{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:00.182827Z","repo":{"ref":{"host":"github.com","owner":"Ces107","name":"agent-forge"},"default_branch":"main","clone_url":"https://github.com/Ces107/agent-forge.git","html_url":"https://github.com/Ces107/agent-forge","description":"Free agent skills and Claude Code plugins: launch-check (pre-launch audit of any URL: exposed keys, open database, SEO, phone design) and done-gate (no \"done\" until the tests pass). SKILL.md format for Claude Code, Codex, Cursor and Copilot.","stars":0,"forks":0,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":12067,"primary_language":"Python","license_spdx":"MIT","created_at":"2026-06-01T14:25:42Z","pushed_at":"2026-10-23T12:18:46Z","security_policy_url":null,"distribution":{"owner_created_at":"2023-09-17T23:34:19Z","owner_type":"User","release_assets":[]}},"commit_sha":"20bf7ef688c37257e8ed4ed22ad6331f738c4516","profile":{"lines_by_language":{"Python":29475},"files_by_category":{"docs":141,"binary":68,"source":43,"config":24,"test":14,"other":7,"vendored":3},"source_lines":25784,"test_lines":3691},"pillars":{"ai_provenance":{"score":7.8,"confidence":0.95,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":0.0784,"suspected_share":0.7686,"estimated_share":0.0784,"ai_artifacts":5.0,"flagged_work_units":4.0,"flagged_releases":null,"style_index":0.039},"summary":"Explicit AI attribution on 8% of first-party code added; an estimated 8% including velocity signals."},"quality":{"score":53.7,"confidence":0.9,"coverage":1.0,"label":"weak","breakdown":{"complexity":22.8,"duplication":1.7,"lint":76.2,"testing":82.2,"docs":65.0,"type_safety":100.0,"process":null},"summary":"Code quality is weak: test-to-source ratio 0.14, CI runs tests; 49% of function code in complex or long functions; 68% duplicated lines. Weakest area: duplication."},"security":{"score":69.1,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":100.0,"sast":89.9,"dependencies":77.9,"ci_actions":24.2,"posture":0.0,"scorecard":null},"summary":"Security posture is weak: 54 known vulnerabilities in 1 dependencies; 3 high-severity SAST findings; 6 high-severity workflow issues. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":11.0,"checked":11.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":130.0,"attributed_commits":5.0,"attributed_commit_share":0.038461538461538464,"effective_loc":30662.0,"attributed_loc":2404.0,"attributed_loc_share":0.07840323527493315,"tools_detected":1.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"Claude Code: 5 attributed commits, 2,404 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"998e7f4643623fe9e366c853aefa79c5c054b079","url":"https://github.com/Ces107/agent-forge/commit/998e7f4643623fe9e366c853aefa79c5c054b079","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"49fa17691aff5f721d1af940d6ea85754d17a329","url":"https://github.com/Ces107/agent-forge/commit/49fa17691aff5f721d1af940d6ea85754d17a329","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"708ee99541d9cc65272f2d6614e94dfad860f772","url":"https://github.com/Ces107/agent-forge/commit/708ee99541d9cc65272f2d6614e94dfad860f772","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"443bbbd6ce991e8f78a8dc496140c3843ddb1fcb","url":"https://github.com/Ces107/agent-forge/commit/443bbbd6ce991e8f78a8dc496140c3843ddb1fcb","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"852469136b2ee07c10d408ae8c6345f828acea4c","url":"https://github.com/Ces107/agent-forge/commit/852469136b2ee07c10d408ae8c6345f828acea4c","weight":0.9}],"data":{"attributed_loc_by_commit":{"852469136b2ee07c10d408ae8c6345f828acea4c":0,"443bbbd6ce991e8f78a8dc496140c3843ddb1fcb":1283,"708ee99541d9cc65272f2d6614e94dfad860f772":517,"998e7f4643623fe9e366c853aefa79c5c054b079":0,"49fa17691aff5f721d1af940d6ea85754d17a329":604},"tools":{"claude-code":{"name":"Claude Code","commits":5,"loc":2404,"first_seen":1780321229,"last_seen":1780322886}},"monthly":{"2026-06":{"loc":4488,"attributed_loc":2404},"2026-10":{"loc":26174,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":5.0,"workflow_agents":0.0,"tools_configured":1.0,"earliest_adoption":1780320990.0},"findings":[],"evidence":[{"kind":"ai-artifact","description":".claude/agents/adversarial-reviewer.md (claude-code configuration)","ref":".claude/agents/adversarial-reviewer.md","url":"https://github.com/Ces107/agent-forge/blob/20bf7ef688c37257e8ed4ed22ad6331f738c4516/.claude/agents/adversarial-reviewer.md","weight":0.5},{"kind":"ai-artifact","description":".claude/agents/architect.md (claude-code configuration)","ref":".claude/agents/architect.md","url":"https://github.com/Ces107/agent-forge/blob/20bf7ef688c37257e8ed4ed22ad6331f738c4516/.claude/agents/architect.md","weight":0.5},{"kind":"ai-artifact","description":".claude/agents/implementer.md (claude-code configuration)","ref":".claude/agents/implementer.md","url":"https://github.com/Ces107/agent-forge/blob/20bf7ef688c37257e8ed4ed22ad6331f738c4516/.claude/agents/implementer.md","weight":0.5},{"kind":"ai-artifact","description":".claude/agents/planner.md (claude-code configuration)","ref":".claude/agents/planner.md","url":"https://github.com/Ces107/agent-forge/blob/20bf7ef688c37257e8ed4ed22ad6331f738c4516/.claude/agents/planner.md","weight":0.5},{"kind":"ai-artifact","description":".claude/agents/verifier.md (claude-code configuration)","ref":".claude/agents/verifier.md","url":"https://github.com/Ces107/agent-forge/blob/20bf7ef688c37257e8ed4ed22ad6331f738c4516/.claude/agents/verifier.md","weight":0.5}],"data":{"artifacts":[{"tool":"claude-code","path":".claude/agents/adversarial-reviewer.md","added_at":1780320990},{"tool":"claude-code","path":".claude/agents/architect.md","added_at":1780320990},{"tool":"claude-code","path":".claude/agents/implementer.md","added_at":1780320990},{"tool":"claude-code","path":".claude/agents/planner.md","added_at":1780327150},{"tool":"claude-code","path":".claude/agents/verifier.md","added_at":1780320990}],"workflows":[],"tools":["claude-code"]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":15.0,"flagged_units":4.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":30662.0,"flagged_loc":23566.0,"flagged_loc_share":0.7685734785728263,"max_loc_per_hour":3196.1676646706587,"median_loc_per_hour":215.05728314238954,"pr_timed_units":0.0,"excluded_import_loc":0.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"6,672 lines of first-party code in ~2.1h (3,196 lines/hour, 10 commit session)","ref":"4aef0e4f0d4648f979325f7c63fa55ec765e8c72","url":"https://github.com/Ces107/agent-forge/commit/4aef0e4f0d4648f979325f7c63fa55ec765e8c72","weight":0.6},{"kind":"velocity-burst","description":"12,438 lines of first-party code in ~4.8h (2,603 lines/hour, 28 commit session)","ref":"1f3a73700fd507fbee1b4ee98666479b06c24e5f","url":"https://github.com/Ces107/agent-forge/commit/1f3a73700fd507fbee1b4ee98666479b06c24e5f","weight":0.6},{"kind":"velocity-burst","description":"2,564 lines of first-party code in ~2.0h (1,262 lines/hour, 2 commit session)","ref":"d30263d5df6af27d7bfcd398f16d49d5746661f9","url":"https://github.com/Ces107/agent-forge/commit/d30263d5df6af27d7bfcd398f16d49d5746661f9","weight":0.3785536568694463},{"kind":"velocity-burst","description":"1,892 lines of first-party code in ~2.9h (661 lines/hour, 4 commit session)","ref":"f582c44182a5af37ee005021a2ecf2608f1b6a7a","url":"https://github.com/Ces107/agent-forge/commit/f582c44182a5af37ee005021a2ecf2608f1b6a7a","weight":0.19821127170433603}],"data":{"flagged_loc_by_commit":{"ad989522d4358a79546b4eea1b7818967b182699":973,"c88d81bbad6eb6ce95333f999fe635a19e01dae5":656,"b53fab6d9348c1defafb8acc6d94009e4cacba40":2,"f582c44182a5af37ee005021a2ecf2608f1b6a7a":261,"adc18cc23f9db6682c4b21e7f44d58bdbc3a1da6":2485,"d30263d5df6af27d7bfcd398f16d49d5746661f9":79,"9edbd14ea2cdb7b88a590b8977f992d1c96504cf":9780,"f9cdcb03e9e8a1e795f322752a136679a3e4aa52":862,"6b6700e2d325622ffe024457bd13723e2d646146":1,"b95be008c5df57b7b77e2124170a56f888663f8f":2,"3f89bf23f2c67d3ff29f317668f2f344f9caaacc":253,"56cafc427b267df47077f6c0b502caee29cfbc98":15,"4a08c0bbe7af5bf1b4138a389940b01e9d35f218":8,"076159e6edc53d3dac68d6d687c94c72876fc40d":8,"488d3850c58c16083c6da28d77a5691c3ceb5c48":6,"baf2d778cf15ce8ff33a9f93cc3732c8977091c5":68,"ba2fb36ccf2ffd170b1d3181bdf6b73af31021a4":4,"2473a648275f96e197b97018ce647a2cbe0bb9cb":145,"1d2635796302ca7b978081c8d5cc5092d0034d1e":243,"3682bfd751785bae6da3c32264164d8f2343346d":208,"6b4d1dfa9c293a5325505988b49fc51ad6caf4ce":150,"2f685bd8d54595f133ab7ac730854c6b518b291f":70,"e7486061d747ddedb64eb6b1e924ed34716b367f":2,"3424a7db8627c1cc503f5dbc0f839c15690bd8e8":281,"77004dafb032aa0cff6fc56d2dfca0114cc750a6":7,"24358dc924193cd9b5b3c92597400c951b9b7789":1,"50cc3509ac220b4d598b23ab0b336fe955b7e981":3,"6585d3b1579634829b4d5788fecc5c75c20295d8":32,"c3ffd9f1f5dc95d2fa2f8b87493255cb821e3cdf":9,"0f45c12dfa07d238610c1bf18d0405322f1c3801":2,"1ad028538473f9fafec4d3d193c6898beccaf593":127,"b1eb8c78a0a4ded7c3071e7184326ecc5fc331c8":3,"73eb1da58e9683202190bec216c0b47cbc69a369":2,"1f3a73700fd507fbee1b4ee98666479b06c24e5f":146,"96e8cede1547d9c0ed798a32658dc65cfedf072b":255,"713007a9a394ea44344b1d112f9ec5e7c360d81d":2,"295d61c11ad3b9a670db60834467f670f8f22f5a":4912,"0dbd5efe7ef5029dc5de019f83ff67c041dfef90":845,"509e10116268a5ac107ca047a950c996e6460054":5,"075fc864ca11747a58d8b35fbb9e9e0206ea0b7f":30,"8ed75f5ecb6b3265de187a84939bebf4910e34ae":609,"4b7fbed030e07a64834938bc4ab0818e853cfdeb":3,"4c389de9f75e8f99849631fb6246aa9113f4298e":3,"4aef0e4f0d4648f979325f7c63fa55ec765e8c72":8},"excluded_import_commits":[]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":25784.0,"index":0.039,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":2.0,"per_kloc:emoji_in_code":0.078,"files:emoji_in_code":1.