{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T15:22:33.742444Z","repo":{"ref":{"host":"github.com","owner":"DietrichGebert","name":"ponytail"},"default_branch":"main","clone_url":"https://github.com/DietrichGebert/ponytail.git","html_url":"https://github.com/DietrichGebert/ponytail","description":"Makes your AI agent think like the laziest senior dev in the room. The best code is the code you never wrote.","stars":190687,"forks":10657,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":13130,"primary_language":"JavaScript","license_spdx":"MIT","created_at":"2026-06-12T00:52:37Z","pushed_at":"2026-10-29T11:59:31Z","security_policy_url":null,"distribution":{"owner_created_at":"2023-06-19T08:36:05Z","owner_type":"User","release_assets":[]}},"commit_sha":"96608e078b2d5ea607c5c3b8b5a54d1c1fba6846","profile":{"lines_by_language":{"JavaScript":6822,"Python":3072,"TypeScript":1923,"PowerShell":24,"Shell":18},"files_by_category":{"docs":61,"binary":45,"source":38,"config":37,"test":24,"other":10,"oversized":1},"source_lines":7296,"test_lines":4563},"pillars":{"ai_provenance":{"score":29.5,"confidence":0.95,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":0.2946,"suspected_share":0.0,"estimated_share":0.2946,"ai_artifacts":5.0,"flagged_work_units":0.0,"flagged_releases":0.0,"style_index":0.206},"summary":"Explicit AI attribution on 29% of first-party code added; an estimated 29% including velocity signals."},"quality":{"score":68.0,"confidence":0.9,"coverage":1.0,"label":"adequate","breakdown":{"complexity":55.2,"duplication":90.1,"lint":27.5,"testing":90.0,"docs":80.0,"type_safety":40.0,"process":null},"summary":"Code quality is adequate: test-to-source ratio 0.63, CI runs tests; 20% of function code in complex or long functions; 2% duplicated lines. Weakest area: lint."},"security":{"score":67.8,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":100.0,"sast":36.8,"dependencies":null,"ci_actions":87.5,"posture":20.0,"scorecard":null},"summary":"Security posture is weak: 10 high-severity SAST findings; 1 high-severity workflow issues. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no registry dependencies declared"},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":361.0,"attributed_commits":106.0,"attributed_commit_share":0.29362880886426596,"effective_loc":13709.0,"attributed_loc":4039.0,"attributed_loc_share":0.2946239696549712,"tools_detected":5.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"Claude Code: 98 attributed commits, 3,857 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attribution-summary","description":"Cursor agent: 3 attributed commits, 57 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attribution-summary","description":"OpenAI Codex: 3 attributed commits, 98 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attribution-summary","description":"GitHub Copilot coding agent: 2 attributed commits, 130 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attribution-summary","description":"Devin: 1 attributed commits, 9 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"96608e078b2d5ea607c5c3b8b5a54d1c1fba6846","url":"https://github.com/DietrichGebert/ponytail/commit/96608e078b2d5ea607c5c3b8b5a54d1c1fba6846","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR description attribution","ref":"713c609cb06d3872dcc8d1a6067f25498cd9a545","url":"https://github.com/DietrichGebert/ponytail/commit/713c609cb06d3872dcc8d1a6067f25498cd9a545","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR description attribution","ref":"26f12397b793d8d2c1654560fb4bb31d618001e3","url":"https://github.com/DietrichGebert/ponytail/commit/26f12397b793d8d2c1654560fb4bb31d618001e3","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR description attribution","ref":"f329330e6104f7ab771fb0ba9612011f401d73cc","url":"https://github.com/DietrichGebert/ponytail/commit/f329330e6104f7ab771fb0ba9612011f401d73cc","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"4b7c7b9028a008c987dbd88ac8241b35e482cadc","url":"https://github.com/DietrichGebert/ponytail/commit/4b7c7b9028a008c987dbd88ac8241b35e482cadc","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR description attribution","ref":"7fc4ab513dcebcda2012311ca84c8f9efcd03340","url":"https://github.com/DietrichGebert/ponytail/commit/7fc4ab513dcebcda2012311ca84c8f9efcd03340","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR description attribution","ref":"f2d50c833c1be04d3c531ee1e67d62f5f0c508e4","url":"https://github.com/DietrichGebert/ponytail/commit/f2d50c833c1be04d3c531ee1e67d62f5f0c508e4","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR description attribution","ref":"8b50c44f193cffe6ac12303ac4c86c361666c06c","url":"https://github.com/DietrichGebert/ponytail/commit/8b50c44f193cffe6ac12303ac4c86c361666c06c","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"11adca68ec928a58730761bcde125a8834a2f11c","url":"https://github.com/DietrichGebert/ponytail/commit/11adca68ec928a58730761bcde125a8834a2f11c","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR description attribution","ref":"c8f8f143ed93c77be00fdaa1b0e9491a6984dcba","url":"https://github.com/DietrichGebert/ponytail/commit/c8f8f143ed93c77be00fdaa1b0e9491a6984dcba","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR description attribution","ref":"bd582c92232e96cb929a896366419e1f7c8c77b9","url":"https://github.com/DietrichGebert/ponytail/commit/bd582c92232e96cb929a896366419e1f7c8c77b9","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/fix-hermes-review-default-20260805'","ref":"00f1aa364b3aa57172e5db2da964167701904d02","url":"https://github.com/DietrichGebert/ponytail/commit/00f1aa364b3aa57172e5db2da964167701904d02","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR description attribution","ref":"2b0ea880d461a7fcbb5388a28c3217ac71f1bc52","url":"https://github.com/DietrichGebert/ponytail/commit/2b0ea880d461a7fcbb5388a28c3217ac71f1bc52","weight":0.9},{"kind":"attributed-commit","description":"Cursor agent: trailer 'Co-authored-by: Cursor'","ref":"6f7a570e8fad47dd49a8a9f8bcb692ab84f7e193","url":"https://github.com/DietrichGebert/ponytail/commit/6f7a570e8fad47dd49a8a9f8bcb692ab84f7e193","weight":0.9},{"kind":"attributed-commit","description":"Cursor agent: trailer 'Co-authored-by: