Leaderboard github.com
neplexlabs/commandkit
The discord.js meta-framework with features such as AI-powered command handler, analytics, feature flags, and more
AI provenance
<1%
explicit
- Confidence
- 95%
- Coverage
- 100%
Estimated share of AI-generated code. Explicit attribution is a lower bound.
Code quality
72/100
adequate
- Confidence
- 90%
- Coverage
- 100%
Complexity, duplication, lint density, tests, CI, docs and review process.
Security
56/100
weak
- Confidence
- 85%
- Coverage
- 100%
Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.
AI provenance
0% explicit
Explicit AI attribution on 0% of first-party code added; an estimated 0% including velocity signals.
How the score is built
- Explicitly attributed share0%
- Unattributed share in AI-pace bursts11%
- Estimated AI-generated share0%
- AI tool configuration files1
- Work sessions at AI pace4
- Releases at AI pace0
- Coding-style index (1.0+ means possible)0.62
Attributed AI tools
| Tool | Commits | Lines added | First seen | Last seen |
|---|---|---|---|---|
| GitHub Copilot coding agent | 8 | 118 | 2025-08-17 | 2026-03-06 |
| OpenAI Codex | 3 | 45 | 2026-10-11 | 2026-10-26 |
Lines added per month all AI-attributed share
- 2023-07678 · 0% AI
- 2023-081,323 · 0% AI
- 2023-091,641 · 0% AI
- 2023-10619 · 0% AI
- 2023-111,613 · 0% AI
- 2023-12307 · 0% AI
- 2024-011,096 · 0% AI
- 2024-022,630 · 0% AI
- 2024-126,837 · 0% AI
- 2025-013,320 · 0% AI
- 2025-027,650 · 0% AI
- 2025-0318,043 · 0% AI
- 2025-043,210 · 0% AI
- 2025-053,272 · 0% AI
- 2025-0610,406 · 0% AI
- 2025-072,913 · 0% AI
- 2025-082,547 · 0% AI
- 2025-09779 · 0% AI
- 2025-103,538 · 2% AI
- 2025-11395 · 0% AI
- 2025-122 · 0% AI
- 2026-01207 · 20% AI
- 2026-02105 · 2% AI
- 2026-036,957 · 0% AI
- 2026-044,713 · 0% AI
- 2026-050 · 0% AI
- 2026-06522 · 0% AI
- 2026-0748 · 0% AI
- 2026-09256 · 0% AI
- 2026-10168 · 27% AI
Findings in AI-attributed lines vs the rest
From git blame: 159 lines trace to AI-attributed commits, 37,779 to others. Too few lines in one group for a fair comparison. Reported, not scored.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Code quality | 0.00 | 1.72 | — |
| Security | 0.00 | 2.44 | — |
Evidence by analyzer
Explicit AI attributionok13 items
- GitHub Copilot coding agent: 8 attributed commits, 118 lines added
- OpenAI Codex: 3 attributed commits, 45 lines added
- OpenAI Codex: PR branch 'codex/issue-641-event-handler-docs'
- OpenAI Codex: trailer 'Co-authored-by: Codex'
- OpenAI Codex: trailer 'Co-authored-by: Codex'
- GitHub Copilot coding agent: author Copilot
- GitHub Copilot coding agent: author Copilot
- GitHub Copilot coding agent: author Copilot
- GitHub Copilot coding agent: author Copilot
- GitHub Copilot coding agent: author copilot-swe-agent[bot]
- GitHub Copilot coding agent: author copilot-swe-agent[bot]
- GitHub Copilot coding agent: author copilot-swe-agent[bot]
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'
- attributed_commit_share
- 0.8%
- attributed_commits
- 11
- attributed_loc
- 163
- attributed_loc_share
- 0.2%
- commits
- 1,305
- effective_loc
- 85,795
- tools_detected
- 2
AI tool configurationok1 item
- artifacts
- 1
- earliest_adoption
- 2026-04-05
- tools_configured
- 1
- workflow_agents
- 0
Commit velocityok4 items
- 1,938 lines of first-party code in ~1.9h (1,011 lines/hour, 3 commit session)
- 2,414 lines of first-party code in ~4.0h (604 lines/hour, 1 commit session)
- 2,216 lines of first-party code in ~4.0h (554 lines/hour, 1 commit session)
- 2,517 lines of first-party code in ~4.9h (509 lines/hour, 3 commit session)
- excluded_import_loc
- 20,991
- flagged_loc
- 9,085
- flagged_loc_share
- 14.0%
- flagged_units
- 4
- max_loc_per_hour
- 1,010.69
- measured_loc
- 64,804
- median_loc_per_hour
- 84.68
- pr_timed_units
- 17
- pre_ai_era_burst_loc
- 0
- pre_ai_era_bursts
- 0
- pre_ai_era_measured_loc
- 0
- work_units
- 324
Release velocityok
- flagged_releases
- 0
- max_loc_per_day
- 384
- releases
- 25
Coding styleok5 items
- placeholder or demo-only phrasing: // Simple delete - in a real scenario, you might want to check ownership
- step-by-step narration comment: // First, get the main JSDoc comment text for the member
- step-by-step narration comment: // Then, add any explicit tags
- step-by-step narration comment: // First, get the main JSDoc comment text (not from tags)