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":17.0,"findings_high":3.0,"findings_medium":14.0,"findings_low":0.0,"weighted_findings":7.85,"scanned_lines":25784.0,"parse_errors":6.0},"findings":[{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"forge/orchestrator.py","line":124,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:forge/orchestrator.py:124"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"web/launch-check/scan.py","line":255,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:web/launch-check/scan.py:255"},{"rule_id":"opengrep/dockerfile.security.missing-user","severity":"high","message":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]","path":"workspaces/ledger/Dockerfile","line":9,"fingerprint":"dockerfile.security.missing-user:workspaces/ledger/Dockerfile:9"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"plugins/agent-forge/skills/launch-check/scripts/polish_audit.py","line":699,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:plugins/agent-forge/skills/launch-check/scripts/polish_audit.py:699"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"plugins/agent-forge/skills/launch-check/scripts/polish_audit.py","line":713,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:plugins/agent-forge/skills/launch-check/scripts/polish_audit.py:713"},{"rule_id":"opengrep/python.lang.security.insecure-hash-algorithm-sha1","severity":"medium","message":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium]","path":"plugins/agent-forge/skills/launch-check/scripts/polish_audit.py","line":1059,"fingerprint":"python.lang.security.insecure-hash-algorithm-sha1:plugins/agent-forge/skills/launch-check/scripts/polish_audit.py:1059"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"plugins/launch-check/skills/launch-check/scripts/polish_audit.py","line":699,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:plugins/launch-check/skills/launch-check/scripts/polish_audit.py:699"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"plugins/launch-check/skills/launch-check/scripts/polish_audit.py","line":713,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:plugins/launch-check/skills/launch-check/scripts/polish_audit.py:713"},{"rule_id":"opengrep/python.lang.security.insecure-hash-algorithm-sha1","severity":"medium","message":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium]","path":"plugins/launch-check/skills/launch-check/scripts/polish_audit.py","line":1059,"fingerprint":"python.lang.security.insecure-hash-algorithm-sha1:plugins/launch-check/skills/launch-check/scripts/polish_audit.py:1059"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"skills/launch-check/scripts/polish_audit.py","line":699,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:skills/launch-check/scripts/polish_audit.py:699"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"skills/launch-check/scripts/polish_audit.py","line":713,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:skills/launch-check/scripts/polish_audit.py:713"},{"rule_id":"opengrep/python.lang.security.insecure-hash-algorithm-sha1","severity":"medium","message":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium]","path":"skills/launch-check/scripts/polish_audit.py","line":1059,"fingerprint":"python.lang.security.insecure-hash-algorithm-sha1:skills/launch-check/scripts/polish_audit.py:1059"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"web/launch-check/app.py","line":276,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:web/launch-check/app.py:276"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"web/launch-check/fixpack.py","line":390,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:web/launch-check/fixpack.py:390"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"web/launch-check/fixpack.py","line":421,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:web/launch-check/fixpack.py:421"},{"rule_id":"opengrep/python.lang.security.audit.regex_dos","severity":"medium","message":"Detected usage of re.compile with an inefficient regular expression. This can lead to regular expression denial of service, which can result in service down time. Instead, check all regexes or use safer alternatives such as pyre2. [confidence low]","path":"web/launch-check/ogmaker.py","line":42,"fingerprint":"python.lang.security.audit.regex_dos:web/launch-check/ogmaker.py:42"},{"rule_id":"opengrep/python.lang.security.audit.non-literal-import","severity":"medium","message":"Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code. [confidence low]","path":"web/launch-check/run_guarded.py","line":472,"fingerprint":"python.lang.security.audit.non-literal-import:web/launch-check/run_guarded.py:472"}],"evidence":[],"data":{"rulesets":["python","dockerfile"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":1.0,"vulnerabilities":54.0,"vulns_critical":5.0,"vulns_high":35.0,"vulns_medium":13.0,"vulns_low":0.0,"vulns_unknown":1.0,"penalty":15.0},"findings":[{"rule_id":"osv/GHSA-5x8w-8jj5-q52h","severity":"critical","message":"pillow@10.4.0 (PyPI) is affected by PYSEC-2026-4330, GHSA-5x8w-8jj5-q52h","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-5x8w-8jj5-q52h"},{"rule_id":"osv/GHSA-8g5g-8vmr-9782","severity":"critical","message":"pillow@10.4.0 (PyPI) is affected by PYSEC-2026-4332, GHSA-8g5g-8vmr-9782","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-8g5g-8vmr-9782"},{"rule_id":"osv/GHSA-xvh5-g6gv-559v","severity":"critical","message":"pillow@10.4.0 (PyPI) is affected by PYSEC-2026-4363, GHSA-xvh5-g6gv-559v","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-xvh5-g6gv-559v"},{"rule_id":"osv/GHSA-332p-7hrc-92wf","severity":"critical","message":"pillow@10.4.0 (PyPI) is affected by GHSA-332p-7hrc-92wf","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-332p-7hrc-92wf"},{"rule_id":"osv/GHSA-w889-685w-c8fh","severity":"critical","message":"pillow@10.4.0 (PyPI) is affected by GHSA-w889-685w-c8fh","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-w889-685w-c8fh"},{"rule_id":"osv/GHSA-cfh3-3jmp-rvhc","severity":"high","message":"pillow@10.4.0 (PyPI) is affected by PYSEC-2026-2249, GHSA-cfh3-3jmp-rvhc","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-cfh3-3jmp-rvhc"},{"rule_id":"osv/GHSA-whj4-6x5x-4v2j","severity":"high","message":"pillow@10.4.0 (PyPI) is affected by PYSEC-2026-2250, GHSA-whj4-6x5x-4v2j","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-whj4-6x5x-4v2j"},{"rule_id":"osv/GHSA-pwv6-vv43-88gr","severity":"high","message":"pillow@10.4.0 (PyPI) is affected by PYSEC-2026-2252, GHSA-pwv6-vv43-88gr","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-pwv6-vv43-88gr"},{"rule_id":"osv/GHSA-8v84-f9pq-wr9x","severity":"high","message":"pillow@10.4.0 (PyPI) is affected by PYSEC-2026-2253, GHSA-8v84-f9pq-wr9x","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-8v84-f9pq-wr9x"},{"rule_id":"osv/GHSA-5x94-69rx-g8h2","severity":"high","message":"pillow@10.4.0 (PyPI) is affected by PYSEC-2026-2254, GHSA-5x94-69rx-g8h2","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-5x94-69rx-g8h2"},{"rule_id":"osv/GHSA-45hq-cxwh-f6vc","severity":"high","message":"pillow@10.4.0 (PyPI) is affected by PYSEC-2026-2255, GHSA-45hq-cxwh-f6vc","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-45hq-cxwh-f6vc"},{"rule_id":"osv/GHSA-phj9-mv4w-65pm","severity":"high","message":"pillow@10.4.0 (PyPI) is affected by PYSEC-2026-2256, GHSA-phj9-mv4w-65pm","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-phj9-mv4w-65pm"},{"rule_id":"osv/GHSA-6r8x-57c9-28j4","severity":"high","message":"pillow@10.4.0 (PyPI) is affected by PYSEC-2026-3451, GHSA-6r8x-57c9-28j4","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-6r8x-57c9-28j4"},{"rule_id":"osv/GHSA-9hw9-ch79-4vh6","severity":"high","message":"pillow@10.4.0 (PyPI) is affected by PYSEC-2026-3453, GHSA-9hw9-ch79-4vh6","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-9hw9-ch79-4vh6"},{"rule_id":"osv/GHSA-xj96-63gp-2gmr","severity":"high","message":"pillow@10.4.0 (PyPI) is affected by PYSEC-2026-3454, GHSA-xj96-63gp-2gmr","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-xj96-63gp-2gmr"},{"rule_id":"osv/GHSA-62p4-gmf7-7g93","severity":"high","message":"pillow@10.4.0 (PyPI) is affected by PYSEC-2026-3493, GHSA-62p4-gmf7-7g93","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-62p4-gmf7-7g93"},{"rule_id":"osv/GHSA-jjj6-mw9f-p565","severity":"high","message":"pillow@10.4.0 (PyPI) is affected by PYSEC-2026-3495, GHSA-jjj6-mw9f-p565","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-jjj6-mw9f-p565"},{"rule_id":"osv/GHSA-vjc4-5qp5-m44j","severity":"high","message":"pillow@10.4.0 (PyPI) is affected by PYSEC-2026-3496, GHSA-vjc4-5qp5-m44j","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-vjc4-5qp5-m44j"},{"rule_id":"osv/GHSA-27h8-gf7j-v5hc","severity":"high","message":"pillow@10.4.0 (PyPI) is affected by PYSEC-2026-4326, GHSA-27h8-gf7j-v5hc","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-27h8-gf7j-v5hc"},{"rule_id":"osv/GHSA-4558-3h8r-v8xp","severity":"high","message":"pillow@10.4.0 (PyPI) is affected by PYSEC-2026-4327, GHSA-4558-3h8r-v8xp","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-4558-3h8r-v8xp"},{"rule_id":"osv/GHSA-58r4-6rv3-gfh8","severity":"high","message":"pillow@10.4.0 (PyPI) is affected by PYSEC-2026-4329, GHSA-58r4-6rv3-gfh8","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-58r4-6rv3-gfh8"},{"rule_id":"osv/GHSA-7mwm-ghpf-9vrm","severity":"high","message":"pillow@10.4.0 (PyPI) is affected by PYSEC-2026-4331, GHSA-7mwm-ghpf-9vrm","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-7mwm-ghpf-9vrm"},{"rule_id":"osv/GHSA-pchr-8j38-3x4p","severity":"high","message":"pillow@10.4.0 (PyPI) is affected by PYSEC-2026-4334, GHSA-pchr-8j38-3x4p","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-pchr-8j38-3x4p"},{"rule_id":"osv/GHSA-xgh8-jp6q-p5x8","severity":"high","message":"pillow@10.4.0 (PyPI) is affected by PYSEC-2026-4335, GHSA-xgh8-jp6q-p5x8","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-xgh8-jp6q-p5x8"},{"rule_id":"osv/GHSA-g842-9rc4-69pw","severity":"high","message":"pillow@10.4.0 (PyPI) is affected by PYSEC-2026-4338, GHSA-g842-9rc4-69pw","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-g842-9rc4-69pw"},{"rule_id":"osv/GHSA-3j72-p6qg-6xp7","severity":"high","message":"pillow@10.4.0 (PyPI) is affected by PYSEC-2026-4341, GHSA-3j72-p6qg-6xp7","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-3j72-p6qg-6xp7"},{"rule_id":"osv/GHSA-9v9v-9qvf-h2hj","severity":"high","message":"pillow@10.4.0 (PyPI) is affected by PYSEC-2026-4343, GHSA-9v9v-9qvf-h2hj","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-9v9v-9qvf-h2hj"},{"rule_id":"osv/GHSA-22hg-r758-rrw9","severity":"high","message":"pillow@10.4.0 (PyPI) is affected by GHSA-22hg-r758-rrw9","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-22hg-r758-rrw9"},{"rule_id":"osv/GHSA-5xm2-6676-qcp9","severity":"high","message":"pillow@10.4.0 (PyPI) is affected by GHSA-5xm2-6676-qcp9","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-5xm2-6676-qcp9"},{"rule_id":"osv/GHSA-65qm-jvmh-6pqg","severity":"high","message":"pillow@10.4.0 (PyPI) is affected by GHSA-65qm-jvmh-6pqg","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-65qm-jvmh-6pqg"},{"rule_id":"osv/GHSA-c6hw-5grf-ff96","severity":"high","message":"pillow@10.4.0 (PyPI) is affected by GHSA-c6hw-5grf-ff96","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-c6hw-5grf-ff96"},{"rule_id":"osv/GHSA-f2g6-542v-9j58","severity":"high","message":"pillow@10.4.0 (PyPI) is affected by GHSA-f2g6-542v-9j58","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-f2g6-542v-9j58"},{"rule_id":"osv/GHSA-g7cr-3p24-7wf7","severity":"high","message":"pillow@10.4.0 (PyPI) is affected by GHSA-g7cr-3p24-7wf7","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-g7cr-3p24-7wf7"},{"rule_id":"osv/GHSA-gg2r-wvfm-q9rx","severity":"high","message":"pillow@10.4.0 (PyPI) is affected by GHSA-gg2r-wvfm-q9rx","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-gg2r-wvfm-q9rx"},{"rule_id":"osv/GHSA-j4m9-6w36-pw47","severity":"high","message":"pillow@10.4.0 (PyPI) is affected by GHSA-j4m9-6w36-pw47","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-j4m9-6w36-pw47"},{"rule_id":"osv/GHSA-jg86-v3jv-hrpm","severity":"high","message":"pillow@10.4.0 (PyPI) is affected by GHSA-jg86-v3jv-hrpm","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-jg86-v3jv-hrpm"},{"rule_id":"osv/GHSA-mrfp-p49p-3hf2","severity":"high","message":"pillow@10.4.0 (PyPI) is affected by GHSA-mrfp-p49p-3hf2","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-mrfp-p49p-3hf2"},{"rule_id":"osv/GHSA-p4wg-p73j-c528","severity":"high","message":"pillow@10.4.0 (PyPI) is affected by GHSA-p4wg-p73j-c528","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-p4wg-p73j-c528"},{"rule_id":"osv/GHSA-q45j-58j2-45rg","severity":"high","message":"pillow@10.4.0 (PyPI) is affected by GHSA-q45j-58j2-45rg","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-q45j-58j2-45rg"},{"rule_id":"osv/GHSA-xcvg-w56q-r89m","severity":"high","message":"pillow@10.4.0 (PyPI) is affected by GHSA-xcvg-w56q-r89m","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-xcvg-w56q-r89m"},{"rule_id":"osv/GHSA-wjx4-4jcj-g98j","severity":"medium","message":"pillow@10.4.0 (PyPI) is affected by PYSEC-2026-165, GHSA-wjx4-4jcj-g98j","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-wjx4-4jcj-g98j"},{"rule_id":"osv/GHSA-4x4j-2g7c-83w6","severity":"medium","message":"pillow@10.4.0 (PyPI) is affected by PYSEC-2026-2257, GHSA-4x4j-2g7c-83w6","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-4x4j-2g7c-83w6"},{"rule_id":"osv/GHSA-r73j-pqj5-w3x7","severity":"medium","message":"pillow@10.4.0 (PyPI) is affected by PYSEC-2026-2874, GHSA-r73j-pqj5-w3x7","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-r73j-pqj5-w3x7"},{"rule_id":"osv/GHSA-fj7v-r99m-22gq","severity":"medium","message":"pillow@10.4.0 (PyPI) is affected by PYSEC-2026-3494, GHSA-fj7v-r99m-22gq","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-fj7v-r99m-22gq"},{"rule_id":"osv/GHSA-p8hx-v2p6-rp84","severity":"medium","message":"pillow@10.4.0 (PyPI) is affected by PYSEC-2026-4337, GHSA-p8hx-v2p6-rp84","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-p8hx-v2p6-rp84"},{"rule_id":"osv/GHSA-4rm8-3hmm-39fg","severity":"medium","message":"pillow@10.4.0 (PyPI) is affected by PYSEC-2026-4340, GHSA-4rm8-3hmm-39fg","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-4rm8-3hmm-39fg"},{"rule_id":"osv/GHSA-24rc-8hj2-v98c","severity":"medium","message":"pillow@10.4.0 (PyPI) is affected by GHSA-24rc-8hj2-v98c","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-24rc-8hj2-v98c"},{"rule_id":"osv/GHSA-254f-3936-288h","severity":"medium","message":"pillow@10.4.0 (PyPI) is affected by GHSA-254f-3936-288h","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-254f-3936-288h"},{"rule_id":"osv/GHSA-462x-pgg6-55fp","severity":"medium","message":"pillow@10.4.0 (PyPI) is affected by GHSA-462x-pgg6-55fp","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-462x-pgg6-55fp"},{"rule_id":"osv/GHSA-74r2-7ff9-mjj2","severity":"medium","message":"pillow@10.4.0 (PyPI) is affected by GHSA-74r2-7ff9-mjj2","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-74r2-7ff9-mjj2"},{"rule_id":"osv/GHSA-fc9g-5qg7-mf45","severity":"medium","message":"pillow@10.4.0 (PyPI) is affected by GHSA-fc9g-5qg7-mf45","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-fc9g-5qg7-mf45"},{"rule_id":"osv/GHSA-rfgq-q3w2-pmv2","severity":"medium","message":"pillow@10.4.0 (PyPI) is affected by GHSA-rfgq-q3w2-pmv2","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-rfgq-q3w2-pmv2"},{"rule_id":"osv/GHSA-vx6w-vv9f-6gvg","severity":"medium","message":"pillow@10.4.0 (PyPI) is affected by GHSA-vx6w-vv9f-6gvg","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-vx6w-vv9f-6gvg"},{"rule_id":"osv/GHSA-wqgw-9xfh-qf2g","severity":"medium","message":"pillow@10.4.0 (PyPI) is affected by GHSA-wqgw-9xfh-qf2g","path":"web/launch-check/requirements.txt","line":null,"fingerprint":"pillow@10.4.0 (PyPI):GHSA-wqgw-9xfh-qf2g"}],"evidence":[],"data":{"ecosystems":["PyPI"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":2.0,"findings":13.0,"findings_high":6.0,"findings_medium":7.0,"findings_low":0.0,"penalty":85.2},"findings":[{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":16,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:16"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":17,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:17"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":37,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:37"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":38,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:38"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":62,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:62"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":65,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:65"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":16,"fingerprint":"artipacked:.github/workflows/ci.yml:16"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":37,"fingerprint":"artipacked:.github/workflows/ci.yml:37"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":62,"fingerprint":"artipacked:.github/workflows/ci.yml:62"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/ci.yml","line":1,"fingerprint":"excessive-permissions:.github/workflows/ci.yml:1"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/ci.yml","line":9,"fingerprint":"excessive-permissions:.github/workflows/ci.yml:9"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/ci.yml","line":33,"fingerprint":"excessive-permissions:.github/workflows/ci.yml:33"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/ci.yml","line":58,"fingerprint":"excessive-permissions:.github/workflows/ci.yml:58"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.0,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":917.0,"function_nloc":15060.0,"mean_ccn":8.73,"p90_ccn":18.0,"complex_functions":121.0,"long_functions":14.0,"many_param_functions":15.0,"risky_nloc_share":0.4933},"findings":[],"evidence":[{"kind":"complex-function","description":"do_GET in web/launch-check/app.py: complexity 160, 224 lines","ref":"web/launch-check/app.py","url":"https://github.com/Ces107/agent-forge/blob/20bf7ef688c37257e8ed4ed22ad6331f738c4516/web/launch-check/app.py#L1385","weight":1.0},{"kind":"complex-function","description":"emit_fixes in plugins/agent-forge/skills/launch-check/scripts/geo_audit.py: complexity 128, 209 lines","ref":"plugins/agent-forge/skills/launch-check/scripts/geo_audit.py","url":"https://github.com/Ces107/agent-forge/blob/20bf7ef688c37257e8ed4ed22ad6331f738c4516/plugins/agent-forge/skills/launch-check/scripts/geo_audit.py#L1703","weight":1.0},{"kind":"complex-function","description":"emit_fixes in plugins/launch-check/skills/launch-check/scripts/geo_audit.py: complexity 128, 209 lines","ref":"plugins/launch-check/skills/launch-check/scripts/geo_audit.py","url":"https://github.com/Ces107/agent-forge/blob/20bf7ef688c37257e8ed4ed22ad6331f738c4516/plugins/launch-check/skills/launch-check/scripts/geo_audit.py#L1703","weight":1.0},{"kind":"complex-function","description":"emit_fixes in skills/launch-check/scripts/geo_audit.py: complexity 128, 209 lines","ref":"skills/launch-check/scripts/geo_audit.py","url":"https://github.com/Ces107/agent-forge/blob/20bf7ef688c37257e8ed4ed22ad6331f738c4516/skills/launch-check/scripts/geo_audit.py#L1703","weight":1.0},{"kind":"complex-function","description":"build_findings in plugins/agent-forge/skills/launch-check/scripts/polish_audit.py: complexity 116, 201 lines","ref":"plugins/agent-forge/skills/launch-check/scripts/polish_audit.py","url":"https://github.com/Ces107/agent-forge/blob/20bf7ef688c37257e8ed4ed22ad6331f738c4516/plugins/agent-forge/skills/launch-check/scripts/polish_audit.py#L815","weight":1.0},{"kind":"complex-function","description":"build_findings in plugins/launch-check/skills/launch-check/scripts/polish_audit.py: complexity 116, 201 lines","ref":"plugins/launch-check/skills/launch-check/scripts/polish_audit.py","url":"https://github.com/Ces107/agent-forge/blob/20bf7ef688c37257e8ed4ed22ad6331f738c4516/plugins/launch-check/skills/launch-check/scripts/polish_audit.py#L815","weight":1.0},{"kind":"complex-function","description":"build_findings in skills/launch-check/scripts/polish_audit.py: complexity 116, 201 lines","ref":"skills/launch-check/scripts/polish_audit.py","url":"https://github.com/Ces107/agent-forge/blob/20bf7ef688c37257e8ed4ed22ad6331f738c4516/skills/launch-check/scripts/polish_audit.py#L815","weight":1.0},{"kind":"complex-function","description":"run_checks.check_page in plugins/agent-forge/skills/launch-check/scripts/geo_audit.py: complexity 103, 135 lines","ref":"plugins/agent-forge/skills/launch-check/scripts/geo_audit.py","url":"https://github.com/Ces107/agent-forge/blob/20bf7ef688c37257e8ed4ed22ad6331f738c4516/plugins/agent-forge/skills/launch-check/scripts/geo_audit.py#L1338","weight":1.0},{"kind":"complex-function","description":"run_checks.check_page in plugins/launch-check/skills/launch-check/scripts/geo_audit.py: complexity 103, 135 lines","ref":"plugins/launch-check/skills/launch-check/scripts/geo_audit.py","url":"https://github.com/Ces107/agent-forge/blob/20bf7ef688c37257e8ed4ed22ad6331f738c4516/plugins/launch-check/skills/launch-check/scripts/geo_audit.py#L1338","weight":1.0},{"kind":"complex-function","description":"run_checks.check_page in skills/launch-check/scripts/geo_audit.py: complexity 103, 135 lines","ref":"skills/launch-check/scripts/geo_audit.py","url":"https://github.com/Ces107/agent-forge/blob/20bf7ef688c37257e8ed4ed22ad6331f738c4516/skills/launch-check/scripts/geo_audit.py#L1338","weight":1.0}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":21632.0,"duplicated_lines":14637.0,"duplicated_share":0.6766,"files":43.