Cursor'","ref":"bb0bdd73b26f84d53285eb0a0d778025abfffe4f","url":"https://github.com/DietrichGebert/ponytail/commit/bb0bdd73b26f84d53285eb0a0d778025abfffe4f","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'","ref":"6743c04bbfd3af89b325943b96eef4d863cb6e37","url":"https://github.com/DietrichGebert/ponytail/commit/6743c04bbfd3af89b325943b96eef4d863cb6e37","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"43b759ffded10870c32c5faa153ac1f112a61b71","url":"https://github.com/DietrichGebert/ponytail/commit/43b759ffded10870c32c5faa153ac1f112a61b71","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"974d940a1c5344210874150b98ff0d2c861fab6a","url":"https://github.com/DietrichGebert/ponytail/commit/974d940a1c5344210874150b98ff0d2c861fab6a","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"7e81f61e4be37e8f29dc76b723ee1142866eb2dc","url":"https://github.com/DietrichGebert/ponytail/commit/7e81f61e4be37e8f29dc76b723ee1142866eb2dc","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"01b1cd885c2b845d8f8f6e856cb70c2f0ba35199","url":"https://github.com/DietrichGebert/ponytail/commit/01b1cd885c2b845d8f8f6e856cb70c2f0ba35199","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR description attribution","ref":"16f29800fd2681bdf24f3eb4ccffe38be3baec6b","url":"https://github.com/DietrichGebert/ponytail/commit/16f29800fd2681bdf24f3eb4ccffe38be3baec6b","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR description attribution","ref":"14a0d79548d4de8fc2de95c1b94bb0de63a739d3","url":"https://github.com/DietrichGebert/ponytail/commit/14a0d79548d4de8fc2de95c1b94bb0de63a739d3","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"b6c04480c03e8db2f035751d7c46289779ec3362","url":"https://github.com/DietrichGebert/ponytail/commit/b6c04480c03e8db2f035751d7c46289779ec3362","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"65db9025a7160aedef1212baf833c44455865499","url":"https://github.com/DietrichGebert/ponytail/commit/65db9025a7160aedef1212baf833c44455865499","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"2ba026211162fd0bb0730754bfae742a2b57f54d","url":"https://github.com/DietrichGebert/ponytail/commit/2ba026211162fd0bb0730754bfae742a2b57f54d","weight":0.9}],"data":{"attributed_loc_by_commit":{"cbb8859f39ec0962999335de9ab5ec501569ab47":4,"983255e2a1f899ac781b653a47fa6190cdf09d51":0,"b609e019a0e1d8e3d22d4ba7421399ad27572072":0,"9c998437257f28918f9be368d4319bbdb2d70552":0,"2d91f6a957d4b57b5452060f5af73447160e8a11":0,"cf97ccc509c758485d1b7b2e980f83128f8e5d08":0,"c16f967d37866a242940553b1a3a55b262b854c5":143,"515fb4c5a4d46d3727c12f42e5262a65407023da":3,"bce21620254bc7dd345c5675239282be7db348f5":29,"de318b94579f155873cdb32e569c0f3d90e577c4":0,"1556f10bc6eddaf66147fc7d32f45d56b2e4d5e4":0,"46c5c28b353ac6738ab4942aeaf3caa06894b80f":129,"24b0b98e16f5c66de296654f2cb480c22ea8debc":0,"93f3ac1d76e09b7e258fe79802e36d7335b1d7dd":0,"321a59c82f009894b953a918a54810d79b5e7840":30,"6abc9f0accdc6e19db8750f4c3615f099130b21e":0,"88431defbaaee945bb4a2f42223d10b56646fc70":0,"004256cdc6281a385f1cf7ae80ccdf584bde6554":0,"82cff4bcd29e662acdb2956384511527e1c70b06":0,"0882e2d256fd953c6a3e90b946f68ce4f9f35153":0,"92efc4a6481dc47caaa32f4dcea0610a1b7cfe56":8,"147bcfd621438ae6c12153990832454e3509e39f":48,"e01aa900f7e12e8a4660fb5d757ad016baeffed9":67,"16319c7bc91b098975d2bfb2e351398ff8aae3e7":0,"94d231cd32cac5220aef07bfcb442dfe7f0bbbc1":0,"01578c0cd486df4746dac11e52086c9fbdfbe136":35,"b545f1536a37435a27b90eb4ac211bf0e223194a":0,"f3da910b4f2827aacbb9762e32db14f915d72194":143,"d9e1480c74986fcc7ff3c18e1773f5364e17deed":8,"e733c6b40b22333baadf11cb61f9125dd92ae59d":0,"706bd2795c32a5d3c22cb80d9a1126d5aeee3b09":0,"49499105878470dd5858d3d4ee86fd4688235a62":0,"e27180633f456bdd666f13988743b3f7cc30ccf3":0,"c1c80f3cc816cd39cfadf792ddba0c3563ba0d6e":112,"f02f9424a528b6f4277b81b761d042d7219973bf":16,"d676635325b49faf92c91eb365eead984c38a063":0,"60a75f8159de451320055afb2e0796b3fea636f6":0,"2e6a93765aabb345b7325cdcac4c8efef7955644":8,"ce153bc95fad5e966c756299bf9f73a13687bed1":0,"687c1b339872289d70f65c5eaabce850b1663867":0,"caf138df5685b24f1d8ad6985a3cfdd5fa76caaf":305,"41d6c2f761e1b4457be56fa69ba526c82fe85f90":85,"adad50d9b393926b2dd5ed7225dcb1848b9df408":0,"1b4914159e0480270644f26babc30d078acb4ebb":0,"45f7d2f83fb430a65fd512a98ad7b14d79e06636":63,"b8d6aa7e9f872134f19a164fcc9d8f5f18732831":1078,"8d5037d9e50bcd4025b89db213e061cac57acbfa":0,"91aef5dfefa986cb87e4557b95970eeb6b149c03":0,"44babb22efb1defa4ec60dd486a09b56b8ba3704":40,"955fff537c3cc428b81d7432573b2aab07725284":156,"6d35c1092032d83bc5e15752e43f5ef8fc4a8aa9":0,"e7e09f8fd4eb5e8a54ffb58c6aeb3a483cb0a794":0,"e782790b154a00f5ae688ca3fdaaf79747d917b2":53,"15749f7ffc94c84ce7be3c000dcefb322ec1eeee":9,"b0c5820bb159bf5566535a336ca5c37ff6bb80cb":0,"fe963cae99d986dae3199fe56403f99e87db7c6c":0,"a4e5e479d6287e564b27b63d20b878198194e14e":0,"48cdf05a25a73fd5d1ccc62d4dc22643b2c86fc2":2,"f316f14d964b1822c81472230e2716857a3e9cd1":0,"10a375b8369bf2f610d17274089bc9fc6a0d3ffe":0,"cf9cbd531eb988c87ee82fcd6d2a3a3f0a3bd9b7":0,"bd6176a9b33ab72594ff82e6f34f17b085f25565":0,"ff5d0936bee1f1267f4f4a7c34a2e6c796254f0b":0,"ee263e5708d249ac2d2180bca265ed2b604ca3b0":9,"248a30b40b2957d70b304bf0d08b048183a56508":2,"dedc97ca7c8a1e7463ac5b36f7fe4b28c3c435a2":452,"763e04deeeb59551aba28557dc46bde6092f2e21":76,"88be9caee7df4585406ae982f6f697f1d7aeed38":75,"6d5d75a4f132ee5e2bb1fa40c2dbaf073a18e539":5,"9d0118df342c2c9e833770c948f4821cfeb014dd":0,"b9fa564429cb615e10ba471c7ceb59a1fd15c894":82,"6cd0c42e86b26135bb5b806c0ab875abe26fbc48":0,"a945778b4a73b0b78c3c781a594b62cd3a324637":0,"4e5f9ccc6cf9a95346f608603e233d181c56e8f7":0,"7086abecc268657a2da241a7acde62fa11793036":0,"64adbf9544581e57053a8d84a94e7e4471d40d95":0,"7790c37b679184ced3f118e903b9df2fb111f03d":9,"e353a1a5d31522218234f7d9bac191d87a935817":0,"ca4dad252d5cdb51a66bab8f025dfd2bd4b4af16":0,"6d0c1110357241b598b53a995d258daadfba0768":62,"1715abccac3c3996d9c4c9a01061b1ffb1da68c2":127,"2ba026211162fd0bb0730754bfae742a2b57f54d":12,"65db9025a7160aedef1212baf833c44455865499":44,"b6c04480c03e8db2f035751d7c46289779ec3362":3,"14a0d79548d4de8fc2de95c1b94bb0de63a739d3":24,"16f29800fd2681bdf24f3eb4ccffe38be3baec6b":0,"01b1cd885c2b845d8f8f6e856cb70c2f0ba35199":0,"7e81f61e4be37e8f29dc76b723ee1142866eb2dc":0,"974d940a1c5344210874150b98ff0d2c861fab6a":0,"43b759ffded10870c32c5faa153ac1f112a61b71":24,"6743c04bbfd3af89b325943b96eef4d863cb6e37":18,"bb0bdd73b26f84d53285eb0a0d778025abfffe4f":41,"6f7a570e8fad47dd49a8a9f8bcb692ab84f7e193":0,"2b0ea880d461a7fcbb5388a28c3217ac71f1bc52":59,"00f1aa364b3aa57172e5db2da964167701904d02":27,"bd582c92232e96cb929a896366419e1f7c8c77b9":0,"c8f8f143ed93c77be00fdaa1b0e9491a6984dcba":140,"11adca68ec928a58730761bcde125a8834a2f11c":30,"8b50c44f193cffe6ac12303ac4c86c361666c06c":4,"f2d50c833c1be04d3c531ee1e67d62f5f0c508e4":8,"7fc4ab513dcebcda2012311ca84c8f9efcd03340":2,"4b7c7b9028a008c987dbd88ac8241b35e482cadc":41,"f329330e6104f7ab771fb0ba9612011f401d73cc":28,"26f12397b793d8d2c1654560fb4bb31d618001e3":25,"713c609cb06d3872dcc8d1a6067f25498cd9a545":36,"96608e078b2d5ea607c5c3b8b5a54d1c1fba6846":0},"tools":{"claude-code":{"name":"Claude