- step-by-step narration comment: // Then, add any explicit @description tags and examples
- count:assistant_voice
- 0
- count:emoji_in_code
- 35
- count:narrated_steps
- 4
- count:placeholder
- 1
- files:assistant_voice
- 0
- files:emoji_in_code
- 12
- files:narrated_steps
- 1
- files:placeholder
- 1
- index
- 0.62
- lines_scanned
- 37,938
- per_kloc:assistant_voice
- 0
- per_kloc:emoji_in_code
- 0.92
- per_kloc:narrated_steps
- 0.10
- per_kloc:placeholder
- 0.03
Findings in AI-written linesok
- ai_lines
- 159
- blame_failures
- 0
- files_blamed
- 424
- other_lines
- 37,779
- quality:ai_findings
- 0
- quality:ai_per_kloc
- 0
- quality:other_findings
- 65
- quality:other_per_kloc
- 1.72
- security:ai_findings
- 0
- security:ai_per_kloc
- 0
- security:other_findings
- 92
- security:other_per_kloc
- 2.44
Code quality
72 adequate
Code quality is adequate: test-to-source ratio 0.10, CI runs tests; 11% of function code in complex or long functions; 9% duplicated lines. Weakest area: duplication.
How the score is built
- Complexity72
- Duplication58
- Lint and smells81
- Tests and CI73
- Documentation80
- Type safety60
- Review processnot measured
Evidence by analyzer
Complexity (lizard)ok10 items
- traverseDirectory in packages/commandkit/src/app/router/CommandsRouter.ts: complexity 39, 200 lines
- beforeExecute in packages/commandkit/src/app/middlewares/permissions.ts: complexity 38, 117 lines
- executeCommand in packages/ratelimit/src/plugin.ts: complexity 37, 206 lines
- prepareCommandRun in packages/commandkit/src/app/handlers/AppCommandHandler.ts: complexity 35, 113 lines
- parseMembers in scripts/docs/typescript-docs-parser.ts: complexity 29, 106 lines
- (anonymous) in packages/ratelimit/src/engine/algorithms/fixed-window.ts: complexity 25, 97 lines
- main in packages/create-commandkit/src/index.ts: complexity 23, 186 lines
- processCommandFile in packages/commandkit/src/app/handlers/AppCommandHandler.ts: complexity 22, 88 lines
- render in scripts/docs/typescript-docs-renderer.ts: complexity 22, 130 lines
- buildApplication in packages/commandkit/src/cli/build.ts: complexity 21, 102 lines
- complex_functions
- 21
- function_nloc
- 18,973
- functions
- 1,906
- long_functions
- 9
- many_param_functions
- 0
- mean_ccn
- 2.58
- p90_ccn
- 6
- risky_nloc_share
- 11.0%
Duplication (jscpd)ok10 items
- 6+ duplicated lines: apps/test-bot/src/app/commands/(developer)/+middleware.ts:10 and apps/test-bot/src/app/commands/(interactions)/+middleware.ts:10
- 6+ duplicated lines: apps/test-bot/src/app/commands/(general)/avatar.ts:32 and apps/test-bot/src/app/commands/(general)/avatar.ts:52
- 6+ duplicated lines: apps/test-bot/src/app/commands/(general)/components.tsx:16 and apps/test-bot/src/app/commands/(interactions)/commandkit.tsx:21
- 6+ duplicated lines: apps/test-bot/src/app/commands/(general)/components.tsx:38 and apps/test-bot/src/app/commands/(select menu)/select-channel.tsx:14
- 6+ duplicated lines: apps/test-bot/src/app/commands/(interactions)/confirmation.tsx:45 and apps/test-bot/src/app/commands/(interactions)/confirmation.tsx:65
- 6+ duplicated lines: apps/test-bot/src/app/commands/(select menu)/select-channel.tsx:20 and apps/test-bot/src/app/commands/(select menu)/select-role.tsx:20
- 6+ duplicated lines: apps/test-bot/src/app/commands/(select menu)/select-string-multi.tsx:2 and apps/test-bot/src/app/commands/(select menu)/select-string.tsx:2
- 6+ duplicated lines: apps/test-bot/src/app/commands/greet.ts:5 and examples/with-workflow/src/app/commands/greet.ts:5
- 6+ duplicated lines: apps/test-bot/src/app/events/(ratelimits)/ratelimited/logger.ts:13 and packages/ratelimit/src/plugin.ts:53
- 6+ duplicated lines: apps/test-bot/src/workflows/greet/greet.workflow.ts:4 and examples/with-workflow/src/workflows/greet/greet.workflow.ts:4
- compared_lines
- 23,816
- duplicated_lines
- 2,164
- duplicated_share
- 9.1%
- files
- 424
Lintok
- category:best-practice
- 14
- category:correctness
- 51
- findings
- 65
- scanned_lines
- 37,902
- weighted_findings
- 32.50
Tests and CIok5 items
- CI config: .github/workflows/code-quality.yaml
.github/workflows/code-quality.yaml - CI config: .github/workflows/publish-latest.yaml
.github/workflows/publish-latest.yaml - CI config: .github/workflows/publish-rc.yaml
.github/workflows/publish-rc.yaml - CI runs tests (npm run test)
- CI runs linters (prettier)
