{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:06.649854Z","repo":{"ref":{"host":"github.com","owner":"notque","name":"vexjoy-agent"},"default_branch":"main","clone_url":"https://github.com/notque/vexjoy-agent.git","html_url":"https://github.com/notque/vexjoy-agent","description":"VexJoy AI Agent with Jev Intelligent Routing - /do routes plain-English requests to the right specialist agent and gates the work with reviews, tests, and a learning loop.","stars":450,"forks":51,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":59860,"primary_language":"Python","license_spdx":"MIT","created_at":"2026-03-18T01:39:09Z","pushed_at":"2026-11-13T18:55:48Z","security_policy_url":null,"distribution":{"owner_created_at":"2010-03-11T21:48:08Z","owner_type":"User","release_assets":[]}},"commit_sha":"871f649901b317d675e63f2dcce2b6515e046230","profile":{"lines_by_language":{"Python":262906,"JavaScript":8393,"Shell":4014,"TypeScript":228},"files_by_category":{"docs":1208,"source":493,"test":370,"other":113,"config":83,"binary":1,"generated":1},"source_lines":171998,"test_lines":103543},"pillars":{"ai_provenance":{"score":9.0,"confidence":0.95,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":0.0902,"suspected_share":0.3309,"estimated_share":0.0902,"ai_artifacts":6.0,"flagged_work_units":49.0,"flagged_releases":null,"style_index":0.616},"summary":"Explicit AI attribution on 9% of first-party code added; an estimated 9% including velocity signals."},"quality":{"score":68.6,"confidence":0.9,"coverage":1.0,"label":"adequate","breakdown":{"complexity":44.5,"duplication":61.4,"lint":70.9,"testing":100.0,"docs":80.0,"type_safety":0.1,"process":null},"summary":"Code quality is adequate: test-to-source ratio 0.60, CI runs tests; 27% of function code in complex or long functions; 8% duplicated lines. Weakest area: type safety."},"security":{"score":44.7,"confidence":0.85,"coverage":1.0,"label":"poor","breakdown":{"secrets":60.7,"sast":54.7,"dependencies":70.5,"ci_actions":0.3,"posture":0.0,"scorecard":null},"summary":"Security posture is poor: 60 known vulnerabilities in 3 dependencies; 262 high-severity SAST findings; 26 high-severity workflow issues. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":28.0,"checked":28.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":1454.0,"attributed_commits":197.0,"attributed_commit_share":0.13548830811554333,"effective_loc":388109.0,"attributed_loc":35012.0,"attributed_loc_share":0.09021177040470589,"tools_detected":1.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"Claude Code: 197 attributed commits, 35,012 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Claude Code: message 'claude.ai/code'","ref":"b09beebf1644906934b057cb1ceeff4299cdd4a1","url":"https://github.com/notque/vexjoy-agent/commit/b09beebf1644906934b057cb1ceeff4299cdd4a1","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: message 'claude.ai/code'","ref":"14fb687d1b695ad3cdc99751a737bb4a28a467f1","url":"https://github.com/notque/vexjoy-agent/commit/14fb687d1b695ad3cdc99751a737bb4a28a467f1","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: message 'claude.ai/code'","ref":"d8c4152eec7a08914cc0748f78a8c7f5ce749c88","url":"https://github.com/notque/vexjoy-agent/commit/d8c4152eec7a08914cc0748f78a8c7f5ce749c88","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: message 'claude.ai/code'","ref":"54aecd92c859b71d9d76ca7a4d7466a8402d8135","url":"https://github.com/notque/vexjoy-agent/commit/54aecd92c859b71d9d76ca7a4d7466a8402d8135","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: message 'claude.ai/code'","ref":"c660af35c4238d068fd67870269d02274895c3ea","url":"https://github.com/notque/vexjoy-agent/commit/c660af35c4238d068fd67870269d02274895c3ea","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: message 'claude.ai/code'","ref":"2ec12defea42afac608d335a66f8e123e612f29a","url":"https://github.com/notque/vexjoy-agent/commit/2ec12defea42afac608d335a66f8e123e612f29a","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: message 'claude.ai/code'","ref":"b59767f633fdd52d3a60cf5e99984f64cf02303e","url":"https://github.com/notque/vexjoy-agent/commit/b59767f633fdd52d3a60cf5e99984f64cf02303e","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: message 'claude.ai/code'","ref":"3f645f24df75e64c73e46db14959492c474622b6","url":"https://github.com/notque/vexjoy-agent/commit/3f645f24df75e64c73e46db14959492c474622b6","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: message 'claude.ai/code'","ref":"7460fc9bc648195dffa9db2d1132c9d2e3d9408b","url":"https://github.com/notque/vexjoy-agent/commit/7460fc9bc648195dffa9db2d1132c9d2e3d9408b","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: message 'claude.ai/code'","ref":"6c14da78cbf19335f0dc4141543cda9ba0ce6e5c","url":"https://github.com/notque/vexjoy-agent/commit/6c14da78cbf19335f0dc4141543cda9ba0ce6e5c","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: message 'claude.ai/code'","ref":"58796653cacac2ee84bf741c859438594c90f7e8","url":"https://github.com/notque/vexjoy-agent/commit/58796653cacac2ee84bf741c859438594c90f7e8","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: message 'claude.ai/code'","ref":"bad5247d539fad6c950e079ad5ffa11e186e26c6","url":"https://github.com/notque/vexjoy-agent/commit/bad5247d539fad6c950e079ad5ffa11e186e26c6","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: message 'claude.ai/code'","ref":"8764fade1bbf825c260f517018c0c7e1756716a9","url":"https://github.com/notque/vexjoy-agent/commit/8764fade1bbf825c260f517018c0c7e1756716a9","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: message 'claude.ai/code'","ref":"c92d2bd0fbb92e229a2cb3ff62db572e2d05e274","url":"https://github.com/notque/vexjoy-agent/commit/c92d2bd0fbb92e229a2cb3ff62db572e2d05e274","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: message 'claude.ai/code'","ref":"5c5d0d00465ed89536354a10305db5ceadc8f2be","url":"https://github.com/notque/vexjoy-agent/commit/5c5d0d00465ed89536354a10305db5ceadc8f2be","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: message 'claude.ai/code'","ref":"693bfe8e8f1258ebd47b2b86dd8b53d16dcfe27d","url":"https://github.com/notque/vexjoy-agent/commit/693bfe8e8f1258ebd47b2b86dd8b53d16dcfe27d","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: message 'claude.ai/code'","ref":"fcf48908d6e48e16fe469357c1436bc078a7b610","url":"https://github.com/notque/vexjoy-agent/commit/fcf48908d6e48e16fe469357c1436bc078a7b610","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: message 'claude.ai/code'","ref":"fff1fe1e4fad88fcb95c211d374a598a787f58d3","url":"https://github.com/notque/vexjoy-agent/commit/fff1fe1e4fad88fcb95c211d374a598a787f58d3","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: message 'claude.ai/code'","ref":"8b9aa0258331e3209445eebf6d4970abd7ae0cbc","url":"https://github.com/notque/vexjoy-agent/commit/8b9aa0258331e3209445eebf6d4970abd7ae0cbc","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: message 'claude.ai/code'","ref":"705fa8efa7a39c688fd3798b3754bcd323429f68","url":"https://github.com/notque/vexjoy-agent/commit/705fa8efa7a39c688fd3798b3754bcd323429f68","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: message 'claude.ai/code'","ref":"0a402da398980ece37dc456a0cdcc2e4e9e58e4f","url":"https://github.com/notque/vexjoy-agent/commit/0a402da398980ece37dc456a0cdcc2e4e9e58e4f","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: message 'claude.ai/code'","ref":"a797daf18c1ac4b361c8a68b1096132ae339c703","url":"https://github.com/notque/vexjoy-agent/commit/a797daf18c1ac4b361c8a68b1096132ae339c703","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: message 'claude.ai/code'","ref":"57967ec5ed768a0da54cf3f8d7afce0f090d45b1","url":"https://github.com/notque/vexjoy-agent/commit/57967ec5ed768a0da54cf3f8d7afce0f090d45b1","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: message 'claude.ai/code'","ref":"16f4280ff65f480d09fbf2edc88d5b3d10f45e69","url":"https://github.com/notque/vexjoy-agent/commit/16f4280ff65f480d09fbf2edc88d5b3d10f45e69","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: message 'claude.ai/code'","ref":"8e47200665ed13d3103ba705048051c38489740d","url":"https://github.com/notque/vexjoy-agent/commit/8e47200665ed13d3103ba705048051c38489740d","weight":0.9}],"data":{"attributed_loc_by_commit":{"ce63fc7abca9fa3a50b9292cde32bf39cb6d04e7":162,"4c5156fcc4aa39d07d4fcecd037bc283e0ea2f8e":48,"a3cfdae7fc3cae467d5ccf3a784e71db2c435c1f":1,"ab7daf8694ee9c957041e57e77b3d62c200467c2":167,"9ac20c4cea4d85631f18c97122c4d70b1e61eb82":487,"bee3094ceb2c61b8137427cc36249dd21f931aa6":0,"dce133b693ba6e1b4f3cf76d0d6a06bc4c0f6c9f":0,"ba772f62b6e240f3660ad7f34d2092a13a5f3594":450,"6d1cbe584390de005ccc4beeffddfcbd4a2e3678":0,"dc44e1d1763255531eb356480c672ce2f455b068":128,"ae985ddf3a276d3ac2e557144451604d532e7860":594,"e7a1e854de64ec947bdf305c18345c3b562e781c":28,"3b96ecd2f99fb0fb2c3eceb27fb08d06546791c5":198,"312c52b9a8cff5ebd9bcb73436ef5a65c2881a16":71,"3c3156127fb3ab90cafd3d850f2b9f36a3d03b1f":0,"6a5f644a3a79137fabd77a1f35abc49c8a9aab6f":13,"f2d4829481d4e0ca18c382265d77abbfd3cb7051":169,"92e17e4a35b5143fc5d767f91dcfe7580d6da384":354,"11ed19bdf4296b910312b52974f3e7156e6cf348":17,"38c5a9897cc590232304138d63066fd5124b7750":5,"10e84ad9c3137178d46f9e4395cefea2851ef659":4,"34b445b3d1f472a15938fae79dd03a14de683d34":0,"55f02ebbfaa967962dd26383a17d668387f28591":0,"78d1ccf3fedf18dbcb7f4c3adef660bb1c1897ea":0,"1dfe138cb3aa5694439fb8076439d023dbfecd86":0,"beef49b7f9937764e713436dc7d2966b0d8510f5":33,"52186741f980a42b93b4b0d007f49dec251ab5bf":32,"64fa5196a6a39b6e3512e39f655c75a0595bffaf":0,"feebe9948a353bf6c07a820c077cfa465290036f":34,"bbbf98fbf5d7f85e44760d38050bd3ca965b496a":103,"c21f79d7d5715d1fa44e2ca23a98f17d7c18eb0e":77,"7deba1738e60b3cb910a6933db7807b6ff20c64e":80,"19c56f1f25fbd61ebdc6deb3cfd92727a9b24332":0,"7804e11137eb40b2d339a9c300eeeca1354687e1":37,"738a97dce57f6aed67fa10b0761933d719ee2a9d":265,"0e79445a17383deb42890838cf7112ac2c26027a":0,"be6542236a39e1ada6c460608c3fe22183aa397d":376,"c8425d7dff4624e2920e5f1fd588ec466d8559ef":0,"cbdf06cd3d2affb613e013fc769aebf4730b638f":773,"24198b4851cc5b391de9a3ecc104425d66015a00":577,"029762bbca86d558ee72a89ff4182fb721651e96":241,"e3b9fe281f0ba26c4f164a46b9e3edb274bb3018":0,"784c3a89a2d9961ffe550d92f26ab3ddc9cf06a7":0,"3463579a7974b2380db8203b98505a4985802796":64,"3e0868ddc475e80c0f9d0f23c367ff6bd1364f85":1,"7772e0600e29cf235f186cebe50fdd9c0d6a5178":37,"7fc3204800df92939d36483fc7fd81c6f584a7cd":238,"bebf29b0c743e8469abf41f0a3cc0939306b8086":0,"07956d7345fb17c83c99590113d2a30fa454ea47":18,"9b521324d6d8de8f91912c97d15fd6defd32deac":176,"1794d18b6ee6342a9a4979196f4c33ede430c960":53,"b2005388fc7948192140736b9b376cb2c8d1abf5":191,"6e9a7cd3b689bdd6ad01208f825d4fa13f250cee":28,"e15a65f9844c7b8b02a8064c1855fd325ba8c9b5":0,"3f131f156a62441da7c16d39fc412e9a66e4ad4d":135,"830d9ed2a5b5784ec11ffd381ddb78dea65a8c0b":43,"523548dd7e17852c29b830164b3712b41c67e50c":393,"5c58431241adff0637bc4065a946387dab15959a":114,"7795544d02a04f359c89098db4f66febfe8f9d74":0,"f1d4ccbda08526c5b555950dda146b4c8b1ec820":43,"1a68e1f908b23939cf9214ff3508cea3f929d40b":0,"0706a10da392e2bd88e37e4ce1127bd02735786c":251,"6749f7433678b407786a87ac8fd4e8e9412d989c":0,"07d68bef5056ed02a9d44d97ab79ca8e182786c4":27,"f25fd2800d64d4197e0cdb9861692c9d2b25a280":85,"edb9abbbfd1e223804f70e498c415d7aec444e58":0,"d37bd3a75fa9afcde9805066c1f059034d02396f":325,"c85c050a8ff5fbcd98a9d920e849e612a9ab9b78":0,"2bdf5f8e1080b48d0c09da0fb7e8b47205caa4a3":47,"677d970c0ca047f263fc7f5efc1f5b7a56a96a8e":50,"f3ace4283c5d069c6f60197e81d1d3c56dbb6299":132,"45f79ee89006402a4c1c3d25411c3f73cd3c7f8e":40,"ce691ec16c00b46b698e7f13d273271a3e2535d4":22,"fec0a55827aa4df32139f0ea12c5aa68b1e6d955":276,"10df9aba17fc9598c22f277ba82facbd90cef290":0,"960ab557f2cd76839162bb4031d126fafc6aa7e4":453,"174f6cce5f2168b45b20ca862e51eae071de261c":33,"e1a0658dcdbeac39b013fb2d77ff3c5191ae05cf":156,"bbbb6369fa8ac260858230a5839d58a2365ee8fa":258,"f67887b111124bab8a39385058b30abd52f3a5a6":124,"7feaff9a9f78f7e90063654213db9d008dd61cec":0,"b632b1ff2815064a8e56747ba15faafaf4facc60":47,"c2743a985e6d6702cc30e4520535316ab71bf7b5":352,"bd7c978b9504f652fe21f59a1796db40c5e4e023":260,"714a3f35c3d92ecc2185ae78638b666e9c6655b3":367,"bbf286c12111247c97b409100e4587159f46e32c":149,"20e78756534fb9f42fce635c727af3375d28a6a5":0,"08b3b14a6641724929842f61f57290d167ff42e5":51,"45139a8bff0746d50d3c3de57bbbb4b0ace542b1":14,"c38ef6e071833fccfac31e08a1c27029d5eb685f":34,"a44c5bf171a1374cc6ea4dddb84add4726164f91":492,"cba6366d3c385234a8b21081b2f5107568fbfb28":601,"0ab92c0a988e31b37b352412b6482473e187cabd":0,"265a212a8656a720d342624b17752a13d027b823":182,"7240a18d3741f48270b153d01281a38625064e14":0,"93f8db00c01963fd63c1286960fe133239977373":0,"89ae3bb1aade047199ee66ba59746aa649b6c0dc":408,"5b5a232c2dd46a26c0f1563295e88b3309617100":0,"d6a8b6bb2800427def682802338982f3028e1e60":627,"a56bd4298080c87303a96c140681179e4c5affc9":0,"f5c4ee5e028dcdcdeb961b2641a3038dd65fde4a":35,"1ffeb932edec4a6a7055d7d7d0e0b2546a765204":0,"418600c70a5dcbf74e723779b6fd44cf5be159e2":38,"9e21fe0603f6bcb4dd589d6c45316739b261715a":169,"96d1256e146666ad586c30ae9e7b818288847f0f":1,"616211e61051296e2d19ac11c9414fbd030372eb":0,"9f46b14d0a3ec5cb0dc35adce838d0f36945fd9c":41,"0f82f7ae009393a9ccc05dd6da9150a856052a83":196,"1df5701aca419307c0daa280222d82127b2df5dc":0,"4e7832ef51608619fa0dee55e21335ea3f8ca308":0,"5cb376b88de4befc5516154b624d004a5cd0dea7":0,"495d36c7c0b658057760ec3e33f4766c05b4fb71":0,"9509e94605b86e200368adb1a4a4917c8c66310f":204,"d9e3056dbac33845d742d3cfa640b6c4f90b0f2b":56,"59806cca1fe99f482556780d32c71b5c25adb7d2":2,"1dcdce6190e7a978e2431d73357ceb9e12ca7f13":0,"d066fd18947fab1a0bb54c0df562ac4ff7ead90c":3,"4fc0b587fde05ae66ada39d4455fb8b31f3f4902":120,"9f6c9b12025d8428c050ce4b27ac45012707038e":198,"18762cfe98a759cb16bb769e393feb3ad14ef06c":13,"39441e747192c0b5f02140a07ac6017d3bcbff7a":38,"9a3c400c7f047e29d0719163081b412e8f298042":0,"1b70bec9e352b66e25a30bea7eddbefbbb4f4bea":63,"08a969f1e6ebe9f168d439c8163f1c4442bccf78":256,"c1d6f9dc80935cf6279d46ef11e4ca449f6202e4":193,"4b2c26f009d06f93daaf0dc6558aaeff8274b20c":541,"662cfc155ae1851d27c22f541fac785ee6072ff8":0,"90e54bbfc88988ad87c5910a83348c5a30b3ad9a":0,"f4e79938d9850938d23adba6a59d14127fb96327":1259,"3d2fce9f8fe7186382d773ca47120ebf45b82ff9":280,"da8fb75e66530819ee35ac7376abdffedba598cc":1,"9400ee436072ae8dd1a21be00e86bd5eaefe124a":569,"c133f2769d401d26e56da425d397410c1e4497e6":0,"49bab3f8b8ee04deceb786ba6d51101b54a5baf7":405,"5c28cf44ef93ff79c7ecada1ba31492e29d0765a":5,"f62a595ba28ae92d4b18d84331701d6c1a6a0160":0,"454fa203a2258abeb8dd2b14cdc4d96bc6220fb4":285,"c365535fa4e1cc821252380f9d9ee9f9d4b85ec5":135,"f159760e56ed7945f0a4cb001bc024e243cd76b6":320,"c7963792ba9623ac973792d237dbb18516355644":27,"5e75e44d7ee9ce3a177787c41a8daf1fbac6d40e":0,"73859b110d473b40a092c7713b0352fb1e025d67":13,"4c9e7f575bc10ca44c85e69aa0712f2967cda55a":0,"91f1001590facc6217ff1eecbe6c6661735666b0":211,"542f7a1660bfbd4207fd74be4e9532ae9c5094ee":129,"46e045dad82331f5cdc92505a4791cbce7d08df9":103,"5af5c92c0071ed725c1da293538f8f72e72d3b38":94,"78aaa021cba0419120849e352616fe58f4d983b7":138,"3e26ead804d025869d2e6395bf7e8dd5662f56b2":63,"93fd230f4af6bc7ed4e7988d54f7e13a452c3b71":52,"e1da33857d449d79987c8375bb62299b3c26386d":564,"e8054c20cfe2c50d20eba35bee50e17f95c7a11a":43,"f70d49a75cd6b2cf28cddd94c7b054492163b325":62,"7e9b501ec52ee2bdd3d3df449fc499cf8c41ffdf":13,"a8ca0e05fee2506d725a0caf46cdfdb038232baa":85,"d9c4e7721331ce9d2947fbdff1763c21a48542d2":13,"4363272b3549335b5ddea83bfa03bed15e5ac799":7,"757079b361dfec03e2532e7ca34f5b67881c305d":350,"38637f34d93a129c915c2628441983d7ab9e0522":407,"c1b981466253a67b3dea3198ea3222e6a7733c1e":61,"7f7eabc20f7b72342b71d8b5fe198438746f2289":18,"1e30dfee00bd90ae0fe163fc118d01609609c742":0,"bdb8a9323f6b3a17c9845d346b1e460ce48e0407":118,"77fddc76cd32efcd9947210ceba51783bf8f1b1f":138,"d0ce3b92aa8b27d211959402b1729b720968e94a":339,"b33f24ff5e679b72c79f1874ad9a2d83609bbd81":3,"03a0514f9e525e71dd7738514a6f2088db956798":376,"fcd49c7539905f239c50a77b8aba0885cac8b9b8":401,"97bdc0db1e3a14dcd4499b67c8f4fe98d6be8cfe":979,"035a3f394ca8557f59ae2491815db458732ca59f":266,"146b117e6ece66cbdc53d978b22fa999b33f5366":84,"5d17b2dd8d05ccc7cffdb7e37b54fd692a096ada":73,"8e47200665ed13d3103ba705048051c38489740d":1,"16f4280ff65f480d09fbf2edc88d5b3d10f45e69":57,"57967ec5ed768a0da54cf3f8d7afce0f090d45b1":197,"a797daf18c1ac4b361c8a68b1096132ae339c703":51,"0a402da398980ece37dc456a0cdcc2e4e9e58e4f":9,"705fa8efa7a39c688fd3798b3754bcd323429f68":27,"8b9aa0258331e3209445eebf6d4970abd7ae0cbc":5733,"fff1fe1e4fad88fcb95c211d374a598a787f58d3":4200,"fcf48908d6e48e16fe469357c1436bc078a7b610":6,"693bfe8e8f1258ebd47b2b86dd8b53d16dcfe27d":3,"5c5d0d00465ed89536354a10305db5ceadc8f2be":187,"c92d2bd0fbb92e229a2cb3ff62db572e2d05e274":125,"8764fade1bbf825c260f517018c0c7e1756716a9":21,"bad5247d539fad6c950e079ad5ffa11e186e26c6":192,"58796653cacac2ee84bf741c859438594c90f7e8":284,"6c14da78cbf19335f0dc4141543cda9ba0ce6e5c":73,"7460fc9bc648195dffa9db2d1132c9d2e3d9408b":0,"3f645f24df75e64c73e46db14959492c474622b6":3,"b59767f633fdd52d3a60cf5e99984f64cf02303e":0,"2ec12defea42afac608d335a66f8e123e612f29a":0,"c660af35c4238d068fd67870269d02274895c3ea":0,"54aecd92c859b71d9d76ca7a4d7466a8402d8135":0,"d8c4152eec7a08914cc0748f78a8c7f5ce749c88":129,"14fb687d1b695ad3cdc99751a737bb4a28a467f1":39,"b09beebf1644906934b057cb1ceeff4299cdd4a1":98},"tools":{"claude-code":{"name":"Claude Code","commits":197,"loc":35012,"first_seen":1774121117,"last_seen":1794595942}},"monthly":{"2026-03":{"loc":115909,"attributed_loc":162},"2026-04":{"loc":40295,"attributed_loc":0},"2026-05":{"loc":50925,"attributed_loc":49},"2026-06":{"loc":18627,"attributed_loc":167},"2026-07":{"loc":29317,"attributed_loc":0},"2026-08":{"loc":22962,"attributed_loc":2492},"2026-09":{"loc":52835,"attributed_loc":26},"2026-10":{"loc":25648,"attributed_loc":2730},"2026-11":{"loc":31591,"attributed_loc":29386}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":4.0,"workflow_agents":2.0,"tools_configured":3.0,"earliest_adoption":1774205830.0},"findings":[],"evidence":[{"kind":"ai-artifact","description":".claude/settings.json (claude-code configuration)","ref":".claude/settings.json","url":"https://github.com/notque/vexjoy-agent/blob/871f649901b317d675e63f2dcce2b6515e046230/.claude/settings.json","weight":0.5},{"kind":"ai-artifact","description":"CLAUDE.md (claude-code configuration)","ref":"CLAUDE.md","url":"https://github.com/notque/vexjoy-agent/blob/871f649901b317d675e63f2dcce2b6515e046230/CLAUDE.md","weight":0.5},{"kind":"ai-artifact","description":"AGENTS.md (generic-agent configuration)","ref":"AGENTS.md","url":"https://github.com/notque/vexjoy-agent/blob/871f649901b317d675e63f2dcce2b6515e046230/AGENTS.md","weight":0.5},{"kind":"ai-artifact","description":"GEMINI.md (gemini configuration)","ref":"GEMINI.md","url":"https://github.com/notque/vexjoy-agent/blob/871f649901b317d675e63f2dcce2b6515e046230/GEMINI.md","weight":0.5},{"kind":"ai-workflow","description":".github/workflows/claude.yml runs anthropics/claude-code-action","ref":".github/workflows/claude.yml","url":"https://github.com/notque/vexjoy-agent/blob/871f649901b317d675e63f2dcce2b6515e046230/.github/workflows/claude.yml","weight":0.6},{"kind":"ai-workflow","description":".github/workflows/pr-ai-review.yml runs anthropics/claude-code-action","ref":".github/workflows/pr-ai-review.yml","url":"https://github.com/notque/vexjoy-agent/blob/871f649901b317d675e63f2dcce2b6515e046230/.github/workflows/pr-ai-review.yml","weight":0.6}],"data":{"artifacts":[{"tool":"claude-code","path":".claude/settings.json","added_at":1774205830},{"tool":"claude-code","path":"CLAUDE.md","added_at":1775009820},{"tool":"generic-agent","path":"AGENTS.md","added_at":1793377957},{"tool":"gemini","path":"GEMINI.md","added_at":1793293899}],"workflows":[{"tool":"claude-code","path":".github/workflows/claude.yml","action":"anthropics/claude-code-action"},{"tool":"claude-code","path":".github/workflows/pr-ai-review.yml","action":"anthropics/claude-code-action"}],"tools":["claude-code","gemini","generic-agent"]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":408.0,"flagged_units":49.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":278513.0,"flagged_loc":146754.0,"flagged_loc_share":0.5269197488088527,"max_loc_per_hour":6322.0,"median_loc_per_hour":257.4581119738455,"pr_timed_units":164.0,"excluded_import_loc":109596.