Code","commits":98,"loc":3857,"first_seen":1781259107,"last_seen":1793275171},"github-copilot":{"name":"GitHub Copilot coding agent","commits":2,"loc":130,"first_seen":1781514179,"last_seen":1790989860},"cursor":{"name":"Cursor agent","commits":3,"loc":57,"first_seen":1781514664,"last_seen":1790996367},"openai-codex":{"name":"OpenAI Codex","commits":3,"loc":98,"first_seen":1781997645,"last_seen":1791211334},"devin":{"name":"Devin","commits":1,"loc":9,"first_seen":1782433573,"last_seen":1782433573}},"monthly":{"2026-06":{"loc":5741,"attributed_loc":3284},"2026-07":{"loc":1083,"attributed_loc":272},"2026-08":{"loc":92,"attributed_loc":0},"2026-09":{"loc":610,"attributed_loc":0},"2026-10":{"loc":6183,"attributed_loc":483}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":5.0,"workflow_agents":0.0,"tools_configured":5.0,"earliest_adoption":1781227515.0},"findings":[],"evidence":[{"kind":"ai-artifact","description":"AGENTS.md (generic-agent configuration)","ref":"AGENTS.md","url":"https://github.com/DietrichGebert/ponytail/blob/96608e078b2d5ea607c5c3b8b5a54d1c1fba6846/AGENTS.md","weight":0.5},{"kind":"ai-artifact","description":".cursor/rules/ponytail.mdc (cursor configuration)","ref":".cursor/rules/ponytail.mdc","url":"https://github.com/DietrichGebert/ponytail/blob/96608e078b2d5ea607c5c3b8b5a54d1c1fba6846/.cursor/rules/ponytail.mdc","weight":0.5},{"kind":"ai-artifact","description":".github/copilot-instructions.md (github-copilot configuration)","ref":".github/copilot-instructions.md","url":"https://github.com/DietrichGebert/ponytail/blob/96608e078b2d5ea607c5c3b8b5a54d1c1fba6846/.github/copilot-instructions.md","weight":0.5},{"kind":"ai-artifact","description":".windsurf/rules/ponytail.md (windsurf configuration)","ref":".windsurf/rules/ponytail.md","url":"https://github.com/DietrichGebert/ponytail/blob/96608e078b2d5ea607c5c3b8b5a54d1c1fba6846/.windsurf/rules/ponytail.md","weight":0.5},{"kind":"ai-artifact","description":".clinerules/ponytail.md (cline configuration)","ref":".clinerules/ponytail.md","url":"https://github.com/DietrichGebert/ponytail/blob/96608e078b2d5ea607c5c3b8b5a54d1c1fba6846/.clinerules/ponytail.md","weight":0.5}],"data":{"artifacts":[{"tool":"generic-agent","path":"AGENTS.md","added_at":1781227515},{"tool":"cursor","path":".cursor/rules/ponytail.mdc","added_at":1781227515},{"tool":"github-copilot","path":".github/copilot-instructions.md","added_at":1781227515},{"tool":"windsurf","path":".windsurf/rules/ponytail.md","added_at":1781227515},{"tool":"cline","path":".clinerules/ponytail.md","added_at":1781227515}],"workflows":[],"tools":["cline","cursor","generic-agent","github-copilot","windsurf"]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-5","metrics":{"work_units":197.0,"flagged_units":0.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":13709.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":424.51896646509067,"median_loc_per_hour":35.75,"pr_timed_units":190.0,"excluded_import_loc":0.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":[]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-5","metrics":{"releases":28.0,"flagged_releases":0.0,"max_loc_per_day":6311.5},"findings":[],"evidence":[],"data":{"releases":[{"from":"v1.0.0","to":"v4.0.0","loc":4,"days":0.35,"loc_per_day":11.5,"flagged":false},{"from":"v4.0.0","to":"v4.1.0","loc":667,"days":0.21,"loc_per_day":3178.8,"flagged":false},{"from":"v4.1.0","to":"v4.2.0","loc":160,"days":0.4,"loc_per_day":402.0,"flagged":false},{"from":"v4.2.0","to":"v4.3.0","loc":642,"days":1.86,"loc_per_day":345.8,"flagged":false},{"from":"v4.3.0","to":"v4.4.0","loc":151,"days":0.13,"loc_per_day":1196.7,"flagged":false},{"from":"v4.4.0","to":"v4.5.0","loc":128,"days":0.37,"loc_per_day":350.4,"flagged":false},{"from":"v4.5.0","to":"v4.6.0","loc":202,"days":0.2,"loc_per_day":1011.8,"flagged":false},{"from":"v4.6.0","to":"v4.7.0","loc":390,"days":0.89,"loc_per_day":438.9,"flagged":false},{"from":"v4.7.0","to":"v4.8.0","loc":2130,"days":6.4,"loc_per_day":332.9,"flagged":false},{"from":"v4.8.0","to":"v4.8.1","loc":76,"days":0.79,"loc_per_day":96.1,"flagged":false},{"from":"v4.8.1","to":"v4.8.2","loc":338,"days":0.37,"loc_per_day":917.3,"flagged":false},{"from":"v4.8.2","to":"v4.8.3","loc":82,"days":0.05,"loc_per_day":1623.5,"flagged":false},{"from":"v4.8.3","to":"v4.8.4","loc":474,"days":5.12,"loc_per_day":92.6,"flagged":false},{"from":"v4.8.4","to":"v4.9.0","loc":1085,"days":39.66,"loc_per_day":27.4,"flagged":false},{"from":"v4.9.0","to":"v4.10.1","loc":1040,"days":55.75,"loc_per_day":18.7,"flagged":false},{"from":"v4.10.1","to":"v4.10.2","loc":373,"days":0.43,"loc_per_day":867.3,"flagged":false},{"from":"v4.10.2","to":"v4.10.3","loc":280,"days":0.04,"loc_per_day":6311.5,"flagged":false},{"from":"v4.10.3","to":"v4.11.0","loc":116,"days":1.85,"loc_per_day":62.8,"flagged":false},{"from":"v4.11.0","to":"v4.12.0","loc":109,"days":0.2,"loc_per_day":544.9,"flagged":false},{"from":"v4.12.0","to":"v4.13.0","loc":531,"days":0.63,"loc_per_day":840.0,"flagged":false},{"from":"v4.13.0","to":"v5.0.0","loc":1269,"days":2.38,"loc_per_day":534.3,"flagged":false},{"from":"v5.0.0","to":"v5.1.0","loc":7,"days":0.52,"loc_per_day":13.5,"flagged":false},{"from":"v5.1.0","to":"v5.1.1","loc":226,"days":4.29,"loc_per_day":52.7,"flagged":false},{"from":"v5.1.1","to":"v5.2.0","loc":392,"days":0.11,"loc_per_day":3713.7,"flagged":false},{"from":"v5.2.0","to":"v5.3.0","loc":1783,"days":3.25,"loc_per_day":548.6,"flagged":false},{"from":"v5.3.0","to":"v5.3.1","loc":89,"days":0.23,"loc_per_day":383.6,"flagged":false},{"from":"v5.3.1","to":"v5.3.2","loc":453,"days":0.41,"loc_per_day":1117.2,"flagged":false},{"from":"v5.3.2","to":"v5.3.3","loc":217,"days":12.17,"loc_per_day":17.8,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":7296.0,"index":0.206,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":3.0,"per_kloc:emoji_in_code":0.411,"files:emoji_in_code":2.