- check:ci_present
- yes
- check:ci_runs_lint
- yes
- check:ci_runs_tests
- yes
- check:has_tests
- yes
- check:test_ratio
- no
- check:tests_cochange
- no
- ci_files
- 3
- cochange_commits
- 136
- cochange_share
- 7.3%
- source_lines
- 37,938
- test_lines
- 3,721
- test_ratio
- 0.10
Documentationok3 items
- README.md
README.md - LICENSE
LICENSE - CONTRIBUTING.md
CONTRIBUTING.md
- check:changelog
- no
- check:contributing
- yes
- check:license
- yes
- check:readme
- yes
- readme_lines
- 26
Type safetyok1 item
- TypeScript strict type checking: apps/test-bot/tsconfig.json
apps/test-bot/tsconfig.json
- check:low_escape_density
- no
- check:strict_config
- yes
- escapes
- 189
- escapes_per_kloc
- 5.08
Security
56 weak
Security posture is weak: 62 known vulnerabilities in 26 dependencies; 15 high-severity workflow issues. Weakest area: ci actions.
How the score is built
- Secrets97
- Static analysis (SAST)80
- Vulnerable dependencies6
- CI workflows5
- Security posture80
- OpenSSF Scorecardnot measured
Evidence by analyzer
OpenSSF Scorecardskipped
no published OpenSSF Scorecard result for this repo
Package registriesok
- checked
- 69
- declared
- 69
- lookup_errors
- 0
- missing
- 0
- recent
- 0
Secrets (gitleaks)ok
- secrets_current
- 0
- secrets_history
- 0
- secrets_low_confidence
- 1
- secrets_nonprod
- 0
Static analysis (opengrep)ok
- findings
- 91
- findings_high
- 0
- findings_low
- 0
- findings_medium
- 91
- parse_errors
- 7
- scanned_lines
- 37,902
- weighted_findings
- 23.45
Dependencies (osv-scanner)ok
- penalty
- 165
- vulnerabilities
- 62
- vulnerable_packages
- 26
- vulns_critical
- 3
- vulns_high
- 23
- vulns_low
- 7
- vulns_medium
- 28
- vulns_unknown
- 1
CI workflows (zizmor)ok
- findings
- 20
- findings_high
- 15
- findings_low
- 1
- findings_medium
- 4
- penalty
- 177.60
- workflows
- 3
Security postureok17 items
- Security policy: SECURITY.md
SECURITY.md - Dependency updates: renovate.json
renovate.json - apps/test-bot/package.json has no lockfile alongside it (unpinned dependencies)
apps/test-bot/package.json - apps/website/package.json has no lockfile alongside it (unpinned dependencies)
apps/website/package.json - packages/ai/package.json has no lockfile alongside it (unpinned dependencies)
packages/ai/package.json - packages/analytics/package.json has no lockfile alongside it (unpinned dependencies)
packages/analytics/package.json - packages/cache/package.json has no lockfile alongside it (unpinned dependencies)
packages/cache/package.json - packages/commandkit/package.json has no lockfile alongside it (unpinned dependencies)
packages/commandkit/package.json - packages/create-commandkit/package.json has no lockfile alongside it (unpinned dependencies)
packages/create-commandkit/package.json - packages/i18n/package.json has no lockfile alongside it (unpinned dependencies)
packages/i18n/package.json - packages/legacy/package.json has no lockfile alongside it (unpinned dependencies)
packages/legacy/package.json - packages/queue/package.json has no lockfile alongside it (unpinned dependencies)
packages/queue/package.json - packages/ratelimit/package.json has no lockfile alongside it (unpinned dependencies)
packages/ratelimit/package.json - packages/redis/package.json has no lockfile alongside it (unpinned dependencies)
packages/redis/package.json - packages/tasks/package.json has no lockfile alongside it (unpinned dependencies)
packages/tasks/package.json - packages/tsconfig/package.json has no lockfile alongside it (unpinned dependencies)
packages/tsconfig/package.json - packages/workflow/package.json has no lockfile alongside it (unpinned dependencies)
packages/workflow/package.json
- check:dependency_updates
- yes
- check:lockfiles
- no
- check:security_policy
- yes
- check:signed_commits
- no
- signed_commit_share
- 30.5%
- unpinned_manifests
- 15
Release downloadsok
- binary_assets
- 0
- signals
- 0
- suspicious
- 0
Findings
3 critical39 high142 medium54 low1 info
239 findings
| Severity | Rule | Location | Message | Tool |
|---|---|---|---|---|
| critical | osv/GHSA-5gmw-xhrv-c9v3 |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-5gmw-xhrv-c9v3 | Dependencies (osv-scanner) |
| critical | osv/GHSA-85c8-ppgw-ccpr |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-85c8-ppgw-ccpr | Dependencies (osv-scanner) |