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"3,161 lines of first-party code in ~0.5h (6,322 lines/hour, PR #1011)","ref":"decd9fa02a30ee32a59cfc53d0f2250acca2c3eb","url":"https://github.com/notque/vexjoy-agent/commit/decd9fa02a30ee32a59cfc53d0f2250acca2c3eb","weight":0.6},{"kind":"velocity-burst","description":"1,829 lines of first-party code in ~0.5h (3,658 lines/hour, PR #1052)","ref":"0ed118a2f4544d4d7d7ee6e08d6d8c7b2762a47e","url":"https://github.com/notque/vexjoy-agent/commit/0ed118a2f4544d4d7d7ee6e08d6d8c7b2762a47e","weight":0.6},{"kind":"velocity-burst","description":"1,783 lines of first-party code in ~0.5h (3,566 lines/hour, PR #1065)","ref":"01c9715b66381edc8fa67d8305d04eee8ddaf0bb","url":"https://github.com/notque/vexjoy-agent/commit/01c9715b66381edc8fa67d8305d04eee8ddaf0bb","weight":0.6},{"kind":"velocity-burst","description":"1,342 lines of first-party code in ~0.5h (2,684 lines/hour, PR #1031)","ref":"1f733c358db23bdc908fd2ce436acba4a491a096","url":"https://github.com/notque/vexjoy-agent/commit/1f733c358db23bdc908fd2ce436acba4a491a096","weight":0.6},{"kind":"velocity-burst","description":"10,491 lines of first-party code in ~4.0h (2,623 lines/hour, 1 commit session)","ref":"d204c9f30201cc1a8a5e51bfd8b429b61ada24dc","url":"https://github.com/notque/vexjoy-agent/commit/d204c9f30201cc1a8a5e51bfd8b429b61ada24dc","weight":0.6},{"kind":"velocity-burst","description":"1,307 lines of first-party code in ~0.5h (2,614 lines/hour, PR #1070)","ref":"3b05801860877bf93a5dd2f52aedeefc69f56386","url":"https://github.com/notque/vexjoy-agent/commit/3b05801860877bf93a5dd2f52aedeefc69f56386","weight":0.6},{"kind":"velocity-burst","description":"6,163 lines of first-party code in ~2.5h (2,468 lines/hour, 6 commit session)","ref":"67868bda2e25d928d283fa7dc0a36010c30465b8","url":"https://github.com/notque/vexjoy-agent/commit/67868bda2e25d928d283fa7dc0a36010c30465b8","weight":0.6},{"kind":"velocity-burst","description":"7,931 lines of first-party code in ~4.0h (1,988 lines/hour, 46 commit session)","ref":"9f6c9b12025d8428c050ce4b27ac45012707038e","url":"https://github.com/notque/vexjoy-agent/commit/9f6c9b12025d8428c050ce4b27ac45012707038e","weight":0.596440359306455},{"kind":"velocity-burst","description":"6,399 lines of first-party code in ~3.5h (1,811 lines/hour, 33 commit session)","ref":"4363272b3549335b5ddea83bfa03bed15e5ac799","url":"https://github.com/notque/vexjoy-agent/commit/4363272b3549335b5ddea83bfa03bed15e5ac799","weight":0.5434394904458598},{"kind":"velocity-burst","description":"3,880 lines of first-party code in ~2.2h (1,747 lines/hour, 7 commit session)","ref":"3999e387d302a907071c0fdee2e1ea53b67c7f7f","url":"https://github.com/notque/vexjoy-agent/commit/3999e387d302a907071c0fdee2e1ea53b67c7f7f","weight":0.5241275797373358},{"kind":"velocity-burst","description":"3,613 lines of first-party code in ~2.1h (1,728 lines/hour, 5 commit session)","ref":"757fd138af26b35aeb7b2b3b1cb1f04b53e0e11c","url":"https://github.com/notque/vexjoy-agent/commit/757fd138af26b35aeb7b2b3b1cb1f04b53e0e11c","weight":0.5184057393383817},{"kind":"velocity-burst","description":"7,526 lines of first-party code in ~4.4h (1,712 lines/hour, 9 commit session)","ref":"eb8a78028af8072a71a56174a59ea122e81215b4","url":"https://github.com/notque/vexjoy-agent/commit/eb8a78028af8072a71a56174a59ea122e81215b4","weight":0.5134929559668961},{"kind":"velocity-burst","description":"1,591 lines of first-party code in ~1.0h (1,564 lines/hour, 3 commit session)","ref":"029762bbca86d558ee72a89ff4182fb721651e96","url":"https://github.com/notque/vexjoy-agent/commit/029762bbca86d558ee72a89ff4182fb721651e96","weight":0.4693471729035783},{"kind":"velocity-burst","description":"1,792 lines of first-party code in ~1.2h (1,449 lines/hour, 1 commit session)","ref":"8653565323bf52ec7f7cda1c08df49febb7bb12f","url":"https://github.com/notque/vexjoy-agent/commit/8653565323bf52ec7f7cda1c08df49febb7bb12f","weight":0.43461935773635757},{"kind":"velocity-burst","description":"1,681 lines of first-party code in ~1.2h (1,425 lines/hour, 1 commit session)","ref":"ba891dba1fe1f47e15abc63a4c60a774f160d459","url":"https://github.com/notque/vexjoy-agent/commit/ba891dba1fe1f47e15abc63a4c60a774f160d459","weight":0.4274735107134448}],"data":{"flagged_loc_by_commit":{"13ff3a7a11809f950ae4d9ab4ea6ece47423d539":888,"0685952fe0c9d66df214ae7695fb193d18008747":1017,"9247f055afa3f976e15fed6c158c60023053a391":102,"f1799e27013b84eec1274ce3d8c6ffd368e40c85":75,"2ea0b8fe40fefa7803798b1409ed6554668e6c3d":2715,"41897eefc8e32fe26f94bc4209802c2493cdbcf3":2449,"d7827f53df91770c73214dece7c2e0a621737c9d":526,"a3cc2e592281236b1b2f85ed5088e7203992b7cc":301,"67868bda2e25d928d283fa7dc0a36010c30465b8":97,"150202cba152e8b0e8724e00a6f3553e27289cfe":735,"1e9841e53ed63b04518c9d3c7a889a446ed66b21":107,"a9b4a94598854c140c4ec9f7e7ccbcbebbd0bd75":45,"4a74268473a0f72113b39b4594c723b4502e04a8":1129,"f781ba803942e799e841d9706691bd98f1acb119":1227,"535a47a6de0277ef88ae3e3435af93a4c4a59d95":244,"7c5203b4f4fbb923acddc879c1f1ca29fa72d51f":441,"93bafbc653f2209ce029be5e1d20dc732ce7b673":1,"82d3cb1564ce346b36dce8a50d738dfaad5b1330":1031,"7027804cbfce28fe3340ee26bd736daf3e63cd5e":11,"7b21eb7fcbbae5c4b4fe5a04a5630ee8c83a5b18":1737,"595a9dae02c90ef4e007b0910eefb40f529bc367":12,"7abbc587e8c2ae1e151a0b567251f647e3efb5eb":109,"08d84d609e2c390f062835b3b0a7de9063890510":132,"4f009fedfa65957c3ac5153c7c80c861c420d254":667,"a3bc62bcc225f9b391fd41dc5db1962dd5cc4223":1238,"d28521947f32e8b1dd8665a544e00ae84a232d09":1412,"fd9fc315dec1dc186bc5f1dbdd4c443580e8452a":413,"0486df92a5982c9b3c5ddf2f0fd66bbddd7e75a6":800,"4443ef1f6c840f87197334ccb012fa77d9a134bf":779,"d2613c3075c0508cf01d1c2fdee4f5c6edb915e3":226,"fad71bd4068523185de5c5d99897d0b1ca8dce74":574,"eb8a78028af8072a71a56174a59ea122e81215b4":1417,"798b38ac457d24f2ee555fafebad2642c65d3cfb":1589,"6405265a8084583bb1ad5f195cf8fb8a781fd087":1603,"b36d5f89e88da885a1d76fdc338582eb94068d50":1318,"ba891dba1fe1f47e15abc63a4c60a774f160d459":1681,"d0425eb3fe639b053c3b96425563df3fc0492f5d":1135,"965ec02aaa39b76b7c63dc507707c6e493813b76":22,"c48004cc127ea8278078df5e326f831982ae4c91":2596,"134fc19dc298e55d8fc1f7f6a7bbbfe26b472086":19,"3b9e6948cc0fe6b800325640ba7f7265f7c7e11c":2,"ce48e4b000fe35e9dbcce42d2d59208d8597cf21":35,"3999e387d302a907071c0fdee2e1ea53b67c7f7f":71,"1f9b137546514e4d9eeb35f5b8922b72497949ca":2683,"efabe256edb44f2a2580eb514408a347e6ee96a6":6,"9757e1dce582b9281697e385177cac6793fb0071":118,"24381caddb4928437da62a53361f30c86b12c444":675,"ce52de6fe80787267e70386f49271c9b9182fd7a":373,"250f9b2de1b3426398d87d3386e01da2506c42f8":89,"8653565323bf52ec7f7cda1c08df49febb7bb12f":1792,"70a8f3063d3ee4e5f192581e5e78c255a6200b63":798,"6caeb27e0691a695ed9f36c4bcb3e6403b21ef1d":610,"2afb88d5bf8a3c85d18724a49275a06d5aa28828":279,"0b2ee59330cb99c98d8c7c96641c92fe110550c2":802,"5705e68064120cf0810bc201dd4bd4d287cdd4d6":1017,"a0d807df44cecb991fd8bfb6f5121fc091ab56ef":225,"4244f8f76795e5bc8c850506d30a071bc932969a":237,"cc0a64d73079f2f5abc6d08e7ea9763bd4d1bf78":444,"55827434412645c0172ddbf897d7e4e4e3945d06":179,"f58f6de0bc05d2f26c5ff0834342e0b2d6319e52":2,"d204c9f30201cc1a8a5e51bfd8b429b61ada24dc":10491,"658db3d76d382caa30ad23c69b780957c3504995":2302,"7af495bbf5e3a974dec489b5479d319b850346cc":1754,"42bd545069d58889769072b3931fff20533939fd":12,"727b7086be0cdfebceb7eb9c85cddc5a19ce2249":333,"3893ececb67a85c2f760fdff0ebc4c9cfcc64bcd":819,"4b8eceaddf597974f451a2ab5efe328f7e34aa81":61,"ac114e7be79885a98da8795c263318576c9f624c":1993,"dc7dda3a62a7e09d7953b8714d34fa5393d9c543":146,"5f596b5d0c173a39709426ba6f3c2c0427ad00d1":7,"9f82b8f4bf169c1f26a4bfbed73f9081afec86e8":796,"8d095ea152e15fdda1e99d7e43eafe1bacb785c2":1607,"ada91f55f52b5ebf1809a8045942dc4eb09ac84c":141,"d5cb7174b8a5524777c2434c4369ae88f8c7c786":603,"97cc2d4db4f5973a360d9911bda01e35ee2b7650":673,"cea4308b31b6f025c510c7dbcbfb5998a26168f6":415,"6f265d60763bd99f829f0b9bcf8831ae874354b3":417,"00639e691400f20cbecce6e7d699ca647f0b965d":193,"bc802d6f5abcd3aaf806ba20a5a0138cbdf8bc49":66,"647d1dc7265a95dd3ecf59a4b0bac1f23e9c0d5a":87,"df594c1bf1a67d72df502839808497eafb79cdaf":338,"b33edfadf03aee940be2e1c1a4421fa77a082069":5,"c401fb6cfc563fa0654002692e4d6c4363922a78":3,"99b26b2e2110acbd3cabec1a3188f7c2f3fc77dd":1,"850df5f9f7be74457f3fd8c376a3fc49837c8aa3":813,"9feb94960bb898b62928c541171e17f98618623e":978,"3f18751a438595abe291200adb0ac72877e8ca19":579,"570bca0bcfeaa27b80e72fc7db14920d7afedb94":141,"b30ef7d2c708045befd4b46315e3d8c7364f1430":66,"3d54fbb3363e3d42b3d03ca4863d4aca322660db":66,"0d9d11ba6cfd57ba3b68a6e856292a5246ab5f2b":37,"24b6a2be3e91651ff8a8628675de2d8d9a148198":126,"c2e40bc6fedbac8796c0cfd5e8776a7a9e5c13aa":1200,"19ac558595128439b36f0603bef4ee2591b4b5f4":29,"f790c5ac334dfe276cfabd420e29c6b71f5f7ce2":14,"c8a33469493da9fbe6f6c2802ac3cf5712c704a0":14,"272c256399aa6dbc38770227f9adfc57d2c53327":2120,"64484039d9e7773df07f50401cb06e431e0b1bc8":70,"c09ae76c637915ee2bd1e89ef5f63a1c049d75c7":1109,"b288b0a363303e6468c972886f4c16879b283499":496,"393c0bc3ce278266b5fd307280c1a816de561216":337,"e5cfba603c69ba24cd2f6e3eb0fa55f149204c45":748,"757fd138af26b35aeb7b2b3b1cb1f04b53e0e11c":923,"c9d69fc05f6741f75008faf4b2b5a3fc3a064a79":2480,"cb2ab76e23ea146db8efa1e12679f926667c609f":1969,"2438bebcbc789c622c4856446785659593f604b6":957,"1fe1320ce57001b22321ea48f0643f5fd4a325c8":943,"74ac1ebd055f084f97116b853c6428e8e74db877":1,"47289c335c863692e8950b0df1ef76e575892200":1,"e0873e3202a1ecbf2bd21d5caa9915a518d9df82":490,"a4dbc19c5d0a1e85cdc06c144983604f7805ca64":1384,"85cdc195225569dfa81a684ef2cbd8868eef417a":445,"f3f1bfbedf448f907c71677622e063eddb324969":265,"95be7ceb116166d6dfa94f5d3ba665ca2da8a934":303,"5564f9e61670717d923d9e44a66c5158873f59e0":1087,"4130bb0c592ea694b56e8fcd691bc98fc03a0f00":147,"be527374a3d676cea21a82ef52b23cc23b63c54e":2428,"25d64905cf6b110cff328761d638c52abacd450b":182,"52847a9f74d0a04117912f5b0601f36f98568682":360,"1952e5e09ffbb9e1e96001ce5cd0f9899f0387f6":120,"1b651c816d17276579585167a47924fa808d04a1":1088,"4f4b314d6b3de3f437d44b5dae616084622c71a5":201,"7455f5763af0c9c4f0f2a1d642fa039b0e74e1de":215,"3bb7b805a64a48bb082b3bd011cc1e0ea78310c5":269,"0f4aa125c4183bef0ab4f4f7c1563c929eb4aee9":48,"e50359e6574e20f49c641bb4b9bcc0dd07525096":1,"6663a0f5dc289090d0bf15973dcf620ea22c8cb9":7,"45ceaaa8acf9b0625150991ec3d1fab77ea84164":114,"b40f9ef94947a4dce25cb74b30d96a2d030a2b6f":295,"ea0b4a075d3e8961bd9a2f12e4b7eadb353215ac":74,"8db029091be405ab969543bf0a591a9eda086d8f":10,"88c16c570be08feb3488d39ae7dc811524ec718a":3,"09127836866aa4a321472bc952961620d73bece3":242,"8323ad90b307475d1dc1ca639d78996e867ef2a7":610,"9eb99a6c77181331ffcd5bf0a6d2062e7c1ad21c":251,"bdebbc6042250ad2e3e8cc059aae9ae6b1572359":705,"ba730e1c8295e4a081c2076b14d40e399f293135":446,"e7dbae82fadeacff8e19f9070c5cc6b96e4ddb5d":612,"41321f702a0e01fa5bb59528bed173603cf22ba6":4309,"80e7fd7d2aa1a5acebe3541a032cb823958c8e3e":2064,"7152afb17981293b06bcdf69162b83be54a8a513":2500,"a134e0fe9894551fe4f9254e81cc9d8d11f44def":2584,"83ceab32da279c1d2cc11c18e116b584fa3ec75c":1116,"284072037778a90c0a86a1985826ed83d437bd43":1016,"0d8a98f10146b08a64a7b0855c54e096f6c6c134":2332,"8ad68453bb6738abb1d1d665f3bb70f7cb18bde1":1663,"decd9fa02a30ee32a59cfc53d0f2250acca2c3eb":3161,"1f733c358db23bdc908fd2ce436acba4a491a096":1342,"0ed118a2f4544d4d7d7ee6e08d6d8c7b2762a47e":1829,"78debb5f25d4534c15f25c566e8d5e852b6ad2df":1249,"01c9715b66381edc8fa67d8305d04eee8ddaf0bb":1783,"3b05801860877bf93a5dd2f52aedeefc69f56386":1307,"b41a42de2ee8c404f81a4035eb3209df580c511f":2453,"2a826cb3b116bbef006eb6c1f449c38b379f0ed2":2067,"cbdf06cd3d2affb613e013fc769aebf4730b638f":773,"24198b4851cc5b391de9a3ecc104425d66015a00":577,"029762bbca86d558ee72a89ff4182fb721651e96":241,"d0f46215d92ee6cad9ed815fd8e9e2a03c224ac3":277,"3f131f156a62441da7c16d39fc412e9a66e4ad4d":135,"830d9ed2a5b5784ec11ffd381ddb78dea65a8c0b":43,"523548dd7e17852c29b830164b3712b41c67e50c":393,"5c58431241adff0637bc4065a946387dab15959a":114,"f1d4ccbda08526c5b555950dda146b4c8b1ec820":43,"0706a10da392e2bd88e37e4ce1127bd02735786c":251,"07d68bef5056ed02a9d44d97ab79ca8e182786c4":27,"f25fd2800d64d4197e0cdb9861692c9d2b25a280":85,"d37bd3a75fa9afcde9805066c1f059034d02396f":325,"2bdf5f8e1080b48d0c09da0fb7e8b47205caa4a3":47,"677d970c0ca047f263fc7f5efc1f5b7a56a96a8e":50,"f3ace4283c5d069c6f60197e81d1d3c56dbb6299":132,"45f79ee89006402a4c1c3d25411c3f73cd3c7f8e":40,"ce691ec16c00b46b698e7f13d273271a3e2535d4":22,"fec0a55827aa4df32139f0ea12c5aa68b1e6d955":276,"960ab557f2cd76839162bb4031d126fafc6aa7e4":453,"174f6cce5f2168b45b20ca862e51eae071de261c":33,"e1a0658dcdbeac39b013fb2d77ff3c5191ae05cf":156,"bbbb6369fa8ac260858230a5839d58a2365ee8fa":258,"f67887b111124bab8a39385058b30abd52f3a5a6":124,"b632b1ff2815064a8e56747ba15faafaf4facc60":47,"c2743a985e6d6702cc30e4520535316ab71bf7b5":352,"bd7c978b9504f652fe21f59a1796db40c5e4e023":260,"714a3f35c3d92ecc2185ae78638b666e9c6655b3":367,"bbf286c12111247c97b409100e4587159f46e32c":149,"08b3b14a6641724929842f61f57290d167ff42e5":51,"45139a8bff0746d50d3c3de57bbbb4b0ace542b1":14,"c38ef6e071833fccfac31e08a1c27029d5eb685f":34,"a44c5bf171a1374cc6ea4dddb84add4726164f91":492,"cba6366d3c385234a8b21081b2f5107568fbfb28":601,"265a212a8656a720d342624b17752a13d027b823":182,"89ae3bb1aade047199ee66ba59746aa649b6c0dc":408,"d6a8b6bb2800427def682802338982f3028e1e60":627,"f5c4ee5e028dcdcdeb961b2641a3038dd65fde4a":35,"418600c70a5dcbf74e723779b6fd44cf5be159e2":38,"9e21fe0603f6bcb4dd589d6c45316739b261715a":169,"96d1256e146666ad586c30ae9e7b818288847f0f":1,"9f46b14d0a3ec5cb0dc35adce838d0f36945fd9c":41,"0f82f7ae009393a9ccc05dd6da9150a856052a83":196,"9509e94605b86e200368adb1a4a4917c8c66310f":204,"d9e3056dbac33845d742d3cfa640b6c4f90b0f2b":56,"59806cca1fe99f482556780d32c71b5c25adb7d2":2,"d066fd18947fab1a0bb54c0df562ac4ff7ead90c":3,"4fc0b587fde05ae66ada39d4455fb8b31f3f4902":120,"9f6c9b12025d8428c050ce4b27ac45012707038e":198,"18762cfe98a759cb16bb769e393feb3ad14ef06c":13,"39441e747192c0b5f02140a07ac6017d3bcbff7a":38,"1b70bec9e352b66e25a30bea7eddbefbbb4f4bea":63,"08a969f1e6ebe9f168d439c8163f1c4442bccf78":256,"c1d6f9dc80935cf6279d46ef11e4ca449f6202e4":193,"4b2c26f009d06f93daaf0dc6558aaeff8274b20c":541,"f4e79938d9850938d23adba6a59d14127fb96327":1259,"3d2fce9f8fe7186382d773ca47120ebf45b82ff9":280,"da8fb75e66530819ee35ac7376abdffedba598cc":1,"9400ee436072ae8dd1a21be00e86bd5eaefe124a":569,"61444f8a7b3d438ec6e3650816e8e5337567343c":305,"49bab3f8b8ee04deceb786ba6d51101b54a5baf7":405,"5c28cf44ef93ff79c7ecada1ba31492e29d0765a":5,"454fa203a2258abeb8dd2b14cdc4d96bc6220fb4":285,"c365535fa4e1cc821252380f9d9ee9f9d4b85ec5":135,"f159760e56ed7945f0a4cb001bc024e243cd76b6":320,"c7963792ba9623ac973792d237dbb18516355644":27,"70de7265d496958b2b31ca87dc472bcfc53ecabf":114,"73859b110d473b40a092c7713b0352fb1e025d67":13,"91f1001590facc6217ff1eecbe6c6661735666b0":211,"542f7a1660bfbd4207fd74be4e9532ae9c5094ee":129,"46e045dad82331f5cdc92505a4791cbce7d08df9":103,"5af5c92c0071ed725c1da293538f8f72e72d3b38":94,"78aaa021cba0419120849e352616fe58f4d983b7":138,"3e26ead804d025869d2e6395bf7e8dd5662f56b2":63,"93fd230f4af6bc7ed4e7988d54f7e13a452c3b71":52,"e1da33857d449d79987c8375bb62299b3c26386d":564,"e8054c20cfe2c50d20eba35bee50e17f95c7a11a":43,"f70d49a75cd6b2cf28cddd94c7b054492163b325":62,"7e9b501ec52ee2bdd3d3df449fc499cf8c41ffdf":13,"a8ca0e05fee2506d725a0caf46cdfdb038232baa":85,"d9c4e7721331ce9d2947fbdff1763c21a48542d2":13,"4363272b3549335b5ddea83bfa03bed15e5ac799":7,"bdb8a9323f6b3a17c9845d346b1e460ce48e0407":118,"77fddc76cd32efcd9947210ceba51783bf8f1b1f":138,"d0ce3b92aa8b27d211959402b1729b720968e94a":339,"b33f24ff5e679b72c79f1874ad9a2d83609bbd81":3,"03a0514f9e525e71dd7738514a6f2088db956798":376,"fcd49c7539905f239c50a77b8aba0885cac8b9b8":401,"97bdc0db1e3a14dcd4499b67c8f4fe98d6be8cfe":979,"035a3f394ca8557f59ae2491815db458732ca59f":266,"146b117e6ece66cbdc53d978b22fa999b33f5366":84,"5d17b2dd8d05ccc7cffdb7e37b54fd692a096ada":73,"8e47200665ed13d3103ba705048051c38489740d":1,"16f4280ff65f480d09fbf2edc88d5b3d10f45e69":57,"57967ec5ed768a0da54cf3f8d7afce0f090d45b1":197,"a797daf18c1ac4b361c8a68b1096132ae339c703":51,"0a402da398980ece37dc456a0cdcc2e4e9e58e4f":9,"705fa8efa7a39c688fd3798b3754bcd323429f68":27},"excluded_import_commits":["28d30f9a0f07044a32065875c14aa7628f226320","380563c9f97bebaf3e7a372225f25e7814a3667a","5ea20993d0c702104002907e6334d8d784aea42b","8b9aa0258331e3209445eebf6d4970abd7ae0cbc","a739987bb5c2fb8614c383e94e208026699d6339","ab51ee7da567e84f72f76d73b6e7b83cec5ef060","d77eb5c8f48dad8399269410f2f93cef5661c3c3","fff1fe1e4fad88fcb95c211d374a598a787f58d3"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":171998.0,"index":0.616,"count:narrated_steps":51.0,"per_kloc:narrated_steps":0.297,"files:narrated_steps":14.0,"count:placeholder":2.0,"per_kloc:placeholder":0.012,"files:placeholder":1.0,"count:emoji_in_code":102.0,"per_kloc:emoji_in_code":0.593,"files:emoji_in_code":14.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: # Step 1.5 health gate inputs on the same marker line (do/SKILL.md Phase 4 Step 2).","ref":"hooks/routing-decision-recorder.py:186","url":"https://github.com/notque/vexjoy-agent/blob/871f649901b317d675e63f2dcce2b6515e046230/hooks/routing-decision-recorder.py#L186","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: # Step 1: Collect tool calls","ref":"scripts/jev-compact.py:901","url":"https://github.com/notque/vexjoy-agent/blob/871f649901b317d675e63f2dcce2b6515e046230/scripts/jev-compact.py#L901","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: # Step 2: Tier 1 pre-filter","ref":"scripts/jev-compact.py:918","url":"https://github.com/notque/vexjoy-agent/blob/871f649901b317d675e63f2dcce2b6515e046230/scripts/jev-compact.py#L918","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: # Step 3: Build and fit state","ref":"scripts/jev-compact.py:948","url":"https://github.com/notque/vexjoy-agent/blob/871f649901b317d675e63f2dcce2b6515e046230/scripts/jev-compact.py#L948","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: # Step 4: Batch questions","ref":"scripts/jev-compact.py:954","url":"https://github.com/notque/vexjoy-agent/blob/871f649901b317d675e63f2dcce2b6515e046230/scripts/jev-compact.py#L954","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: # Step 5: Ask Jev concurrently","ref":"scripts/jev-compact.py:988","url":"https://github.com/notque/vexjoy-agent/blob/871f649901b317d675e63f2dcce2b6515e046230/scripts/jev-compact.py#L988","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: # Step 6: Decide per call","ref":"scripts/jev-compact.py:1053","url":"https://github.com/notque/vexjoy-agent/blob/871f649901b317d675e63f2dcce2b6515e046230/scripts/jev-compact.py#L1053","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: # Step 7: Apply","ref":"scripts/jev-compact.py:1077","url":"https://github.com/notque/vexjoy-agent/blob/871f649901b317d675e63f2dcce2b6515e046230/scripts/jev-compact.py#L1077","weight":0.0}],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":15.0,"secrets_low_confidence":0.0},"findings":[{"rule_id":"gitleaks/curl-auth-user","severity":"low","message":"Possible curl-auth-user secret in the current tree (test/docs/example file)","path":"agents/rabbitmq-messaging-engineer/references/performance.md","line":225,"fingerprint":"agents/rabbitmq-messaging-engineer/references/performance.md:curl-auth-user:225"},{"rule_id":"gitleaks/curl-auth-header","severity":"low","message":"Possible curl-auth-header secret in the current tree (test/docs/example file)","path":"agents/technical-documentation-engineer/references/documentation-templates.md","line":25,"fingerprint":"agents/technical-documentation-engineer/references/documentation-templates.md:curl-auth-header:25"},{"rule_id":"gitleaks/curl-auth-header","severity":"low","message":"Possible curl-auth-header secret in the current tree (test/docs/example file)","path":"agents/technical-documentation-engineer/references/api-doc-verification-failures.md","line":102,"fingerprint":"agents/technical-documentation-engineer/references/api-doc-verification-failures.md:curl-auth-header:102"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"plugins/jev-auto-compact/tests/redact.test.mjs","line":45,"fingerprint":"plugins/jev-auto-compact/tests/redact.test.mjs:generic-api-key:45"},{"rule_id":"gitleaks/jwt","severity":"low","message":"Possible jwt secret in the current tree (test/docs/example file)","path":"plugins/jev-auto-compact/tests/redact.test.mjs","line":14,"fingerprint":"plugins/jev-auto-compact/tests/redact.test.mjs:jwt:14"},{"rule_id":"gitleaks/stripe-access-token","severity":"low","message":"Possible stripe-access-token secret in the current tree (test/docs/example file)","path":"plugins/jev-auto-compact/tests/redact.test.mjs","line":37,"fingerprint":"plugins/jev-auto-compact/tests/redact.test.mjs:stripe-access-token:37"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"scripts/tests/test_learning_source_filter.py","line":67,"fingerprint":"scripts/tests/test_learning_source_filter.py:generic-api-key:67"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"skills/meta/toolkit/references/skill-creator/error-catalog.md","line":424,"fingerprint":"skills/meta/toolkit/references/skill-creator/error-catalog.md:generic-api-key:424"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit eb6f8cbb52); removed from the current tree but still retrievable","path":"docs/evaluations/philosophy-2026-09-04/archive-index.json","line":93,"fingerprint":"eb6f8cbb52c074ef8cec93d4c135c1fabbae2e7c:docs/evaluations/philosophy-2026-09-04/archive-index.json:generic-api-key:93"},{"rule_id":"gitleaks/curl-auth-header","severity":"low","message":"Possible curl-auth-header secret in history (commit 7408b6afc0); removed from the current tree but still retrievable","path":"agents/technical-documentation-engineer/references/api-doc-anti-patterns.md","line":94,"fingerprint":"7408b6afc0f8ab7a9f07dd14de445d31a935b346:agents/technical-documentation-engineer/references/api-doc-anti-patterns.md:curl-auth-header:94"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit 579d755530); removed from the current tree but still retrievable","path":"agents/php-general-engineer/references/php-security-testing.md","line":100,"fingerprint":"579d7555304b8420e28fc7028a0a67db6d5f5315:agents/php-general-engineer/references/php-security-testing.md:generic-api-key:100"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit 4ce36a51dd); removed from the current tree but still retrievable","path":"agents/php-general-engineer.md","line":509,"fingerprint":"4ce36a51dd68cba5dec0eb5fa8bc1c5cbf4cf764:agents/php-general-engineer.md:generic-api-key:509"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit d77eb5c8f4); removed from the current tree but still retrievable","path":"agents/skill-creator-engineer/references/error-catalog.md","line":424,"fingerprint":"d77eb5c8f48dad8399269410f2f93cef5661c3c3:agents/skill-creator-engineer/references/error-catalog.md:generic-api-key:424"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit d77eb5c8f4); removed from the current tree but still retrievable","path":"agents/skill-creator-engineer/references/anti-patterns.md","line":236,"fingerprint":"d77eb5c8f48dad8399269410f2f93cef5661c3c3:agents/skill-creator-engineer/references/anti-patterns.md:generic-api-key:236"},{"rule_id":"gitleaks/curl-auth-header","severity":"low","message":"Possible curl-auth-header secret in history (commit d77eb5c8f4); removed from the current tree but still