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":63.0,"findings_high":10.0,"findings_medium":53.0,"findings_low":0.0,"weighted_findings":20.75,"scanned_lines":7272.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"benchmarks/agentic/judge.py","line":70,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:benchmarks/agentic/judge.py:70"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"benchmarks/agentic/run.py","line":167,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:benchmarks/agentic/run.py:167"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"benchmarks/agentic/run.py","line":269,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:benchmarks/agentic/run.py:269"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"benchmarks/agentic/run.py","line":330,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:benchmarks/agentic/run.py:330"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"benchmarks/agentic/run.py","line":381,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:benchmarks/agentic/run.py:381"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"benchmarks/agentic/run.py","line":460,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:benchmarks/agentic/run.py:460"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"benchmarks/agentic/tasks.py","line":544,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:benchmarks/agentic/tasks.py:544"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"benchmarks/agentic/tasks.py","line":852,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:benchmarks/agentic/tasks.py:852"},{"rule_id":"opengrep/javascript.lang.security.detect-child-process","severity":"high","message":"Detected calls to child_process from a function argument `cmd`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low]","path":"benchmarks/correctness.js","line":50,"fingerprint":"javascript.lang.security.detect-child-process:benchmarks/correctness.js:50"},{"rule_id":"opengrep/javascript.lang.security.audit.spawn-shell-true","severity":"high","message":"Found '$SPAWN' with '{shell: true}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead. [confidence low]","path":"scripts/publish-openclaw-skills.js","line":64,"fingerprint":"javascript.lang.security.audit.spawn-shell-true:scripts/publish-openclaw-skills.js:64"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":".opencode/plugins/ponytail-frontmatter.cjs","line":15,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:.opencode/plugins/ponytail-frontmatter.cjs:15"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":".opencode/plugins/ponytail-frontmatter.cjs","line":53,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:.opencode/plugins/ponytail-frontmatter.cjs:53"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"benchmarks/agentic/judge.py","line":85,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:benchmarks/agentic/judge.py:85"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"benchmarks/agentic/tasks.py","line":541,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:benchmarks/agentic/tasks.py:541"},{"rule_id":"opengrep/python.lang.security.audit.non-literal-import","severity":"medium","message":"Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code. [confidence low]","path":"benchmarks/agentic/tasks.py","line":601,"fingerprint":"python.lang.security.audit.non-literal-import:benchmarks/agentic/tasks.py:601"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"benchmarks/behavior.js","line":50,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:benchmarks/behavior.js:50"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"benchmarks/correctness.js","line":72,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:benchmarks/correctness.js:72"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `ext` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"benchmarks/correctness.js","line":73,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:benchmarks/correctness.js:73"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `blocks` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"benchmarks/correctness.js","line":133,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:benchmarks/correctness.js:133"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `blocks` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"benchmarks/correctness.js","line":178,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:benchmarks/correctness.js:178"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `blocks` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"benchmarks/correctness.js","line":226,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:benchmarks/correctness.js:226"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"benchmarks/correctness.js","line":284,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:benchmarks/correctness.js:284"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"hooks/band/board.ts","line":511,"fingerprint":"javascript.lang.security.html-in-template-string:hooks/band/board.ts:511"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"hooks/band/board.ts","line":512,"fingerprint":"javascript.lang.security.html-in-template-string:hooks/band/board.ts:512"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"hooks/band/board.ts","line":513,"fingerprint":"javascript.lang.security.html-in-template-string:hooks/band/board.ts:513"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"hooks/band/board.ts","line":530,"fingerprint":"javascript.lang.security.html-in-template-string:hooks/band/board.ts:530"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"hooks/band/board.ts","line":536,"fingerprint":"javascript.lang.security.html-in-template-string:hooks/band/board.ts:536"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"hooks/band/board.ts","line":537,"fingerprint":"javascript.lang.security.html-in-template-string:hooks/band/board.ts:537"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"hooks/band/metrics.ts","line":117,"fingerprint":"javascript.lang.security.html-in-template-string:hooks/band/metrics.ts:117"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"hooks/band/metrics.ts","line":121,"fingerprint":"javascript.lang.security.html-in-template-string:hooks/band/metrics.ts:121"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"hooks/band/metrics.ts","line":122,"fingerprint":"javascript.lang.security.html-in-template-string:hooks/band/metrics.ts:122"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"hooks/band/metrics.ts","line":123,"fingerprint":"javascript.lang.security.html-in-template-string:hooks/band/metrics.ts:123"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"hooks/band/metrics.ts","line":124,"fingerprint":"javascript.lang.security.html-in-template-string:hooks/band/metrics.ts:124"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"hooks/band/metrics.ts","line":130,"fingerprint":"javascript.lang.security.html-in-template-string:hooks/band/metrics.ts:130"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"hooks/band/metrics.ts","line":134,"fingerprint":"javascript.lang.security.html-in-template-string:hooks/band/metrics.ts:134"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `$` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled in [confidence low]","path":"hooks/band/register.tsx","line":319,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:hooks/band/register.tsx:319"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `file` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"hooks/ponytail-band-import.js","line":86,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:hooks/ponytail-band-import.js:86"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `file` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"hooks/ponytail-band-import.js","line":91,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:hooks/ponytail-band-import.js:91"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `file` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"hooks/ponytail-band-import.js","line":98,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:hooks/ponytail-band-import.js:98"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `cwd` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"hooks/ponytail-band-import.js","line":203,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:hooks/ponytail-band-import.js:203"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"hooks/ponytail-band-import.js","line":242,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:hooks/ponytail-band-import.js:242"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `dir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"hooks/ponytail-map.js","line":51,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:hooks/ponytail-map.js:51"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"hooks/ponytail-map.js","line":54,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:hooks/ponytail-map.js:54"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"hooks/ponytail-map.js","line":54,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:hooks/ponytail-map.js:54"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `root` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"hooks/ponytail-map.js","line":85,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:hooks/ponytail-map.js:85"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"hooks/ponytail-map.js","line":85,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:hooks/ponytail-map.js:85"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"hooks/ponytail-map.js","line":85,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:hooks/ponytail-map.js:85"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `root` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"hooks/ponytail-map.js","line":86,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:hooks/ponytail-map.js:86"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"hooks/ponytail-map.js","line":86,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:hooks/ponytail-map.js:86"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"hooks/ponytail-map.js","line":86,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:hooks/ponytail-map.js:86"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"pi-extension/index.js","line":22,"fingerprint":"javascript.lang.security.html-in-template-string:pi-extension/index.js:22"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `name` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/build-openclaw-skills.js","line":31,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/build-openclaw-skills.js:31"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"scripts/build-openclaw-skills.js","line":48,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:scripts/build-openclaw-skills.js:48"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `relPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/check-rule-copies.js","line":8,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/check-rule-copies.js:8"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `relPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/check-versions.js","line":34,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/check-versions.js:34"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `file` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/cursor-hooks.js","line":35,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/cursor-hooks.js:35"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `file` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/cursor-hooks.js","line":55,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/cursor-hooks.js:55"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `file` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/cursor-hooks.js","line":56,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/cursor-hooks.js:56"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `scope` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/cursor-hooks.js","line":102,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/cursor-hooks.js:102"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `scope` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/cursor-hooks.js","line":110,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/cursor-hooks.js:110"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `e` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/publish-openclaw-skills.js","line":32,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/publish-openclaw-skills.js:32"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"scripts/publish-openclaw-skills.js","line":32,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:scripts/publish-openclaw-skills.js:32"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/uninstall.js","line":19,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/uninstall.js:19"}],"evidence":[],"data":{"rulesets":["python","javascript","typescript","bash"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":2.0,"findings":5.0,"findings_high":1.0,"findings_medium":2.0,"findings_low":2.0,"penalty":8.0},"findings":[{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/publish.yml","line":23,"fingerprint":"cache-poisoning:.github/workflows/publish.yml:23"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/publish.yml","line":22,"fingerprint":"artipacked:.github/workflows/publish.yml:22"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/test.yml","line":16,"fingerprint":"artipacked:.github/workflows/test.yml:16"},{"rule_id":"zizmor/adhoc-packages","severity":"low","message":"ad-hoc