{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-13T23:54:51.045682Z","repo":{"ref":{"host":"github.com","owner":"mikayla-maki","name":"loom"},"default_branch":"main","clone_url":"https://github.com/mikayla-maki/loom.git","html_url":"https://github.com/mikayla-maki/loom","description":"A secure agent harness runtime and framework","stars":31,"forks":0,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":1614,"primary_language":"TypeScript","license_spdx":"CC0-1.0","created_at":"2026-05-06T07:06:54Z","pushed_at":"2026-07-16T16:01:13Z","security_policy_url":null,"distribution":{"owner_created_at":"2012-09-04T20:46:51Z","owner_type":"User","release_assets":[]}},"commit_sha":"0d2ef7c8a88ff1c32d641bc06cfebdf05af73048","profile":{"lines_by_language":{"TypeScript":36507,"JavaScript":642},"files_by_category":{"source":98,"test":59,"docs":23,"config":21,"generated":2},"source_lines":21395,"test_lines":15754},"pillars":{"ai_provenance":{"score":46.0,"confidence":0.91,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":0.4602,"suspected_share":0.1978,"estimated_share":0.4602,"ai_artifacts":0.0,"flagged_work_units":9.0,"flagged_releases":null},"summary":"Explicit AI attribution on 46% of first-party code added; an estimated 46% including velocity signals."},"quality":{"score":65.8,"confidence":0.9,"coverage":1.0,"label":"adequate","breakdown":{"complexity":53.8,"duplication":62.1,"lint":93.0,"testing":55.0,"docs":65.0,"type_safety":100.0,"process":null},"summary":"Code quality is adequate: test-to-source ratio 0.74, no CI test run detected; 21% of function code in complex or long functions; 8% duplicated lines. Weakest area: complexity."},"security":{"score":61.1,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":100.0,"sast":95.2,"dependencies":8.8,"ci_actions":null,"posture":0.0,"scorecard":null},"summary":"Security posture is weak: 89 known vulnerabilities in 19 dependencies. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":14.0,"checked":14.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":85.0,"attributed_commits":49.0,"attributed_commit_share":0.5764705882352941,"effective_loc":74894.0,"attributed_loc":34468.0,"attributed_loc_share":0.46022378294656446,"tools_detected":2.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"Cursor agent: 42 attributed commits, 30,804 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attribution-summary","description":"Claude Code: 7 attributed commits, 3,664 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"0d2ef7c8a88ff1c32d641bc06cfebdf05af73048","url":"https://github.com/mikayla-maki/loom/commit/0d2ef7c8a88ff1c32d641bc06cfebdf05af73048","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"bccea3c236e200e6034c5b8329d27f4fbbc732f9","url":"https://github.com/mikayla-maki/loom/commit/bccea3c236e200e6034c5b8329d27f4fbbc732f9","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"48e67d852b6b0b8ca86029e5530783887aa42568","url":"https://github.com/mikayla-maki/loom/commit/48e67d852b6b0b8ca86029e5530783887aa42568","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"545525cf3e539f802e116cfe0a83175a6a00378d","url":"https://github.com/mikayla-maki/loom/commit/545525cf3e539f802e116cfe0a83175a6a00378d","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"286514e11dff27283bc8e7b27bff8ed33a9f9fd1","url":"https://github.com/mikayla-maki/loom/commit/286514e11dff27283bc8e7b27bff8ed33a9f9fd1","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"b8b7eb1716cd47f61a2f7855b5cae00c45e720ba","url":"https://github.com/mikayla-maki/loom/commit/b8b7eb1716cd47f61a2f7855b5cae00c45e720ba","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"e29af564cecb6d1defdafca07e235e13dc06e410","url":"https://github.com/mikayla-maki/loom/commit/e29af564cecb6d1defdafca07e235e13dc06e410","weight":0.9},{"kind":"attributed-commit","description":"Cursor agent: on merged branch (9891c6c4fc)","ref":"c7e02074947fa02d3c95cbcdbc7f56d6a7081baa","url":"https://github.com/mikayla-maki/loom/commit/c7e02074947fa02d3c95cbcdbc7f56d6a7081baa","weight":0.9},{"kind":"attributed-commit","description":"Cursor agent: on merged branch (9891c6c4fc)","ref":"cec9b53724e9fd70a71d5fcccbba63847bd489ff","url":"https://github.com/mikayla-maki/loom/commit/cec9b53724e9fd70a71d5fcccbba63847bd489ff","weight":0.9},{"kind":"attributed-commit","description":"Cursor agent: on merged branch (9891c6c4fc)","ref":"9b31735cbaf8c2c6ec2b500683f21f7d3cdc8344","url":"https://github.com/mikayla-maki/loom/commit/9b31735cbaf8c2c6ec2b500683f21f7d3cdc8344","weight":0.9},{"kind":"attributed-commit","description":"Cursor agent: on merged branch (9891c6c4fc)","ref":"d826ed4736902ee803b115c5aaeb1cd249c283b7","url":"https://github.com/mikayla-maki/loom/commit/d826ed4736902ee803b115c5aaeb1cd249c283b7","weight":0.9},{"kind":"attributed-commit","description":"Cursor agent: on merged branch (9891c6c4fc)","ref":"0383bfa743798389b0635604d3e64bc8b2f15842","url":"https://github.com/mikayla-maki/loom/commit/0383bfa743798389b0635604d3e64bc8b2f15842","weight":0.9},{"kind":"attributed-commit","description":"Cursor agent: on merged branch (9891c6c4fc)","ref":"98d2bfe2e56cbaacf7d0b5fa4f909201e81af50d","url":"https://github.com/mikayla-maki/loom/commit/98d2bfe2e56cbaacf7d0b5fa4f909201e81af50d","weight":0.9},{"kind":"attributed-commit","description":"Cursor agent: on merged branch (9891c6c4fc)","ref":"3b1a264a81547cc5c5736853503d8640c2a3ebbb","url":"https://github.com/mikayla-maki/loom/commit/3b1a264a81547cc5c5736853503d8640c2a3ebbb","weight":0.9},{"kind":"attributed-commit","description":"Cursor agent: on merged branch (9891c6c4fc)","ref":"981254ceb5e05939e19ac00ae783bbd48fb576ee","url":"https://github.com/mikayla-maki/loom/commit/981254ceb5e05939e19ac00ae783bbd48fb576ee","weight":0.9},{"kind":"attributed-commit","description":"Cursor agent: on merged branch (9891c6c4fc)","ref":"4102f05612b184ab70b19f220bbc5d43be5d70aa","url":"https://github.com/mikayla-maki/loom/commit/4102f05612b184ab70b19f220bbc5d43be5d70aa","weight":0.9},{"kind":"attributed-commit","description":"Cursor agent: on merged branch (9891c6c4fc)","ref":"226749e008b00d2051b6c7e540b5baa3eb7e4d28","url":"https://github.com/mikayla-maki/loom/commit/226749e008b00d2051b6c7e540b5baa3eb7e4d28","weight":0.9},{"kind":"attributed-commit","description":"Cursor agent: on merged branch (9891c6c4fc)","ref":"a4de7eeb15267cf36789d1525d74d447e4fc3892","url":"https://github.com/mikayla-maki/loom/commit/a4de7eeb15267cf36789d1525d74d447e4fc3892","weight":0.9},{"kind":"attributed-commit","description":"Cursor agent: on merged branch (9891c6c4fc)","ref":"f44f2a190a2b63b0d55569bd1b077ec256de4f2a","url":"https://github.com/mikayla-maki/loom/commit/f44f2a190a2b63b0d55569bd1b077ec256de4f2a","weight":0.9},{"kind":"attributed-commit","description":"Cursor agent: on merged branch (9891c6c4fc)","ref":"1278ca0caf88a7419235341fb537fc2593491233","url":"https://github.com/mikayla-maki/loom/commit/1278ca0caf88a7419235341fb537fc2593491233","weight":0.9},{"kind":"attributed-commit","description":"Cursor agent: on merged branch (9891c6c4fc)","ref":"3bd8344aac08ea1b095e3776eb61a3e5e76e7ac9","url":"https://github.com/mikayla-maki/loom/commit/3bd8344aac08ea1b095e3776eb61a3e5e76e7ac9","weight":0.9},{"kind":"attributed-commit","description":"Cursor agent: on merged branch (9891c6c4fc)","ref":"290974e05be76985de7177a9f7f55d1e52237125","url":"https://github.com/mikayla-maki/loom/commit/290974e05be76985de7177a9f7f55d1e52237125","weight":0.9},{"kind":"attributed-commit","description":"Cursor agent: on merged branch (9891c6c4fc)","ref":"4c22184cc08766dbcd461799985df8d058dd03f3","url":"https://github.com/mikayla-maki/loom/commit/4c22184cc08766dbcd461799985df8d058dd03f3","weight":0.9},{"kind":"attributed-commit","description":"Cursor agent: on merged branch (9891c6c4fc)","ref":"e47f5ecd34c9b93a537f03b882f034533c136699","url":"https://github.com/mikayla-maki/loom/commit/e47f5ecd34c9b93a537f03b882f034533c136699","weight":0.9},{"kind":"attributed-commit","description":"Cursor agent: on merged branch (9891c6c4fc)","ref":"9ce3f0ca734b49206af6382afc6d9fc27ac1cfdb","url":"https://github.com/mikayla-maki/loom/commit/9ce3f0ca734b49206af6382afc6d9fc27ac1cfdb","weight":0.9}],"data":{"attributed_loc_by_commit":{"59eec5064018e7fa4638c56fce02bb411cf015b3":5372,"29652959b17c62cda5a0964b80b95f0958581a0b":1672,"0f05479590fb92d78c34cf3c25b68e840a08439d":741,"cb4b434fad057c655cb8dd750228eb1a3616927d":1803,"07f15df45fffef16874b9d912e2a8cf50121e4a8":218,"89984cfae9dc00523e722d9b912b358bfb99b3be":780,"57f6bd2681150cde437e4d9b44d1630854b90045":467,"51e4871a49700026bd1571146549a3544088f5aa":1053,"936624f0d5a0a7ef9ed5323a5bacd223a72ae4ef":0,"99a4e49ba0b09cd3cf76e4c62f57a391aef26e6a":3478,"3e82bf19e359097e1ca72fe60ad092313a4b27f6":1677,"d32ec57d308031f2e9f302c8179d29e53bcf2afa":544,"9feb6b75ed69a0bdf79677a973bce5bc38086be4":3,"bfcda3ae054636b0a4304173d42f9f177e44bfd1":2191,"364a9a80412a3a048aa26f5174e23f8e118d03f3":957,"a6592935c8b56afee0a3578b8d6288c531b5c01a":416,"e1982b3e3c69cb70b0cba2d3a7d6af66cc5157e5":838,"5045719fd06e664f39101d520477c11157c71a4e":600,"6c9d8fab169b45e16dfff7371e4d4aaadfca3417":244,"825bd6331b50d1baaa3d9a996a7b0f22fccad09e":63,"724392732f0cdbb364770cb3af7000a040813eee":421,"6dceb6bd17900e4852d87eac7b6880d3cc4466f7":38,"034ff0f049c3810cb35d928bfc192872c56ad809":660,"b22703b657cc2df68649cae3b6e4662b9e07107f":615,"9ce3f0ca734b49206af6382afc6d9fc27ac1cfdb":265,"e47f5ecd34c9b93a537f03b882f034533c136699":474,"4c22184cc08766dbcd461799985df8d058dd03f3":115,"290974e05be76985de7177a9f7f55d1e52237125":793,"3bd8344aac08ea1b095e3776eb61a3e5e76e7ac9":129,"1278ca0caf88a7419235341fb537fc2593491233":1294,"f44f2a190a2b63b0d55569bd1b077ec256de4f2a":577,"a4de7eeb15267cf36789d1525d74d447e4fc3892":69,"226749e008b00d2051b6c7e540b5baa3eb7e4d28":247,"4102f05612b184ab70b19f220bbc5d43be5d70aa":78,"981254ceb5e05939e19ac00ae783bbd48fb576ee":352,"3b1a264a81547cc5c5736853503d8640c2a3ebbb":70,"98d2bfe2e56cbaacf7d0b5fa4f909201e81af50d":407,"0383bfa743798389b0635604d3e64bc8b2f15842":67,"d826ed4736902ee803b115c5aaeb1cd249c283b7":95,"9b31735cbaf8c2c6ec2b500683f21f7d3cdc8344":575,"cec9b53724e9fd70a71d5fcccbba63847bd489ff":323,"c7e02074947fa02d3c95cbcdbc7f56d6a7081baa":23,"e29af564cecb6d1defdafca07e235e13dc06e410":0,"b8b7eb1716cd47f61a2f7855b5cae00c45e720ba":1531,"286514e11dff27283bc8e7b27bff8ed33a9f9fd1":607,"545525cf3e539f802e116cfe0a83175a6a00378d":5,"48e67d852b6b0b8ca86029e5530783887aa42568":442,"bccea3c236e200e6034c5b8329d27f4fbbc732f9":255,"0d2ef7c8a88ff1c32d641bc06cfebdf05af73048":824},"tools":{"cursor":{"name":"Cursor agent","commits":42,"loc":30804,"first_seen":1778053238,"last_seen":1778278474},"claude-code":{"name":"Claude Code","commits":7,"loc":3664,"first_seen":1780814047,"last_seen":1784217672}},"monthly":{"2026-05":{"loc":60269,"attributed_loc":30804},"2026-06":{"loc":13104,"attributed_loc":2143},"2026-07":{"loc":1521,"attributed_loc":1521}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":29.0,"flagged_units":9.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":50641.0,"flagged_loc":33070.0,"flagged_loc_share":0.653028178748445,"max_loc_per_hour":2271.395288635775,"median_loc_per_hour":483.4788029925187,"pr_timed_units":0.0,"excluded_import_loc":24253.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"7,312 lines of first-party code in ~3.2h (2,271 lines/hour, 1 commit session)","ref":"79c9227adc05785731e68af6951b6fba39a700f5","url":"https://github.com/mikayla-maki/loom/commit/79c9227adc05785731e68af6951b6fba39a700f5","weight":0.6},{"kind":"velocity-burst","description":"4,450 lines of first-party code in ~3.3h (1,332 lines/hour, 14 commit session)","ref":"ce8e7ffb32118fe6f85fb10b587722a350f4846b","url":"https://github.com/mikayla-maki/loom/commit/ce8e7ffb32118fe6f85fb10b587722a350f4846b","weight":0.39956767542401056},{"kind":"velocity-burst","description":"6,734 lines of first-party code in ~5.3h (1,272 lines/hour, 7 commit session)","ref":"51e4871a49700026bd1571146549a3544088f5aa","url":"https://github.com/mikayla-maki/loom/commit/51e4871a49700026bd1571146549a3544088f5aa","weight":0.3815697796432319},{"kind":"velocity-burst","description":"1,390 lines of first-party code in ~1.4h (1,003 lines/hour, 3 commit session)","ref":"bbe9f44caea1edfde04128951d81f1567f7cef2a","url":"https://github.com/mikayla-maki/loom/commit/bbe9f44caea1edfde04128951d81f1567f7cef2a","weight":0.30078140653175717},{"kind":"velocity-burst","description":"2,191 lines of first-party code in ~2.3h (949 lines/hour, 1 commit session)","ref":"bfcda3ae054636b0a4304173d42f9f177e44bfd1","url":"https://github.com/mikayla-maki/loom/commit/bfcda3ae054636b0a4304173d42f9f177e44bfd1","weight":0.2847509025270758},{"kind":"velocity-burst","description":"3,478 lines of first-party code in ~4.0h (870 lines/hour, 1 commit session)","ref":"99a4e49ba0b09cd3cf76e4c62f57a391aef26e6a","url":"https://github.com/mikayla-maki/loom/commit/99a4e49ba0b09cd3cf76e4c62f57a391aef26e6a","weight":0.26085},{"kind":"velocity-burst","description":"1,677 lines of first-party code in ~2.1h (809 lines/hour, 1 commit