Leaderboard github.com

Leonxlnx/taste-skill

Agent skills that give coding agents taste: art direction, reference images and a browser check instead of generic AI pages

View repository ↗
JavaScript
★ 115,465
commit f6b76575f949
scored 2026-11-14
scoring prov-5+qual-2+sec-2

unreviewed-ai-risk

AI provenance

100%

explicit

Confidence: 95%
Coverage: 100%

Estimated share of AI-generated code. Explicit attribution is a lower bound.

Code quality

59/100

weak

Confidence: 90%
Coverage: 100%

Complexity, duplication, lint density, tests, CI, docs and review process.

Security

40/100

poor

Confidence: 85%
Coverage: 100%

Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.

Dispute or request a re-score Full report JSON

AI provenance

100% explicit

Explicit AI attribution on 100% of first-party code added; an estimated 100% including velocity signals.

How the score is built

Explicitly attributed share100%
Unattributed share in AI-pace bursts0%
Estimated AI-generated share100%
AI tool configuration files0
Work sessions at AI pace7
Releases at AI pace1
Coding-style index (1.0+ means possible)0.00

Attributed AI tools

Tool	Commits	Lines added	First seen	Last seen
Claude Code	104	104,022	2026-05-28	2026-11-07
Cursor agent	48	444	2026-05-02	2026-10-14
Devin	1	0	2026-06-09	2026-06-09
OpenAI Codex	11	0	2026-08-21	2026-10-08

Lines added per month all AI-attributed share

2026-020 · 0% AI
2026-030 · 0% AI
2026-0450 · 0% AI
2026-0529 · 100% AI
2026-06443 · 100% AI
2026-07145 · 100% AI
2026-080 · 0% AI
2026-09140 · 100% AI
2026-1056,985 · 100% AI
2026-1146,839 · 100% AI

Findings in AI-attributed lines vs the rest

From git blame: 34,039 lines trace to AI-attributed commits, 0 to others. Too few lines in one group for a fair comparison. Reported, not scored.

Findings per 1,000 lines	AI-attributed	Other	Ratio
Code quality	5.88	—	—
Security	4.61	—	—

Evidence by analyzer

Explicit AI attributionok29 items

Claude Code: 104 attributed commits, 104,022 lines added
Cursor agent: 48 attributed commits, 444 lines added
OpenAI Codex: 11 attributed commits, 0 lines added
Devin: 1 attributed commits, 0 lines added
Claude Code: trailer 'Co-Authored-By: Claude'
Claude Code: trailer 'Co-Authored-By: Claude'
Claude Code: trailer 'Co-Authored-By: Claude'
Claude Code: trailer 'Co-Authored-By: Claude'
Claude Code: trailer 'Co-Authored-By: Claude'
Claude Code: trailer 'Co-Authored-By: Claude'
Claude Code: trailer 'Co-Authored-By: Claude'
Claude Code: trailer 'Co-Authored-By: Claude'
Claude Code: trailer 'Co-Authored-By: Claude'
Claude Code: trailer 'Co-Authored-By: Claude'
Claude Code: trailer 'Co-Authored-By: Claude'
Claude Code: trailer 'Co-Authored-By: Claude'
Claude Code: trailer 'Co-Authored-By: Claude'
Claude Code: trailer 'Co-Authored-By: Claude'
Claude Code: trailer 'Co-Authored-By: Claude'
Claude Code: on merged branch (9b4bf937a1)
Claude Code: trailer 'Co-Authored-By: Claude'
Claude Code: on merged branch (8fcde309b3)
Claude Code: on merged branch (8fcde309b3)
Claude Code: trailer 'Co-Authored-By: Claude'
Claude Code: trailer 'Co-Authored-By: Claude'
Claude Code: trailer 'Co-Authored-By: Claude'
Claude Code: trailer 'Co-Authored-By: Claude'
Claude Code: trailer 'Co-Authored-By: Claude'
Claude Code: trailer 'Co-Authored-By: Claude'

attributed_commit_share: 61.0%
attributed_commits: 164
attributed_loc: 104,466
attributed_loc_share: 99.8%
commits: 269
effective_loc: 104,631
tools_detected: 4

AI tool configurationok

artifacts: 0
tools_configured: 0
workflow_agents: 0

Commit velocityok7 items

excluded_import_loc: 38,295
flagged_loc: 42,432
flagged_loc_share: 64.0%
flagged_units: 7
max_loc_per_hour: 4,637.89
measured_loc: 66,336
median_loc_per_hour: 255.84
pr_timed_units: 1
pre_ai_era_burst_loc: 0
pre_ai_era_bursts: 0
pre_ai_era_measured_loc: 0
work_units: 72

Release velocityok1 item

v2.1.5 → v2.5.0: 56,333 lines in 11.0 days (5,121.7 lines/day)

flagged_releases: 1
max_loc_per_day: 5,121.70
releases: 9

Coding styleok

count:assistant_voice: 0
count:emoji_in_code: 0
count:narrated_steps: 0
count:placeholder: 0
files:assistant_voice: 0
files:emoji_in_code: 0
files:narrated_steps: 0
files:placeholder: 0
index: 0
lines_scanned: 34,039
per_kloc:assistant_voice: 0
per_kloc:emoji_in_code: 0
per_kloc:narrated_steps: 0
per_kloc:placeholder: 0

Findings in AI-written linesok

ai_lines: 34,039
blame_failures: 0
files_blamed: 135
other_lines: 0
quality:ai_findings: 200
quality:ai_per_kloc: 5.88
quality:other_findings: 0
security:ai_findings: 157
security:ai_per_kloc: 4.61
security:other_findings: 0

Code quality

59 weak

Code quality is weak: test-to-source ratio 0.01, no CI test run detected; 24% of function code in complex or long functions; 3% duplicated lines. Weakest area: testing.