installation of packages [confidence high]","path":".github/workflows/publish.yml","line":27,"fingerprint":"adhoc-packages:.github/workflows/publish.yml:27"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/publish.yml","line":13,"fingerprint":"self-repository:.github/workflows/publish.yml:13"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":1.0,"check:lockfiles":0.0,"signed_commit_share":0.96,"unpinned_manifests":2.0},"findings":[],"evidence":[{"kind":"posture","description":"package.json has no lockfile alongside it (unpinned dependencies)","ref":"package.json","url":null,"weight":0.3},{"kind":"posture","description":"pi-extension/package.json has no lockfile alongside it (unpinned dependencies)","ref":"pi-extension/package.json","url":null,"weight":0.3}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":460.0,"function_nloc":3612.0,"mean_ccn":3.97,"p90_ccn":8.0,"complex_functions":14.0,"long_functions":1.0,"many_param_functions":1.0,"risky_nloc_share":0.1982},"findings":[],"evidence":[{"kind":"complex-function","description":"finish in hooks/ponytail-mode-tracker.js: complexity 66, 119 lines","ref":"hooks/ponytail-mode-tracker.js","url":"https://github.com/DietrichGebert/ponytail/blob/96608e078b2d5ea607c5c3b8b5a54d1c1fba6846/hooks/ponytail-mode-tracker.js#L27","weight":1.0},{"kind":"complex-function","description":"aggregate in benchmarks/agentic/run.py: complexity 44, 31 lines","ref":"benchmarks/agentic/run.py","url":"https://github.com/DietrichGebert/ponytail/blob/96608e078b2d5ea607c5c3b8b5a54d1c1fba6846/benchmarks/agentic/run.py#L394","weight":0.7333333333333333},{"kind":"complex-function","description":"activate in hooks/ponytail-activate.js: complexity 42, 96 lines","ref":"hooks/ponytail-activate.js","url":"https://github.com/DietrichGebert/ponytail/blob/96608e078b2d5ea607c5c3b8b5a54d1c1fba6846/hooks/ponytail-activate.js#L31","weight":0.7},{"kind":"complex-function","description":"sessionStats in hooks/ponytail-band-import.js: complexity 34, 59 lines","ref":"hooks/ponytail-band-import.js","url":"https://github.com/DietrichGebert/ponytail/blob/96608e078b2d5ea607c5c3b8b5a54d1c1fba6846/hooks/ponytail-band-import.js#L105","weight":0.5666666666666667},{"kind":"complex-function","description":"(anonymous) in hooks/band/register.tsx: complexity 31, 99 lines","ref":"hooks/band/register.tsx","url":"https://github.com/DietrichGebert/ponytail/blob/96608e078b2d5ea607c5c3b8b5a54d1c1fba6846/hooks/band/register.tsx#L354","weight":0.5166666666666667},{"kind":"complex-function","description":"main in benchmarks/agentic/run.py: complexity 26, 57 lines","ref":"benchmarks/agentic/run.py","url":"https://github.com/DietrichGebert/ponytail/blob/96608e078b2d5ea607c5c3b8b5a54d1c1fba6846/benchmarks/agentic/run.py#L463","weight":0.43333333333333335},{"kind":"complex-function","description":"main in benchmarks/agentic/compare.py: complexity 23, 34 lines","ref":"benchmarks/agentic/compare.py","url":"https://github.com/DietrichGebert/ponytail/blob/96608e078b2d5ea607c5c3b8b5a54d1c1fba6846/benchmarks/agentic/compare.py#L52","weight":0.38333333333333336},{"kind":"complex-function","description":"run in benchmarks/agentic/complete.py: complexity 21, 31 lines","ref":"benchmarks/agentic/complete.py","url":"https://github.com/DietrichGebert/ponytail/blob/96608e078b2d5ea607c5c3b8b5a54d1c1fba6846/benchmarks/agentic/complete.py#L122","weight":0.35},{"kind":"complex-function","description":"run in hooks/ponytail-band-import.js: complexity 21, 50 lines","ref":"hooks/ponytail-band-import.js","url":"https://github.com/DietrichGebert/ponytail/blob/96608e078b2d5ea607c5c3b8b5a54d1c1fba6846/hooks/ponytail-band-import.js#L216","weight":0.35},{"kind":"complex-function","description":"score_todo in benchmarks/agentic/tasks.py: complexity 20, 46 lines","ref":"benchmarks/agentic/tasks.py","url":"https://github.com/DietrichGebert/ponytail/blob/96608e078b2d5ea607c5c3b8b5a54d1c1fba6846/benchmarks/agentic/tasks.py#L523","weight":0.3333333333333333}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":5950.0,"duplicated_lines":103.0,"duplicated_share":0.0173,"files":38.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: benchmarks/agentic/tasks.py:340 and benchmarks/agentic/tasks.py:352","ref":"benchmarks/agentic/tasks.py","url":"https://github.com/DietrichGebert/ponytail/blob/96608e078b2d5ea607c5c3b8b5a54d1c1fba6846/benchmarks/agentic/tasks.py#L340","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: hooks/band/register.tsx:44 and hooks/band/register.tsx:62","ref":"hooks/band/register.tsx","url":"https://github.com/DietrichGebert/ponytail/blob/96608e078b2d5ea607c5c3b8b5a54d1c1fba6846/hooks/band/register.tsx#L44","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: hooks/ponytail-activate.js:15 and hooks/ponytail-mode-tracker.js:9","ref":"hooks/ponytail-activate.js","url":"https://github.com/DietrichGebert/ponytail/blob/96608e078b2d5ea607c5c3b8b5a54d1c1fba6846/hooks/ponytail-activate.js#L15","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: hooks/ponytail-mode-tracker.js:12 and hooks/ponytail-runtime.js:173","ref":"hooks/ponytail-mode-tracker.js","url":"https://github.com/DietrichGebert/ponytail/blob/96608e078b2d5ea607c5c3b8b5a54d1c1fba6846/hooks/ponytail-mode-tracker.js#L12","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: hooks/ponytail-runtime.js:124 and