{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:04.078709Z","repo":{"ref":{"host":"github.com","owner":"driwand","name":"super-codex"},"default_branch":"main","clone_url":"https://github.com/driwand/super-codex.git","html_url":"https://github.com/driwand/super-codex","description":"VIBING ✨🪩😎","stars":0,"forks":0,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":518,"primary_language":"Python","license_spdx":"MIT","created_at":"2026-08-20T14:23:27Z","pushed_at":"2026-09-22T22:03:07Z","security_policy_url":"https://github.com/driwand/super-codex/security/policy","distribution":{"owner_created_at":"2018-10-11T11:15:46Z","owner_type":"User","release_assets":[{"name":"install.py","size":7693,"download_count":0,"release_tag":"v0.10.0","url":"https://github.com/driwand/super-codex/releases/download/v0.10.0/install.py"},{"name":"release.json","size":238,"download_count":2,"release_tag":"v0.10.0","url":"https://github.com/driwand/super-codex/releases/download/v0.10.0/release.json"},{"name":"sc","size":51369,"download_count":1,"release_tag":"v0.10.0","url":"https://github.com/driwand/super-codex/releases/download/v0.10.0/sc"},{"name":"install.py","size":7693,"download_count":0,"release_tag":"v0.9.5","url":"https://github.com/driwand/super-codex/releases/download/v0.9.5/install.py"},{"name":"release.json","size":236,"download_count":4,"release_tag":"v0.9.5","url":"https://github.com/driwand/super-codex/releases/download/v0.9.5/release.json"},{"name":"sc","size":50471,"download_count":1,"release_tag":"v0.9.5","url":"https://github.com/driwand/super-codex/releases/download/v0.9.5/sc"},{"name":"install.py","size":7693,"download_count":0,"release_tag":"v0.9.4","url":"https://github.com/driwand/super-codex/releases/download/v0.9.4/install.py"},{"name":"release.json","size":236,"download_count":1,"release_tag":"v0.9.4","url":"https://github.com/driwand/super-codex/releases/download/v0.9.4/release.json"},{"name":"sc","size":50382,"download_count":1,"release_tag":"v0.9.4","url":"https://github.com/driwand/super-codex/releases/download/v0.9.4/sc"},{"name":"install.py","size":7693,"download_count":0,"release_tag":"v0.9.3","url":"https://github.com/driwand/super-codex/releases/download/v0.9.3/install.py"},{"name":"release.json","size":236,"download_count":2,"release_tag":"v0.9.3","url":"https://github.com/driwand/super-codex/releases/download/v0.9.3/release.json"},{"name":"sc","size":49152,"download_count":1,"release_tag":"v0.9.3","url":"https://github.com/driwand/super-codex/releases/download/v0.9.3/sc"},{"name":"install.py","size":7693,"download_count":0,"release_tag":"v0.9.2","url":"https://github.com/driwand/super-codex/releases/download/v0.9.2/install.py"},{"name":"release.json","size":236,"download_count":1,"release_tag":"v0.9.2","url":"https://github.com/driwand/super-codex/releases/download/v0.9.2/release.json"},{"name":"sc","size":48979,"download_count":1,"release_tag":"v0.9.2","url":"https://github.com/driwand/super-codex/releases/download/v0.9.2/sc"},{"name":"install.py","size":7693,"download_count":1,"release_tag":"v0.9.1","url":"https://github.com/driwand/super-codex/releases/download/v0.9.1/install.py"},{"name":"release.json","size":236,"download_count":2,"release_tag":"v0.9.1","url":"https://github.com/driwand/super-codex/releases/download/v0.9.1/release.json"},{"name":"sc","size":47457,"download_count":2,"release_tag":"v0.9.1","url":"https://github.com/driwand/super-codex/releases/download/v0.9.1/sc"},{"name":"install.py","size":7693,"download_count":0,"release_tag":"v0.9.0","url":"https://github.com/driwand/super-codex/releases/download/v0.9.0/install.py"},{"name":"release.json","size":236,"download_count":3,"release_tag":"v0.9.0","url":"https://github.com/driwand/super-codex/releases/download/v0.9.0/release.json"},{"name":"sc","size":47444,"download_count":2,"release_tag":"v0.9.0","url":"https://github.com/driwand/super-codex/releases/download/v0.9.0/sc"},{"name":