How the score is built

Complexity49
Duplication86
Lint and smells60
Tests and CI41
Documentation85
Type safetynot measured
Review processnot measured

Evidence by analyzer

Complexity (lizard)ok10 items

complex_functions: 122
function_nloc: 24,040
functions: 4,493
long_functions: 9
many_param_functions: 0
mean_ccn: 3.32
p90_ccn: 7
risky_nloc_share: 23.9%

Duplication (jscpd)ok10 items

compared_lines: 29,042
duplicated_lines: 732
duplicated_share: 2.5%
files: 135

Lintok

category:correctness: 226
findings: 226
scanned_lines: 34,039
weighted_findings: 70.75

Tests and CIok1 item

CI config: .github/workflows/check-skills.yml .github/workflows/check-skills.yml

check:ci_present: yes
check:ci_runs_lint: no
check:ci_runs_tests: no
check:has_tests: yes
check:test_ratio: no
check:tests_cochange: no
ci_files: 1
cochange_commits: 98
cochange_share: 13.3%
source_lines: 34,039
test_lines: 267
test_ratio: 0.01

Documentationok3 items

README.md README.md
LICENSE LICENSE
CHANGELOG.md CHANGELOG.md

check:changelog: yes
check:contributing: no
check:license: yes
check:readme: yes
readme_lines: 190

Type safetyskipped

Security

40 poor

Security posture is poor: 0 possible secret(s) in the tree, 7 only in history; 48 high-severity SAST findings; 2 high-severity workflow issues. Weakest area: posture.

How the score is built

Secrets31
Static analysis (SAST)53
Vulnerable dependenciesnot measured
CI workflows62
Security posture0
OpenSSF Scorecardnot measured

Evidence by analyzer

OpenSSF Scorecardskipped

no published OpenSSF Scorecard result for this repo

Package registriesskipped

no registry dependencies declared

Secrets (gitleaks)ok

secrets_current: 0
secrets_history: 7
secrets_low_confidence: 0
secrets_nonprod: 0

Static analysis (opengrep)ok

findings: 157
findings_high: 48
findings_low: 6
findings_medium: 103
parse_errors: 2
scanned_lines: 34,039
weighted_findings: 62.12

Dependencies (osv-scanner)skipped

CI workflows (zizmor)ok

findings: 5
findings_high: 2
findings_low: 1
findings_medium: 2
penalty: 28.60
workflows: 1

Security postureok

check:dependency_updates: no
check:lockfiles: yes
check:security_policy: no
check:signed_commits: no
signed_commit_share: 15.5%
unpinned_manifests: 0