retrievable","path":"agents/technical-documentation-engineer.md","line":153,"fingerprint":"d77eb5c8f48dad8399269410f2f93cef5661c3c3:agents/technical-documentation-engineer.md:curl-auth-header:153"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":307.0,"findings_high":262.0,"findings_medium":44.0,"findings_low":1.0,"weighted_findings":296.15,"scanned_lines":171998.0,"parse_errors":6.0},"findings":[{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"conftest.py","line":139,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:conftest.py:139"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/adr-enforcement.py","line":27,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/adr-enforcement.py:27"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/adr-enforcement.py","line":27,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/adr-enforcement.py:27"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"hooks/adr-enforcement.py","line":144,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:hooks/adr-enforcement.py:144"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/adr-lifecycle-on-merge.py","line":31,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/adr-lifecycle-on-merge.py:31"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/adr-lifecycle-on-merge.py","line":31,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/adr-lifecycle-on-merge.py:31"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"hooks/adr-lifecycle-on-merge.py","line":81,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:hooks/adr-lifecycle-on-merge.py:81"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/afk-mode.py","line":33,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/afk-mode.py:33"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/afk-mode.py","line":33,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/afk-mode.py:33"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/agy-hook-adapter.py","line":38,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/agy-hook-adapter.py:38"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/agy-hook-adapter.py","line":38,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/agy-hook-adapter.py:38"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"hooks/agy-hook-adapter.py","line":685,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:hooks/agy-hook-adapter.py:685"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/ci-merge-gate.py","line":21,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/ci-merge-gate.py:21"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/ci-merge-gate.py","line":21,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/ci-merge-gate.py:21"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/codex-auto-review.py","line":42,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/codex-auto-review.py:42"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/codex-auto-review.py","line":42,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/codex-auto-review.py:42"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/codex-hook-adapter.py","line":26,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/codex-hook-adapter.py:26"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/codex-hook-adapter.py","line":26,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/codex-hook-adapter.py:26"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"hooks/codex-hook-adapter.py","line":532,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:hooks/codex-hook-adapter.py:532"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/creation-protocol-enforcer.py","line":37,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/creation-protocol-enforcer.py:37"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/creation-protocol-enforcer.py","line":37,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/creation-protocol-enforcer.py:37"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/cross-repo-agents.py","line":28,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/cross-repo-agents.py:28"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/cross-repo-agents.py","line":28,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/cross-repo-agents.py:28"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/fish-shell-detector.py","line":35,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/fish-shell-detector.py:35"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/fish-shell-detector.py","line":35,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/fish-shell-detector.py:35"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/gemini-turn-gate-userprompt.py","line":23,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/gemini-turn-gate-userprompt.py:23"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/gemini-turn-gate-userprompt.py","line":23,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/gemini-turn-gate-userprompt.py:23"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/herdr-state-reporter.py","line":20,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/herdr-state-reporter.py:20"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/herdr-state-reporter.py","line":20,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/herdr-state-reporter.py:20"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/hook-version-parity-check.py","line":39,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/hook-version-parity-check.py:39"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/hook-version-parity-check.py","line":39,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/hook-version-parity-check.py:39"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/jev-route-injector-userprompt.py","line":39,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/jev-route-injector-userprompt.py:39"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/jev-route-injector-userprompt.py","line":39,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/jev-route-injector-userprompt.py:39"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"hooks/jev-route-injector-userprompt.py","line":128,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:hooks/jev-route-injector-userprompt.py:128"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"hooks/lib/installed_index.py","line":57,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:hooks/lib/installed_index.py:57"},{"rule_id":"opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query","severity":"high","message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]","path":"hooks/lib/learning_db_v2.py","line":336,"fingerprint":"python.sqlalchemy.security.sqlalchemy-execute-raw-query:hooks/lib/learning_db_v2.py:336"},{"rule_id":"opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query","severity":"high","message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]","path":"hooks/lib/learning_db_v2.py","line":1844,"fingerprint":"python.sqlalchemy.security.sqlalchemy-execute-raw-query:hooks/lib/learning_db_v2.py:1844"},{"rule_id":"opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query","severity":"high","message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]","path":"hooks/lib/learning_db_v2.py","line":1851,"fingerprint":"python.sqlalchemy.security.sqlalchemy-execute-raw-query:hooks/lib/learning_db_v2.py:1851"},{"rule_id":"opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query","severity":"high","message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]","path":"hooks/lib/learning_db_v2.py","line":1921,"fingerprint":"python.sqlalchemy.security.sqlalchemy-execute-raw-query:hooks/lib/learning_db_v2.py:1921"},{"rule_id":"opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query","severity":"high","message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]","path":"hooks/lib/learning_db_v2.py","line":1926,"fingerprint":"python.sqlalchemy.security.sqlalchemy-execute-raw-query:hooks/lib/learning_db_v2.py:1926"},{"rule_id":"opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query","severity":"high","message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]","path":"hooks/lib/learning_db_v2.py","line":1981,"fingerprint":"python.sqlalchemy.security.sqlalchemy-execute-raw-query:hooks/lib/learning_db_v2.py:1981"},{"rule_id":"opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query","severity":"high","message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]","path":"hooks/lib/learning_db_v2.py","line":2169,"fingerprint":"python.sqlalchemy.security.sqlalchemy-execute-raw-query:hooks/lib/learning_db_v2.py:2169"},{"rule_id":"opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query","severity":"high","message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]","path":"hooks/lib/learning_db_v2.py","line":2491,"fingerprint":"python.sqlalchemy.security.sqlalchemy-execute-raw-query:hooks/lib/learning_db_v2.py:2491"},{"rule_id":"opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query","severity":"high","message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]","path":"hooks/lib/learning_db_v2.py","line":2631,"fingerprint":"python.sqlalchemy.security.sqlalchemy-execute-raw-query:hooks/lib/learning_db_v2.py:2631"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"hooks/lib/manifest_cache.py","line":117,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:hooks/lib/manifest_cache.py:117"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"hooks/lib/quality_gate.py","line":162,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:hooks/lib/quality_gate.py:162"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"hooks/lib/quality_gate.py","line":260,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:hooks/lib/quality_gate.py:260"},{"rule_id":"opengrep/python.lang.security.audit.subprocess-shell-true","severity":"high","message":"Found 'subprocess' function 'run' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead. [confidence medium]","path":"hooks/lib/quality_gate.py","line":262,"fingerprint":"python.lang.security.audit.subprocess-shell-true:hooks/lib/quality_gate.py:262"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"hooks/mcp-health-check.py","line":261,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:hooks/mcp-health-check.py:261"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"hooks/mcp-health-check.py","line":331,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:hooks/mcp-health-check.py:331"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"hooks/mcp-health-check.py","line":332,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:hooks/mcp-health-check.py:332"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/operator-context-detector.py","line":46,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/operator-context-detector.py:46"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/operator-context-detector.py","line":46,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/operator-context-detector.py:46"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/pending-advisory-injector-userprompt.py","line":32,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/pending-advisory-injector-userprompt.py:32"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/pending-advisory-injector-userprompt.py","line":32,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/pending-advisory-injector-userprompt.py:32"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/pipeline-context-detector.py","line":41,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/pipeline-context-detector.py:41"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/pipeline-context-detector.py","line":41,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/pipeline-context-detector.py:41"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/pipeline-phase-gate.py","line":63,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/pipeline-phase-gate.py:63"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/pipeline-phase-gate.py","line":63,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/pipeline-phase-gate.py:63"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/postcompact-handler.py","line":20,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/postcompact-handler.py:20"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/postcompact-handler.py","line":20,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/postcompact-handler.py:20"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/posttool-bash-injection-scan.py","line":28,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/posttool-bash-injection-scan.py:28"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/posttool-bash-injection-scan.py","line":28,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/posttool-bash-injection-scan.py:28"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/posttool-docs-drift-alert.py","line":25,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/posttool-docs-drift-alert.py:25"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/posttool-docs-drift-alert.py","line":25,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/posttool-docs-drift-alert.py:25"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"hooks/posttool-docs-drift-alert.py","line":90,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:hooks/posttool-docs-drift-alert.py:90"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/posttool-rename-sweep.py","line":30,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/posttool-rename-sweep.py:30"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/posttool-rename-sweep.py","line":30,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/posttool-rename-sweep.py:30"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/posttool-security-scan.py","line":44,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/posttool-security-scan.py:44"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/posttool-security-scan.py","line":44,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/posttool-security-scan.py:44"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/posttool-session-reads.py","line":54,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/posttool-session-reads.py:54"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/posttool-session-reads.py","line":54,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/posttool-session-reads.py:54"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/posttool-skill-frontmatter-check.py","line":25,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/posttool-skill-frontmatter-check.py:25"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/posttool-skill-frontmatter-check.py","line":25,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/posttool-skill-frontmatter-check.py:25"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"hooks/posttool-skill-frontmatter-check.py","line":93,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:hooks/posttool-skill-frontmatter-check.py:93"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/posttooluse-joy-check-warn.py","line":24,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/posttooluse-joy-check-warn.py:24"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/posttooluse-joy-check-warn.py","line":24,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/posttooluse-joy-check-warn.py:24"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/posttooluse-sync-agent-index.py","line":29,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/posttooluse-sync-agent-index.py:29"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/posttooluse-sync-agent-index.py","line":29,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/posttooluse-sync-agent-index.py:29"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/posttooluse-sync-skill-index.py","line":34,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/posttooluse-sync-skill-index.py:34"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/posttooluse-sync-skill-index.py","line":34,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/posttooluse-sync-skill-index.py:34"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/precompact-archive.py","line":34,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/precompact-archive.py:34"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/precompact-archive.py","line":34,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/precompact-archive.py:34"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/pretool-adr-creation-gate.py","line":47,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/pretool-adr-creation-gate.py:47"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/pretool-adr-creation-gate.py","line":47,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/pretool-adr-creation-gate.py:47"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/pretool-branch-safety.py","line":34,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/pretool-branch-safety.py:34"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/pretool-branch-safety.py","line":34,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/pretool-branch-safety.py:34"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/pretool-config-protection.py","line":30,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/pretool-config-protection.py:30"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/pretool-config-protection.py","line":30,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/pretool-config-protection.py:30"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/pretool-dispatch-spec-gate.py","line":46,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/pretool-dispatch-spec-gate.py:46"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/pretool-dispatch-spec-gate.py","line":46,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/pretool-dispatch-spec-gate.py:46"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/pretool-file-backup.py","line":40,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/pretool-file-backup.py:40"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/pretool-file-backup.py","line":40,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/pretool-file-backup.py:40"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/pretool-plan-gate.py","line":36,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/pretool-plan-gate.py:36"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/pretool-plan-gate.py","line":36,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/pretool-plan-gate.py:36"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/pretool-private-name-leak-gate.py","line":103,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/pretool-private-name-leak-gate.py:103"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/pretool-private-name-leak-gate.py","line":103,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/pretool-private-name-leak-gate.py:103"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/pretool-prompt-injection-scanner.py","line":33,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/pretool-prompt-injection-scanner.py:33"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/pretool-prompt-injection-scanner.py","line":33,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/pretool-prompt-injection-scanner.py:33"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/pretool-review-before-push-gate.py","line":48,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/pretool-review-before-push-gate.py:48"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/pretool-review-before-push-gate.py","line":48,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/pretool-review-before-push-gate.py:48"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/pretool-routing-gate.py","line":26,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/pretool-routing-gate.py:26"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/pretool-routing-gate.py","line":26,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/pretool-routing-gate.py:26"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/pretool-ruff-format-gate.py","line":46,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/pretool-ruff-format-gate.py:46"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/pretool-ruff-format-gate.py","line":46,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/pretool-ruff-format-gate.py:46"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/pretool-section-integrity-validator.py","line":33,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/pretool-section-integrity-validator.py:33"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/pretool-section-integrity-validator.py","line":33,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/pretool-section-integrity-validator.py:33"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/pretool-synthesis-gate.py","line":50,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/pretool-synthesis-gate.py:50"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/pretool-synthesis-gate.py","line":50,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/pretool-synthesis-gate.py:50"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/pretool-unified-gate.py","line":47,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/pretool-unified-gate.py:47"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/pretool-unified-gate.py","line":47,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/pretool-unified-gate.py:47"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"hooks/pretool-unified-gate.py","line":1667,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:hooks/pretool-unified-gate.py:1667"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"hooks/pretool-voice-publish-gate.py","line":64,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:hooks/pretool-voice-publish-gate.py:64"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/pretool-worktree-edit-guard.py","line":60,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/pretool-worktree-edit-guard.py:60"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/pretool-worktree-edit-guard.py","line":60,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/pretool-worktree-edit-guard.py:60"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/prompt-capture.py","line":36,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/prompt-capture.py:36"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/prompt-capture.py","line":36,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/prompt-capture.py:36"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/reference-loading-enforcer.py","line":37,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/reference-loading-enforcer.py:37"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/reference-loading-enforcer.py","line":37,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/reference-loading-enforcer.py:37"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/review-capture.py","line":31,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/review-capture.py:31"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/review-capture.py","line":31,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/review-capture.py:31"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/review-false-positive-capture.py","line":26,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/review-false-positive-capture.py:26"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/review-false-positive-capture.py","line":26,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/review-false-positive-capture.py:26"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/routing-decision-recorder.py","line":83,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/routing-decision-recorder.py:83"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/routing-decision-recorder.py","line":83,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/routing-decision-recorder.py:83"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/routing-outcome-finalizer.py","line":94,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/routing-outcome-finalizer.py:94"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/routing-outcome-finalizer.py","line":94,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/routing-outcome-finalizer.py:94"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/routing-outcome-recorder.py","line":64,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/routing-outcome-recorder.py:64"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/routing-outcome-recorder.py","line":64,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/routing-outcome-recorder.py:64"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/routing-outcome-stop-fallback.py","line":56,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/routing-outcome-stop-fallback.py:56"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/routing-outcome-stop-fallback.py","line":56,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/routing-outcome-stop-fallback.py:56"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/rules-distill-injector.py","line":29,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/rules-distill-injector.py:29"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