"install.py","size":7693,"download_count":1,"release_tag":"v0.8.1","url":"https://github.com/driwand/super-codex/releases/download/v0.8.1/install.py"},{"name":"release.json","size":236,"download_count":3,"release_tag":"v0.8.1","url":"https://github.com/driwand/super-codex/releases/download/v0.8.1/release.json"},{"name":"sc","size":46330,"download_count":2,"release_tag":"v0.8.1","url":"https://github.com/driwand/super-codex/releases/download/v0.8.1/sc"},{"name":"install.py","size":7693,"download_count":4,"release_tag":"v0.8.0","url":"https://github.com/driwand/super-codex/releases/download/v0.8.0/install.py"},{"name":"release.json","size":236,"download_count":3,"release_tag":"v0.8.0","url":"https://github.com/driwand/super-codex/releases/download/v0.8.0/release.json"},{"name":"sc","size":46133,"download_count":5,"release_tag":"v0.8.0","url":"https://github.com/driwand/super-codex/releases/download/v0.8.0/sc"},{"name":"install.py","size":7693,"download_count":1,"release_tag":"v0.7.0","url":"https://github.com/driwand/super-codex/releases/download/v0.7.0/install.py"},{"name":"release.json","size":236,"download_count":2,"release_tag":"v0.7.0","url":"https://github.com/driwand/super-codex/releases/download/v0.7.0/release.json"},{"name":"sc","size":36704,"download_count":2,"release_tag":"v0.7.0","url":"https://github.com/driwand/super-codex/releases/download/v0.7.0/sc"}]}},"commit_sha":"35a37d655c09ef53e1db6353178ecd80993a1573","profile":{"lines_by_language":{"Python":10748},"files_by_category":{"source":14,"test":10,"docs":8,"config":4,"other":3},"source_lines":6389,"test_lines":4359},"pillars":{"ai_provenance":{"score":49.0,"confidence":0.8,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":0.49,"suspected_share":0.0959,"estimated_share":0.49,"ai_artifacts":2.0,"flagged_work_units":1.0,"flagged_releases":0.0,"style_index":0.0},"summary":"Explicit AI attribution on 49% of first-party code added; an estimated 49% including velocity signals."},"quality":{"score":72.4,"confidence":0.9,"coverage":1.0,"label":"adequate","breakdown":{"complexity":29.7,"duplication":85.6,"lint":79.1,"testing":90.0,"docs":100.0,"type_safety":40.0,"process":null},"summary":"Code quality is adequate: test-to-source ratio 0.68, CI runs tests; 40% of function code in complex or long functions; 3% duplicated lines. Weakest area: complexity."},"security":{"score":78.5,"confidence":0.85,"coverage":1.0,"label":"adequate","breakdown":{"secrets":100.0,"sast":54.7,"dependencies":null,"ci_actions":100.0,"posture":40.0,"scorecard":null},"summary":"Security posture is adequate: 9 high-severity SAST findings. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no registry dependencies declared"},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":40.0,"attributed_commits":17.0,"attributed_commit_share":0.425,"effective_loc":11442.0,"attributed_loc":5607.0,"attributed_loc_share":0.4900367068694284,"tools_detected":2.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"Claude Code: 14 attributed commits, 3,641 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attribution-summary","description":"Devin: 3 attributed commits, 1,966 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"08f7c54cea11f0cfc8826e7cbf3c93132aa911c8","url":"https://github.com/driwand/super-codex/commit/08f7c54cea11f0cfc8826e7cbf3c93132aa911c8","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"8ee938fd3c96cee0695229a821b70613841c0474","url":"https://github.com/driwand/super-codex/commit/8ee938fd3c96cee0695229a821b70613841c0474","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"800a55d983630efc8f559f82ca816b04a1f3d3b9","url":"https://github.com/driwand/super-codex/commit/800a55d983630efc8f559f82ca816b04a1f3d3b9","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"eef945b0516b7d7a35a600723fc3f8d7242f37a2","url":"https://github.com/driwand/super-codex/commit/eef945b0516b7d7a35a600723fc3f8d7242f37a2","weight":0.9},{"kind":"attributed-commit","description":"Devin: trailer 'Co-Authored-By: Devin'","ref":"bef4d3b7675921bfee5bf8ecb5775dfcd16bb438","url":"https://github.com/driwand/super-codex/commit/bef4d3b7675921bfee5bf8ecb5775dfcd16bb438","weight":0.9},{"kind":"attributed-commit","description":"Devin: trailer 'Co-Authored-By: Devin'","ref":"655b5e41feb74e2f56648e38426cc939e71fddaf","url":"https://github.com/driwand/super-codex/commit/655b5e41feb74e2f56648e38426cc939e71fddaf","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"d7016edbde0f01c3cd4b6bcccffdd476e2845f34","url":"https://github.com/driwand/super-codex/commit/d7016edbde0f01c3cd4b6bcccffdd476e2845f34","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"09b1e5174d1734836aa05ad688662b15cd1da6be","url":"https://github.com/driwand/super-codex/commit/09b1e5174d1734836aa05ad688662b15cd1da6be","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"e0ed915dab50e9496b191f80589ff425cf111e9f","url":"https://github.com/driwand/super-codex/commit/e0ed915dab50e9496b191f80589ff425cf111e9f","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"e6152d0d52358c8ce1f21f32f916a3e18f1639f9","url":"https://github.com/driwand/super-codex/commit/e6152d0d52358c8ce1f21f32f916a3e18f1639f9","weight":0.9},{"kind":"attributed-commit","description":"Devin: trailer 'Co-Authored-By: Devin'","ref":"089488cbe427361b3eda2aabb3d4975d8c01c229","url":"https://github.com/driwand/super-codex/commit/089488cbe427361b3eda2aabb3d4975d8c01c229","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"b327a1e3bce39c1698d905d557103efc6ec3b0d3","url":"https://github.com/driwand/super-codex/commit/b327a1e3bce39c1698d905d557103efc6ec3b0d3","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"b31054dc21a9230b5dba45bd65ae0b6c256f8c76","url":"https://github.com/driwand/super-codex/commit/b31054dc21a9230b5dba45bd65ae0b6c256f8c76","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"36982697d33b2bf3055799fd6ac6ba1dbe5c3b12","url":"https://github.com/driwand/super-codex/commit/36982697d33b2bf3055799fd6ac6ba1dbe5c3b12","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"5b0220557a37156d23a3e656ba17b97b32bad093","url":"https://github.com/driwand/super-codex/commit/5b0220557a37156d23a3e656ba17b97b32bad093","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"de9fcfa3c26f1a881230b2c88460afcf52885faa","url":"https://github.com/driwand/super-codex/commit/de9fcfa3c26f1a881230b2c88460afcf52885faa","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"84fc17d997600e72c5ea5db8792720b649f4aa78","url":"https://github.com/driwand/super-codex/commit/84fc17d997600e72c5ea5db8792720b649f4aa78","weight":0.9}],"data":{"attributed_loc_by_commit":{"84fc17d997600e72c5ea5db8792720b649f4aa78":1185,"de9fcfa3c26f1a881230b2c88460afcf52885faa":103,"5b0220557a37156d23a3e656ba17b97b32bad093":80,"36982697d33b2bf3055799fd6ac6ba1dbe5c3b12":778,"b327a1e3bce39c1698d905d557103efc6ec3b0d3":1,"b31054dc21a9230b5dba45bd65ae0b6c256f8c76":0,"089488cbe427361b3eda2aabb3d4975d8c01c229":35,"e6152d0d52358c8ce1f21f32f916a3e18f1639f9":179,"e0ed915dab50e9496b191f80589ff425cf111e9f":1,"09b1e5174d1734836aa05ad688662b15cd1da6be":815,"d7016edbde0f01c3cd4b6bcccffdd476e2845f34":1,"655b5e41feb74e2f56648e38426cc939e71fddaf":1837,"bef4d3b7675921bfee5bf8ecb5775dfcd16bb438":94,"eef945b0516b7d7a35a600723fc3f8d7242f37a2":251,"800a55d983630efc8f559f82ca816b04a1f3d3b9":1,"8ee938fd3c96cee0695229a821b70613841c0474":195,"08f7c54cea11f0cfc8826e7cbf3c93132aa911c8":51},"tools":{"claude-code":{"name":"Claude Code","commits":14,"loc":3641,"first_seen":1787236045,"last_seen":1789824700},"devin":{"name":"Devin","commits":3,"loc":1966,"first_seen":1787240773,"last_seen":1788802958}},"monthly":{"2026-08":{"loc":7706,"attributed_loc":2362},"2026-09":{"loc":3736,"attributed_loc":3245}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":2.0,"workflow_agents":0.0,"tools_configured":2.0,"earliest_adoption":1787179885.0},"findings":[],"evidence":[{"kind":"ai-artifact","description":"CLAUDE.md (claude-code configuration)","ref":"CLAUDE.md","url":"https://github.com/driwand/super-codex/blob/35a37d655c09ef53e1db6353178ecd80993a1573/CLAUDE.md","weight":0.5},{"kind":"ai-artifact","description":"AGENTS.md (generic-agent configuration)","ref":"AGENTS.md","url":"https://github.com/driwand/super-codex/blob/35a37d655c09ef53e1db6353178ecd80993a1573/AGENTS.md","weight":0.5}],"data":{"artifacts":[{"tool":"claude-code","path":"CLAUDE.md","added_at":1787179885},{"tool":"generic-agent","path":"AGENTS.md","added_at":1787179885}],"workflows":[],"tools":["claude-code","generic-agent"]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":16.0,"flagged_units":1.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":11442.0,"flagged_loc":3279.0,"flagged_loc_share":0.28657577346617724,"max_loc_per_hour":583.538484354145,"median_loc_per_hour":199.19124429127885,"pr_timed_units":2.0,"excluded_import_loc":0.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"3,279 lines of first-party code in ~5.6h (584 lines/hour, 15 commit session)","ref":"79a3bd987aad6ce3f028a55fecba1e0ef0963333","url":"https://github.com/driwand/super-codex/commit/79a3bd987aad6ce3f028a55fecba1e0ef0963333","weight":0.1750615453062435}],"data":{"flagged_loc_by_commit":{"84fc17d997600e72c5ea5db8792720b649f4aa78":1185,"de9fcfa3c26f1a881230b2c88460afcf52885faa":103,"5b0220557a37156d23a3e656ba17b97b32bad093":80,"36982697d33b2bf3055799fd6ac6ba1dbe5c3b12":778,"b327a1e3bce39c1698d905d557103efc6ec3b0d3":1,"042f6e5d1ed09680121c9cc48a3e3ed06a584ac1":73,"83e7439109547d56e8f7a4a49e9f681f4b1277ff":177,"fc2ad80cba0c0290da90b5ae2100cafe5d827046":99,"f8bed4acde7f95daf121f22d34b3d6a51cdc0ec8":75,"089488cbe427361b3eda2aabb3d4975d8c01c229":35,"15b8537dcfdbf39e9d7159f380ef3bc8ed7ad722":321,"d97c71da9639df72e9769cd5b5ebc011c1778196":202,"80ddef374215ebe1eacf00b239be22c0da4e7171":104,"4d7ae0eed3358adb93106dffe8944266f1037b27":29,"79a3bd987aad6ce3f028a55fecba1e0ef0963333":17},"excluded_import_commits":[]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"releases":12.0,"flagged_releases":0.0,"max_loc_per_day":5664.0},"findings":[],"evidence":[],"data":{"releases":[{"from":"v0.4.0","to":"v0.5.0","loc":1100,"days":0.25,"loc_per_day":4376.3,"flagged":false},{"from":"v0.5.0","to":"v0.6.0","loc":180,"days":2.27,"loc_per_day":79.3,"flagged":false},{"from":"v0.6.0","to":"v0.7.0","loc":816,"days":13.62,"loc_per_day":59.9,"flagged":false},{"from":"v0.7.0","to":"v0.8.0","loc":1837,"days":0.37,"loc_per_day":4967.4,"flagged":false},{"from":"v0.8.0","to":"v0.8.1","loc":94,"days":0.7,"loc_per_day":134.3,"flagged":false},{"from":"v0.8.1","to":"v0.9.0","loc":252,"days":0.97,"loc_per_day":258.9,"flagged":false},{"from":"v0.9.0","to":"v0.9.1","loc":9,"days":1.32,"loc_per_day":6.8,"flagged":false},{"from":"v0.9.1","to":"v0.9.2","loc":236,"days":0.04,"loc_per_day":5664.0,"flagged":false},{"from":"v0.9.2","to":"v0.9.3","loc":38,"days":0.04,"loc_per_day":912.0,"flagged":false},{"from":"v0.9.3","to":"v0.9.4","loc":195,"days":2.63,"loc_per_day":74.1,"flagged":false},{"from":"v0.9.4","to":"v0.9.5","loc":51,"days":6.88,"loc_per_day":7.4,"flagged":false},{"from":"v0.9.5","to":"v0.10.0","loc":208,"days":3.35,"loc_per_day":62.1,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":6389.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":19.0,"findings_high":9.0,"findings_medium":10.0,"findings_low":0.0,"weighted_findings":11.0,"scanned_lines":6389.