Release downloadsok

binary_assets: 0
signals: 0
suspicious: 0

Findings

50 high131 medium188 low

Severity	Rule	Location	Message	Tool
high	`zizmor/unpinned-uses`	.github/workflows/check-skills.yml:12	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/check-skills.yml:13	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`opengrep/javascript.browser.security.insecure-document-method`	skills/taste-skill/assets/components/fx-bars/component.js:19	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	skills/taste-skill/assets/components/fx-bars/component.js:19	User controlled data in a `cols.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	skills/taste-skill/assets/components/fx-bars/component.js:20	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	skills/taste-skill/assets/components/fx-bars/component.js:20	User controlled data in a `root.querySelector('.cx-bars__scale').innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	skills/taste-skill/assets/components/fx-bars/component.js:21	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	skills/taste-skill/assets/components/fx-bars/component.js:21	User controlled data in a `root.querySelector('.cx-bars__axis').innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	skills/taste-skill/assets/components/fx-bars/component.js:22	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	skills/taste-skill/assets/components/fx-bars/component.js:22	User controlled data in a `root.querySelector('[data-table] tbody').innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	skills/taste-skill/assets/components/fx-chart/component.js:29	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	skills/taste-skill/assets/components/fx-chart/component.js:29	User controlled data in a `grid.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	skills/taste-skill/assets/components/fx-chart/component.js:30	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	skills/taste-skill/assets/components/fx-chart/component.js:30	User controlled data in a `axis.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	skills/taste-skill/assets/components/fx-chart/component.js:31	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	skills/taste-skill/assets/components/fx-chart/component.js:31	User controlled data in a `root.querySelector('[data-table] tbody').innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	skills/taste-skill/assets/components/fx-chart/component.js:77	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	skills/taste-skill/assets/components/fx-chart/component.js:77	User controlled data in a `tip.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	skills/taste-skill/assets/diagrams/diagram.js:229	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	skills/taste-skill/assets/diagrams/diagram.js:229	User controlled data in a `span.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	skills/taste-skill/assets/objects/_print-core/demo.js:32	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	skills/taste-skill/assets/objects/_print-core/demo.js:32	User controlled data in a `root.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	skills/taste-skill/assets/objects/_scenes/demo.js:20	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	skills/taste-skill/assets/objects/_scenes/demo.js:20	User controlled data in a `document.body.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	skills/taste-skill/assets/objects/photo-kit/demo.js:44	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	skills/taste-skill/assets/objects/photo-kit/demo.js:44	User controlled data in a `document.body.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	skills/taste-skill/assets/scenes/letter-bar-floods-the-ground/scene.js:41	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	skills/taste-skill/assets/scenes/letter-bar-floods-the-ground/scene.js:41	User controlled data in a `line.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	skills/taste-skill/assets/ui/apps/fragment.js:23	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	skills/taste-skill/assets/ui/apps/fragment.js:23	User controlled data in a `svg.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	skills/taste-skill/assets/ui/calendar/fragment.js:21	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	skills/taste-skill/assets/ui/calendar/fragment.js:21	User controlled data in a `pointer.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	skills/taste-skill/assets/ui/cursor/fragment.js:24	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	skills/taste-skill/assets/ui/cursor/fragment.js:24	User controlled data in a `pointer.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	skills/taste-skill/assets/ui/integrations/fragment.js:16	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	skills/taste-skill/assets/ui/integrations/fragment.js:16	User controlled data in a `pointer.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	skills/taste-skill/assets/ui/notify/fragment.js:16	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	skills/taste-skill/assets/ui/notify/fragment.js:16	User controlled data in a `li.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	skills/taste-skill/assets/ui/notify/fragment.js:21	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	skills/taste-skill/assets/ui/notify/fragment.js:21	User controlled data in a `list.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	skills/taste-skill/assets/ui/search/fragment.js:18	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	skills/taste-skill/assets/ui/search/fragment.js:18	User controlled data in a `list.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	skills/taste-skill/assets/ui/search/fragment.js:20	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	skills/taste-skill/assets/ui/search/fragment.js:20	User controlled data in a `list.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	skills/taste-skill/assets/ui/stat/fragment.js:24	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	skills/taste-skill/assets/ui/stat/fragment.js:24	User controlled data in a `bars.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	skills/taste-skill/assets/ui/ui.js:106	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	skills/taste-skill/assets/ui/ui.js:106	User controlled data in a `el.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	skills/taste-skill/assets/ui/voice/fragment.js:70	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	skills/taste-skill/assets/ui/voice/fragment.js:70	User controlled data in a `cap.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.correctness.no-stringify-keys`	skills/taste-skill/assets/backgrounds/check.mjs:145	JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.	Lint
medium	`opengrep/javascript.lang.correctness.no-stringify-keys`	skills/taste-skill/assets/backgrounds/check.mjs:153	JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.	Lint
medium	`opengrep/javascript.lang.correctness.no-stringify-keys`	skills/taste-skill/assets/backgrounds/check.mjs:153	JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.	Lint
medium	`opengrep/javascript.lang.correctness.no-stringify-keys`	skills/taste-skill/assets/backgrounds/check.mjs:153	JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.	Lint
medium	`opengrep/javascript.lang.correctness.no-stringify-keys`	skills/taste-skill/assets/diagrams/diagram.js:1664	JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.	Lint
medium	`opengrep/javascript.lang.correctness.no-stringify-keys`	skills/taste-skill/assets/objects/product-render/make-posters.mjs:145	JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.	Lint
medium	`opengrep/javascript.lang.correctness.no-replaceall`	skills/taste-skill/scripts/effects.mjs:315	The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")...	Lint
medium	`opengrep/javascript.lang.correctness.no-stringify-keys`	skills/taste-skill/scripts/gate.mjs:594	JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.	Lint
medium	`opengrep/javascript.lang.correctness.no-stringify-keys`	skills/taste-skill/scripts/gate.mjs:687	JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.	Lint
medium	`opengrep/javascript.lang.correctness.no-stringify-keys`	skills/taste-skill/scripts/icons.mjs:545	JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.	Lint
medium	`opengrep/javascript.lang.correctness.no-stringify-keys`	skills/taste-skill/scripts/icons.mjs:546	JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.	Lint
medium	`opengrep/javascript.lang.correctness.no-stringify-keys`	skills/taste-skill/scripts/icons.mjs:546	JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.	Lint
medium	`opengrep/javascript.lang.correctness.no-stringify-keys`	skills/taste-skill/scripts/icons.mjs:548	JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.	Lint
medium	`opengrep/javascript.lang.correctness.no-stringify-keys`	skills/taste-skill/scripts/icons.mjs:548	JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.	Lint
medium	`opengrep/javascript.lang.correctness.no-stringify-keys`	skills/taste-skill/scripts/icons.mjs:548	JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.	Lint
medium	`opengrep/javascript.lang.correctness.no-stringify-keys`	skills/taste-skill/scripts/icons.mjs:548	JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.	Lint
medium	`opengrep/javascript.lang.correctness.no-stringify-keys`	skills/taste-skill/scripts/icons.mjs:548	JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.	Lint
medium	`opengrep/javascript.lang.correctness.no-stringify-keys`	skills/taste-skill/scripts/icons.mjs:548	JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.	Lint