session)","ref":"3e82bf19e359097e1ca72fe60ad092313a4b27f6","url":"https://github.com/mikayla-maki/loom/commit/3e82bf19e359097e1ca72fe60ad092313a4b27f6","weight":0.2426527331189711},{"kind":"velocity-burst","description":"3,071 lines of first-party code in ~4.0h (768 lines/hour, 1 commit session)","ref":"18fce50c7a7adfafcf9cf5327be3d8a1caf56b30","url":"https://github.com/mikayla-maki/loom/commit/18fce50c7a7adfafcf9cf5327be3d8a1caf56b30","weight":0.230325},{"kind":"velocity-burst","description":"2,767 lines of first-party code in ~4.0h (692 lines/hour, 1 commit session)","ref":"4bfb0573285853907014a83fc339769f313b3fda","url":"https://github.com/mikayla-maki/loom/commit/4bfb0573285853907014a83fc339769f313b3fda","weight":0.207525}],"data":{"flagged_loc_by_commit":{"29652959b17c62cda5a0964b80b95f0958581a0b":1672,"0f05479590fb92d78c34cf3c25b68e840a08439d":741,"cb4b434fad057c655cb8dd750228eb1a3616927d":1803,"07f15df45fffef16874b9d912e2a8cf50121e4a8":218,"89984cfae9dc00523e722d9b912b358bfb99b3be":780,"57f6bd2681150cde437e4d9b44d1630854b90045":467,"51e4871a49700026bd1571146549a3544088f5aa":1053,"99a4e49ba0b09cd3cf76e4c62f57a391aef26e6a":3478,"3e82bf19e359097e1ca72fe60ad092313a4b27f6":1677,"bfcda3ae054636b0a4304173d42f9f177e44bfd1":2191,"1278ca0caf88a7419235341fb537fc2593491233":1294,"f44f2a190a2b63b0d55569bd1b077ec256de4f2a":577,"a4de7eeb15267cf36789d1525d74d447e4fc3892":69,"226749e008b00d2051b6c7e540b5baa3eb7e4d28":247,"4102f05612b184ab70b19f220bbc5d43be5d70aa":78,"981254ceb5e05939e19ac00ae783bbd48fb576ee":352,"3b1a264a81547cc5c5736853503d8640c2a3ebbb":70,"98d2bfe2e56cbaacf7d0b5fa4f909201e81af50d":407,"0383bfa743798389b0635604d3e64bc8b2f15842":67,"d826ed4736902ee803b115c5aaeb1cd249c283b7":95,"9b31735cbaf8c2c6ec2b500683f21f7d3cdc8344":575,"cec9b53724e9fd70a71d5fcccbba63847bd489ff":323,"c7e02074947fa02d3c95cbcdbc7f56d6a7081baa":23,"ce8e7ffb32118fe6f85fb10b587722a350f4846b":273,"4bfb0573285853907014a83fc339769f313b3fda":2767,"79c9227adc05785731e68af6951b6fba39a700f5":7312,"7a941f313765c4439321098386ca9eb8615ccef4":947,"0686ac84ec972ac5148ebccd59b1252d417159b9":349,"bbe9f44caea1edfde04128951d81f1567f7cef2a":94,"18fce50c7a7adfafcf9cf5327be3d8a1caf56b30":3071},"excluded_import_commits":["1667391186b3e83cf251192437ecf065d3b6ced7","32fc612ef0d690e5f991b638028d65de337eb962","59eec5064018e7fa4638c56fce02bb411cf015b3","729156be27e7cac31203ae5603ded3bdc6b4b5f0"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":21395.0,"index":0.257,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":11.0,"per_kloc:emoji_in_code":0.514,"files:emoji_in_code":2.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":12.0,"findings_high":0.0,"findings_medium":12.0,"findings_low":0.0,"weighted_findings":3.0,"scanned_lines":21395.0,"parse_errors":2.0},"findings":[{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/capabilities/src/parser.ts","line":292,"fingerprint":"javascript.lang.security.html-in-template-string:packages/capabilities/src/parser.ts:292"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/loom/src/audit/audit.ts","line":355,"fingerprint":"javascript.lang.security.html-in-template-string:packages/loom/src/audit/audit.ts:355"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/loom/src/audit/audit.ts","line":357,"fingerprint":"javascript.lang.security.html-in-template-string:packages/loom/src/audit/audit.ts:357"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/loom/src/builtins/session/file.ts","line":164,"fingerprint":"javascript.lang.security.html-in-template-string:packages/loom/src/builtins/session/file.ts:164"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/loom/src/builtins/session/skills.ts","line":179,"fingerprint":"javascript.lang.security.html-in-template-string:packages/loom/src/builtins/session/skills.ts:179"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/loom/src/builtins/session/skills.ts","line":187,"fingerprint":"javascript.lang.security.html-in-template-string:packages/loom/src/builtins/session/skills.ts:187"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"packages/loom/src/builtins/tools/native.ts","line":74,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:packages/loom/src/builtins/tools/native.ts:74"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `g` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled in [confidence low]","path":"packages/loom/src/runtime/builtins/find.ts","line":172,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:packages/loom/src/runtime/builtins/find.ts:172"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/loom/src/runtime/builtins/spawn_subagent.ts","line":138,"fingerprint":"javascript.lang.security.html-in-template-string:packages/loom/src/runtime/builtins/spawn_subagent.ts:138"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/loom/src/runtime/builtins/spawn_subagent.ts","line":142,"fingerprint":"javascript.lang.security.html-in-template-string:packages/loom/src/runtime/builtins/spawn_subagent.ts:142"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `pattern` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-control [confidence low]","path":"packages/loom/src/runtime/builtins/web_search.ts","line":278,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:packages/loom/src/runtime/builtins/web_search.ts:278"},{"rule_id":"opengrep/javascript.ajv.security.audit.ajv-allerrors-true","severity":"medium","message":"By setting `allErrors: true` in `Ajv` library, all error objects will be allocated without limit. This allows the attacker to produce a huge number of errors which can lead to denial of service. Do not use `allErrors: true` in production. [confidence low]","path":"packages/loom/src/runtime/tool-table.ts","line":12,"fingerprint":"javascript.ajv.security.audit.ajv-allerrors-true:packages/loom/src/runtime/tool-table.ts:12"}],"evidence":[],"data":{"rulesets":["typescript","javascript"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":19.0,"vulnerabilities":89.0,"vulns_critical":4.0,"vulns_high":26.0,"vulns_medium":52.0,"vulns_low":7.0,"vulns_unknown":0.0,"penalty":146.0},"findings":[{"rule_id":"osv/GHSA-jqcg-44mw-7w3h","severity":"critical","message":"proxy-addr@2.0.7 (npm) is affected by GHSA-jqcg-44mw-7w3h","path":"package-lock.json","line":null,"fingerprint":"proxy-addr@2.0.7 (npm):GHSA-jqcg-44mw-7w3h"},{"rule_id":"osv/GHSA-5gmw-xhrv-c9v3","severity":"critical","message":"tinypool@1.1.1 (npm) is affected by GHSA-5gmw-xhrv-c9v3","path":"package-lock.json","line":null,"fingerprint":"tinypool@1.1.1 (npm):GHSA-5gmw-xhrv-c9v3"},{"rule_id":"osv/GHSA-85c8-ppgw-ccpr","severity":"critical","message":"tinypool@1.1.1 (npm) is affected by