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/check_sensitive_data.py","line":43,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/check_sensitive_data.py:43"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/run_gitleaks.py","line":51,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/run_gitleaks.py:51"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/run_gitleaks.py","line":100,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/run_gitleaks.py:100"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"src/super_agent/adapters.py","line":93,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:src/super_agent/adapters.py:93"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"src/super_agent/adapters.py","line":107,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:src/super_agent/adapters.py:107"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"src/super_agent/adapters.py","line":597,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:src/super_agent/adapters.py:597"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"src/super_agent/adapters.py","line":608,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:src/super_agent/adapters.py:608"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"src/super_agent/mcp_server.py","line":288,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:src/super_agent/mcp_server.py:288"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"src/super_agent/mcp_server.py","line":579,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:src/super_agent/mcp_server.py:579"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"install.py","line":44,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:install.py:44"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"install.py","line":119,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:install.py:119"},{"rule_id":"opengrep/python.lang.security.audit.insecure-file-permissions","severity":"medium","message":"These permissions `0o755` are widely permissive and grant access to more people than may be necessary. A good default is `0o644` which gives read and write access to yourself and read access to everyone else. [confidence medium]","path":"install.py","line":143,"fingerprint":"python.lang.security.audit.insecure-file-permissions:install.py:143"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"scripts/install_gitleaks.py","line":60,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:scripts/install_gitleaks.py:60"},{"rule_id":"opengrep/python.lang.security.audit.insecure-file-permissions","severity":"medium","message":"These permissions `0o700` are widely permissive and grant access to more people than may be necessary. A good default is `0o644` which gives read and write access to yourself and read access to everyone else. [confidence medium]","path":"scripts/install_gitleaks.py","line":100,"fingerprint":"python.lang.security.audit.insecure-file-permissions:scripts/install_gitleaks.py:100"},{"rule_id":"opengrep/python.lang.security.audit.insecure-file-permissions","severity":"medium","message":"These permissions `0o700` are widely permissive and grant access to more people than may be necessary. A good default is `0o644` which gives read and write access to yourself and read access to everyone else. [confidence medium]","path":"scripts/install_gitleaks.py","line":111,"fingerprint":"python.lang.security.audit.insecure-file-permissions:scripts/install_gitleaks.py:111"},{"rule_id":"opengrep/python.lang.security.audit.insecure-file-permissions","severity":"medium","message":"These permissions `0o700` are widely permissive and grant access to more people than may be necessary. A good default is `0o644` which gives read and write access to yourself and read access to everyone else. [confidence medium]","path":"src/super_agent/config.py","line":80,"fingerprint":"python.lang.security.audit.insecure-file-permissions:src/super_agent/config.py:80"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"src/super_agent/release.py","line":66,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:src/super_agent/release.py:66"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"src/super_agent/release.py","line":149,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:src/super_agent/release.py:149"},{"rule_id":"opengrep/python.lang.security.audit.insecure-file-permissions","severity":"medium","message":"These permissions `0o755` are widely permissive and grant access to more people than may be necessary. A good default is `0o644` which gives read and write access to yourself and read access to everyone else. [confidence medium]","path":"src/super_agent/release.py","line":173,"fingerprint":"python.lang.security.audit.insecure-file-permissions:src/super_agent/release.py:173"}],"evidence":[],"data":{"rulesets":["python"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":2.0,"findings":0.0,"findings_high":0.0,"findings_medium":0.0,"findings_low":0.0,"penalty":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":1.