medium	`opengrep/javascript.lang.correctness.no-stringify-keys`	skills/taste-skill/scripts/icons.mjs:550	JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.	Lint
medium	`zizmor/artipacked`	.github/workflows/check-skills.yml:12	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/check-skills.yml:9	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/components/fx-bars/component.js:19	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/components/fx-bars/component.js:20	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/components/fx-bars/component.js:21	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/components/fx-bars/component.js:22	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/components/fx-chart/component.js:29	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/components/fx-chart/component.js:30	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/components/fx-chart/component.js:31	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/components/fx-chart/component.js:43	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/components/fx-chart/component.js:77	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/components/fx-dither-object/component.js:399	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/components/fx-dither-object/component.js:400	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/components/fx-dither-object/component.js:401	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/components/fx-dither-object/component.js:402	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/components/fx-dither-object/component.js:405	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`	skills/taste-skill/assets/components/fx-map/component.js:242	Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/components/shared.js:368	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/components/shared.js:378	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/diagrams/diagram.js:1667	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.insecure-object-assign`	skills/taste-skill/assets/diagrams/diagram.js:1674	Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/effects/contour-lines/effect.js:159	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/effects/contour-lines/effect.js:161	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/effects/fx.js:295	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/effects/halftone-screen/effect.js:208	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/effects/halftone-screen/effect.js:212	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/effects/halftone-screen/effect.js:224	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/effects/halftone-screen/effect.js:225	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/effects/halftone-screen/effect.js:227	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/effects/halftone-screen/effect.js:228	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/effects/halftone-screen/effect.js:230	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/effects/line-engraving/effect.js:200	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/effects/line-engraving/effect.js:204	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/effects/line-engraving/effect.js:213	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/effects/line-engraving/effect.js:214	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/effects/line-engraving/effect.js:216	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/effects/line-engraving/effect.js:217	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/effects/line-engraving/effect.js:219	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/effects/ruled-grounds/effect.js:193	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/objects/_print-core/demo.js:32	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/objects/_print-core/demo.js:39	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/objects/_print-core/demo.js:41	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/objects/_print-core/demo.js:42	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/objects/_scenes/demo.js:24	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/objects/_scenes/demo.js:40	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/objects/_scenes/demo.js:45	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/objects/photo-kit/demo.js:36	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/objects/photo-kit/demo.js:42	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/objects/photo-kit/demo.js:44	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/objects/photo-kit/demo.js:53	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/objects/photo-kit/demo.js:59	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/objects/photo-kit/photo.js:1102	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/objects/photo-kit/photo.js:1130	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/objects/photo-kit/photo.js:1135	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/objects/photo-kit/photo.js:1137	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`	skills/taste-skill/assets/objects/product-render/build.js:629	Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/objects/product-render/build.js:694	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/scenes/_demo/shoot.mjs:289	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/scenes/_demo/shoot.mjs:289	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/scenes/_demo/shoot.mjs:289	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/scenes/_demo/shoot.mjs:291	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/scenes/_demo/shoot.mjs:99	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/ui/apps/fragment.js:28	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/ui/notify/fragment.js:16	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/ui/search/fragment.js:7	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/assets/ui/voice/fragment.js:70	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	skills/taste-skill/scripts/copy-lint.mjs:158	RegExp() called with a `n` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`	skills/taste-skill/scripts/copy-lint.mjs:213	Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	skills/taste-skill/scripts/copy-lint.mjs:249	RegExp() called with a `w` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	skills/taste-skill/scripts/copy-lint.mjs:284	RegExp() called with a `re` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	skills/taste-skill/scripts/copy-lint.mjs:292	RegExp() called with a `n` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	skills/taste-skill/scripts/copy-lint.mjs:340	RegExp() called with a `re` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	skills/taste-skill/scripts/copy-lint.mjs:381	RegExp() called with a `n` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	skills/taste-skill/scripts/copy-lint.mjs:384	RegExp() called with a `n` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	skills/taste-skill/scripts/copy-lint.mjs:385	RegExp() called with a `n` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	skills/taste-skill/scripts/copy-lint.mjs:68	RegExp() called with a `k` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	skills/taste-skill/scripts/copy-lint.mjs:69	RegExp() called with a `k` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/scripts/effects.mjs:180	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`	skills/taste-skill/scripts/effects.mjs:561	Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/scripts/gate.mjs:365	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/scripts/gate.mjs:647	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/scripts/gate.mjs:670	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.insecure-object-assign`	skills/taste-skill/scripts/gate.mjs:672	Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/scripts/gate.mjs:715	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/scripts/gate.mjs:794	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.insecure-object-assign`	skills/taste-skill/scripts/gate.mjs:804	Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.insecure-object-assign`	skills/taste-skill/scripts/gate.mjs:846	Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.insecure-object-assign`	skills/taste-skill/scripts/gate.mjs:849	Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/scripts/gate.mjs:886	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	skills/taste-skill/scripts/icons.mjs:112	RegExp() called with a `k` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	skills/taste-skill/scripts/icons.mjs:215	RegExp() called with a `k` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/scripts/icons.mjs:248	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/scripts/icons.mjs:291	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/scripts/icons.mjs:363	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/scripts/icons.mjs:372	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/scripts/icons.mjs:374	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/scripts/icons.mjs:377	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	skills/taste-skill/scripts/photos.mjs:1001	RegExp() called with a `c` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	skills/taste-skill/scripts/photos.mjs:354	RegExp() called with a `x` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/scripts/photos.mjs:590	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/scripts/photos.mjs:635	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/scripts/photos.mjs:730	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	skills/taste-skill/scripts/shoot.mjs:256	RegExp() called with a `o` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/scripts/start.mjs:201	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	skills/taste-skill/scripts/start.mjs:305	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`gitleaks/sourcegraph-access-token`	taste-blocks/public/r/componentry-circuit-board.json:42	Possible sourcegraph-access-token secret in history (commit 4e032cd7bc); removed from the current tree but still retrievable	Secrets (gitleaks)