/rules-distill-injector.py","line":29,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/rules-distill-injector.py:29"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/rules-distill-trigger.py","line":24,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/rules-distill-trigger.py:24"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/rules-distill-trigger.py","line":24,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/rules-distill-trigger.py:24"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"hooks/rules-distill-trigger.py","line":105,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:hooks/rules-distill-trigger.py:105"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/sapcc-go-detector.py","line":37,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/sapcc-go-detector.py:37"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/sapcc-go-detector.py","line":37,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/sapcc-go-detector.py:37"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/security-review-hook.py","line":84,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/security-review-hook.py:84"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/security-review-hook.py","line":84,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/security-review-hook.py:84"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"hooks/security-review-hook.py","line":183,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:hooks/security-review-hook.py:183"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/session-adr-health-check.py","line":39,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/session-adr-health-check.py:39"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/session-adr-health-check.py","line":39,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/session-adr-health-check.py:39"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/session-context.py","line":31,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/session-context.py:31"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/session-context.py","line":31,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/session-context.py:31"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/session-github-briefing.py","line":22,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/session-github-briefing.py:22"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/session-github-briefing.py","line":22,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/session-github-briefing.py:22"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/session-manifest-cache.py","line":36,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/session-manifest-cache.py:36"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/session-manifest-cache.py","line":36,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/session-manifest-cache.py:36"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/session-no-agent-summary-check.py","line":32,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/session-no-agent-summary-check.py:32"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/session-no-agent-summary-check.py","line":32,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/session-no-agent-summary-check.py:32"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/session-summary.py","line":27,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/session-summary.py:27"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/session-summary.py","line":27,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/session-summary.py:27"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/session-task-registry.py","line":28,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/session-task-registry.py:28"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/session-task-registry.py","line":28,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/session-task-registry.py:28"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/stop-drift-guard.py","line":71,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/stop-drift-guard.py:71"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/stop-drift-guard.py","line":71,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/stop-drift-guard.py:71"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"hooks/stop-drift-guard.py","line":311,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:hooks/stop-drift-guard.py:311"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/stop-failure-handler.py","line":19,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/stop-failure-handler.py:19"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/stop-failure-handler.py","line":19,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/stop-failure-handler.py:19"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/subagent-completion-guard.py","line":52,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/subagent-completion-guard.py:52"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/subagent-completion-guard.py","line":52,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/subagent-completion-guard.py:52"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/subagent-start-warmstart.py","line":35,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/subagent-start-warmstart.py:35"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/subagent-start-warmstart.py","line":35,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/subagent-start-warmstart.py:35"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/subagent-state-tracker.py","line":27,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/subagent-state-tracker.py:27"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/subagent-state-tracker.py","line":27,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/subagent-state-tracker.py:27"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/suggest-compact.py","line":42,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/suggest-compact.py:42"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/suggest-compact.py","line":42,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/suggest-compact.py:42"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/sync-to-user-claude.py","line":38,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/sync-to-user-claude.py:38"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/sync-to-user-claude.py","line":38,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/sync-to-user-claude.py:38"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"hooks/sync-to-user-claude.py","line":129,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:hooks/sync-to-user-claude.py:129"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/team-config-loader.py","line":33,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/team-config-loader.py:33"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/team-config-loader.py","line":33,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/team-config-loader.py:33"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/usage-tracker.py","line":27,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/usage-tracker.py:27"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/usage-tracker.py","line":27,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/usage-tracker.py:27"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"hooks/zsh-shell-detector.py","line":37,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:hooks/zsh-shell-detector.py:37"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"hooks/zsh-shell-detector.py","line":37,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:hooks/zsh-shell-detector.py:37"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/agent-scheduler.py","line":445,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/agent-scheduler.py:445"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/benchmark-hooks.py","line":117,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/benchmark-hooks.py:117"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/build-dispatch.py","line":1401,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/build-dispatch.py:1401"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/check-routing-drift.py","line":148,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/check-routing-drift.py:148"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/d_route_model.py","line":67,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/d_route_model.py:67"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/d_route_model.py","line":74,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/d_route_model.py:74"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/d_route_model.py","line":89,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/d_route_model.py:89"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/d_route_model.py","line":139,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/d_route_model.py:139"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/generate-skill-index.py","line":823,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/generate-skill-index.py:823"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/generate-skills-doc.py","line":85,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/generate-skills-doc.py:85"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/github-notification-triage.py","line":168,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/github-notification-triage.py:168"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/handoff.py","line":92,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/handoff.py:92"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/install-doctor.py","line":127,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/install-doctor.py:127"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/install-doctor.py","line":768,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/install-doctor.py:768"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/jev-browser-agent.py","line":404,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/jev-browser-agent.py:404"},{"rule_id":"opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query","severity":"high","message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]","path":"scripts/jev-compact-evidence.py","line":279,"fingerprint":"python.sqlalchemy.security.sqlalchemy-execute-raw-query:scripts/jev-compact-evidence.py:279"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/jev-cost-report.py","line":215,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/jev-cost-report.py:215"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/jev-route.py","line":229,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/jev-route.py:229"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/jev-route.py","line":266,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/jev-route.py:266"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/jev_alt_model.py","line":217,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/jev_alt_model.py:217"},{"rule_id":"opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query","severity":"high","message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]","path":"scripts/learning-db.py","line":270,"fingerprint":"python.sqlalchemy.security.sqlalchemy-execute-raw-query:scripts/learning-db.py:270"},{"rule_id":"opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query","severity":"high","message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]","path":"scripts/learning-db.py","line":284,"fingerprint":"python.sqlalchemy.security.sqlalchemy-execute-raw-query:scripts/learning-db.py:284"},{"rule_id":"opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query","severity":"high","message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]","path":"scripts/learning-db.py","line":504,"fingerprint":"python.sqlalchemy.security.sqlalchemy-execute-raw-query:scripts/learning-db.py:504"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/lib/index_freshness.py","line":101,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/lib/index_freshness.py:101"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/manifest.py","line":283,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/manifest.py:283"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/mutation_check/engine.py","line":102,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/mutation_check/engine.py:102"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/pr-risk-classify.py","line":169,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/pr-risk-classify.py:169"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/pre-route.py","line":98,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/pre-route.py:98"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/probe-codex-hooks.py","line":316,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/probe-codex-hooks.py:316"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/probe-codex-hooks.py","line":372,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/probe-codex-hooks.py:372"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/probe-codex-hooks.py","line":813,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/probe-codex-hooks.py:813"},{"rule_id":"opengrep/python.django.security.injection.command.subprocess-injection","severity":"high","message":"Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, scan sensitive data, or run any command they wish on the serve [confidence high]","path":"scripts/record-misroute.py","line":58,"fingerprint":"python.django.security.injection.command.subprocess-injection:scripts/record-misroute.py:58"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/record-misroute.py","line":58,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/record-misroute.py:58"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/register-hook.py","line":155,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/register-hook.py:155"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/right-size-review.py","line":116,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/right-size-review.py:116"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/router-self-audit.py","line":72,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/router-self-audit.py:72"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/router_attachment/run_eval.py","line":57,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/router_attachment/run_eval.py:57"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/router_attachment/run_eval.py","line":165,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/router_attachment/run_eval.py:165"},{"rule_id":"opengrep/python.django.security.injection.command.subprocess-injection","severity":"high","message":"Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, scan sensitive data, or run any command they wish on the serve [confidence high]","path":"scripts/routing-ab-test.py","line":248,"fingerprint":"python.django.security.injection.command.subprocess-injection:scripts/routing-ab-test.py:248"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/routing-ab-test.py","line":248,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/routing-ab-test.py:248"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/routing-ab-test.py","line":261,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/routing-ab-test.py:261"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/routing-ab-test.py","line":274,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/routing-ab-test.py:274"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/rules-distill.py","line":324,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/rules-distill.py:324"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/scheduler-ctl.py","line":168,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/scheduler-ctl.py:168"},{"rule_id":"opengrep/python.lang.security.use-defused-xml","severity":"high","message":"The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and \"XML bombs\" can cause denial of service. [confidence low]","path":"scripts/search-engine-bulk-indexer.py","line":32,"fingerprint":"python.lang.security.use-defused-xml:scripts/search-engine-bulk-indexer.py:32"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/session-bootstrap-replay.py","line":75,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/session-bootstrap-replay.py:75"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/smoke-test-hooks.py","line":236,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/smoke-test-hooks.py:236"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/trajectory-ab-test.py","line":448,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/trajectory-ab-test.py:448"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/trajectory-ab-test.py","line":454,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/trajectory-ab-test.py:454"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/trajectory-ab-test.py","line":482,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/trajectory-ab-test.py:482"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/validate-doc-commands.py","line":151,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/validate-doc-commands.py:151"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/validate-hook-health.py","line":812,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/validate-hook-health.py:812"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'CompletedProcess' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/validate-hook-health.py","line":832,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/validate-hook-health.py:832"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/validate-hook-health.py","line":916,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/validate-hook-health.py:916"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/vexinstall/interp.py","line":115,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/vexinstall/interp.py:115"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/vexinstall/interp.py","line":403,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/vexinstall/interp.py:403"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/video-transcript.py","line":355,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/video-transcript.py:355"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/video-transcript.py","line":482,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/video-transcript.py:482"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"skills/content/video-editing/scripts/image_to_video.py","line":59,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:skills/content/video-editing/scripts/image_to_video.py:59"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"skills/content/video-editing/scripts/image_to_video.py","line":343,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:skills/content/video-editing/scripts/image_to_video.py:343"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"skills/frontend/frontend/scripts-html-artifact/pptx-bridge/render_pptx.py","line":65,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:skills/frontend/frontend/scripts-html-artifact/pptx-bridge/render_pptx.py:65"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"skills/frontend/frontend/scripts-html-artifact/pptx-bridge/render_pptx.py","line":108,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:skills/frontend/frontend/scripts-html-artifact/pptx-bridge/render_pptx.py:108"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"skills/frontend/frontend/scripts-html-artifact/pptx-bridge/render_pptx.py","line":134,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:skills/frontend/frontend/scripts-html-artifact/pptx-bridge/render_pptx.py:134"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"skills/frontend/frontend/scripts-html-artifact/pptx-bridge/run-unified.py","line":72,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:skills/frontend/frontend/scripts-html-artifact/pptx-bridge/run-unified.py:72"},{"rule_id":"opengrep/javascript.lang.security.detect-child-process","severity":"high","message":"Detected calls to child_process from a function argument `inputPath`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low]","path":"skills/game/game-dev/scripts/optimize-glb.mjs","line":50,"fingerprint":"javascript.lang.security.detect-child-process:skills/game/game-dev/scripts/optimize-glb.mjs:50"},{"rule_id":"opengrep/javascript.lang.security.detect-child-process","severity":"high","message":"Detected calls to child_process from a function argument `outputPath`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low]","path":"skills/game/game-dev/scripts/optimize-glb.mjs","line":50,"fingerprint":"javascript.lang.security.detect-child-process:skills/game/game-dev/scripts/optimize-glb.mjs:50"},{"rule_id":"opengrep/javascript.lang.security.detect-child-process","severity":"high","message":"Detected calls to child_process from a function argument `outputPath`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low]","path":"skills/game/game-dev/scripts/optimize-glb.mjs","line":51,"fingerprint":"javascript.lang.security.detect-child-process:skills/game/game-dev/scripts/optimize-glb.mjs:51"},{"rule_id":"opengrep/javascript.lang.security.detect-child-process","severity":"high","message":"Detected calls to child_process from a function argument `outputPath`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low]","path":"skills/game/game-dev/scripts/optimize-glb.mjs","line":55,"fingerprint":"javascript.lang.security.detect-child-process:skills/game/game-dev/scripts/optimize-glb.mjs:55"},{"rule_id":"opengrep/javascript.lang.security.detect-child-process","severity":"high","message":"Detected calls to child_process from a function argument `outputPath`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low]","path":"skills/game/game-dev/scripts/optimize-glb.mjs","line":62,"fingerprint":"javascript.lang.security.detect-child-process:skills/game/game-dev/scripts/optimize-glb.mjs:62"},{"rule_id":"opengrep/javascript.lang.security.detect-child-process","severity":"high","message":"Detected calls to child_process from a function argument `outputPath`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low]","path":"skills/game/game-dev/scripts/optimize-glb.mjs","line":70,"fingerprint":"javascript.lang.security.detect-child-process:skills/game/game-dev/scripts/optimize-glb.mjs:70"},{"rule_id":"opengrep/javascript.lang.security.detect-child-process","severity":"high","message":"Detected calls to child_process from a function argument `outputPath`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low]","path":"skills/game/game-dev/scripts/optimize-glb.mjs","line":73,"fingerprint":"javascript.lang.security.detect-child-process:skills/game/game-dev/scripts/optimize-glb.mjs:73"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"skills/game/game-dev/scripts/sprite_generate.py","line":181,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:skills/game/game-dev/scripts/sprite_generate.py:181"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"skills/game/game-dev/scripts/sprite_generate.py","line":254,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:skills/game/game-dev/scripts/sprite_generate.py:254"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"skills/game/game-dev/scripts/video_extract_frames.py","line":80,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:skills/game/game-dev/scripts/video_extract_frames.py:80"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"skills/game/game-dev/scripts/with_server.py","line":177,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:skills/game/game-dev/scripts/with_server.py:177"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"skills/game/game-dev/scripts/with_server.py","line":178,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:skills/game/game-dev/scripts/with_server.py:178"},{"rule_id":"opengrep/python.lang.security.audit.subprocess-shell-true","severity":"high","message":"Found 'subprocess' function 'run' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead. [confidence medium]","path":"skills/game/game-dev/scripts/with_server.py","line":179,"fingerprint":"python.lang.security.audit.subprocess-shell-true:skills/game/game-dev/scripts/with_server.py:179"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"skills/meta/docs-sync-checker/scripts/validate.py","line":171,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:skills/meta/docs-sync-checker/scripts/validate.py:171"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"skills/meta/toolkit/scripts/agent-comparison/generate_variant.py","line":230,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:skills/meta/toolkit/scripts/agent-comparison/generate_variant.py:230"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"skills/meta/toolkit/scripts/agent-comparison/optimize_loop.py","line":216,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:skills/meta/toolkit/scripts/agent-comparison/optimize_loop.py:216"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"skills/meta/toolkit/scripts/agent-comparison/optimize_loop.py","line":724,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:skills/meta/toolkit/scripts/agent-comparison/optimize_loop.py:724"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"skills/meta/toolkit/scripts/agent-comparison/trigger_eval.py","line":242,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:skills/meta/toolkit/scripts/agent-comparison/trigger_eval.py:242"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"skills/meta/toolkit/scripts/skill-creator/eval_compare.py","line":102,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:skills/meta/toolkit/scripts/skill-creator/eval_compare.py:102"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"skills/meta/toolkit/scripts/skill-creator/run_eval.py","line":124,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:skills/meta/toolkit/scripts/skill-creator/run_eval.py:124"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"skills/process/pr-workflow/scripts/validate_state.py","line":82,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:skills/process/pr-workflow/scripts/validate_state.py:82"},{"rule_id":"opengrep/python.lang.security.audit.non-literal-import","severity":"medium","message":"Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code. [confidence low]","path":"hooks/lib/hook_utils.py","line":41,"fingerprint":"python.lang.security.audit.non-literal-import:hooks/lib/hook_utils.py:41"},{"rule_id":"opengrep/python.lang.security.insecure-hash-algorithm-md5","severity":"medium","message":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium]","path":"hooks/lib/hook_utils.py","line":327,"fingerprint":"python.lang.security.insecure-hash-algorithm-md5:hooks/lib/hook_utils.py:327"},{"rule_id":"opengrep/python.lang.security.audit.insecure-file-permissions","severity":"medium","message":"These permissions `0o700` are widely permissive and grant access to more people than may be necessary. A good default is `0o644` which gives read and write access to yourself and read access to everyone else. [confidence medium]","path":"hooks/lib/learning_db_v2.py","line":90,"fingerprint":"python.lang.security.audit.insecure-file-permissions:hooks/lib/learning_db_v2.py:90"},{"rule_id":"opengrep/python.lang.security.audit.formatted-sql-query","severity":"medium","message":"Detected possible formatted SQL query. Use parameterized queries instead. [confidence low]","path":"hooks/lib/learning_db_v2.py","line":336,"fingerprint":"python.lang.security.audit.formatted-sql-query:hooks/lib/learning_db_v2.py:336"},{"rule_id":"opengrep/python.lang.security.insecure-hash-algorithm-md5","severity":"medium","message":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium]","path":"hooks/lib/learning_db_v2.py","line":2377,"fingerprint":"python.lang.security.insecure-hash-algorithm-md5:hooks/lib/learning_db_v2.py:2377"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"hooks/mcp-health-check.py","line":240,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:hooks/mcp-health-check.py:240"},{"rule_id":"opengrep/python.lang.security.audit.regex_dos","severity":"medium","message":"Detected usage of re.compile with an inefficient regular expression. This can lead to regular expression denial of service, which can result in service down time. Instead, check all regexes or use safer alternatives such as pyre2. [confidence low]","path":"hooks/pretool-private-name-leak-gate.py","line":631,"fingerprint":"python.lang.security.audit.regex_dos:hooks/pretool-private-name-leak-gate.py:631"},{"rule_id":"opengrep/python.lang.security.audit.non-literal-import","severity":"medium","message":"Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code. [confidence low]","path":"hooks/pretool-unified-gate.py","line":78,"fingerprint":"python.lang.security.audit.non-literal-import:hooks/pretool-unified-gate.py:78"},{"rule_id":"opengrep/python.lang.security.insecure-hash-algorithm-md5","severity":"medium","message":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium]","path":"hooks/prompt-capture.py","line":76,"fingerprint":"python.lang.security.insecure-hash-algorithm-md5:hooks/prompt-capture.py:76"},{"rule_id":"opengrep/python.lang.security.insecure-hash-algorithm-md5","severity":"medium","message":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium]","path":"hooks/review-capture.py","line":188,"fingerprint":"python.lang.security.insecure-hash-algorithm-md5:hooks/review-capture.py:188"},{"rule_id":"opengrep/python.lang.security.insecure-hash-algorithm-md5","severity":"medium","message":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium]","path":"hooks/routing-decision-recorder.py","line":551,"fingerprint":"python.lang.security.insecure-hash-algorithm-md5:hooks/routing-decision-recorder.py:551"},{"rule_id":"opengrep/python.lang.security.insecure-hash-algorithm-md5","severity":"medium","message":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium]","path":"hooks/routing-decision-recorder.py","line":565,"fingerprint":"python.lang.security.insecure-hash-algorithm-md5:hooks/routing-decision-recorder.py:565"},{"rule_id":"opengrep/python.lang.security.audit.insecure-file-permissions","severity":"medium","message":"These permissions `0o700` are widely permissive and grant access to more people than may be necessary. A good default is `0o644` which gives read and write access to yourself and read access to everyone else. [confidence medium]","path":"hooks/subagent-state-tracker.py","line":62,"fingerprint":"python.lang.security.audit.insecure-file-permissions:hooks/subagent-state-tracker.py:62"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/jev-auto-compact/hooks/redact.mjs","line":21,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/jev-auto-compact/hooks/redact.mjs:21"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/jev-auto-compact/hooks/redact.mjs","line":21,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/jev-auto-compact/hooks/redact.mjs:21"},{"rule_id":"opengrep/javascript.lang.security.audit.unknown-value-with-script-tag","severity":"medium","message":"Cannot determine what 'file' is and it is used with a '<script>' tag. This could be susceptible to cross-site scripting (XSS). Ensure 'file' is not externally controlled, or sanitize this data. [confidence low]","path":"scripts/bench-frames.mjs","line":465,"fingerprint":"javascript.lang.security.audit.unknown-value-with-script-tag:scripts/bench-frames.mjs:465"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"scripts/bench-http.py","line":172,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:scripts/bench-http.py:172"},{"rule_id":"opengrep/python.lang.security.audit.regex_dos","severity":"medium","message":"Detected usage of re.compile with an inefficient regular expression. This can lead to regular expression denial of service, which can result in service down time. Instead, check all regexes or use safer alternatives such as pyre2. [confidence low]","path":"scripts/check-index-colocation.py","line":44,"fingerprint":"python.lang.security.audit.regex_dos:scripts/check-index-colocation.py:44"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"scripts/github-api-fetcher.py","line":44,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:scripts/github-api-fetcher.py:44"},{"rule_id":"opengrep/python.lang.security.audit.non-literal-import","severity":"medium","message":"Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code. [confidence low]","path":"scripts/install-doctor.py","line":295,"fingerprint":"python.lang.security.audit.non-literal-import:scripts/install-doctor.py:295"},{"rule_id":"opengrep/python.lang.security.audit.regex_dos","severity":"medium","message":"Detected usage of re.compile with an inefficient regular expression. This can lead to regular expression denial of service, which can result in service down time. Instead, check all regexes or use safer alternatives such as pyre2. [confidence low]","path":"scripts/pre-route.py","line":46,"fingerprint":"python.lang.security.audit.regex_dos:scripts/pre-route.py:46"},{"rule_id":"opengrep/python.lang.security.insecure-hash-algorithm-md5","severity":"medium","message":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium]","path":"scripts/rules-distill.py","line":489,"fingerprint":"python.lang.security.insecure-hash-algorithm-md5:scripts/rules-distill.py:489"},{"rule_id":"opengrep/python.lang.security.audit.regex_dos","severity":"medium","message":"Detected usage of re.compile with an inefficient regular expression. This can lead to regular expression denial of service, which can result in service down time. Instead, check all regexes or use safer alternatives such as pyre2. [confidence low]","path":"scripts/validate-review-output.py","line":136,"fingerprint":"python.lang.security.audit.regex_dos:scripts/validate-review-output.py:136"},{"rule_id":"opengrep/python.lang.security.audit.regex_dos","severity":"medium","message":"Detected usage of re.compile with an inefficient regular expression. This can lead to regular expression denial of service, which can result in service down time. Instead, check all regexes or use safer alternatives such as pyre2. [confidence low]","path":"scripts/vexinstall/githooks.py","line":33,"fingerprint":"python.lang.security.audit.regex_dos:scripts/vexinstall/githooks.py:33"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"skills/analysis/assessment/scripts/check-cve-sources.py","line":152,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:skills/analysis/assessment/scripts/check-cve-sources.py:152"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"skills/content/content/scripts/publish/link_scanner.py","line":239,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:skills/content/content/scripts/publish/link_scanner.py:239"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"skills/content/content/scripts/publish/link_scanner.py","line":254,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:skills/content/content/scripts/publish/link_scanner.py:254"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"skills/content/content/scripts/publish/pagespeed.py","line":68,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:skills/content/content/scripts/publish/pagespeed.py:68"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"skills/game/game-dev/scripts/fal_queue_image_run.py","line":78,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:skills/game/game-dev/scripts/fal_queue_image_run.py:78"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"skills/game/game-dev/scripts/fal_queue_image_run.py","line":91,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:skills/game/game-dev/scripts/fal_queue_image_run.py:91"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `outputPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"skills/game/game-dev/scripts/meshy-generate.mjs","line":108,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:skills/game/game-dev/scripts/meshy-generate.mjs:108"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `outputPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"skills/game/game-dev/scripts/meshy-generate.mjs","line":111,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:skills/game/game-dev/scripts/meshy-generate.mjs:111"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `outputPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"skills/game/game-dev/scripts/meshy-generate.mjs","line":113,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:skills/game/game-dev/scripts/meshy-generate.mjs:113"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `outputPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"skills/game/game-dev/scripts/meshy-generate.mjs","line":113,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:skills/game/game-dev/scripts/meshy-generate.mjs:113"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `outputPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"skills/game/game-dev/scripts/meshy-generate.mjs","line":120,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:skills/game/game-dev/scripts/meshy-generate.mjs:120"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `args` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"skills/game/game-dev/scripts/meshy-generate.mjs","line":185,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:skills/game/game-dev/scripts/meshy-generate.mjs:185"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"skills/game/game-dev/scripts/meshy-generate.mjs","line":318,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:skills/game/game-dev/scripts/meshy-generate.mjs:318"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `inputPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"skills/game/game-dev/scripts/optimize-glb.mjs","line":39,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:skills/game/game-dev/scripts/optimize-glb.mjs:39"}],"evidence":[],"data":{"rulesets":["python","javascript","bash","typescript"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":3.0,"vulnerabilities":60.0,"vulns_critical":6.0,"vulns_high":34.0,"vulns_medium":18.0,"vulns_low":0.0,"vulns_unknown":2.0,"penalty":21.0},"findings":[{"rule_id":"osv/GHSA-5x8w-8jj5-q52h","severity":"critical","message":"pillow@10.0 (PyPI) is affected by PYSEC-2026-4330, GHSA-5x8w-8jj5-q52h","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-5x8w-8jj5-q52h"},{"rule_id":"osv/GHSA-8g5g-8vmr-9782","severity":"critical","message":"pillow@10.0 (PyPI) is affected by PYSEC-2026-4332, GHSA-8g5g-8vmr-9782","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-8g5g-8vmr-9782"},{"rule_id":"osv/GHSA-xvh5-g6gv-559v","severity":"critical","message":"pillow@10.0 (PyPI) is affected by PYSEC-2026-4363, GHSA-xvh5-g6gv-559v","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-xvh5-g6gv-559v"},{"rule_id":"osv/GHSA-3f63-hfp8-52jq","severity":"critical","message":"pillow@10.0 (PyPI) is affected by PYSEC-2026-457, GHSA-3f63-hfp8-52jq","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-3f63-hfp8-52jq"},{"rule_id":"osv/GHSA-332p-7hrc-92wf","severity":"critical","message":"pillow@10.0 (PyPI) is affected by GHSA-332p-7hrc-92wf","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-332p-7hrc-92wf"},{"rule_id":"osv/GHSA-w889-685w-c8fh","severity":"critical","message":"pillow@10.0 (PyPI) is affected by GHSA-w889-685w-c8fh","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-w889-685w-c8fh"},{"rule_id":"osv/GHSA-44wm-f244-xhp3","severity":"high","message":"pillow@10.0 (PyPI) is affected by PYSEC-2026-1793, GHSA-44wm-f244-xhp3","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-44wm-f244-xhp3"},{"rule_id":"osv/GHSA-j7hp-h8jx-5ppr","severity":"high","message":"pillow@10.0 (PyPI) is affected by PYSEC-2026-1794, GHSA-j7hp-h8jx-5ppr","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-j7hp-h8jx-5ppr"},{"rule_id":"osv/GHSA-8v84-f9pq-wr9x","severity":"high","message":"pillow@10.0 (PyPI) is affected by PYSEC-2026-2253, GHSA-8v84-f9pq-wr9x","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-8v84-f9pq-wr9x"},{"rule_id":"osv/GHSA-5x94-69rx-g8h2","severity":"high","message":"pillow@10.0 (PyPI) is affected by PYSEC-2026-2254, GHSA-5x94-69rx-g8h2","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-5x94-69rx-g8h2"},{"rule_id":"osv/GHSA-45hq-cxwh-f6vc","severity":"high","message":"pillow@10.0 (PyPI) is affected by PYSEC-2026-2255, GHSA-45hq-cxwh-f6vc","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-45hq-cxwh-f6vc"},{"rule_id":"osv/GHSA-phj9-mv4w-65pm","severity":"high","message":"pillow@10.0 (PyPI) is affected by PYSEC-2026-2256, GHSA-phj9-mv4w-65pm","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-phj9-mv4w-65pm"},{"rule_id":"osv/GHSA-6r8x-57c9-28j4","severity":"high","message":"pillow@10.0 (PyPI) is affected by PYSEC-2026-3451, GHSA-6r8x-57c9-28j4","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-6r8x-57c9-28j4"},{"rule_id":"osv/GHSA-9hw9-ch79-4vh6","severity":"high","message":"pillow@10.0 (PyPI) is affected by PYSEC-2026-3453, GHSA-9hw9-ch79-4vh6","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-9hw9-ch79-4vh6"},{"rule_id":"osv/GHSA-xj96-63gp-2gmr","severity":"high","message":"pillow@10.0 (PyPI) is affected by PYSEC-2026-3454, GHSA-xj96-63gp-2gmr","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-xj96-63gp-2gmr"},{"rule_id":"osv/GHSA-62p4-gmf7-7g93","severity":"high","message":"pillow@10.0 (PyPI) is affected by PYSEC-2026-3493, GHSA-62p4-gmf7-7g93","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-62p4-gmf7-7g93"},{"rule_id":"osv/GHSA-jjj6-mw9f-p565","severity":"high","message":"pillow@10.0 (PyPI) is affected by PYSEC-2026-3495, GHSA-jjj6-mw9f-p565","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-jjj6-mw9f-p565"},{"rule_id":"osv/GHSA-vjc4-5qp5-m44j","severity":"high","message":"pillow@10.0 (PyPI) is affected by PYSEC-2026-3496, GHSA-vjc4-5qp5-m44j","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-vjc4-5qp5-m44j"},{"rule_id":"osv/GHSA-27h8-gf7j-v5hc","severity":"high","message":"pillow@10.0 (PyPI) is affected by PYSEC-2026-4326, GHSA-27h8-gf7j-v5hc","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-27h8-gf7j-v5hc"},{"rule_id":"osv/GHSA-4558-3h8r-v8xp","severity":"high","message":"pillow@10.0 (PyPI) is affected by PYSEC-2026-4327, GHSA-4558-3h8r-v8xp","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-4558-3h8r-v8xp"},{"rule_id":"osv/GHSA-58r4-6rv3-gfh8","severity":"high","message":"pillow@10.0 (PyPI) is affected by PYSEC-2026-4329, GHSA-58r4-6rv3-gfh8","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-58r4-6rv3-gfh8"},{"rule_id":"osv/GHSA-7mwm-ghpf-9vrm","severity":"high","message":"pillow@10.0 (PyPI) is affected by PYSEC-2026-4331, GHSA-7mwm-ghpf-9vrm","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-7mwm-ghpf-9vrm"},{"rule_id":"osv/GHSA-pchr-8j38-3x4p","severity":"high","message":"pillow@10.0 (PyPI) is affected by PYSEC-2026-4334, GHSA-pchr-8j38-3x4p","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-pchr-8j38-3x4p"},{"rule_id":"osv/GHSA-xgh8-jp6q-p5x8","severity":"high","message":"pillow@10.0 (PyPI) is affected by PYSEC-2026-4335, GHSA-xgh8-jp6q-p5x8","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-xgh8-jp6q-p5x8"},{"rule_id":"osv/GHSA-g842-9rc4-69pw","severity":"high","message":"pillow@10.0 (PyPI) is affected by PYSEC-2026-4338, GHSA-g842-9rc4-69pw","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-g842-9rc4-69pw"},{"rule_id":"osv/GHSA-3j72-p6qg-6xp7","severity":"high","message":"pillow@10.0 (PyPI) is affected by PYSEC-2026-4341, GHSA-3j72-p6qg-6xp7","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-3j72-p6qg-6xp7"},{"rule_id":"osv/GHSA-9v9v-9qvf-h2hj","severity":"high","message":"pillow@10.0 (PyPI) is affected by PYSEC-2026-4343, GHSA-9v9v-9qvf-h2hj","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-9v9v-9qvf-h2hj"},{"rule_id":"osv/GHSA-22hg-r758-rrw9","severity":"high","message":"pillow@10.0 (PyPI) is affected by GHSA-22hg-r758-rrw9","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-22hg-r758-rrw9"},{"rule_id":"osv/GHSA-5xm2-6676-qcp9","severity":"high","message":"pillow@10.0 (PyPI) is affected by GHSA-5xm2-6676-qcp9","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-5xm2-6676-qcp9"},{"rule_id":"osv/GHSA-65qm-jvmh-6pqg","severity":"high","message":"pillow@10.0 (PyPI) is affected by GHSA-65qm-jvmh-6pqg","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-65qm-jvmh-6pqg"},{"rule_id":"osv/GHSA-c6hw-5grf-ff96","severity":"high","message":"pillow@10.0 (PyPI) is affected by GHSA-c6hw-5grf-ff96","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-c6hw-5grf-ff96"},{"rule_id":"osv/GHSA-f2g6-542v-9j58","severity":"high","message":"pillow@10.0 (PyPI) is affected by GHSA-f2g6-542v-9j58","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-f2g6-542v-9j58"},{"rule_id":"osv/GHSA-g7cr-3p24-7wf7","severity":"high","message":"pillow@10.0 (PyPI) is affected by GHSA-g7cr-3p24-7wf7","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-g7cr-3p24-7wf7"},{"rule_id":"osv/GHSA-gg2r-wvfm-q9rx","severity":"high","message":"pillow@10.0 (PyPI) is affected by GHSA-gg2r-wvfm-q9rx","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-gg2r-wvfm-q9rx"},{"rule_id":"osv/GHSA-j4m9-6w36-pw47","severity":"high","message":"pillow@10.0 (PyPI) is affected by GHSA-j4m9-6w36-pw47","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-j4m9-6w36-pw47"},{"rule_id":"osv/GHSA-jg86-v3jv-hrpm","severity":"high","message":"pillow@10.0 (PyPI) is affected by GHSA-jg86-v3jv-hrpm","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-jg86-v3jv-hrpm"},{"rule_id":"osv/GHSA-mrfp-p49p-3hf2","severity":"high","message":"pillow@10.0 (PyPI) is affected by GHSA-mrfp-p49p-3hf2","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-mrfp-p49p-3hf2"},{"rule_id":"osv/GHSA-p4wg-p73j-c528","severity":"high","message":"pillow@10.0 (PyPI) is affected by GHSA-p4wg-p73j-c528","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-p4wg-p73j-c528"},{"rule_id":"osv/GHSA-q45j-58j2-45rg","severity":"high","message":"pillow@10.0 (PyPI) is affected by GHSA-q45j-58j2-45rg","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-q45j-58j2-45rg"},{"rule_id":"osv/GHSA-xcvg-w56q-r89m","severity":"high","message":"pillow@10.0 (PyPI) is affected by GHSA-xcvg-w56q-r89m","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-xcvg-w56q-r89m"},{"rule_id":"osv/PYSEC-2023-175","severity":"medium","message":"pillow@10.0 (PyPI) is affected by PYSEC-2023-175","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):PYSEC-2023-175"},{"rule_id":"osv/GHSA-wjx4-4jcj-g98j","severity":"medium","message":"pillow@10.0 (PyPI) is affected by PYSEC-2026-165, GHSA-wjx4-4jcj-g98j","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-wjx4-4jcj-g98j"},{"rule_id":"osv/GHSA-4x4j-2g7c-83w6","severity":"medium","message":"pillow@10.0 (PyPI) is affected by PYSEC-2026-2257, GHSA-4x4j-2g7c-83w6","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-4x4j-2g7c-83w6"},{"rule_id":"osv/GHSA-r73j-pqj5-w3x7","severity":"medium","message":"pillow@10.0 (PyPI) is affected by PYSEC-2026-2874, GHSA-r73j-pqj5-w3x7","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-r73j-pqj5-w3x7"},{"rule_id":"osv/GHSA-fj7v-r99m-22gq","severity":"medium","message":"pillow@10.0 (PyPI) is affected by PYSEC-2026-3494, GHSA-fj7v-r99m-22gq","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-fj7v-r99m-22gq"},{"rule_id":"osv/GHSA-p8hx-v2p6-rp84","severity":"medium","message":"pillow@10.0 (PyPI) is affected by PYSEC-2026-4337, GHSA-p8hx-v2p6-rp84","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-p8hx-v2p6-rp84"},{"rule_id":"osv/GHSA-4rm8-3hmm-39fg","severity":"medium","message":"pillow@10.0 (PyPI) is affected by PYSEC-2026-4340, GHSA-4rm8-3hmm-39fg","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-4rm8-3hmm-39fg"},{"rule_id":"osv/GHSA-24rc-8hj2-v98c","severity":"medium","message":"pillow@10.0 (PyPI) is affected by GHSA-24rc-8hj2-v98c","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-24rc-8hj2-v98c"},{"rule_id":"osv/GHSA-254f-3936-288h","severity":"medium","message":"pillow@10.0 (PyPI) is affected by GHSA-254f-3936-288h","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-254f-3936-288h"},{"rule_id":"osv/GHSA-462x-pgg6-55fp","severity":"medium","message":"pillow@10.0 (PyPI) is affected by GHSA-462x-pgg6-55fp","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-462x-pgg6-55fp"},{"rule_id":"osv/GHSA-74r2-7ff9-mjj2","severity":"medium","message":"pillow@10.0 (PyPI) is affected by GHSA-74r2-7ff9-mjj2","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-74r2-7ff9-mjj2"},{"rule_id":"osv/GHSA-fc9g-5qg7-mf45","severity":"medium","message":"pillow@10.0 (PyPI) is affected by GHSA-fc9g-5qg7-mf45","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-fc9g-5qg7-mf45"},{"rule_id":"osv/GHSA-rfgq-q3w2-pmv2","severity":"medium","message":"pillow@10.0 (PyPI) is affected by GHSA-rfgq-q3w2-pmv2","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-rfgq-q3w2-pmv2"},{"rule_id":"osv/GHSA-vx6w-vv9f-6gvg","severity":"medium","message":"pillow@10.0 (PyPI) is affected by GHSA-vx6w-vv9f-6gvg","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-vx6w-vv9f-6gvg"},{"rule_id":"osv/GHSA-wqgw-9xfh-qf2g","severity":"medium","message":"pillow@10.0 (PyPI) is affected by GHSA-wqgw-9xfh-qf2g","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0 (PyPI):GHSA-wqgw-9xfh-qf2g"},{"rule_id":"osv/GHSA-mf9w-mj56-hr94","severity":"medium","message":"python-dotenv@1.0 (PyPI) is affected by PYSEC-2026-2270, GHSA-mf9w-mj56-hr94","path":"requirements.txt","line":null,"fingerprint":"python-dotenv@1.0 (PyPI):GHSA-mf9w-mj56-hr94"},{"rule_id":"osv/GHSA-9hjg-9r4m-mvj7","severity":"medium","message":"requests@2.28 (PyPI) is affected by PYSEC-2026-1872, GHSA-9hjg-9r4m-mvj7","path":"requirements.txt","line":null,"fingerprint":"requests@2.28 (PyPI):GHSA-9hjg-9r4m-mvj7"},{"rule_id":"osv/GHSA-9wx4-h78v-vm56","severity":"medium","message":"requests@2.28 (PyPI) is affected by PYSEC-2026-1873, GHSA-9wx4-h78v-vm56","path":"requirements.txt","line":null,"fingerprint":"requests@2.28 (PyPI):GHSA-9wx4-h78v-vm56"},{"rule_id":"osv/GHSA-gc5v-m9x4-r6x2","severity":"medium","message":"requests@2.28 (PyPI) is affected by PYSEC-2026-2275, GHSA-gc5v-m9x4-r6x2","path":"requirements.txt","line":null,"fingerprint":"requests@2.28 (PyPI):GHSA-gc5v-m9x4-r6x2"},{"rule_id":"osv/GHSA-j8r2-6x86-q33q","severity":"medium","message":"requests@2.28 (PyPI) is affected by GHSA-j8r2-6x86-q33q","path":"requirements.txt","line":null,"fingerprint":"requests@2.28 (PyPI):GHSA-j8r2-6x86-q33q"}],"evidence":[],"data":{"ecosystems":["PyPI","npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":3.0,"findings":51.0,"findings_high":26.0,"findings_medium":12.0,"findings_low":13.0,"penalty":339.9},"findings":[{"rule_id":"zizmor/dangerous-triggers","severity":"high","message":"use of fundamentally insecure workflow trigger [confidence medium]","path":".github/workflows/claude.yml","line":4,"fingerprint":"dangerous-triggers:.github/workflows/claude.yml:4"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/claude.yml","line":36,"fingerprint":"unpinned-uses:.github/workflows/claude.yml:36"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/pr-ai-review.yml","line":43,"fingerprint":"unpinned-uses:.github/workflows/pr-ai-review.yml:43"},{"rule_id":"zizmor/template-injection","severity":"high","message":"code injection via template expansion [confidence high]","path":".github/workflows/test.yml","line":222,"fingerprint":"template-injection:.github/workflows/test.yml:222"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":17,"fingerprint":"unpinned-uses:.github/workflows/test.yml:17"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":18,"fingerprint":"unpinned-uses:.github/workflows/test.yml:18"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":96,"fingerprint":"unpinned-uses:.github/workflows/test.yml:96"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":97,"fingerprint":"unpinned-uses:.github/workflows/test.yml:97"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":119,"fingerprint":"unpinned-uses:.github/workflows/test.yml:119"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":120,"fingerprint":"unpinned-uses:.github/workflows/test.yml:120"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":133,"fingerprint":"unpinned-uses:.github/workflows/test.yml:133"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":134,"fingerprint":"unpinned-uses:.github/workflows/test.yml:134"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":145,"fingerprint":"unpinned-uses:.github/workflows/test.yml:145"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":146,"fingerprint":"unpinned-uses:.github/workflows/test.yml:146"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":157,"fingerprint":"unpinned-uses:.github/workflows/test.yml:157"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":158,"fingerprint":"unpinned-uses:.github/workflows/test.yml:158"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":169,"fingerprint":"unpinned-uses:.github/workflows/test.yml:169"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":170,"fingerprint":"unpinned-uses:.github/workflows/test.yml:170"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":180,"fingerprint":"unpinned-uses:.github/workflows/test.yml:180"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":181,"fingerprint":"unpinned-uses:.github/workflows/test.yml:181"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":211,"fingerprint":"unpinned-uses:.github/workflows/test.yml:211"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":214,"fingerprint":"unpinned-uses:.github/workflows/test.yml:214"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":237,"fingerprint":"unpinned-uses:.github/workflows/test.yml:237"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":238,"fingerprint":"unpinned-uses:.github/workflows/test.yml:238"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":252,"fingerprint":"unpinned-uses:.github/workflows/test.yml:252"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":255,"fingerprint":"unpinned-uses:.github/workflows/test.yml:255"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/test.yml","line":1,"fingerprint":"excessive-permissions:.github/workflows/test.yml:1"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/test.yml","line":14,"fingerprint":"excessive-permissions:.github/workflows/test.yml:14"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/test.yml","line":90,"fingerprint":"excessive-permissions:.github/workflows/test.yml:90"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/test.yml","line":109,"fingerprint":"excessive-permissions:.github/workflows/test.yml:109"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/test.yml","line":130,"fingerprint":"excessive-permissions:.github/workflows/test.yml:130"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/test.yml","line":142,"fingerprint":"excessive-permissions:.github/workflows/test.yml:142"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/test.yml","line":154,"fingerprint":"excessive-permissions:.github/workflows/test.yml:154"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/test.yml","line":166,"fingerprint":"excessive-permissions:.github/workflows/test.yml:166"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/test.yml","line":177,"fingerprint":"excessive-permissions:.github/workflows/test.yml:177"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/test.yml","line":206,"fingerprint":"excessive-permissions:.github/workflows/test.yml:206"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/test.yml","line":232,"fingerprint":"excessive-permissions:.github/workflows/test.yml:232"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/test.yml","line":246,"fingerprint":"excessive-permissions:.github/workflows/test.yml:246"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/claude.yml","line":35,"fingerprint":"artipacked:.github/workflows/claude.yml:35"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/pr-ai-review.yml","line":42,"fingerprint":"artipacked:.github/workflows/pr-ai-review.yml:42"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/test.yml","line":17,"fingerprint":"artipacked:.github/workflows/test.yml:17"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/test.yml","line":96,"fingerprint":"artipacked:.github/workflows/test.yml:96"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/test.yml","line":119,"fingerprint":"artipacked:.github/workflows/test.yml:119"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/test.yml","line":133,"fingerprint":"artipacked:.github/workflows/test.yml:133"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/test.yml","line":145,"fingerprint":"artipacked:.github/workflows/test.yml:145"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/test.yml","line":157,"fingerprint":"artipacked:.github/workflows/test.yml:157"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/test.yml","line":169,"fingerprint":"artipacked:.github/workflows/test.yml:169"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/test.yml","line":180,"fingerprint":"artipacked:.github/workflows/test.yml:180"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/test.yml","line":211,"fingerprint":"artipacked:.github/workflows/test.yml:211"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/test.yml","line":237,"fingerprint":"artipacked:.github/workflows/test.yml:237"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/test.yml","line":252,"fingerprint":"artipacked:.github/workflows/test.yml:252"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":0.0,"signed_commit_share":0.155,"unpinned_manifests":1.0},"findings":[],"evidence":[{"kind":"posture","description":"plugins/custom-panel/package.json has no lockfile alongside it (unpinned dependencies)","ref":"plugins/custom-panel/package.json","url":null,"weight":0.3}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":4944.0,"function_nloc":96590.0,"mean_ccn":6.07,"p90_ccn":13.0,"complex_functions":320.0,"long_functions":68.0,"many_param_functions":60.0,"risky_nloc_share":0.2699},"findings":[],"evidence":[{"kind":"complex-function","description":"validate in scripts/validate-gm-governance.py: complexity 135, 220 lines","ref":"scripts/validate-gm-governance.py","url":"https://github.com/notque/vexjoy-agent/blob/871f649901b317d675e63f2dcce2b6515e046230/scripts/validate-gm-governance.py#L39","weight":1.0},{"kind":"complex-function","description":"_derive_rules in skills/analysis/assessment/scripts/cartographer_omni.py: complexity 117, 732 lines","ref":"skills/analysis/assessment/scripts/cartographer_omni.py","url":"https://github.com/notque/vexjoy-agent/blob/871f649901b317d675e63f2dcce2b6515e046230/skills/analysis/assessment/scripts/cartographer_omni.py#L904","weight":1.0},{"kind":"complex-function","description":"run in scripts/jev-browser-agent.py: complexity 115, 525 lines","ref":"scripts/jev-browser-agent.py","url":"https://github.com/notque/vexjoy-agent/blob/871f649901b317d675e63f2dcce2b6515e046230/scripts/jev-browser-agent.py#L642","weight":1.0},{"kind":"complex-function","description":"plan_target in scripts/vexinstall/plan.py: complexity 98, 185 lines","ref":"scripts/vexinstall/plan.py","url":"https://github.com/notque/vexjoy-agent/blob/871f649901b317d675e63f2dcce2b6515e046230/scripts/vexinstall/plan.py#L346","weight":1.0},{"kind":"complex-function","description":"_apply_locked in scripts/vexinstall/apply.py: complexity 79, 172 lines","ref":"scripts/vexinstall/apply.py","url":"https://github.com/notque/vexjoy-agent/blob/871f649901b317d675e63f2dcce2b6515e046230/scripts/vexinstall/apply.py#L414","weight":1.0},{"kind":"complex-function","description":"_destructive_git_operation in hooks/pretool-unified-gate.py: complexity 78, 108 lines","ref":"hooks/pretool-unified-gate.py","url":"https://github.com/notque/vexjoy-agent/blob/871f649901b317d675e63f2dcce2b6515e046230/hooks/pretool-unified-gate.py#L652","weight":1.0},{"kind":"complex-function","description":"run_optimization_loop in skills/meta/toolkit/scripts/agent-comparison/optimize_loop.py: complexity 77, 503 lines","ref":"skills/meta/toolkit/scripts/agent-comparison/optimize_loop.py","url":"https://github.com/notque/vexjoy-agent/blob/871f649901b317d675e63f2dcce2b6515e046230/skills/meta/toolkit/scripts/agent-comparison/optimize_loop.py#L1609","weight":1.0},{"kind":"complex-function","description":"main in hooks/routing-outcome-finalizer.py: complexity 63, 140 lines","ref":"hooks/routing-outcome-finalizer.py","url":"https://github.com/notque/vexjoy-agent/blob/871f649901b317d675e63f2dcce2b6515e046230/hooks/routing-outcome-finalizer.py#L425","weight":1.0},{"kind":"complex-function","description":"main in scripts/generate-skill-index.py: complexity 58, 195 lines","ref":"scripts/generate-skill-index.py","url":"https://github.com/notque/vexjoy-agent/blob/871f649901b317d675e63f2dcce2b6515e046230/scripts/generate-skill-index.py#L592","weight":0.9666666666666667},{"kind":"complex-function","description":"translate_child_result in hooks/agy-hook-adapter.py: complexity 55, 83 lines","ref":"hooks/agy-hook-adapter.py","url":"https://github.com/notque/vexjoy-agent/blob/871f649901b317d675e63f2dcce2b6515e046230/hooks/agy-hook-adapter.py#L547","weight":0.9166666666666666}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":132441.0,"duplicated_lines":10751.0,"duplicated_share":0.0812,"files":493.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: hooks/adr-enforcement.py:18 and hooks/adr-lifecycle-on-merge.py:22","ref":"hooks/adr-enforcement.py","url":"https://github.com/notque/vexjoy-agent/blob/871f649901b317d675e63f2dcce2b6515e046230/hooks/adr-enforcement.py#L18","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: hooks/adr-enforcement.py:28 and hooks/cross-repo-agents.py:29","ref":"hooks/adr-enforcement.py","url":"https://github.com/notque/vexjoy-agent/blob/871f649901b317d675e63f2dcce2b6515e046230/hooks/adr-enforcement.py#L28","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: hooks/adr-lifecycle-on-merge.py:32 and hooks/codex-auto-review.py:43","ref":"hooks/adr-lifecycle-on-merge.py","url":"https://github.com/notque/vexjoy-agent/blob/871f649901b317d675e63f2dcce2b6515e046230/hooks/adr-lifecycle-on-merge.py#L32","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: hooks/adr-lifecycle-on-merge.py:323 and hooks/creation-protocol-enforcer.py:162","ref":"hooks/adr-lifecycle-on-merge.py","url":"https://github.com/notque/vexjoy-agent/blob/871f649901b317d675e63f2dcce2b6515e046230/hooks/adr-lifecycle-on-merge.py#L323","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: hooks/agy-hook-adapter.py:29 and hooks/codex-hook-adapter.py:17","ref":"hooks/agy-hook-adapter.py","url":"https://github.com/notque/vexjoy-agent/blob/871f649901b317d675e63f2dcce2b6515e046230/hooks/agy-hook-adapter.py#L29","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: hooks/agy-hook-adapter.py:146 and hooks/posttool-session-reads.py:177","ref":"hooks/agy-hook-adapter.py","url":"https://github.com/notque/vexjoy-agent/blob/871f649901b317d675e63f2dcce2b6515e046230/hooks/agy-hook-adapter.py#L146","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: hooks/agy-hook-adapter.py:608 and hooks/agy-hook-adapter.py:621","ref":"hooks/agy-hook-adapter.py","url":"https://github.com/notque/vexjoy-agent/blob/871f649901b317d675e63f2dcce2b6515e046230/hooks/agy-hook-adapter.py#L608","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: hooks/ci-merge-gate.py:12 and hooks/pipeline-phase-gate.py:54","ref":"hooks/ci-merge-gate.py","url":"https://github.com/notque/vexjoy-agent/blob/871f649901b317d675e63f2dcce2b6515e046230/hooks/ci-merge-gate.py#L12","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: hooks/ci-merge-gate.py:203 and hooks/ci-merge-gate.py:222","ref":"hooks/ci-merge-gate.py","url":"https://github.com/notque/vexjoy-agent/blob/871f649901b317d675e63f2dcce2b6515e046230/hooks/ci-merge-gate.py#L203","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: hooks/ci-merge-gate.py:244 and hooks/hook-version-parity-check.py:156","ref":"hooks/ci-merge-gate.py","url":"https://github.com/notque/vexjoy-agent/blob/871f649901b317d675e63f2dcce2b6515e046230/hooks/ci-merge-gate.py#L244","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":276.0,"weighted_findings":237.0,"scanned_lines":171998.0,"category:best-practice":68.0,"category:correctness":170.0,"category:maintainability":38.0},"findings":[{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"hooks/agy-hook-adapter.py","line":174,"fingerprint":"python.lang.best-practice.arbitrary-sleep:hooks/agy-hook-adapter.py:174"},{"rule_id":"opengrep/python.lang.correctness.tempfile.tempfile-without-flush","severity":"high","message":"Using 'tmp.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'tmp.name' is used. Use '.flush()' or close the file before using 'tmp.name'.","path":"hooks/jev-route-injector-userprompt.py","line":127,"fingerprint":"python.lang.correctness.tempfile.tempfile-without-flush:hooks/jev-route-injector-userprompt.py:127"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"hooks/posttool-session-reads.py","line":204,"fingerprint":"python.lang.best-practice.arbitrary-sleep:hooks/posttool-session-reads.py:204"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"hooks/session-task-registry.py","line":112,"fingerprint":"python.lang.best-practice.arbitrary-sleep:hooks/session-task-registry.py:112"},{"rule_id":"opengrep/python.lang.correctness.tempfile.tempfile-without-flush","severity":"high","message":"Using 'f.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'f.name' is used. Use '.flush()' or close the file before using 'f.name'.","path":"scripts/crontab-manager.py","line":112,"fingerprint":"python.lang.correctness.tempfile.tempfile-without-flush:scripts/crontab-manager.py:112"},{"rule_id":"opengrep/python.lang.correctness.tempfile.tempfile-without-flush","severity":"high","message":"Using 'fh.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'fh.name' is used. Use '.flush()' or close the file before using 'fh.name'.","path":"scripts/d_route_model.py","line":61,"fingerprint":"python.lang.correctness.tempfile.tempfile-without-flush:scripts/d_route_model.py:61"},{"rule_id":"opengrep/python.lang.correctness.tempfile.tempfile-without-flush","severity":"high","message":"Using 'fh.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'fh.name' is used. Use '.flush()' or close the file before using 'fh.name'.","path":"scripts/d_route_model.py","line":87,"fingerprint":"python.lang.correctness.tempfile.tempfile-without-flush:scripts/d_route_model.py:87"},{"rule_id":"opengrep/python.lang.best-practice.open-never-closed","severity":"high","message":"file object opened without corresponding close","path":"scripts/jev-browser-agent.py","line":124,"fingerprint":"python.lang.best-practice.open-never-closed:scripts/jev-browser-agent.py:124"},{"rule_id":"opengrep/python.lang.correctness.tempfile.tempfile-without-flush","severity":"high","message":"Using 'tmp.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'tmp.name' is used. Use '.flush()' or close the file before using 'tmp.name'.","path":"scripts/jev-route.py","line":228,"fingerprint":"python.lang.correctness.tempfile.tempfile-without-flush:scripts/jev-route.py:228"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"scripts/jev-size-probe.py","line":111,"fingerprint":"python.lang.best-practice.arbitrary-sleep:scripts/jev-size-probe.py:111"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"scripts/jev_router_common.py","line":810,"fingerprint":"python.lang.best-practice.arbitrary-sleep:scripts/jev_router_common.py:810"},{"rule_id":"opengrep/python.lang.correctness.tempfile.tempfile-without-flush","severity":"high","message":"Using 'fh.