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.075,"unpinned_manifests":0.0},"findings":[],"evidence":[{"kind":"posture","description":"Security policy: SECURITY.md","ref":"SECURITY.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":247.0,"function_nloc":5262.0,"mean_ccn":6.81,"p90_ccn":14.0,"complex_functions":23.0,"long_functions":6.0,"many_param_functions":4.0,"risky_nloc_share":0.4042},"findings":[],"evidence":[{"kind":"complex-function","description":"main in src/super_agent/cli.py: complexity 86, 235 lines","ref":"src/super_agent/cli.py","url":"https://github.com/driwand/super-codex/blob/35a37d655c09ef53e1db6353178ecd80993a1573/src/super_agent/cli.py#L1071","weight":1.0},{"kind":"complex-function","description":"handle_request in src/super_agent/mcp_server.py: complexity 64, 216 lines","ref":"src/super_agent/mcp_server.py","url":"https://github.com/driwand/super-codex/blob/35a37d655c09ef53e1db6353178ecd80993a1573/src/super_agent/mcp_server.py#L1033","weight":1.0},{"kind":"complex-function","description":"validate in src/super_agent/config.py: complexity 49, 100 lines","ref":"src/super_agent/config.py","url":"https://github.com/driwand/super-codex/blob/35a37d655c09ef53e1db6353178ecd80993a1573/src/super_agent/config.py#L363","weight":0.8166666666666667},{"kind":"complex-function","description":"run_sessions in src/super_agent/cli.py: complexity 41, 167 lines","ref":"src/super_agent/cli.py","url":"https://github.com/driwand/super-codex/blob/35a37d655c09ef53e1db6353178ecd80993a1573/src/super_agent/cli.py#L722","weight":0.6833333333333333},{"kind":"complex-function","description":"run_claude_consult in src/super_agent/mcp_server.py: complexity 36, 145 lines","ref":"src/super_agent/mcp_server.py","url":"https://github.com/driwand/super-codex/blob/35a37d655c09ef53e1db6353178ecd80993a1573/src/super_agent/mcp_server.py#L485","weight":0.6},{"kind":"complex-function","description":"_link_session_tree in src/super_agent/config.py: complexity 32, 98 lines","ref":"src/super_agent/config.py","url":"https://github.com/driwand/super-codex/blob/35a37d655c09ef53e1db6353178ecd80993a1573/src/super_agent/config.py#L754","weight":0.5333333333333333},{"kind":"complex-function","description":"_app_server_requests in src/super_agent/adapters.py: complexity 31, 83 lines","ref":"src/super_agent/adapters.py","url":"https://github.com/driwand/super-codex/blob/35a37d655c09ef53e1db6353178ecd80993a1573/src/super_agent/adapters.py#L130","weight":0.5166666666666667},{"kind":"complex-function","description":"choose_profile in src/super_agent/cli.py: complexity 29, 67 lines","ref":"src/super_agent/cli.py","url":"https://github.com/driwand/super-codex/blob/35a37d655c09ef53e1db6353178ecd80993a1573/src/super_agent/cli.py#L425","weight":0.48333333333333334},{"kind":"complex-function","description":"_link_shared_history in src/super_agent/config.py: complexity 26, 83 lines","ref":"src/super_agent/config.py","url":"https://github.com/driwand/super-codex/blob/35a37d655c09ef53e1db6353178ecd80993a1573/src/super_agent/config.py#L971","weight":0.43333333333333335},{"kind":"complex-function","description":"build_command in src/super_agent/adapters.py: complexity 23, 62 lines","ref":"src/super_agent/adapters.py","url":"https://github.com/driwand/super-codex/blob/35a37d655c09ef53e1db6353178ecd80993a1573/src/super_agent/adapters.py#L398","weight":0.38333333333333336}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":5307.0,"duplicated_lines":138.0,"duplicated_share":0.026,"files":14.