medium	`gitleaks/sourcegraph-access-token`	taste-blocks/public/r/cult-distorted-glass.json:40	Possible sourcegraph-access-token secret in history (commit 4e032cd7bc); removed from the current tree but still retrievable	Secrets (gitleaks)
medium	`gitleaks/sourcegraph-access-token`	taste-blocks/public/r/elevenlabs-matrix-display.json:41	Possible sourcegraph-access-token secret in history (commit 4e032cd7bc); removed from the current tree but still retrievable	Secrets (gitleaks)
medium	`gitleaks/sourcegraph-access-token`	taste-blocks/public/r/fancy-gooey-svg-filter.json:32	Possible sourcegraph-access-token secret in history (commit 4e032cd7bc); removed from the current tree but still retrievable	Secrets (gitleaks)
medium	`gitleaks/sourcegraph-access-token`	taste-blocks/public/r/fancy-pixelate-svg-filter.json:32	Possible sourcegraph-access-token secret in history (commit 4e032cd7bc); removed from the current tree but still retrievable	Secrets (gitleaks)
medium	`gitleaks/sourcegraph-access-token`	taste-blocks/public/r/magic-backlight.json:31	Possible sourcegraph-access-token secret in history (commit 4e032cd7bc); removed from the current tree but still retrievable	Secrets (gitleaks)
medium	`gitleaks/sourcegraph-access-token`	taste-blocks/public/r/uilayouts-liquid-glass.json:41	Possible sourcegraph-access-token secret in history (commit 4e032cd7bc); removed from the current tree but still retrievable	Secrets (gitleaks)
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/backgrounds/check.mjs:125	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/components/fx-dither-object/component.js:114	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/components/fx-dither-object/component.js:114	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/components/fx-dither-object/component.js:157	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/components/fx-dither-object/component.js:157	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/components/fx-dither-object/component.js:194	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/components/fx-dither-object/component.js:194	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/components/fx-dither-object/component.js:22	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/components/fx-dither-object/component.js:22	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/components/fx-dither-object/component.js:244	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/components/fx-dither-object/component.js:244	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/components/fx-dither-object/component.js:405	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/components/fx-dither-object/component.js:405	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/components/fx-dither-object/component.js:50	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/components/fx-dither-object/component.js:50	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	skills/taste-skill/assets/components/fx-map/component.js:202	`chip.hidden` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/diagrams/diagram.js:1667	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/diagrams/diagram.js:1667	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/effects/aurora-curtains/effect.js:20	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/effects/aurora-curtains/effect.js:20	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/effects/bayer-dither/effect.js:22	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/effects/bayer-dither/effect.js:22	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/effects/caustics/effect.js:20	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/effects/caustics/effect.js:20	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/effects/contour-lines/effect.js:25	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/effects/contour-lines/effect.js:25	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/effects/dot-terrain/effect.js:27	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/effects/dot-terrain/effect.js:27	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/effects/dotted-globe/effect.js:367	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/effects/dotted-globe/effect.js:367	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/effects/dotted-globe/effect.js:403	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/effects/dotted-globe/effect.js:403	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/effects/duotone-grade/effect.js:23	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/effects/duotone-grade/effect.js:23	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/effects/edge-glow/effect.js:23	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/effects/edge-glow/effect.js:23	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/effects/film-light-leak/effect.js:23	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/effects/film-light-leak/effect.js:23	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/effects/fluted-glass/effect.js:202	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/effects/fluted-glass/effect.js:202	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/effects/fluted-glass/effect.js:21	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/effects/fluted-glass/effect.js:21	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	skills/taste-skill/assets/effects/fx.js:195	`probe.fillStyle` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/effects/fx.js:394	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/effects/fx.js:394	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/effects/god-rays/effect.js:24	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/effects/god-rays/effect.js:24	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/effects/gradient-mesh/effect.js:25	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/effects/gradient-mesh/effect.js:25	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/effects/gradient-mesh/effect.js:56	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/effects/grain-gradient/effect.js:19	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/effects/grain-gradient/effect.js:19	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/effects/halftone-screen/effect.js:21	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/effects/halftone-screen/effect.js:21	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/effects/line-engraving/effect.js:23	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/effects/line-engraving/effect.js:23	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/effects/orb-sphere/effect.js:25	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/effects/orb-sphere/effect.js:25	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/effects/painterly-landscape/effect.js:22	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/effects/painterly-landscape/effect.js:22	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/effects/prism-dispersion/effect.js:23	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/effects/prism-dispersion/effect.js:23	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	skills/taste-skill/assets/effects/ridgeline/effect.js:247	`vb[vn++]` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	skills/taste-skill/assets/effects/ridgeline/effect.js:247	`vb[vn++]` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	skills/taste-skill/assets/effects/ridgeline/effect.js:247	`vb[vn++]` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	skills/taste-skill/assets/effects/ridgeline/effect.js:247	`vb[vn++]` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	skills/taste-skill/assets/effects/ridgeline/effect.js:247	`vb[vn++]` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	skills/taste-skill/assets/effects/ridgeline/effect.js:250	`vb[vn++]` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	skills/taste-skill/assets/effects/ridgeline/effect.js:250	`vb[vn++]` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	skills/taste-skill/assets/effects/ridgeline/effect.js:250	`vb[vn++]` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	skills/taste-skill/assets/effects/ridgeline/effect.js:250	`vb[vn++]` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	skills/taste-skill/assets/effects/ridgeline/effect.js:250	`vb[vn++]` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/effects/ruled-grounds/effect.js:20	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/effects/ruled-grounds/effect.js:20	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/effects/silk-folds/effect.js:21	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/effects/silk-folds/effect.js:21	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/effects/soft-light-bars/effect.js:24	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/effects/soft-light-bars/effect.js:24	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/effects/spotlight-cone/effect.js:22	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/effects/spotlight-cone/effect.js:22	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/layout/check.mjs:144	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/layout/check.mjs:144	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	