hooks/ponytail-runtime.js:138","ref":"hooks/ponytail-runtime.js","url":"https://github.com/DietrichGebert/ponytail/blob/96608e078b2d5ea607c5c3b8b5a54d1c1fba6846/hooks/ponytail-runtime.js#L124","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":56.0,"weighted_findings":37.5,"scanned_lines":7272.0,"category:best-practice":6.0,"category:correctness":31.0,"category:maintainability":19.0},"findings":[{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"benchmarks/agentic/tasks.py","line":552,"fingerprint":"python.lang.best-practice.arbitrary-sleep:benchmarks/agentic/tasks.py:552"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"benchmarks/agentic/tasks.py","line":567,"fingerprint":"python.lang.best-practice.arbitrary-sleep:benchmarks/agentic/tasks.py:567"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":".opencode/plugins/ponytail-frontmatter.cjs","line":14,"fingerprint":"javascript.lang.best-practice.lazy-load-module:.opencode/plugins/ponytail-frontmatter.cjs:14"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":".opencode/plugins/ponytail-frontmatter.cjs","line":52,"fingerprint":"javascript.lang.best-practice.lazy-load-module:.opencode/plugins/ponytail-frontmatter.cjs:52"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":".opencode/plugins/ponytail.mjs","line":116,"fingerprint":"javascript.lang.correctness.no-replaceall:.opencode/plugins/ponytail.mjs:116"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"benchmarks/agentic/compare.py","line":21,"fingerprint":"python.lang.maintainability.return-not-in-function:benchmarks/agentic/compare.py:21"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"benchmarks/agentic/compare.py","line":22,"fingerprint":"python.lang.maintainability.return-not-in-function:benchmarks/agentic/compare.py:22"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"benchmarks/agentic/compare.py","line":23,"fingerprint":"python.lang.maintainability.return-not-in-function:benchmarks/agentic/compare.py:23"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"benchmarks/agentic/compare.py","line":24,"fingerprint":"python.lang.maintainability.return-not-in-function:benchmarks/agentic/compare.py:24"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"benchmarks/agentic/compare.py","line":25,"fingerprint":"python.lang.maintainability.return-not-in-function:benchmarks/agentic/compare.py:25"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"benchmarks/agentic/compare.py","line":26,"fingerprint":"python.lang.maintainability.return-not-in-function:benchmarks/agentic/compare.py:26"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"benchmarks/agentic/compare.py","line":27,"fingerprint":"python.lang.maintainability.return-not-in-function:benchmarks/agentic/compare.py:27"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"benchmarks/agentic/compare.py","line":28,"fingerprint":"python.lang.maintainability.return-not-in-function:benchmarks/agentic/compare.py:28"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"benchmarks/agentic/compare.py","line":29,"fingerprint":"python.lang.maintainability.return-not-in-function:benchmarks/agentic/compare.py:29"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"benchmarks/agentic/compare.py","line":30,"fingerprint":"python.lang.maintainability.return-not-in-function:benchmarks/agentic/compare.py:30"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"benchmarks/agentic/compare.py","line":31,"fingerprint":"python.lang.maintainability.return-not-in-function:benchmarks/agentic/compare.py:31"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"benchmarks/agentic/run.py","line":36,"fingerprint":"python.lang.maintainability.return-not-in-function:benchmarks/agentic/run.py:36"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"benchmarks/agentic/run.py","line":37,"fingerprint":"python.lang.maintainability.return-not-in-function:benchmarks/agentic/run.py:37"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"benchmarks/agentic/run.py","line":38,"fingerprint":"python.lang.maintainability.return-not-in-function:benchmarks/agentic/run.py:38"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"benchmarks/agentic/run.py","line":39,"fingerprint":"python.lang.maintainability.return-not-in-function:benchmarks/agentic/run.py:39"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"benchmarks/agentic/run.py","line":40,"fingerprint":"python.lang.maintainability.return-not-in-function:benchmarks/agentic/run.py:40"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"benchmarks/agentic/run.py","line":41,"fingerprint":"python.lang.maintainability.return-not-in-function:benchmarks/agentic/run.py:41"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"benchmarks/agentic/run.py","line":42,"fingerprint":"python.lang.maintainability.return-not-in-function:benchmarks/agentic/run.py:42"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"benchmarks/agentic/run.py","line":43,"fingerprint":"python.lang.maintainability.return-not-in-function:benchmarks/agentic/run.py:43"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"hooks/band/register.tsx","line":453,"fingerprint":"typescript.react.best-practice.react-props-spreading:hooks/band/register.tsx:453"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"hooks/band/register.tsx","line":480,"fingerprint":"typescript.react.best-practice.react-props-spreading:hooks/band/register.tsx:480"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`const` is assigned twice; the first assignment is useless","path":".opencode/plugins/ponytail.mjs","line":25,"fingerprint":"javascript.lang.correctness.useless-assignment:.opencode/plugins/ponytail.mjs:25"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`const` is assigned twice; the first assignment is