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'fh.name' is used. Use '.flush()' or close the file before using 'fh.name'.","path":"scripts/router_attachment/run_eval.py","line":163,"fingerprint":"python.lang.correctness.tempfile.tempfile-without-flush:scripts/router_attachment/run_eval.py:163"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"scripts/search-engine-bulk-indexer.py","line":250,"fingerprint":"python.lang.best-practice.arbitrary-sleep:scripts/search-engine-bulk-indexer.py:250"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"scripts/search-engine-bulk-indexer.py","line":278,"fingerprint":"python.lang.best-practice.arbitrary-sleep:scripts/search-engine-bulk-indexer.py:278"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"scripts/validate-hook-health.py","line":788,"fingerprint":"python.lang.best-practice.arbitrary-sleep:scripts/validate-hook-health.py:788"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"scripts/vexinstall/lock.py","line":66,"fingerprint":"python.lang.best-practice.arbitrary-sleep:scripts/vexinstall/lock.py:66"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"skills/content/content/scripts/publish/pagespeed.py","line":76,"fingerprint":"python.lang.best-practice.arbitrary-sleep:skills/content/content/scripts/publish/pagespeed.py:76"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"skills/content/image-gen/scripts/generate_image.py","line":266,"fingerprint":"python.lang.best-practice.arbitrary-sleep:skills/content/image-gen/scripts/generate_image.py:266"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"skills/game/game-dev/scripts/fal_queue_image_run.py","line":183,"fingerprint":"python.lang.best-practice.arbitrary-sleep:skills/game/game-dev/scripts/fal_queue_image_run.py:183"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"skills/game/game-dev/scripts/with_server.py","line":63,"fingerprint":"python.lang.best-practice.arbitrary-sleep:skills/game/game-dev/scripts/with_server.py:63"},{"rule_id":"opengrep/python.lang.correctness.tempfile.tempfile-without-flush","severity":"high","message":"Using 'f.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'f.name' is used. Use '.flush()' or close the file before using 'f.name'.","path":"skills/meta/toolkit/scripts/agent-comparison/optimize_loop.py","line":681,"fingerprint":"python.lang.correctness.tempfile.tempfile-without-flush:skills/meta/toolkit/scripts/agent-comparison/optimize_loop.py:681"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"hooks/adr-enforcement.py","line":115,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:hooks/adr-enforcement.py:115"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"hooks/no-agent-summary/no-agent-summary.js","line":106,"fingerprint":"javascript.lang.best-practice.lazy-load-module:hooks/no-agent-summary/no-agent-summary.js:106"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"hooks/precompact-archive.py","line":69,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:hooks/precompact-archive.py:69"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"hooks/pretool-section-integrity-validator.py","line":62,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:hooks/pretool-section-integrity-validator.py:62"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"hooks/pretool-unified-gate.py","line":2832,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:hooks/pretool-unified-gate.py:2832"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"hooks/pretool-unified-gate.py","line":2837,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:hooks/pretool-unified-gate.py:2837"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"hooks/pretool-unified-gate.py","line":2848,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:hooks/pretool-unified-gate.py:2848"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"hooks/pretool-unified-gate.py","line":2855,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:hooks/pretool-unified-gate.py:2855"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"hooks/pretool-unified-gate.py","line":2981,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:hooks/pretool-unified-gate.py:2981"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"hooks/pretool-unified-gate.py","line":2989,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:hooks/pretool-unified-gate.py:2989"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"hooks/pretool-unified-gate.py","line":2997,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:hooks/pretool-unified-gate.py:2997"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"hooks/pretool-unified-gate.py","line":3001,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:hooks/pretool-unified-gate.py:3001"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"hooks/pretool-unified-gate.py","line":3009,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:hooks/pretool-unified-gate.py:3009"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"hooks/pretool-unified-gate.py","line":3016,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:hooks/pretool-unified-gate.py:3016"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"hooks/pretool-unified-gate.py","line":3029,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:hooks/pretool-unified-gate.py:3029"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"hooks/pretool-unified-gate.py","line":3034,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:hooks/pretool-unified-gate.py:3034"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"hooks/pretool-unified-gate.py","line":3043,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:hooks/pretool-unified-gate.py:3043"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"hooks/pretool-unified-gate.py","line":3050,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:hooks/pretool-unified-gate.py:3050"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"hooks/pretool-unified-gate.py","line":3055,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:hooks/pretool-unified-gate.py:3055"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"hooks/pretool-unified-gate.py","line":3062,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:hooks/pretool-unified-gate.py:3062"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"hooks/pretool-unified-gate.py","line":3067,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:hooks/pretool-unified-gate.py:3067"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"hooks/pretool-unified-gate.py","line":3241,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:hooks/pretool-unified-gate.py:3241"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"hooks/pretool-unified-gate.py","line":3244,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:hooks/pretool-unified-gate.py:3244"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"hooks/pretool-unified-gate.py","line":3250,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:hooks/pretool-unified-gate.py:3250"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"hooks/pretool-unified-gate.py","line":3256,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:hooks/pretool-unified-gate.py:3256"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"hooks/pretool-unified-gate.py","line":3266,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:hooks/pretool-unified-gate.py:3266"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"hooks/pretool-unified-gate.py","line":3272,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:hooks/pretool-unified-gate.py:3272"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"hooks/pretool-unified-gate.py","line":3278,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:hooks/pretool-unified-gate.py:3278"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"hooks/pretool-unified-gate.py","line":3286,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:hooks/pretool-unified-gate.py:3286"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"hooks/pretool-unified-gate.py","line":3292,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:hooks/pretool-unified-gate.py:3292"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"hooks/pretool-unified-gate.py","line":3299,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:hooks/pretool-unified-gate.py:3299"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"hooks/session-no-agent-summary-check.py","line":77,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:hooks/session-no-agent-summary-check.py:77"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"hooks/session-task-registry.py","line":219,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:hooks/session-task-registry.py:219"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"hooks/stop-failure-handler.py","line":53,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:hooks/stop-failure-handler.py:53"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"hooks/suggest-compact.py","line":103,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:hooks/suggest-compact.py:103"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"plugins/jev-auto-compact/hooks/jev-auto-compact.mjs","line":612,"fingerprint":"javascript.lang.correctness.no-stringify-keys:plugins/jev-auto-compact/hooks/jev-auto-compact.mjs:612"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"scripts/adr-decision-coverage.py","line":474,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:scripts/adr-decision-coverage.py:474"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_loopback\" a function or an attribute? If it is a function, you may have meant ipaddress.ip_address(host).is_loopback() because ipaddress.ip_address(host).is_loopback is always true.","path":"scripts/bench-http.py","line":108,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:scripts/bench-http.py:108"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_loopback\" a function or an attribute? If it is a function, you may have meant ipaddress.ip_address(info[4][0]).is_loopback() because ipaddress.ip_address(info[4][0]).is_loopback is always true.","path":"scripts/bench-http.py","line":115,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:scripts/bench-http.py:115"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_sensitive_path\" a function or an attribute? If it is a function, you may have meant module.is_sensitive_path() because module.is_sensitive_path is always true.","path":"scripts/build-dispatch.py","line":1060,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:scripts/build-dispatch.py:1060"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"scripts/check-scope-overlap.py","line":380,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:scripts/check-scope-overlap.py:380"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"scripts/disprove-findings.py","line":88,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:scripts/disprove-findings.py:88"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"scripts/feature-state.py","line":121,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:scripts/feature-state.py:121"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"scripts/feature-state.py","line":532,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:scripts/feature-state.py:532"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"scripts/feature-state.py","line":620,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:scripts/feature-state.py:620"},{"rule_id":"opengrep/python.lang.correctness.use-sys-exit","severity":"medium","message":"Detected use of `exit`. Use `sys.exit` over the python shell `exit` built-in. `exit` is a helper for the interactive shell and may not be available on all Python implementations.","path":"scripts/generate-agent-index.py","line":283,"fingerprint":"python.lang.correctness.use-sys-exit:scripts/generate-agent-index.py:283"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"scripts/github-api-fetcher.py","line":189,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:scripts/github-api-fetcher.py:189"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"scripts/github-api-fetcher.py","line":344,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:scripts/github-api-fetcher.py:344"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"scripts/github-api-fetcher.py","line":436,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:scripts/github-api-fetcher.py:436"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"scripts/install-doctor.py","line":77,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:scripts/install-doctor.py:77"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"scripts/install-doctor.py","line":181,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:scripts/install-doctor.py:181"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"scripts/install-doctor.py","line":596,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:scripts/install-doctor.py:596"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"scripts/install-doctor.py","line":607,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:scripts/install-doctor.py:607"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_loopback\" a function or an attribute? If it is a function, you may have meant ipaddress.ip_address(host).is_loopback() because ipaddress.ip_address(host).is_loopback is always true.","path":"scripts/jev-browser-agent.py","line":585,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:scripts/jev-browser-agent.py:585"},{"rule_id":"opengrep/python.lang.best-practice.manual-defaultdict-list-create","severity":"medium","message":"manually creating a defaultdict - use collections.defaultdict(list)","path":"scripts/jev-call-stats.py","line":32,"fingerprint":"python.lang.best-practice.manual-defaultdict-list-create:scripts/jev-call-stats.py:32"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"scripts/jev-eval-live.py","line":169,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:scripts/jev-eval-live.py:169"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_loopback\" a function or an attribute? If it is a function, you may have meant ipaddress.ip_address(host).is_loopback() because ipaddress.ip_address(host).is_loopback is always true.","path":"scripts/jev_alt_model.py","line":79,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:scripts/jev_alt_model.py:79"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"scripts/jev_images.py","line":396,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:scripts/jev_images.py:396"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"scripts/lib/jev_harness/__init__.py","line":82,"fingerprint":"python.lang.maintainability.return-not-in-function:scripts/lib/jev_harness/__init__.py:82"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"scripts/lib/jev_harness/__init__.py","line":86,"fingerprint":"python.lang.maintainability.return-not-in-function:scripts/lib/jev_harness/__init__.py:86"},{"rule_id":"opengrep/python.lang.best-practice.manual-defaultdict-list-create","severity":"medium","message":"manually creating a defaultdict - use collections.defaultdict(list)","path":"scripts/lib/jev_harness/__init__.py","line":942,"fingerprint":"python.lang.best-practice.manual-defaultdict-list-create:scripts/lib/jev_harness/__init__.py:942"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"scripts/motion-pipeline.py","line":191,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:scripts/motion-pipeline.py:191"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"scripts/nano-banana-generate.py","line":244,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:scripts/nano-banana-generate.py:244"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_stale\" a function or an attribute? If it is a function, you may have meant plan.is_stale() because plan.is_stale is always true.","path":"scripts/plan-manager.py","line":260,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:scripts/plan-manager.py:260"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_stale\" a function or an attribute? If it is a function, you may have meant plan.is_stale() because plan.is_stale is always true.","path":"scripts/plan-manager.py","line":271,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:scripts/plan-manager.py:271"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_stale\" a function or an attribute? If it is a function, you may have meant plan.is_stale() because plan.is_stale is always true.","path":"scripts/plan-manager.py","line":282,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:scripts/plan-manager.py:282"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_stale\" a function or an attribute? If it is a function, you may have meant plan.is_stale() because plan.is_stale is always true.","path":"scripts/plan-manager.py","line":558,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:scripts/plan-manager.py:558"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_stale\" a function or an attribute? If it is a function, you may have meant plan.is_stale() because plan.is_stale is always true.","path":"scripts/plan-manager.py","line":614,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:scripts/plan-manager.py:614"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_stale\" a function or an attribute? If it is a function, you may have meant plan.is_stale() because plan.is_stale is always true.","path":"scripts/plan-manager.py","line":718,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:scripts/plan-manager.py:718"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_stale\" a function or an attribute? If it is a function, you may have meant plan.is_stale() because plan.is_stale is always true.","path":"scripts/plan-manager.py","line":735,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:scripts/plan-manager.py:735"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_public\" a function or an attribute? If it is a function, you may have meant m.is_public() because m.is_public is always true.","path":"scripts/python-doc-verifier.py","line":67,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:scripts/python-doc-verifier.py:67"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_public\" a function or an attribute? If it is a function, you may have meant f.is_public() because f.is_public is always true.","path":"scripts/python-doc-verifier.py","line":88,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:scripts/python-doc-verifier.py:88"},{"rule_id":"opengrep/python.lang.maintainability.useless-if-body","severity":"medium","message":"Useless if statement; both blocks have the same body","path":"scripts/python-doc-verifier.py","line":224,"fingerprint":"python.lang.maintainability.useless-if-body:scripts/python-doc-verifier.py:224"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_method\" a function or an attribute? If it is a function, you may have meant func.is_method() because func.is_method is always true.","path":"scripts/python-doc-verifier.py","line":249,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:scripts/python-doc-verifier.py:249"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_async\" a function or an attribute? If it is a function, you may have meant f.is_async() because f.is_async is always true.","path":"scripts/python-doc-verifier.py","line":550,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:scripts/python-doc-verifier.py:550"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_private\" a function or an attribute? If it is a function, you may have meant f.is_private() because f.is_private is always true.","path":"scripts/python-doc-verifier.py","line":562,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:scripts/python-doc-verifier.py:562"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_dataclass\" a function or an attribute? If it is a function, you may have meant c.is_dataclass() because c.is_dataclass is always true.","path":"scripts/python-doc-verifier.py","line":569,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:scripts/python-doc-verifier.py:569"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_primary\" a function or an attribute? If it is a function, you may have meant a.is_primary() because a.is_primary is always true.","path":"scripts/research-stats-checkpoint.py","line":79,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:scripts/research-stats-checkpoint.py:79"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_primary\" a function or an attribute? If it is a function, you may have meant art.is_primary() because art.is_primary is always true.","path":"scripts/research-stats-checkpoint.py","line":222,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:scripts/research-stats-checkpoint.py:222"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"scripts/review-record.py","line":110,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:scripts/review-record.py:110"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"scripts/routing-ab-results/planning-unknowns-v1/gen-prompts.py","line":32,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:scripts/routing-ab-results/planning-unknowns-v1/gen-prompts.py:32"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"scripts/routing-ab-results/planning-unknowns-v1/gen-prompts.py","line":42,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:scripts/routing-ab-results/planning-unknowns-v1/gen-prompts.py:42"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"scripts/routing-ab-results/planning-unknowns-v1/gen-prompts.py","line":49,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:scripts/routing-ab-results/planning-unknowns-v1/gen-prompts.py:49"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"scripts/routing-ab-results/planning-unknowns-v1/gen-prompts.py","line":58,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:scripts/routing-ab-results/planning-unknowns-v1/gen-prompts.py:58"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"scripts/routing-ab-results/planning-unknowns-v1/gen-prompts.py","line":66,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:scripts/routing-ab-results/planning-unknowns-v1/gen-prompts.py:66"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"scripts/routing-ab-results/planning-unknowns-v1/gen-prompts.py","line":74,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:scripts/routing-ab-results/planning-unknowns-v1/gen-prompts.py:74"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"scripts/routing-ab-results/planning-unknowns-v2/gen-prompts.py","line":32,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:scripts/routing-ab-results/planning-unknowns-v2/gen-prompts.py:32"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"scripts/routing-ab-results/planning-unknowns-v2/gen-prompts.py","line":42,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:scripts/routing-ab-results/planning-unknowns-v2/gen-prompts.py:42"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"scripts/routing-ab-results/planning-unknowns-v2/gen-prompts.py","line":49,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:scripts/routing-ab-results/planning-unknowns-v2/gen-prompts.py:49"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"scripts/routing-ab-results/planning-unknowns-v2/gen-prompts.py","line":58,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:scripts/routing-ab-results/planning-unknowns-v2/gen-prompts.py:58"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"scripts/routing-ab-results/planning-unknowns-v2/gen-prompts.py","line":66,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:scripts/routing-ab-results/planning-unknowns-v2/gen-prompts.py:66"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"scripts/routing-ab-results/planning-unknowns-v2/gen-prompts.py","line":74,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:scripts/routing-ab-results/planning-unknowns-v2/gen-prompts.py:74"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"scripts/routing-ab-results/planning-unknowns-v2/gen-prompts.py","line":82,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