skills/taste-skill/assets/objects/_print-core/print3d.js:243	`probe.fillStyle` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/_print-core/print3d.js:325	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/_print-core/print3d.js:325	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/_print-core/print3d.js:329	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/_print-core/print3d.js:329	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/_print-core/print3d.js:346	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/_print-core/print3d.js:346	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/_print-core/print3d.js:365	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/_print-core/print3d.js:371	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/_print-core/print3d.js:634	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/_print-core/print3d.js:634	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/_print-core/print3d.js:841	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/_print-core/print3d.js:841	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/_scenes/kit.js:298	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/_scenes/kit.js:298	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/_scenes/kit.js:329	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/_scenes/kit.js:329	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/_scenes/kit.js:339	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	skills/taste-skill/assets/objects/_scenes/kit.js:76	`cssProbe.fillStyle` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/dither-sequence/object.js:30	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/dot-object/object.js:29	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/dot-object/object.js:29	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/dot-object/object.js:50	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/dot-object/object.js:50	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/exploded-layers/object.js:23	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/exploded-layers/object.js:23	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/exploded-layers/object.js:33	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/exploded-layers/object.js:33	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/photo-dither/object.js:28	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/photo-dither/object.js:28	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/photo-engraving/object.js:29	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/photo-engraving/object.js:29	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/photo-halftone/object.js:29	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/photo-halftone/object.js:29	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/photo-kit/photo.js:300	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/photo-kit/photo.js:300	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/print-cards/object.js:12	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/print-cards/object.js:12	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/print-cup/object.js:11	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/print-cup/object.js:11	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/print-globe/object.js:16	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/print-globe/object.js:16	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/print-lamp/object.js:14	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/print-lamp/object.js:14	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/print-wheel/object.js:15	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/print-wheel/object.js:15	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/product-render/build.js:150	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/product-render/build.js:150	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/product-render/build.js:187	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/product-render/build.js:187	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/product-render/build.js:230	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/product-render/build.js:230	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/product-render/build.js:252	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/product-render/build.js:252	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/product-render/build.js:266	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/product-render/build.js:266	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/product-render/build.js:640	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/product-render/build.js:640	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/product-render/build.js:640	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/product-render/build.js:640	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/product-render/build.js:640	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/product-render/build.js:640	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/product-render/build.js:970	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/product-render/build.js:970	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/product-turntable/object.js:27	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/split-reveal/object.js:25	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/objects/split-reveal/object.js:25	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/scenes/_demo/shoot.mjs:256	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/scenes/_demo/shoot.mjs:256	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/scenes/_demo/shoot.mjs:259	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/scenes/_demo/shoot.mjs:259	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/scenes/_demo/shoot.mjs:267	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/scenes/_demo/shoot.mjs:267	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/scenes/_demo/shoot.mjs:291	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/scenes/_demo/shoot.mjs:291	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/scenes/_demo/shoot.mjs:305	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/scenes/_demo/shoot.mjs:305	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/scenes/_demo/shoot.mjs:327	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/scenes/_demo/shoot.mjs:327	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/scenes/_demo/shoot.mjs:331	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/assets/scenes/_demo/shoot.mjs:331	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	skills/taste-skill/assets/system.js:393	`probe.fillStyle` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.eqeq-is-bad`	skills/taste-skill/assets/ui/ui.js:406	Detected a useless comparison operation `last == last` or `last != last`. This operation is always true. If testing for floating point NaN, use `math.isnan`, or `cmath.isnan` if the number is complex.	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	skills/taste-skill/assets/ui/voice/fragment.js:18	`probe.fillStyle` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/scripts/effects.mjs:482	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/scripts/effects.mjs:482	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/scripts/effects.mjs:495	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/scripts/effects.mjs:495	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/scripts/effects.mjs:539	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/scripts/gate.mjs:431	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/scripts/gate.mjs:431	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/scripts/gate.mjs:794	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/scripts/gate.mjs:794	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/scripts/icons.mjs:538	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/scripts/icons.mjs:538	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/scripts/icons.mjs:539	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/scripts/perf.mjs:114	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/scripts/perf.mjs:114	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	skills/taste-skill/scripts/perf.mjs:136	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`zizmor/adhoc-packages`	.github/workflows/check-skills.yml:18	ad-hoc installation of packages [confidence high]	CI workflows (zizmor)
low	`opengrep/javascript.lang.security.audit.unsafe-formatstring`	skills/taste-skill/assets/diagrams/diagram.js:1667	Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string....	Static analysis (opengrep)
low	`opengrep/javascript.lang.security.audit.unsafe-formatstring`	skills/taste-skill/assets/diagrams/diagram.js:1670	Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string....	Static analysis (opengrep)
low	`opengrep/javascript.lang.security.audit.unsafe-formatstring`	skills/taste-skill/assets/effects/fx.js:932	Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string....	Static analysis (opengrep)
low	`opengrep/javascript.lang.security.audit.unsafe-formatstring`	skills/taste-skill/assets/objects/_scenes/kit.js:574	Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string....	Static analysis (opengrep)
low	`opengrep/javascript.lang.security.audit.unsafe-formatstring`	skills/taste-skill/assets/objects/_scenes/kit.js:708	Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string....	Static analysis (opengrep)
low	`opengrep/javascript.lang.security.audit.unsafe-formatstring`	skills/taste-skill/assets/ui/ui.js:506	Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string....	Static analysis (opengrep)