GHSA-85c8-ppgw-ccpr","path":"package-lock.json","line":null,"fingerprint":"tinypool@1.1.1 (npm):GHSA-85c8-ppgw-ccpr"},{"rule_id":"osv/GHSA-5xrq-8626-4rwp","severity":"critical","message":"vitest@2.1.9 (npm) is affected by GHSA-5xrq-8626-4rwp","path":"package-lock.json","line":null,"fingerprint":"vitest@2.1.9 (npm):GHSA-5xrq-8626-4rwp"},{"rule_id":"osv/GHSA-22jm-h49p-29qw","severity":"high","message":"@modelcontextprotocol/sdk@1.29.0 (npm) is affected by GHSA-22jm-h49p-29qw","path":"package-lock.json","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.29.0 (npm):GHSA-22jm-h49p-29qw"},{"rule_id":"osv/GHSA-46jr-4wx8-v453","severity":"high","message":"@modelcontextprotocol/sdk@1.29.0 (npm) is affected by GHSA-46jr-4wx8-v453","path":"package-lock.json","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.29.0 (npm):GHSA-46jr-4wx8-v453"},{"rule_id":"osv/GHSA-6qxp-vccf-f47h","severity":"high","message":"@modelcontextprotocol/sdk@1.29.0 (npm) is affected by GHSA-6qxp-vccf-f47h","path":"package-lock.json","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.29.0 (npm):GHSA-6qxp-vccf-f47h"},{"rule_id":"osv/GHSA-f897-62hf-6gxq","severity":"high","message":"@modelcontextprotocol/sdk@1.29.0 (npm) is affected by GHSA-f897-62hf-6gxq","path":"package-lock.json","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.29.0 (npm):GHSA-f897-62hf-6gxq"},{"rule_id":"osv/GHSA-27r3-jxmh-p828","severity":"high","message":"body-parser@2.2.2 (npm) is affected by GHSA-27r3-jxmh-p828","path":"package-lock.json","line":null,"fingerprint":"body-parser@2.2.2 (npm):GHSA-27r3-jxmh-p828"},{"rule_id":"osv/GHSA-4c8g-83qw-93j6","severity":"high","message":"fast-uri@3.1.2 (npm) is affected by GHSA-4c8g-83qw-93j6","path":"package-lock.json","line":null,"fingerprint":"fast-uri@3.1.2 (npm):GHSA-4c8g-83qw-93j6"},{"rule_id":"osv/GHSA-7p8r-x3mc-p8w7","severity":"high","message":"fast-uri@3.1.2 (npm) is affected by GHSA-7p8r-x3mc-p8w7","path":"package-lock.json","line":null,"fingerprint":"fast-uri@3.1.2 (npm):GHSA-7p8r-x3mc-p8w7"},{"rule_id":"osv/GHSA-f65p-4m7j-42xc","severity":"high","message":"fast-uri@3.1.2 (npm) is affected by GHSA-f65p-4m7j-42xc","path":"package-lock.json","line":null,"fingerprint":"fast-uri@3.1.2 (npm):GHSA-f65p-4m7j-42xc"},{"rule_id":"osv/GHSA-fph4-wmhf-6fwf","severity":"high","message":"fast-uri@3.1.2 (npm) is affected by GHSA-fph4-wmhf-6fwf","path":"package-lock.json","line":null,"fingerprint":"fast-uri@3.1.2 (npm):GHSA-fph4-wmhf-6fwf"},{"rule_id":"osv/GHSA-jqff-g426-hqxp","severity":"high","message":"fast-uri@3.1.2 (npm) is affected by GHSA-jqff-g426-hqxp","path":"package-lock.json","line":null,"fingerprint":"fast-uri@3.1.2 (npm):GHSA-jqff-g426-hqxp"},{"rule_id":"osv/GHSA-qw65-cvwx-89v3","severity":"high","message":"fast-uri@3.1.2 (npm) is affected by GHSA-qw65-cvwx-89v3","path":"package-lock.json","line":null,"fingerprint":"fast-uri@3.1.2 (npm):GHSA-qw65-cvwx-89v3"},{"rule_id":"osv/GHSA-v2hh-gcrm-f6hx","severity":"high","message":"fast-uri@3.1.2 (npm) is affected by GHSA-v2hh-gcrm-f6hx","path":"package-lock.json","line":null,"fingerprint":"fast-uri@3.1.2 (npm):GHSA-v2hh-gcrm-f6hx"},{"rule_id":"osv/GHSA-88fw-hqm2-52qc","severity":"high","message":"hono@4.12.18 (npm) is affected by GHSA-88fw-hqm2-52qc","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.18 (npm):GHSA-88fw-hqm2-52qc"},{"rule_id":"osv/GHSA-mwp4-54f8-5fhr","severity":"high","message":"ip-address@10.2.0 (npm) is affected by GHSA-mwp4-54f8-5fhr","path":"package-lock.json","line":null,"fingerprint":"ip-address@10.2.0 (npm):GHSA-mwp4-54f8-5fhr"},{"rule_id":"osv/GHSA-28wg-ghj8-5hjv","severity":"high","message":"nanoid@3.3.12 (npm) is affected by GHSA-28wg-ghj8-5hjv","path":"package-lock.json","line":null,"fingerprint":"nanoid@3.3.12 (npm):GHSA-28wg-ghj8-5hjv"},{"rule_id":"osv/GHSA-2v37-7h3g-55p8","severity":"high","message":"nanoid@3.3.12 (npm) is affected by GHSA-2v37-7h3g-55p8","path":"package-lock.json","line":null,"fingerprint":"nanoid@3.3.12 (npm):GHSA-2v37-7h3g-55p8"},{"rule_id":"osv/GHSA-r28c-9q8g-f849","severity":"high","message":"postcss@8.5.14 (npm) is affected by GHSA-r28c-9q8g-f849","path":"package-lock.json","line":null,"fingerprint":"postcss@8.5.14 (npm):GHSA-r28c-9q8g-f849"},{"rule_id":"osv/GHSA-68fv-2mgg-jv7q","severity":"high","message":"source-map-js@1.2.1 (npm) is affected by GHSA-68fv-2mgg-jv7q","path":"package-lock.json","line":null,"fingerprint":"source-map-js@1.2.1 (npm):GHSA-68fv-2mgg-jv7q"},{"rule_id":"osv/GHSA-4qx8-w7c3-pj3p","severity":"high","message":"toml@4.1.1 (npm) is affected by GHSA-4qx8-w7c3-pj3p","path":"package-lock.json","line":null,"fingerprint":"toml@4.1.1 (npm):GHSA-4qx8-w7c3-pj3p"},{"rule_id":"osv/GHSA-82x6-q7mm-w9cf","severity":"high","message":"toml@4.1.1 (npm) is affected by GHSA-82x6-q7mm-w9cf","path":"package-lock.json","line":null,"fingerprint":"toml@4.1.1 (npm):GHSA-82x6-q7mm-w9cf"},{"rule_id":"osv/GHSA-9j65-hcg3-gc64","severity":"high","message":"toml@4.1.1 (npm) is affected by GHSA-9j65-hcg3-gc64","path":"package-lock.json","line":null,"fingerprint":"toml@4.1.1 (npm):GHSA-9j65-hcg3-gc64"},{"rule_id":"osv/GHSA-9qmh-m7c6-f92p","severity":"high","message":"toml@4.1.1 (npm) is affected by GHSA-9qmh-m7c6-f92p","path":"package-lock.json","line":null,"fingerprint":"toml@4.1.1 (npm):GHSA-9qmh-m7c6-f92p"},{"rule_id":"osv/GHSA-h895-cgqg-jf52","severity":"high","message":"toml@4.1.1 (npm) is affected by GHSA-h895-cgqg-jf52","path":"package-lock.json","line":null,"fingerprint":"toml@4.1.1 (npm):GHSA-h895-cgqg-jf52"},{"rule_id":"osv/GHSA-v5mp-jgw5-2x6j","severity":"high","message":"toml@4.1.1 (npm) is affected by GHSA-v5mp-jgw5-2x6j","path":"package-lock.json","line":null,"fingerprint":"toml@4.1.1 (npm):GHSA-v5mp-jgw5-2x6j"},{"rule_id":"osv/GHSA-587h-7wmj-h5pm","severity":"high","message":"vite@5.4.21 (npm) is affected by GHSA-587h-7wmj-h5pm","path":"package-lock.json","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-587h-7wmj-h5pm"},{"rule_id":"osv/GHSA-mrhx-c7xc-m3w5","severity":"high","message":"zod@4.4.3 (npm) is affected by GHSA-mrhx-c7xc-m3w5","path":"package-lock.json","line":null,"fingerprint":"zod@4.4.3 (npm):GHSA-mrhx-c7xc-m3w5"},{"rule_id":"osv/GHSA-frvp-7c67-39w9","severity":"medium","message":"@hono/node-server@1.19.14 (npm) is affected by GHSA-frvp-7c67-39w9","path":"package-lock.json","line":null,"fingerprint":"@hono/node-server@1.19.14 (npm):GHSA-frvp-7c67-39w9"},{"rule_id":"osv/GHSA-jpvv-r467-5p4w","severity":"medium","message":"@hono/node-server@1.19.14 (npm) is affected by GHSA-jpvv-r467-5p4w","path":"package-lock.json","line":null,"fingerprint":"@hono/node-server@1.19.14 (npm):GHSA-jpvv-r467-5p4w"},{"rule_id":"osv/GHSA-rmxm-3fg6-px4f","severity":"medium","message":"@hono/node-server@1.19.14 (npm) is affected by GHSA-rmxm-3fg6-px4f","path":"package-lock.json","line":null,"fingerprint":"@hono/node-server@1.19.14 (npm):GHSA-rmxm-3fg6-px4f"},{"rule_id":"osv/GHSA-6prh-2h8m-c8cw","severity":"medium","message":"@modelcontextprotocol/sdk@1.29.0 (npm) is affected by GHSA-6prh-2h8m-c8cw","path":"package-lock.json","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.29.0 (npm):GHSA-6prh-2h8m-c8cw"},{"rule_id":"osv/GHSA-rvq5-wwqv-78pq","severity":"medium","message":"@modelcontextprotocol/sdk@1.29.0 (npm) is affected by GHSA-rvq5-wwqv-78pq","path":"package-lock.json","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.29.0 (npm):GHSA-rvq5-wwqv-78pq"},{"rule_id":"osv/GHSA-82fw-gwwq-j7x9","severity":"medium","message":"@vitest/mocker@2.1.9 (npm) is affected by GHSA-82fw-gwwq-j7x9","path":"package-lock.json","line":null,"fingerprint":"@vitest/mocker@2.1.9 (npm):GHSA-82fw-gwwq-j7x9"},{"rule_id":"osv/GHSA-qxg6-89mg-rqv8","severity":"medium","message":"@vitest/mocker@2.1.9 (npm) is affected by GHSA-qxg6-89mg-rqv8","path":"package-lock.json","line":null,"fingerprint":"@vitest/mocker@2.1.9 (npm):GHSA-qxg6-89mg-rqv8"},{"rule_id":"osv/GHSA-67mh-4wv8-2f99","severity":"medium","message":"esbuild@0.21.5 (npm) is affected by GHSA-67mh-4wv8-2f99","path":"package-lock.json","line":null,"fingerprint":"esbuild@0.21.5 (npm):GHSA-67mh-4wv8-2f99"},{"rule_id":"osv/GHSA-hrr3-gc8f-f4qj","severity":"medium","message":"fast-uri@3.1.2 (npm) is affected by GHSA-hrr3-gc8f-f4qj","path":"package-lock.json","line":null,"fingerprint":"fast-uri@3.1.2 (npm):GHSA-hrr3-gc8f-f4qj"},{"rule_id":"osv/GHSA-w74x-v6f9-j3xg","severity":"medium","message":"fast-uri@3.1.2 (npm) is affected by GHSA-w74x-v6f9-j3xg","path":"package-lock.json","line":null,"fingerprint":"fast-uri@3.1.2 (npm):GHSA-w74x-v6f9-j3xg"},{"rule_id":"osv/GHSA-2gcr-mfcq-wcc3","severity":"medium","message":"hono@4.12.18 (npm) is affected by GHSA-2gcr-mfcq-wcc3","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.18 (npm):GHSA-2gcr-mfcq-wcc3"},{"rule_id":"osv/GHSA-3hrh-pfw6-9m5x","severity":"medium","message":"hono@4.12.18 (npm) is affected by GHSA-3hrh-pfw6-9m5x","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.18 (npm):GHSA-3hrh-pfw6-9m5x"},{"rule_id":"osv/GHSA-46wx-v44x-9hh2","severity":"medium","message":"hono@4.12.18 (npm) is affected by GHSA-46wx-v44x-9hh2","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.18 (npm):GHSA-46wx-v44x-9hh2"},{"rule_id":"osv/GHSA-4h7h-rv7c-7m2v","severity":"medium","message":"hono@4.12.18 (npm) is affected by GHSA-4h7h-rv7c-7m2v","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.18 (npm):GHSA-4h7h-rv7c-7m2v"},{"rule_id":"osv/GHSA-4m76-xfj5-7975","severity":"medium","message":"hono@4.12.18 (npm) is affected by GHSA-4m76-xfj5-7975","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.18 (npm):GHSA-4m76-xfj5-7975"},{"rule_id":"osv/GHSA-54fx-42gc-7vw4","severity":"medium","message":"hono@4.12.18 (npm) is affected by GHSA-54fx-42gc-7vw4","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.18 (npm):GHSA-54fx-42gc-7vw4"},{"rule_id":"osv/GHSA-5r4p-p66f-jhc7","severity":"medium","message":"hono@4.12.18 (npm) is affected by GHSA-5r4p-p66f-jhc7","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.18 (npm):GHSA-5r4p-p66f-jhc7"},{"rule_id":"osv/GHSA-8j4g-w8fx-2239","severity":"medium","message":"hono@4.12.18 (npm) is affected by GHSA-8j4g-w8fx-2239","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.18 (npm):GHSA-8j4g-w8fx-2239"},{"rule_id":"osv/GHSA-crvj-82cr-hjcx","severity":"medium","message":"hono@4.12.18 (npm) is affected by GHSA-crvj-82cr-hjcx","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.18 (npm):GHSA-crvj-82cr-hjcx"},{"rule_id":"osv/GHSA-f23p-vx2j-j53r","severity":"medium","message":"hono@4.12.18 (npm) is affected by GHSA-f23p-vx2j-j53r","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.18 (npm):GHSA-f23p-vx2j-j53r"},{"rule_id":"osv/GHSA-f577-qrjj-4474","severity":"medium","message":"hono@4.12.18 (npm) is affected by GHSA-f577-qrjj-4474","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.18 (npm):GHSA-f577-qrjj-4474"},{"rule_id":"osv/GHSA-g6gw-c38x-mqfc","severity":"medium","message":"hono@4.12.18 (npm) is affected by GHSA-g6gw-c38x-mqfc","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.18 (npm):GHSA-g6gw-c38x-mqfc"},{"rule_id":"osv/GHSA-gqvv-2mrq-wpjv","severity":"medium","message":"hono@4.12.18 (npm) is affected by GHSA-gqvv-2mrq-wpjv","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.18 (npm):GHSA-gqvv-2mrq-wpjv"},{"rule_id":"osv/GHSA-h7mg-cq63-vhpq","severity":"medium","message":"hono@4.12.18 (npm) is affected by GHSA-h7mg-cq63-vhpq","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.18 (npm):GHSA-h7mg-cq63-vhpq"},{"rule_id":"osv/GHSA-hvrm-45r6-mjfj","severity":"medium","message":"hono@4.12.18 (npm) is affected by GHSA-hvrm-45r6-mjfj","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.18 (npm):GHSA-hvrm-45r6-mjfj"},{"rule_id":"osv/GHSA-hxh3-vqpv-xpqv","severity":"medium","message":"hono@4.12.18 (npm) is affected by GHSA-hxh3-vqpv-xpqv","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.18 (npm):GHSA-hxh3-vqpv-xpqv"},{"rule_id":"osv/GHSA-j6c9-x7qj-28xf","severity":"medium","message":"hono@4.12.18 (npm) is affected by GHSA-j6c9-x7qj-28xf","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.18 (npm):GHSA-j6c9-x7qj-28xf"},{"rule_id":"osv/GHSA-rv63-4mwf-qqc2","severity":"medium","message":"hono@4.12.18 (npm) is affected by GHSA-rv63-4mwf-qqc2","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.18 (npm):GHSA-rv63-4mwf-qqc2"},{"rule_id":"osv/GHSA-w62v-xxxg-mg59","severity":"medium","message":"hono@4.12.18 (npm) is affected by GHSA-w62v-xxxg-mg59","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.18 (npm):GHSA-w62v-xxxg-mg59"},{"rule_id":"osv/GHSA-wgpf-jwqj-8h8p","severity":"medium","message":"hono@4.12.18 (npm) is affected by GHSA-wgpf-jwqj-8h8p","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.18 (npm):GHSA-wgpf-jwqj-8h8p"},{"rule_id":"osv/GHSA-wwfh-h76j-fc44","severity":"medium","message":"hono@4.12.18 (npm) is affected by GHSA-wwfh-h76j-fc44","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.18 (npm):GHSA-wwfh-h76j-fc44"},{"rule_id":"osv/GHSA-xgm2-5f3f-mvvc","severity":"medium","message":"hono@4.12.18 (npm) is affected by GHSA-xgm2-5f3f-mvvc","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.18 (npm):GHSA-xgm2-5f3f-mvvc"},{"rule_id":"osv/GHSA-xrhx-7g5j-rcj5","severity":"medium","message":"hono@4.12.18 (npm) is affected by GHSA-xrhx-7g5j-rcj5","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.18 (npm):GHSA-xrhx-7g5j-rcj5"},{"rule_id":"osv/GHSA-22jq-vg5j-6vgg","severity":"medium","message":"ip-address@10.2.0 (npm) is affected by GHSA-22jq-vg5j-6vgg","path":"package-lock.json","line":null,"fingerprint":"ip-address@10.2.0 (npm):GHSA-22jq-vg5j-6vgg"},{"rule_id":"osv/GHSA-2vr4-cq9g-pvrc","severity":"medium","message":"ip-address@10.2.0 (npm) is affected by GHSA-2vr4-cq9g-pvrc","path":"package-lock.json","line":null,"fingerprint":"ip-address@10.2.0 (npm):GHSA-2vr4-cq9g-pvrc"},{"rule_id":"osv/GHSA-4xrf-jv44-h6hh","severity":"medium","message":"ip-address@10.2.0 (npm) is affected by GHSA-4xrf-jv44-h6hh","path":"package-lock.json","line":null,"fingerprint":"ip-address@10.2.0 (npm):GHSA-4xrf-jv44-h6hh"},{"rule_id":"osv/GHSA-h3mg-xc3c-68pw","severity":"medium","message":"ip-address@10.2.0 (npm) is affected by GHSA-h3mg-xc3c-68pw","path":"package-lock.json","line":null,"fingerprint":"ip-address@10.2.0 (npm):GHSA-h3mg-xc3c-68pw"},{"rule_id":"osv/GHSA-j6r3-76f7-8jcv","severity":"medium","message":"ip-address@10.2.0 (npm) is affected by GHSA-j6r3-76f7-8jcv","path":"package-lock.json","line":null,"fingerprint":"ip-address@10.2.0 (npm):GHSA-j6r3-76f7-8jcv"},{"rule_id":"osv/GHSA-rpw4-54j3-4h4q","severity":"medium","message":"ip-address@10.2.0 (npm) is affected by GHSA-rpw4-54j3-4h4q","path":"package-lock.json","line":null,"fingerprint":"ip-address@10.2.0 (npm):GHSA-rpw4-54j3-4h4q"},{"rule_id":"osv/GHSA-rxp7-6hxx-x8q5","severity":"medium","message":"ip-address@10.2.0 (npm) is affected by GHSA-rxp7-6hxx-x8q5","path":"package-lock.json","line":null,"fingerprint":"ip-address@10.2.0 (npm):GHSA-rxp7-6hxx-x8q5"},{"rule_id":"osv/GHSA-fxqj-rqcc-2cmp","severity":"medium","message":"postcss@8.5.14 (npm) is affected by GHSA-fxqj-rqcc-2cmp","path":"package-lock.json","line":null,"fingerprint":"postcss@8.5.14 (npm):GHSA-fxqj-rqcc-2cmp"},{"rule_id":"osv/GHSA-4mjr-xmp4-gh2g","severity":"medium","message":"qs@6.15.1 (npm) is affected by GHSA-4mjr-xmp4-gh2g","path":"package-lock.json","line":null,"fingerprint":"qs@6.15.1 (npm):GHSA-4mjr-xmp4-gh2g"},{"rule_id":"osv/GHSA-6pq8-jhm2-2vcw","severity":"medium","message":"qs@6.15.1 (npm) is affected by GHSA-6pq8-jhm2-2vcw","path":"package-lock.json","line":null,"fingerprint":"qs@6.15.1 (npm):GHSA-6pq8-jhm2-2vcw"},{"rule_id":"osv/GHSA-q8mj-m7cp-5q26","severity":"medium","message":"qs@6.15.1 (npm) is affected by GHSA-q8mj-m7cp-5q26","path":"package-lock.json","line":null,"fingerprint":"qs@6.15.1 (npm):GHSA-q8mj-m7cp-5q26"},{"rule_id":"osv/GHSA-x5fp-wj9c-mxmx","severity":"medium","message":"qs@6.15.1 (npm) is affected by GHSA-x5fp-wj9c-mxmx","path":"package-lock.json","line":null,"fingerprint":"qs@6.15.1 (npm):GHSA-x5fp-wj9c-mxmx"},{"rule_id":"osv/GHSA-4w7w-66w2-5vf9","severity":"medium","message":"vite@5.4.21 (npm) is affected by GHSA-4w7w-66w2-5vf9","path":"package-lock.json","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-4w7w-66w2-5vf9"},{"rule_id":"osv/GHSA-698v-4r3x-3vcv","severity":"medium","message":"vite@5.4.21 (npm) is affected by GHSA-698v-4r3x-3vcv","path":"package-lock.json","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-698v-4r3x-3vcv"},{"rule_id":"osv/GHSA-fx2h-pf6j-xcff","severity":"medium","message":"vite@5.4.21 (npm) is affected by GHSA-fx2h-pf6j-xcff","path":"package-lock.json","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-fx2h-pf6j-xcff"},{"rule_id":"osv/GHSA-r825-w8mm-5pxw","severity":"medium","message":"vite@5.4.21 (npm) is affected by GHSA-r825-w8mm-5pxw","path":"package-lock.json","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-r825-w8mm-5pxw"},{"rule_id":"osv/GHSA-rq7h-c2jc-7f22","severity":"medium","message":"vite@5.4.21 (npm) is affected by GHSA-rq7h-c2jc-7f22","path":"package-lock.json","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-rq7h-c2jc-7f22"},{"rule_id":"osv/GHSA-v6wh-96g9-6wx3","severity":"medium","message":"vite@5.4.21 (npm) is affected by GHSA-v6wh-96g9-6wx3","path":"package-lock.json","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-v6wh-96g9-6wx3"},{"rule_id":"osv/GHSA-82fw-gwwq-j7x9","severity":"medium","message":"vitest@2.1.9 (npm) is affected by GHSA-82fw-gwwq-j7x9","path":"package-lock.json","line":null,"fingerprint":"vitest@2.1.9 (npm):GHSA-82fw-gwwq-j7x9"},{"rule_id":"osv/GHSA-v422-hmwv-36x6","severity":"low","message":"body-parser@2.2.2 (npm) is affected by GHSA-v422-hmwv-36x6","path":"package-lock.json","line":null,"fingerprint":"body-parser@2.2.2 (npm):GHSA-v422-hmwv-36x6"},{"rule_id":"osv/GHSA-g7r4-m6w7-qqqr","severity":"low","message":"esbuild@0.27.7 (npm) is affected by GHSA-g7r4-m6w7-qqqr","path":"package-lock.json","line":null,"fingerprint":"esbuild@0.27.7 (npm):GHSA-g7r4-m6w7-qqqr"},{"rule_id":"osv/GHSA-333x-w4r6-6crp","severity":"low","message":"fast-uri@3.1.2 (npm) is affected by GHSA-333x-w4r6-6crp","path":"package-lock.json","line":null,"fingerprint":"fast-uri@3.1.2 (npm):GHSA-333x-w4r6-6crp"},{"rule_id":"osv/GHSA-xhq7-xmqj-769h","severity":"low","message":"fast-uri@3.1.2 (npm) is affected by GHSA-xhq7-xmqj-769h","path":"package-lock.json","line":null,"fingerprint":"fast-uri@3.1.2 (npm):GHSA-xhq7-xmqj-769h"},{"rule_id":"osv/GHSA-3gg2-335m-rxc6","severity":"low","message":"hono@4.12.18 (npm) is affected by GHSA-3gg2-335m-rxc6","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.18 (npm):GHSA-3gg2-335m-rxc6"},{"rule_id":"osv/GHSA-79qm-7rj5-m7r9","severity":"low","message":"hono@4.12.18 (npm) is affected by GHSA-79qm-7rj5-m7r9","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.18 (npm):GHSA-79qm-7rj5-m7r9"},{"rule_id":"osv/GHSA-9jrq-w75r-8gcw","severity":"low","message":"vite@5.4.21 (npm) is affected by GHSA-9jrq-w75r-8gcw","path":"package-lock.json","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-9jrq-w75r-8gcw"}],"evidence":[],"data":{"ecosystems":["npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":0.0,"signed_commit_share":0.0353,"unpinned_manifests":3.0},"findings":[],"evidence":[{"kind":"posture","description":"packages/capabilities/package.json has no lockfile alongside it (unpinned dependencies)","ref":"packages/capabilities/package.json","url":null,"weight":0.3},{"kind":"posture","description":"packages/loom/package.json has no lockfile alongside it (unpinned dependencies)","ref":"packages/loom/package.json","url":null,"weight":0.3},{"kind":"posture","description":"packages/sandbox/package.json has no lockfile alongside it (unpinned dependencies)","ref":"packages/sandbox/package.json","url":null,"weight":0.3}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":1.