:scripts/routing-ab-results/planning-unknowns-v2/gen-prompts.py:82"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"scripts/routing-ab-results/planning-unknowns-v2/gen-prompts.py","line":89,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:scripts/routing-ab-results/planning-unknowns-v2/gen-prompts.py:89"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"scripts/routing-ab-results/planning-unknowns-v2/gen-prompts.py","line":98,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:scripts/routing-ab-results/planning-unknowns-v2/gen-prompts.py:98"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"scripts/routing-ab-results/planning-unknowns-v2/gen-prompts.py","line":106,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:scripts/routing-ab-results/planning-unknowns-v2/gen-prompts.py:106"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"scripts/routing-ab-results/planning-unknowns-v2/gen-prompts.py","line":114,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:scripts/routing-ab-results/planning-unknowns-v2/gen-prompts.py:114"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"scripts/routing-ab-results/planning-unknowns-v2/gen-prompts.py","line":122,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:scripts/routing-ab-results/planning-unknowns-v2/gen-prompts.py:122"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"scripts/rules-compiler.py","line":62,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:scripts/rules-compiler.py:62"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"scripts/rules-compiler.py","line":67,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:scripts/rules-compiler.py:67"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"scripts/rules-compiler.py","line":73,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:scripts/rules-compiler.py:73"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"scripts/rules-compiler.py","line":78,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:scripts/rules-compiler.py:78"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"scripts/rules-compiler.py","line":322,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:scripts/rules-compiler.py:322"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"scripts/rules-compiler.py","line":367,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:scripts/rules-compiler.py:367"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"scripts/rules-compiler.py","line":390,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:scripts/rules-compiler.py:390"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"scripts/rules-compiler.py","line":407,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:scripts/rules-compiler.py:407"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"scripts/rules-compiler.py","line":426,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:scripts/rules-compiler.py:426"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"scripts/rules-compiler.py","line":436,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:scripts/rules-compiler.py:436"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"scripts/rules-compiler.py","line":443,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:scripts/rules-compiler.py:443"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"scripts/scan-ai-patterns.py","line":39,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:scripts/scan-ai-patterns.py:39"},{"rule_id":"opengrep/python.requests.best-practice.use-raise-for-status","severity":"medium","message":"There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a 500 error while you're only checking for a 401.","path":"scripts/search-engine-indexer.py","line":210,"fingerprint":"python.requests.best-practice.use-raise-for-status:scripts/search-engine-indexer.py:210"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"scripts/smoke-test-hooks.py","line":104,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:scripts/smoke-test-hooks.py:104"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_open\" a function or an attribute? If it is a function, you may have meant self.is_open() because self.is_open is always true.","path":"scripts/validate-doc-commands.py","line":214,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:scripts/validate-doc-commands.py:214"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_parent\" a function or an attribute? If it is a function, you may have meant parent.is_parent() because parent.is_parent is always true.","path":"scripts/validate-doc-commands.py","line":339,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:scripts/validate-doc-commands.py:339"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_open\" a function or an attribute? If it is a function, you may have meant spec.is_open() because spec.is_open is always true.","path":"scripts/validate-doc-commands.py","line":342,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:scripts/validate-doc-commands.py:342"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_child\" a function or an attribute? If it is a function, you may have meant child.is_child() because child.is_child is always true.","path":"scripts/validate-doc-commands.py","line":383,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:scripts/validate-doc-commands.py:383"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_open\" a function or an attribute? If it is a function, you may have meant target.is_open() because target.is_open is always true.","path":"scripts/validate-doc-commands.py","line":419,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:scripts/validate-doc-commands.py:419"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_open\" a function or an attribute? If it is a function, you may have meant value.is_open() because value.is_open is always true.","path":"scripts/validate-doc-commands.py","line":448,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:scripts/validate-doc-commands.py:448"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_child\" a function or an attribute? If it is a function, you may have meant spec.is_child() because spec.is_child is always true.","path":"scripts/validate-doc-commands.py","line":461,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:scripts/validate-doc-commands.py:461"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_parent\" a function or an attribute? If it is a function, you may have meant spec.is_parent() because spec.is_parent is always true.","path":"scripts/validate-doc-commands.py","line":461,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:scripts/validate-doc-commands.py:461"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_open\" a function or an attribute? If it is a function, you may have meant pool.is_open() because pool.is_open is always true.","path":"scripts/validate-doc-commands.py","line":482,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:scripts/validate-doc-commands.py:482"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"scripts/validate-hook-health.py","line":652,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:scripts/validate-hook-health.py:652"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"scripts/validate-references.py","line":666,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:scripts/validate-references.py:666"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_json\" a function or an attribute? If it is a function, you may have meant args.is_json() because args.is_json is always true.","path":"scripts/validate-review-output.py","line":1114,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:scripts/validate-review-output.py:1114"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_generated\" a function or an attribute? If it is a function, you may have meant transcript.is_generated() because transcript.is_generated is always true.","path":"scripts/video-transcript.py","line":159,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:scripts/video-transcript.py:159"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"scripts/voice-stylometry.py","line":161,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:scripts/voice-stylometry.py:161"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"scripts/voice-stylometry.py","line":326,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:scripts/voice-stylometry.py:326"},{"rule_id":"opengrep/python.requests.best-practice.use-raise-for-status","severity":"medium","message":"There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a 500 error while you're only checking for a 401.","path":"scripts/x-api-poster.py","line":374,"fingerprint":"python.requests.best-practice.use-raise-for-status:scripts/x-api-poster.py:374"},{"rule_id":"opengrep/python.requests.best-practice.use-timeout","severity":"medium","message":"Detected a 'requests' call without a timeout set. By default, 'requests' calls wait until the connection is closed. This means a 'requests' call without a timeout will hang the program if a response is never received. Consider setting a timeout for all 'requests'.","path":"scripts/x-api-poster.py","line":374,"fingerprint":"python.requests.best-practice.use-timeout:scripts/x-api-poster.py:374"},{"rule_id":"opengrep/python.requests.best-practice.use-raise-for-status","severity":"medium","message":"There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a 500 error while you're only checking for a 401.","path":"scripts/x-api-poster.py","line":387,"fingerprint":"python.requests.best-practice.use-raise-for-status:scripts/x-api-poster.py:387"},{"rule_id":"opengrep/python.requests.best-practice.use-timeout","severity":"medium","message":"Detected a 'requests' call without a timeout set. By default, 'requests' calls wait until the connection is closed. This means a 'requests' call without a timeout will hang the program if a response is never received. Consider setting a timeout for all 'requests'.","path":"scripts/x-api-poster.py","line":387,"fingerprint":"python.requests.best-practice.use-timeout:scripts/x-api-poster.py:387"},{"rule_id":"opengrep/python.requests.best-practice.use-raise-for-status","severity":"medium","message":"There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a 500 error while you're only checking for a 401.","path":"scripts/x-api-poster.py","line":429,"fingerprint":"python.requests.best-practice.use-raise-for-status:scripts/x-api-poster.py:429"},{"rule_id":"opengrep/python.requests.best-practice.use-timeout","severity":"medium","message":"Detected a 'requests' call without a timeout set. By default, 'requests' calls wait until the connection is closed. This means a 'requests' call without a timeout will hang the program if a response is never received. Consider setting a timeout for all 'requests'.","path":"scripts/x-api-poster.py","line":429,"fingerprint":"python.requests.best-practice.use-timeout:scripts/x-api-poster.py:429"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"skills/analysis/assessment/scripts/cartographer.py","line":327,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:skills/analysis/assessment/scripts/cartographer.py:327"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"skills/analysis/assessment/scripts/cartographer_omni.py","line":2104,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:skills/analysis/assessment/scripts/cartographer_omni.py:2104"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"skills/analysis/assessment/scripts/cartographer_ultimate.py","line":309,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:skills/analysis/assessment/scripts/cartographer_ultimate.py:309"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"skills/content/content/scripts/publish/wordpress-media-upload.py","line":44,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:skills/content/content/scripts/publish/wordpress-media-upload.py:44"},{"rule_id":"opengrep/python.requests.best-practice.use-raise-for-status","severity":"medium","message":"There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a 500 error while you're only checking for a 401.","path":"skills/content/content/scripts/publish/wordpress-scraper.py","line":60,"fingerprint":"python.requests.best-practice.use-raise-for-status:skills/content/content/scripts/publish/wordpress-scraper.py:60"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_suspended\" a function or an attribute? If it is a function, you may have meant self.is_suspended() because self.is_suspended is always true.","path":"skills/content/content/scripts/reddit-moderate/reddit-mod.py","line":349,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:skills/content/content/scripts/reddit-moderate/reddit-mod.py:349"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_suspended\" a function or an attribute? If it is a function, you may have meant self.is_suspended() because self.is_suspended is always true.","path":"skills/content/content/scripts/reddit-moderate/reddit-mod.py","line":374,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:skills/content/content/scripts/reddit-moderate/reddit-mod.py:374"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_highlighted\" a function or an attribute? If it is a function, you may have meant conv.is_highlighted() because conv.is_highlighted is always true.","path":"skills/content/content/scripts/reddit-moderate/reddit-mod.py","line":1667,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:skills/content/content/scripts/reddit-moderate/reddit-mod.py:1667"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"skills/content/image-gen/scripts/generate_image.py","line":231,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:skills/content/image-gen/scripts/generate_image.py:231"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"skills/content/image-gen/scripts/nano-banana-generate.py","line":244,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:skills/content/image-gen/scripts/nano-banana-generate.py:244"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"skills/frontend/frontend/scripts-html-artifact/pptx-bridge/_pptx_engine.py","line":909,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:skills/frontend/frontend/scripts-html-artifact/pptx-bridge/_pptx_engine.py:909"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"skills/frontend/frontend/scripts-html-artifact/pptx-bridge/_pptx_engine.py","line":911,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:skills/frontend/frontend/scripts-html-artifact/pptx-bridge/_pptx_engine.py:911"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"skills/game/game-dev/scripts/sprite_prompt.py","line":468,"fingerprint":"python.lang.maintainability.return-not-in-function:skills/game/game-dev/scripts/sprite_prompt.py:468"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"skills/process/pr-workflow/scripts/miner.py","line":231,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:skills/process/pr-workflow/scripts/miner.py:231"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":344,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:344"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/auto-dream-cron.sh","line":17,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/auto-dream-cron.sh:17"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/auto-dream-cron.sh","line":123,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/auto-dream-cron.sh:123"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/bench-frames.mjs","line":191,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/bench-frames.mjs:191"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/bench-frames.mjs","line":191,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/bench-frames.mjs:191"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/bench-frames.mjs","line":438,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/bench-frames.mjs:438"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/bench-frames.mjs","line":438,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/bench-frames.mjs:438"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/lib/jev_browser/cdp_driver.mjs","line":313,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/lib/jev_browser/cdp_driver.mjs:313"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/lib/jev_browser/cdp_driver.mjs","line":316,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/lib/jev_browser/cdp_driver.mjs:316"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/lib/jev_browser/cdp_driver.mjs","line":342,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/lib/jev_browser/cdp_driver.mjs:342"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/lib/jev_browser/cdp_driver.mjs","line":342,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/lib/jev_browser/cdp_driver.mjs:342"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/lib/jev_browser/cdp_driver.mjs","line":349,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/lib/jev_browser/cdp_driver.mjs:349"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/lib/jev_browser/cdp_driver.mjs","line":350,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/lib/jev_browser/cdp_driver.mjs:350"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/lib/jev_browser/cdp_driver.mjs","line":416,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/lib/jev_browser/cdp_driver.mjs:416"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/lib/jev_browser/cdp_driver.mjs","line":416,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/lib/jev_browser/cdp_driver.mjs:416"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/reference-enrichment-cron.sh","line":20,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/reference-enrichment-cron.sh:20"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/reference-enrichment-cron.sh","line":353,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/reference-enrichment-cron.sh:353"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/session-bootstrap.sh","line":38,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/session-bootstrap.sh:38"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/toolkit-evolution-cron.sh","line":17,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/toolkit-evolution-cron.sh:17"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/toolkit-evolution-cron.sh","line":139,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/toolkit-evolution-cron.sh:139"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"skills/content/content/scripts/reddit-moderate/reddit-automod-cron.sh","line":18,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:skills/content/content/scripts/reddit-moderate/reddit-automod-cron.sh:18"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"skills/content/content/scripts/reddit-moderate/reddit-automod-cron.sh","line":106,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:skills/content/content/scripts/reddit-moderate/reddit-automod-cron.sh:106"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"skills/kb/scripts/kb-compile-cron.sh","line":13,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:skills/kb/scripts/kb-compile-cron.sh:13"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"skills/kb/scripts/kb-compile-cron.sh","line":128,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:skills/kb/scripts/kb-compile-cron.sh:128"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"skills/programming/programming/scripts/bench-compare.sh","line":9,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:skills/programming/programming/scripts/bench-compare.sh:9"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"skills/programming/programming/scripts/bench-compare.sh","line":65,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:skills/programming/programming/scripts/bench-compare.sh:65"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"skills/programming/programming/scripts/bench-compare.sh","line":122,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:skills/programming/programming/scripts/bench-compare.sh:122"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"skills/programming/programming/scripts/bench-compare.sh","line":133,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:skills/programming/programming/scripts/bench-compare.sh:133"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"skills/programming/programming/scripts/bench-compare.sh","line":145,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:skills/programming/programming/scripts/bench-compare.sh:145"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"skills/programming/programming/scripts/bench-compare.sh","line":158,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:skills/programming/programming/scripts/bench-compare.sh:158"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"skills/programming/programming/scripts/bench-compare.sh","line":158,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:skills/programming/programming/scripts/bench-compare.sh:158"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"skills/programming/programming/scripts/bench-compare.sh","line":173,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:skills/programming/programming/scripts/bench-compare.sh:173"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":1.0,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":1.0,"check:tests_cochange":1.0,"test_lines":103543.0,"source_lines":171998.0,"test_ratio":0.602,"ci_files":3.0,"cochange_share":0.9038,"cochange_commits":208.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/claude.yml","ref":".github/workflows/claude.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/pr-ai-review.yml","ref":".github/workflows/pr-ai-review.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/test.yml","ref":".github/workflows/test.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (pytest)","ref":null,"url":null,"weight":0.0},{"kind":"ci","description":"CI runs linters (ruff)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["pytest"],"lint_commands":["ruff"]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":1.0,"check:changelog":0.0,"readme_lines":209.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0},{"kind":"docs","description":"CONTRIBUTING.md","ref":"CONTRIBUTING.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.0014,"check:low_escape_density":0.0,"escapes":868.0,"escapes_per_kloc":5.373},"findings":[],"evidence":[{"kind":"typing","description":"TypeScript strict type checking: plugins/custom-panel/tsconfig.json","ref":"plugins/custom-panel/tsconfig.json","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":14816.0,"other_lines":157182.0,"files_blamed":493.0,"blame_failures":0.0,"quality:ai_findings":22.0,"quality:ai_per_kloc":1.485,"quality:other_findings":178.0,"quality:other_per_kloc":1.132,"quality:ratio":1.31,"security:ai_findings":22.0,"security:ai_per_kloc":1.485,"security:other_findings":278.0,"security:other_per_kloc":1.769,"security:ratio":0.84},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":true},"error":null}],"flags":[]}