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: bench/code-review/cases.py:47 and bench/code-review/cases.py:92","ref":"bench/code-review/cases.py","url":"https://github.com/Ces107/agent-forge/blob/20bf7ef688c37257e8ed4ed22ad6331f738c4516/bench/code-review/cases.py#L47","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: bench/code-review/cases_holdout.py:87 and bench/code-review/cases_holdout.py:160","ref":"bench/code-review/cases_holdout.py","url":"https://github.com/Ces107/agent-forge/blob/20bf7ef688c37257e8ed4ed22ad6331f738c4516/bench/code-review/cases_holdout.py#L87","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: forge/traceability.py:1 and plugins/agent-forge/skills/spec-trace-gate/scripts/trace_gate.py:1","ref":"forge/traceability.py","url":"https://github.com/Ces107/agent-forge/blob/20bf7ef688c37257e8ed4ed22ad6331f738c4516/forge/traceability.py#L1","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: plugins/agent-forge/skills/done-gate/scripts/done_gate.py:1 and plugins/done-gate/scripts/done_gate.py:1","ref":"plugins/agent-forge/skills/done-gate/scripts/done_gate.py","url":"https://github.com/Ces107/agent-forge/blob/20bf7ef688c37257e8ed4ed22ad6331f738c4516/plugins/agent-forge/skills/done-gate/scripts/done_gate.py#L1","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: plugins/agent-forge/skills/launch-check/examples/demo/serve_demo.py:1 and plugins/launch-check/skills/launch-check/examples/demo/serve_demo.py:1","ref":"plugins/agent-forge/skills/launch-check/examples/demo/serve_demo.py","url":"https://github.com/Ces107/agent-forge/blob/20bf7ef688c37257e8ed4ed22ad6331f738c4516/plugins/agent-forge/skills/launch-check/examples/demo/serve_demo.py#L1","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: plugins/agent-forge/skills/launch-check/scripts/geo_audit.py:1 and plugins/launch-check/skills/launch-check/scripts/geo_audit.py:1","ref":"plugins/agent-forge/skills/launch-check/scripts/geo_audit.py","url":"https://github.com/Ces107/agent-forge/blob/20bf7ef688c37257e8ed4ed22ad6331f738c4516/plugins/agent-forge/skills/launch-check/scripts/geo_audit.py#L1","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: plugins/agent-forge/skills/launch-check/scripts/launch_check.py:1 and plugins/launch-check/skills/launch-check/scripts/launch_check.py:1","ref":"plugins/agent-forge/skills/launch-check/scripts/launch_check.py","url":"https://github.com/Ces107/agent-forge/blob/20bf7ef688c37257e8ed4ed22ad6331f738c4516/plugins/agent-forge/skills/launch-check/scripts/launch_check.py#L1","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: plugins/agent-forge/skills/launch-check/scripts/polish_audit.py:1 and plugins/launch-check/skills/launch-check/scripts/polish_audit.py:1","ref":"plugins/agent-forge/skills/launch-check/scripts/polish_audit.py","url":"https://github.com/Ces107/agent-forge/blob/20bf7ef688c37257e8ed4ed22ad6331f738c4516/plugins/agent-forge/skills/launch-check/scripts/polish_audit.py#L1","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: web/launch-check/app.py:990 and web/launch-check/ogmaker.py:582","ref":"web/launch-check/app.py","url":"https://github.com/Ces107/agent-forge/blob/20bf7ef688c37257e8ed4ed22ad6331f738c4516/web/launch-check/app.py#L990","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: web/launch-check/app.py:1206 and web/launch-check/app.py:1289","ref":"web/launch-check/app.py","url":"https://github.com/Ces107/agent-forge/blob/20bf7ef688c37257e8ed4ed22ad6331f738c4516/web/launch-check/app.py#L1206","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":22.0,"weighted_findings":28.0,"scanned_lines":25784.0,"category:best-practice":3.0,"category:correctness":9.0,"category:maintainability":10.0},"findings":[{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"web/launch-check/app.py","line":1793,"fingerprint":"python.lang.best-practice.arbitrary-sleep:web/launch-check/app.py:1793"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"web/launch-check/app.py","line":1798,"fingerprint":"python.lang.best-practice.arbitrary-sleep:web/launch-check/app.py:1798"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"workspaces/ledger/src/ledger/service.py","line":131,"fingerprint":"python.lang.best-practice.arbitrary-sleep:workspaces/ledger/src/ledger/service.py:131"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"forge/traceability.py","line":107,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:forge/traceability.py:107"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"plugins/agent-forge/skills/spec-trace-gate/scripts/trace_gate.py","line":107,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:plugins/agent-forge/skills/spec-trace-gate/scripts/trace_gate.py:107"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"skills/spec-trace-gate/scripts/trace_gate.py","line":107,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:skills/spec-trace-gate/scripts/trace_gate.py:107"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"web/launch-check/app.py","line":60,"fingerprint":"python.lang.maintainability.return-not-in-function:web/launch-check/