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: install.py:87 and src/super_agent/release.py:109","ref":"install.py","url":"https://github.com/driwand/super-codex/blob/35a37d655c09ef53e1db6353178ecd80993a1573/install.py#L87","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: scripts/check_sensitive_data.py:127 and scripts/install_gitleaks.py:118","ref":"scripts/check_sensitive_data.py","url":"https://github.com/driwand/super-codex/blob/35a37d655c09ef53e1db6353178ecd80993a1573/scripts/check_sensitive_data.py#L127","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/super_agent/adapters.py:222 and src/super_agent/adapters.py:335","ref":"src/super_agent/adapters.py","url":"https://github.com/driwand/super-codex/blob/35a37d655c09ef53e1db6353178ecd80993a1573/src/super_agent/adapters.py#L222","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/super_agent/config.py:309 and src/super_agent/config.py:1648","ref":"src/super_agent/config.py","url":"https://github.com/driwand/super-codex/blob/35a37d655c09ef53e1db6353178ecd80993a1573/src/super_agent/config.py#L309","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/super_agent/mcp_server.py:59 and src/super_agent/mcp_server.py:734","ref":"src/super_agent/mcp_server.py","url":"https://github.com/driwand/super-codex/blob/35a37d655c09ef53e1db6353178ecd80993a1573/src/super_agent/mcp_server.py#L59","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":4.0,"weighted_findings":6.0,"scanned_lines":6389.0,"category:best-practice":1.0,"category:correctness":3.0},"findings":[{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"src/super_agent/mcp_server.py","line":391,"fingerprint":"python.lang.best-practice.arbitrary-sleep:src/super_agent/mcp_server.py:391"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"src/super_agent/adapters.py","line":375,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:src/super_agent/adapters.py:375"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"src/super_agent/adapters.py","line":384,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:src/super_agent/adapters.py:384"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"src/super_agent/adapters.py","line":389,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:src/super_agent/adapters.py:389"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":1.0,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":0.0,"check:tests_cochange":1.0,"test_lines":4359.0,"source_lines":6389.0,"test_ratio":0.6823,"ci_files":2.0,"cochange_share":0.8824,"cochange_commits":34.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/ci.yml","ref":".github/workflows/ci.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/release.yml","ref":".github/workflows/release.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (unittest)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["unittest"],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":1.0,"check:changelog":1.0,"readme_lines":73.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0},{"kind":"docs","description":"CONTRIBUTING.md","ref":"CONTRIBUTING.md","url":null,"weight":0.0},{"kind":"docs","description":"CHANGELOG.md","ref":"CHANGELOG.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.0,"check:low_escape_density":1.0,"escapes":0.0,"escapes_per_kloc":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":2939.0,"other_lines":3450.0,"files_blamed":14.0,"blame_failures":0.0,"quality:ai_findings":1.0,"quality:ai_per_kloc":0.34,"quality:other_findings":3.0,"quality:other_per_kloc":0.87,"quality:ratio":0.39,"security:ai_findings":3.0,"security:ai_per_kloc":1.021,"security:other_findings":16.0,"security:other_per_kloc":4.638,"security:ratio":0.22},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":true},"error":null}],"flags":[]}