useless","path":".opencode/plugins/ponytail.mjs","line":26,"fingerprint":"javascript.lang.correctness.useless-assignment:.opencode/plugins/ponytail.mjs:26"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"benchmarks/correctness.js","line":143,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:benchmarks/correctness.js:143"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"hooks/band/board.ts","line":98,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:hooks/band/board.ts:98"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"hooks/band/board.ts","line":98,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:hooks/band/board.ts:98"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"hooks/band/board.ts","line":100,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:hooks/band/board.ts:100"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"hooks/band/board.ts","line":102,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:hooks/band/board.ts:102"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"hooks/band/board.ts","line":106,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:hooks/band/board.ts:106"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"hooks/band/board.ts","line":112,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:hooks/band/board.ts:112"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"hooks/band/board.ts","line":132,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:hooks/band/board.ts:132"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"hooks/band/board.ts","line":141,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:hooks/band/board.ts:141"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"hooks/band/board.ts","line":145,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:hooks/band/board.ts:145"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"hooks/band/board.ts","line":168,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:hooks/band/board.ts:168"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"hooks/band/board.ts","line":185,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:hooks/band/board.ts:185"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"hooks/band/board.ts","line":185,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:hooks/band/board.ts:185"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"hooks/band/board.ts","line":190,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:hooks/band/board.ts:190"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"hooks/band/board.ts","line":558,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:hooks/band/board.ts:558"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"hooks/band/metrics.ts","line":110,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:hooks/band/metrics.ts:110"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"hooks/band/metrics.ts","line":110,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:hooks/band/metrics.ts:110"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`const` is assigned twice; the first assignment is useless","path":"hooks/ponytail-activate.js","line":12,"fingerprint":"javascript.lang.correctness.useless-assignment:hooks/ponytail-activate.js:12"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`const` is assigned twice; the first assignment is useless","path":"hooks/ponytail-activate.js","line":13,"fingerprint":"javascript.lang.correctness.useless-assignment:hooks/ponytail-activate.js:13"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`const` is assigned twice; the first assignment is useless","path":"hooks/ponytail-activate.js","line":14,"fingerprint":"javascript.lang.correctness.useless-assignment:hooks/ponytail-activate.js:14"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`const` is assigned twice; the first assignment is useless","path":"hooks/ponytail-band-import.js","line":9,"fingerprint":"javascript.lang.correctness.useless-assignment:hooks/ponytail-band-import.js:9"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`const` is assigned twice; the first assignment is useless","path":"hooks/ponytail-band-import.js","line":10,"fingerprint":"javascript.lang.correctness.useless-assignment:hooks/ponytail-band-import.js:10"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`const` is assigned twice; the first assignment is useless","path":"hooks/ponytail-mode-tracker.js","line":7,"fingerprint":"javascript.lang.correctness.useless-assignment:hooks/ponytail-mode-tracker.js:7"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`const` is assigned twice; the first assignment is useless","path":"hooks/ponytail-mode-tracker.js","line":8,"fingerprint":"javascript.lang.correctness.useless-assignment:hooks/ponytail-mode-tracker.js:8"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`const` is assigned twice; the first assignment is useless","path":"hooks/ponytail-mode-tracker.js","line":9,"fingerprint":"javascript.lang.correctness.useless-assignment:hooks/ponytail-mode-tracker.js:9"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`const` is assigned twice; the first assignment is useless","path":"hooks/ponytail-runtime.js","line":4,"fingerprint":"javascript.lang.correctness.useless-assignment:hooks/ponytail-runtime.js:4"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`const` is assigned twice; the first assignment is useless","path":"hooks/ponytail-subagent.js","line":13,"fingerprint":"javascript.lang.correctness.useless-assignment:hooks/ponytail-subagent.js:13"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`const` is assigned twice; the first assignment is useless","path":"pi-extension/index.js","line":4,"fingerprint":"javascript.lang.correctness.useless-assignment:pi-extension/index.js:4"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":1.0,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":0.0,"check:tests_cochange":1.0,"test_lines":4563.0,"source_lines":7296.0,"test_ratio":0.6254,"ci_files":2.0,"cochange_share":0.6689,"cochange_commits":148.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/publish.yml","ref":".github/workflows/publish.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/test.yml","ref":".github/workflows/test.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (npm test)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["npm test"],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":1.0,"check:changelog":0.0,"readme_lines":163.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0},{"kind":"docs","description":".github/CONTRIBUTING.md","ref":".github/CONTRIBUTING.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.0,"check:low_escape_density":1.0,"escapes":10.0,"escapes_per_kloc":2.235},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":2373.0,"other_lines":4923.0,"files_blamed":38.0,"blame_failures":0.0,"quality:ai_findings":10.0,"quality:ai_per_kloc":4.214,"quality:other_findings":46.0,"quality:other_per_kloc":9.344,"quality:ratio":0.45,"security:ai_findings":14.0,"security:ai_per_kloc":5.9,"security:other_findings":49.0,"security:other_per_kloc":9.953,"security:ratio":0.59},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":true},"error":null}],"flags":[]}