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[{"kind":"readme-download-lure","description":"gives an archive password","ref":"README.md","url":null,"weight":0.0}],"data":{"signals":["readme-download-lure"],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":1097.0,"function_nloc":15207.0,"mean_ccn":3.8,"p90_ccn":8.0,"complex_functions":29.0,"long_functions":10.0,"many_param_functions":0.0,"risky_nloc_share":0.2067},"findings":[],"evidence":[{"kind":"complex-function","description":"auditAgentInner in packages/loom/src/audit/audit.ts: complexity 121, 568 lines","ref":"packages/loom/src/audit/audit.ts","url":"https://github.com/mikayla-maki/loom/blob/0d2ef7c8a88ff1c32d641bc06cfebdf05af73048/packages/loom/src/audit/audit.ts#L346","weight":1.0},{"kind":"complex-function","description":"formatCapabilityTree in packages/loom/src/audit/audit.ts: complexity 65, 235 lines","ref":"packages/loom/src/audit/audit.ts","url":"https://github.com/mikayla-maki/loom/blob/0d2ef7c8a88ff1c32d641bc06cfebdf05af73048/packages/loom/src/audit/audit.ts#L1387","weight":1.0},{"kind":"complex-function","description":"renderResults in packages/loom/src/runtime/builtins/web_search.ts: complexity 35, 53 lines","ref":"packages/loom/src/runtime/builtins/web_search.ts","url":"https://github.com/mikayla-maki/loom/blob/0d2ef7c8a88ff1c32d641bc06cfebdf05af73048/packages/loom/src/runtime/builtins/web_search.ts#L336","weight":0.5833333333333334},{"kind":"complex-function","description":"tryClassifyLineStart in packages/loom/src/cli/streaming-markdown.ts: complexity 32, 91 lines","ref":"packages/loom/src/cli/streaming-markdown.ts","url":"https://github.com/mikayla-maki/loom/blob/0d2ef7c8a88ff1c32d641bc06cfebdf05af73048/packages/loom/src/cli/streaming-markdown.ts#L218","weight":0.5333333333333333},{"kind":"complex-function","description":"applyToolGroups in packages/capabilities/src/tool-groups.ts: complexity 31, 113 lines","ref":"packages/capabilities/src/tool-groups.ts","url":"https://github.com/mikayla-maki/loom/blob/0d2ef7c8a88ff1c32d641bc06cfebdf05af73048/packages/capabilities/src/tool-groups.ts#L134","weight":0.5166666666666667},{"kind":"complex-function","description":"runAgent in packages/loom/src/sdk/run-agent.ts: complexity 28, 182 lines","ref":"packages/loom/src/sdk/run-agent.ts","url":"https://github.com/mikayla-maki/loom/blob/0d2ef7c8a88ff1c32d641bc06cfebdf05af73048/packages/loom/src/sdk/run-agent.ts#L153","weight":0.4666666666666667},{"kind":"complex-function","description":"eventsToMessages in packages/loom/src/builtins/harness/anthropic.ts: complexity 26, 96 lines","ref":"packages/loom/src/builtins/harness/anthropic.ts","url":"https://github.com/mikayla-maki/loom/blob/0d2ef7c8a88ff1c32d641bc06cfebdf05af73048/packages/loom/src/builtins/harness/anthropic.ts#L753","weight":0.43333333333333335},{"kind":"complex-function","description":"installManifest in packages/loom/src/cli/install.ts: complexity 26, 152 lines","ref":"packages/loom/src/cli/install.ts","url":"https://github.com/mikayla-maki/loom/blob/0d2ef7c8a88ff1c32d641bc06cfebdf05af73048/packages/loom/src/cli/install.ts#L53","weight":0.43333333333333335},{"kind":"complex-function","description":"resolveToolEntry in packages/loom/src/manifest/resolver.ts: complexity 26, 174 lines","ref":"packages/loom/src/manifest/resolver.ts","url":"https://github.com/mikayla-maki/loom/blob/0d2ef7c8a88ff1c32d641bc06cfebdf05af73048/packages/loom/src/manifest/resolver.ts#L415","weight":0.43333333333333335},{"kind":"complex-function","description":"checkGrantAlgebra in packages/capabilities/src/algebra-conformance.ts: complexity 25, 79 lines","ref":"packages/capabilities/src/algebra-conformance.ts","url":"https://github.com/mikayla-maki/loom/blob/0d2ef7c8a88ff1c32d641bc06cfebdf05af73048/packages/capabilities/src/algebra-conformance.ts#L37","weight":0.4166666666666667}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":15691.0,"duplicated_lines":1247.0,"duplicated_share":0.0795,"files":98.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: examples/mcp-agent/mcp-server/server.js:2 and examples/mcp-agent/mcp-server/server.ts:2","ref":"examples/mcp-agent/mcp-server/server.js","url":"https://github.com/mikayla-maki/loom/blob/0d2ef7c8a88ff1c32d641bc06cfebdf05af73048/examples/mcp-agent/mcp-server/server.js#L2","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: examples/notes-provider/index.js:2 and examples/notes-provider/index.ts:2","ref":"examples/notes-provider/index.js","url":"https://github.com/mikayla-maki/loom/blob/0d2ef7c8a88ff1c32d641bc06cfebdf05af73048/examples/notes-provider/index.js#L2","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: packages/capabilities/src/parser.ts:277 and packages/capabilities/src/parser.ts:534","ref":"packages/capabilities/src/parser.ts","url":"https://github.com/mikayla-maki/loom/blob/0d2ef7c8a88ff1c32d641bc06cfebdf05af73048/packages/capabilities/src/parser.ts#L277","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: packages/loom/src/audit/audit.ts:439 and packages/loom/src/cli/install.ts:277","ref":"packages/loom/src/audit/audit.ts","url":"https://github.com/mikayla-maki/loom/blob/0d2ef7c8a88ff1c32d641bc06cfebdf05af73048/packages/loom/src/audit/audit.ts#L439","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: packages/loom/src/audit/audit.ts:727 and packages/loom/src/audit/audit.ts:741","ref":"packages/loom/src/audit/audit.ts","url":"https://github.com/mikayla-maki/loom/blob/0d2ef7c8a88ff1c32d641bc06cfebdf05af73048/packages/loom/src/audit/audit.ts#L727","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: packages/loom/src/audit/audit.ts:1217 and packages/loom/src/sdk/run-agent.ts:775","ref":"packages/loom/src/audit/audit.ts","url":"https://github.com/mikayla-maki/loom/blob/0d2ef7c8a88ff1c32d641bc06cfebdf05af73048/packages/loom/src/audit/audit.ts#L1217","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: packages/loom/src/builtins/harness/anthropic.ts:32 and packages/loom/src/builtins/harness/openai.ts:26","ref":"packages/loom/src/builtins/harness/anthropic.ts","url":"https://github.com/mikayla-maki/loom/blob/0d2ef7c8a88ff1c32d641bc06cfebdf05af73048/packages/loom/src/builtins/harness/anthropic.ts#L32","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: packages/loom/src/builtins/harness/anthropic.ts:106 and