self_upgrade_guidance.py`
`__init__.py`	software	healthy	`tests/__init__.py`

Showing first 50 of this kind. Full payload available via the JSON button at the top of the page.

Label	Layer	Status	Path
`integrations`	software	healthy	`integrations`
`.devcontainer`	software	healthy	`.devcontainer`
`presets`	software	healthy	`presets`
`self-test`	software	healthy	`presets/self-test`
`commands`	software	healthy	`presets/self-test/commands`
`templates`	software	healthy	`presets/self-test/templates`
`lean`	software	healthy	`presets/lean`
`commands`	software	healthy	`presets/lean/commands`
`scaffold`	software	healthy	`presets/scaffold`
`commands`	software	healthy	`presets/scaffold/commands`
`templates`	software	healthy	`presets/scaffold/templates`
`tests`	software	healthy	`tests`
`integrations`	software	healthy	`tests/integrations`
`extensions`	software	healthy	`tests/extensions`
`git`	software	healthy	`tests/extensions/git`
`bug`	software	healthy	`tests/extensions/bug`
`hooks`	software	healthy	`tests/hooks`
`docs`	software	healthy	`docs`
`reference`	software	healthy	`docs/reference`
`install`	software	healthy	`docs/install`
`community`	software	healthy	`docs/community`
`template`	software	healthy	`docs/template`
`public`	software	healthy	`docs/template/public`
`concepts`	software	healthy	`docs/concepts`
`scripts`	software	healthy	`scripts`
`bash`	software	healthy	`scripts/bash`
`templates`	software	healthy	`templates`
`commands`	software	healthy	`templates/commands`
`extensions`	software	healthy	`extensions`
`git`	software	healthy	`extensions/git`
`commands`	software	healthy	`extensions/git/commands`
`scripts`	software	healthy	`extensions/git/scripts`
`bash`	software	healthy	`extensions/git/scripts/bash`
`selftest`	software	healthy	`extensions/selftest`
`commands`	software	healthy	`extensions/selftest/commands`
`template`	software	healthy	`extensions/template`
`commands`	software	healthy	`extensions/template/commands`
`agent-context`	software	healthy	`extensions/agent-context`
`commands`	software	healthy	`extensions/agent-context/commands`
`scripts`	software	healthy	`extensions/agent-context/scripts`
`bash`	software	healthy	`extensions/agent-context/scripts/bash`
`bug`	software	healthy	`extensions/bug`
`commands`	software	healthy	`extensions/bug/commands`
`newsletters`	software	healthy	`newsletters`
`workflows`	software	healthy	`workflows`
`speckit`	software	healthy	`workflows/speckit`
`.github`	software	healthy	`.github`
`ISSUE_TEMPLATE`	software	healthy	`.github/ISSUE_TEMPLATE`
`aw`	software	healthy	`.github/aw`
`workflows`	software	healthy	`.github/workflows`

Showing first 50 of this kind. Full payload available via the JSON button at the top of the page.

Label	Layer	Status	Path
`analyze`	cicd	healthy	`.github/workflows/codeql.yml`
`ruff`	cicd	healthy	`.github/workflows/test.yml`
`pytest`	cicd	healthy	`.github/workflows/test.yml`
`activation`	cicd	healthy	`.github/workflows/add-community-extension.lock.yml`
`agent`	cicd	healthy	`.github/workflows/add-community-extension.lock.yml`
`conclusion`	cicd	healthy	`.github/workflows/add-community-extension.lock.yml`
`detection`	cicd	healthy	`.github/workflows/add-community-extension.lock.yml`
`pre_activation`	cicd	healthy	`.github/workflows/add-community-extension.lock.yml`
`safe_outputs`	cicd	healthy	`.github/workflows/add-community-extension.lock.yml`
`markdownlint`	cicd	healthy	`.github/workflows/lint.yml`
`assign`	cicd	healthy	`.github/workflows/catalog-assign.yml`
`bump-version`	cicd	healthy	`.github/workflows/release-trigger.yml`
`build`	cicd	healthy	`.github/workflows/docs.yml`
`deploy`	cicd	healthy	`.github/workflows/docs.yml`
`release`	cicd	healthy	`.github/workflows/release.yml`
`stale`	cicd	healthy	`.github/workflows/stale.yml`
`activation`	cicd	healthy	`.github/workflows/add-community-preset.lock.yml`
`agent`	cicd	healthy	`.github/workflows/add-community-preset.lock.yml`
`conclusion`	cicd	healthy	`.github/workflows/add-community-preset.lock.yml`
`detection`	cicd	healthy	`.github/workflows/add-community-preset.lock.yml`
`pre_activation`	cicd	healthy	`.github/workflows/add-community-preset.lock.yml`
`safe_outputs`	cicd	healthy	`.github/workflows/add-community-preset.lock.yml`