Tools and coverage

Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.

Analyzer	Pillar	Status	Version	Findings	Note
AI tool configuration	AI provenance	ok	`signatures-v1`	0
Explicit AI attribution	AI provenance	ok	`signatures-v1`	0
Release velocity	AI provenance	ok	`prov-5`	0
Coding style	AI provenance	ok	`—`	0
Commit velocity	AI provenance	ok	`prov-5`	0
Findings in AI-written lines	AI provenance	ok	`git-blame`	0
Complexity (lizard)	Code quality	ok	`lizard 1.25.1`	0
Documentation	Code quality	ok	`—`	0
Duplication (jscpd)	Code quality	ok	`repotrust-dup-w6`	0
Lint	Code quality	ok	`opengrep 1.33.1; rules f1d2b562b414`	200
Tests and CI	Code quality	ok	`—`	0
Type safety	Code quality	skipped	`—`	0
CI workflows (zizmor)	Security	ok	`zizmor 1.32.0`	5
Dependencies (osv-scanner)	Security	skipped	`—`	0
Release downloads	Security	ok	`—`	0
Security posture	Security	ok	`—`	0
Package registries	Security	skipped	`—`	0	no registry dependencies declared
Static analysis (opengrep)	Security	ok	`opengrep 1.33.1; rules f1d2b562b414`	157
OpenSSF Scorecard	Security	skipped	`—`	0	no published OpenSSF Scorecard result for this repo
Secrets (gitleaks)	Security	ok	`gitleaks 8.30.1`	7

Score history

Scored	Commit	Scoring	AI provenance	Quality	Security
2026-11-14	`f6b76575f949`	`prov-5+qual-2+sec-2`	100%	59	40

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/Leonxlnx/taste-skill/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/Leonxlnx/taste-skill/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/Leonxlnx/taste-skill/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/Leonxlnx/taste-skill/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/Leonxlnx/taste-skill/security.svg)](https://repotrust.synapticcyber.com/r/github.com/Leonxlnx/taste-skill/)

Full text report

Repository: https://github.com/Leonxlnx/taste-skill
Commit: f6b76575f949707b4e3c37cd86cb44b0b98643e8
Generated: 2026-11-14T16:24:51+00:00
Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2

Scores

Unreviewed AI code risk: a large share of this code is explicitly AI-attributed, and its tests or review process are weak while quality or security scores are low.

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	100	explicit	95%	100%
Code quality	59	weak	90%	100%
Security	40	poor	85%	100%

AI provenance

Explicit AI attribution on 100% of first-party code added; an estimated 100% including velocity signals.

Explicitly attributed share (lower bound): 99.8%
Unattributed share in AI-consistent velocity bursts: 0.0%
Estimated AI-generated share: 99.8%

AI tool	Attributed commits	Lines added
Claude Code	104	104,022
Cursor agent	48	444
OpenAI Codex	11	0
Devin	1	0

Current source lines last changed by AI-attributed commits: 34,039 of 34,039.