packages/loom/src/runtime/builtins/web_search.ts:27","ref":"packages/loom/src/builtins/harness/anthropic.ts","url":"https://github.com/mikayla-maki/loom/blob/0d2ef7c8a88ff1c32d641bc06cfebdf05af73048/packages/loom/src/builtins/harness/anthropic.ts#L106","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: packages/loom/src/builtins/harness/anthropic.ts:643 and packages/loom/src/builtins/harness/anthropic.ts:656","ref":"packages/loom/src/builtins/harness/anthropic.ts","url":"https://github.com/mikayla-maki/loom/blob/0d2ef7c8a88ff1c32d641bc06cfebdf05af73048/packages/loom/src/builtins/harness/anthropic.ts#L643","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: packages/loom/src/builtins/index.ts:92 and packages/loom/src/index.ts:60","ref":"packages/loom/src/builtins/index.ts","url":"https://github.com/mikayla-maki/loom/blob/0d2ef7c8a88ff1c32d641bc06cfebdf05af73048/packages/loom/src/builtins/index.ts#L92","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":25.0,"weighted_findings":6.25,"scanned_lines":21395.0,"category:correctness":25.0},"findings":[{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/capabilities/src/parser.ts","line":181,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/capabilities/src/parser.ts:181"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/capabilities/src/parser.ts","line":181,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/capabilities/src/parser.ts:181"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/capabilities/src/parser.ts","line":233,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/capabilities/src/parser.ts:233"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/capabilities/src/parser.ts","line":233,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/capabilities/src/parser.ts:233"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/capabilities/src/parser.ts","line":234,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/capabilities/src/parser.ts:234"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/capabilities/src/parser.ts","line":234,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/capabilities/src/parser.ts:234"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/capabilities/src/parser.ts","line":292,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/capabilities/src/parser.ts:292"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/capabilities/src/parser.ts","line":292,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/capabilities/src/parser.ts:292"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/capabilities/src/parser.ts","line":293,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/capabilities/src/parser.ts:293"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/capabilities/src/parser.ts","line":293,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/capabilities/src/parser.ts:293"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/capabilities/src/tool-groups.ts","line":191,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/capabilities/src/tool-groups.ts:191"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/capabilities/src/tool-groups.ts","line":191,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/capabilities/src/tool-groups.ts:191"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/capabilities/src/tool-groups.ts","line":191,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/capabilities/src/tool-groups.ts:191"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/loom/src/cli/main.ts","line":70,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/loom/src/cli/main.ts:70"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/loom/src/cli/main.ts","line":70,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/loom/src/cli/main.ts:70"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/loom/src/cli/mcp-inspect.ts","line":71,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/loom/src/cli/mcp-inspect.ts:71"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/loom/src/cli/mcp-inspect.ts","line":71,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/loom/src/cli/mcp-inspect.ts:71"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/loom/src/cli/mcp-inspect.ts","line":71,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/loom/src/cli/mcp-inspect.ts:71"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/loom/src/cli/mcp-inspect.ts","line":71,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/loom/src/cli/mcp-inspect.ts:71"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/loom/src/cli/mcp-inspect.ts","line":71,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/loom/src/cli/mcp-inspect.ts:71"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/loom/src/cli/mcp-inspect.ts","line":71,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/loom/src/cli/mcp-inspect.ts:71"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/loom/src/cli/mcp-inspect.ts","line":216,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/loom/src/cli/mcp-inspect.ts:216"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/loom/src/cli/mcp-inspect.ts","line":216,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/loom/src/cli/mcp-inspect.ts:216"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/loom/src/manifest/ceiling.ts","line":90,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/loom/src/manifest/ceiling.ts:90"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/loom/src/manifest/ceiling.ts","line":90,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/loom/src/manifest/ceiling.ts:90"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":1.0,"check:ci_present":0.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":1.0,"test_lines":15754.0,"source_lines":21395.0,"test_ratio":0.7363,"ci_files":0.0,"cochange_share":0.8219,"cochange_commits":73.0},"findings":[],"evidence":[],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":1398.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":1.0,"check:low_escape_density":1.0,"escapes":1.0,"escapes_per_kloc":0.048},"findings":[],"evidence":[{"kind":"typing","description":"TypeScript strict type checking: examples/mcp-agent/mcp-server/tsconfig.json","ref":"examples/mcp-agent/mcp-server/tsconfig.json","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":6448.0,"other_lines":14947.0,"files_blamed":98.0,"blame_failures":0.0,"quality:ai_findings":2.0,"quality:ai_per_kloc":0.31,"quality:other_findings":23.0,"quality:other_per_kloc":1.539,"quality:ratio":0.2,"security:ai_findings":4.0,"security:ai_per_kloc":0.62,"security:other_findings":8.0,"security:other_per_kloc":0.535,"security:ratio":1.16},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":true},"error":null}],"flags":[]}