app.py:60"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"web/launch-check/app.py","line":709,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:web/launch-check/app.py:709"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"web/launch-check/fixpack.py","line":75,"fingerprint":"python.lang.maintainability.return-not-in-function:web/launch-check/fixpack.py:75"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"web/launch-check/fixpages.py","line":13,"fingerprint":"python.lang.maintainability.return-not-in-function:web/launch-check/fixpages.py:13"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"web/launch-check/fixpages.py","line":107,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:web/launch-check/fixpages.py:107"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"web/launch-check/fixpages.py","line":111,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:web/launch-check/fixpages.py:111"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"web/launch-check/fixpages.py","line":118,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:web/launch-check/fixpages.py:118"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_private\" a function or an attribute? If it is a function, you may have meant ip.is_private() because ip.is_private is always true.","path":"web/launch-check/guard.py","line":48,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:web/launch-check/guard.py:48"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_loopback\" a function or an attribute? If it is a function, you may have meant ip.is_loopback() because ip.is_loopback is always true.","path":"web/launch-check/guard.py","line":48,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:web/launch-check/guard.py:48"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_link_local\" a function or an attribute? If it is a function, you may have meant ip.is_link_local() because ip.is_link_local is always true.","path":"web/launch-check/guard.py","line":48,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:web/launch-check/guard.py:48"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_multicast\" a function or an attribute? If it is a function, you may have meant ip.is_multicast() because ip.is_multicast is always true.","path":"web/launch-check/guard.py","line":48,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:web/launch-check/guard.py:48"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_reserved\" a function or an attribute? If it is a function, you may have meant ip.is_reserved() because ip.is_reserved is always true.","path":"web/launch-check/guard.py","line":48,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:web/launch-check/guard.py:48"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_unspecified\" a function or an attribute? If it is a function, you may have meant ip.is_unspecified() because ip.is_unspecified is always true.","path":"web/launch-check/guard.py","line":49,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:web/launch-check/guard.py:49"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_global\" a function or an attribute? If it is a function, you may have meant ip.is_global() because ip.is_global is always true.","path":"web/launch-check/guard.py","line":49,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:web/launch-check/guard.py:49"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"web/launch-check/ogmaker.py","line":538,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:web/launch-check/ogmaker.py:538"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"web/launch-check/ogmaker.py","line":540,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:web/launch-check/ogmaker.py:540"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.2863,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":1.0,"check:tests_cochange":1.0,"test_lines":3691.0,"source_lines":25784.0,"test_ratio":0.1432,"ci_files":2.0,"cochange_share":0.3874,"cochange_commits":111.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/ci.yml","ref":".github/workflows/ci.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/launch-check-keepalive.yml","ref":".github/workflows/launch-check-keepalive.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (pytest)","ref":null,"url":null,"weight":0.0},{"kind":"ci","description":"CI runs linters (ruff, mypy)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["pytest"],"lint_commands":["ruff","mypy"]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":181.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":1.0,"check:low_escape_density":1.0,"escapes":19.0,"escapes_per_kloc":0.737},"findings":[],"evidence":[{"kind":"typing","description":"Python strict type checking: forge/pyproject.toml","ref":"forge/pyproject.toml","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":663.0,"other_lines":25121.0,"files_blamed":43.0,"blame_failures":0.0,"quality:ai_findings":1.0,"quality:ai_per_kloc":1.508,"quality:other_findings":21.0,"quality:other_per_kloc":0.836,"quality:ratio":1.8,"security:ai_findings":0.0,"security:ai_per_kloc":0.0,"security:other_findings":16.0,"security:other_per_kloc":0.637,"security:ratio":0.0},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":true},"error":null}],"flags":[]}