Label	Layer	Status	Path
`gha::codeql`	cicd	healthy	`.github/workflows/codeql.yml`
`gha::test`	cicd	healthy	`.github/workflows/test.yml`
`gha::add-community-extension.lock`	cicd	healthy	`.github/workflows/add-community-extension.lock.yml`
`gha::lint`	cicd	healthy	`.github/workflows/lint.yml`
`gha::catalog-assign`	cicd	healthy	`.github/workflows/catalog-assign.yml`
`gha::release-trigger`	cicd	healthy	`.github/workflows/release-trigger.yml`
`gha::docs`	cicd	healthy	`.github/workflows/docs.yml`
`gha::release`	cicd	healthy	`.github/workflows/release.yml`
`gha::stale`	cicd	healthy	`.github/workflows/stale.yml`
`gha::add-community-preset.lock`	cicd	healthy	`.github/workflows/add-community-preset.lock.yml`

Label	Layer	Status	Path
`auth::tests/integrations/test_integration_rovodev.py`	security	healthy	`tests/integrations/test_integration_rovodev.py`
`auth::tests/test_self_upgrade_verification.py`	security	healthy	`tests/test_self_upgrade_verification.py`
`auth::tests/integrations/test_integration_opencode.py`	security	healthy	`tests/integrations/test_integration_opencode.py`
`auth::src/specify_cli/authentication/github.py`	security	healthy	`src/specify_cli/authentication/github.py`
`auth::extensions/catalog.community.json`	security	healthy	`extensions/catalog.community.json`
`auth::src/specify_cli/authentication/azure_devops.py`	security	healthy	`src/specify_cli/authentication/azure_devops.py`
`auth::tests/test_workflows.py`	security	healthy	`tests/test_workflows.py`

Label	Layer	Status	Path
`GH_AW_GITHUB_TOKEN`	cicd	healthy	`—`
`GH_AW_GITHUB_MCP_SERVER_TOKEN`	cicd	healthy	`—`
`COPILOT_GITHUB_TOKEN`	cicd	healthy	`—`
`GITHUB_TOKEN`	cicd	healthy	`—`
`GH_AW_CI_TRIGGER_TOKEN`	cicd	healthy	`—`
`RELEASE_PAT`	cicd	healthy	`—`

Label	Layer	Status	Path
`port:3001`	network	healthy	`.github/workflows/add-community-extension.lock.yml`
`port:256`	network	healthy	`.github/workflows/add-community-extension.lock.yml`
`port:64828`	network	healthy	`.github/workflows/add-community-extension.lock.yml`

Label	Layer	Status	Path
`repobility-clone-41hloy8u`	software	healthy	`/tmp/repobility-clone-41hloy8u`

Label	Layer	Status	Path
`127.0.0.1`	network	healthy	`tests/test_presets.py`

Label	Layer	Status	Path
`vps::azure`	hardware	healthy	`presets/catalog.community.json`

For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.

For AI agents + API integrations

Email me when this repo regresses

Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.

API access

This page is publicly accessible at: https://repobility.com/scan/fd7adca4-f4b6-4783-9a75-00a79d91bfd4/

To check status programmatically (no auth required):

curl -s https://repobility.com/api/v1/public/scan/fd7adca4-f4b6-4783-9a75-00a79d91bfd4/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.

github/spec-kit

Complete repo analysis

function 50+

class 50+

file 50+

directory 50+

job 22

pipeline 10

auth 7

env_var 6

port 3

repo 1

service 1

vps 1