Too few lines in one group to compare finding densities.

Month	Lines added	Attributed to AI
2026-04	50	0%
2026-05	29	100%
2026-06	443	100%
2026-07	145	100%
2026-09	140	100%
2026-10	56,985	100%
2026-11	46,839	100%

Evidence

Claude Code: trailer 'Co-Authored-By: Claude' (b900a8075fd7)
Claude Code: trailer 'Co-Authored-By: Claude' (386d187d8637)
Claude Code: trailer 'Co-Authored-By: Claude' (4c492ecf6d59)
Claude Code: trailer 'Co-Authored-By: Claude' (3324132353b0)
Claude Code: trailer 'Co-Authored-By: Claude' (50cb75fc270a)
Claude Code: trailer 'Co-Authored-By: Claude' (a851fc5c2084)
Claude Code: trailer 'Co-Authored-By: Claude' (c9890c32ebdd)
Claude Code: trailer 'Co-Authored-By: Claude' (76822a340876)
Claude Code: trailer 'Co-Authored-By: Claude' (c0e5dbf185d4)
Claude Code: trailer 'Co-Authored-By: Claude' (c707f2ac6db4)
Claude Code: trailer 'Co-Authored-By: Claude' (2d4644c53b7e)
Claude Code: trailer 'Co-Authored-By: Claude' (0042d7f8bb50)
Claude Code: trailer 'Co-Authored-By: Claude' (829d610b13b9)
Claude Code: trailer 'Co-Authored-By: Claude' (94b71d8bc48b)
Claude Code: trailer 'Co-Authored-By: Claude' (f2d14704448d)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is weak: test-to-source ratio 0.01, no CI test run detected; 24% of function code in complex or long functions; 3% duplicated lines. Weakest area: testing.

Area	Score
Complexity (lizard)	49
Duplication	86
Code smells (Opengrep)	60
Tests and CI	41
Documentation	85
Type safety	n/a
Process (Scorecard review/maintenance)	n/a

Functions: 4,493; mean complexity 3.3, 90th percentile 7; 122 complex and 9 long functions
Duplicated lines: 2.5% of 29,042 compared
Tests: 267 test lines for 34,039 source lines (ratio 0.01); CI test commands: none detected; 13% of recent source commits also change tests
Docs missing or thin: contributing

Most complex functions:

Security

Security posture is poor: 0 possible secret(s) in the tree, 7 only in history; 48 high-severity SAST findings; 2 high-severity workflow issues. Weakest area: posture.

Area	Score
Secrets (gitleaks, tree + history)	31
Static analysis (Opengrep)	53
Vulnerable dependencies (OSV)	n/a
CI workflows (zizmor)	62
Posture (policy, updates, signing, lockfiles)	0
OpenSSF Scorecard	n/a

Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits

Top findings

Severity	Finding	Location
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	skills/taste-skill/assets/components/fx-bars/component.js:19
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `cols.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	skills/taste-skill/assets/components/fx-bars/component.js:19
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	skills/taste-skill/assets/components/fx-bars/component.js:20
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `root.querySelector('.cx-bars__scale').innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	skills/taste-skill/assets/components/fx-bars/component.js:20
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	skills/taste-skill/assets/components/fx-bars/component.js:21
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `root.querySelector('.cx-bars__axis').innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	skills/taste-skill/assets/components/fx-bars/component.js:21
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	skills/taste-skill/assets/components/fx-bars/component.js:22
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `root.querySelector('[data-table] tbody').innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	skills/taste-skill/assets/components/fx-bars/component.js:22
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	skills/taste-skill/assets/components/fx-chart/component.js:29
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `grid.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	skills/taste-skill/assets/components/fx-chart/component.js:29
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	skills/taste-skill/assets/components/fx-chart/component.js:30
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `axis.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	skills/taste-skill/assets/components/fx-chart/component.js:30
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	skills/taste-skill/assets/components/fx-chart/component.js:31
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `root.querySelector('[data-table] tbody').innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	skills/taste-skill/assets/components/fx-chart/component.js:31
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	skills/taste-skill/assets/components/fx-chart/component.js:77
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `tip.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	skills/taste-skill/assets/components/fx-chart/component.js:77
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	skills/taste-skill/assets/diagrams/diagram.js:229
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `span.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	skills/taste-skill/assets/diagrams/diagram.js:229
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	skills/taste-skill/assets/objects/_print-core/demo.js:32
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `root.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	skills/taste-skill/assets/objects/_print-core/demo.js:32
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	skills/taste-skill/assets/objects/_scenes/demo.js:20
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `document.body.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	skills/taste-skill/assets/objects/_scenes/demo.js:20
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	skills/taste-skill/assets/objects/photo-kit/demo.js:44
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `document.body.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	skills/taste-skill/assets/objects/photo-kit/demo.js:44
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	skills/taste-skill/assets/scenes/letter-bar-floods-the-ground/scene.js:41

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

Source lines: 34,039; test lines: 267

Language	Lines
JavaScript	34,125
Shell	181