| critical | osv/GHSA-cg2g-xh64-v4q7 |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-cg2g-xh64-v4q7 | Dependencies (osv-scanner) |
| high | opengrep/typescript.lang.correctness.useless-ternary |
packages/commandkit/src/app/handlers/AppCommandHandler.ts:374 | It looks like no matter how node.kind === 'command' is evaluated, this expression returns ''. This is probably a copy-paste error. | Lint |
| high | zizmor/unpinned-uses |
.github/workflows/code-quality.yaml:15 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/code-quality.yaml:19 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/code-quality.yaml:21 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/publish-latest.yaml:21 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/publish-latest.yaml:25 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/publish-latest.yaml:255 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/publish-latest.yaml:29 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/publish-latest.yaml:29 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/publish-rc.yaml:141 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/publish-rc.yaml:143 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/publish-rc.yaml:21 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/publish-rc.yaml:25 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/publish-rc.yaml:27 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/publish-rc.yaml:38 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/publish-rc.yaml:45 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | osv/GHSA-27r3-jxmh-p828 |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-27r3-jxmh-p828 | Dependencies (osv-scanner) |
| high | osv/GHSA-28wg-ghj8-5hjv |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-28wg-ghj8-5hjv | Dependencies (osv-scanner) |
| high | osv/GHSA-2m5v-pch6-74hx |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-2m5v-pch6-74hx | Dependencies (osv-scanner) |
| high | osv/GHSA-2m5v-pch6-74hx |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-2m5v-pch6-74hx | Dependencies (osv-scanner) |
| high | osv/GHSA-4528-x5fx-h6hg |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-4528-x5fx-h6hg | Dependencies (osv-scanner) |
| high | osv/GHSA-4w7w-5xrc-9h26 |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-4w7w-5xrc-9h26 | Dependencies (osv-scanner) |
| high | osv/GHSA-587h-7wmj-h5pm |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-587h-7wmj-h5pm | Dependencies (osv-scanner) |
| high | osv/GHSA-5c6j-r48x-rmvq |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-5c6j-r48x-rmvq | Dependencies (osv-scanner) |
| high | osv/GHSA-j22f-vq7h-c4qm |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-j22f-vq7h-c4qm | Dependencies (osv-scanner) |
| high | osv/GHSA-mcm9-63f2-9j32 |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-mcm9-63f2-9j32 | Dependencies (osv-scanner) |
| high | osv/GHSA-mrhx-c7xc-m3w5 |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-mrhx-c7xc-m3w5 | Dependencies (osv-scanner) |
| high | osv/GHSA-mrhx-c7xc-m3w5 |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-mrhx-c7xc-m3w5 | Dependencies (osv-scanner) |
| high | osv/GHSA-mrhx-c7xc-m3w5 |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-mrhx-c7xc-m3w5 | Dependencies (osv-scanner) |
| high | osv/GHSA-mrv2-3pqr-j5jr |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-mrv2-3pqr-j5jr | Dependencies (osv-scanner) |
| high | osv/GHSA-mrwp-f3q8-3g9p |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-mrwp-f3q8-3g9p | Dependencies (osv-scanner) |
| high | osv/GHSA-qrxm-fqhp-jwvm |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-qrxm-fqhp-jwvm | Dependencies (osv-scanner) |
| high | osv/GHSA-qrxm-fqhp-jwvm |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-qrxm-fqhp-jwvm | Dependencies (osv-scanner) |
| high | osv/GHSA-r9w8-h9r3-54w4 |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-r9w8-h9r3-54w4 | Dependencies (osv-scanner) |
| high | osv/GHSA-w5hq-g745-h8pq |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-w5hq-g745-h8pq | Dependencies (osv-scanner) |
| high | osv/GHSA-x5rw-q4pp-hg5g |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-x5rw-q4pp-hg5g | Dependencies (osv-scanner) |
| high | osv/GHSA-xjj6-f33q-929c |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-xjj6-f33q-929c | Dependencies (osv-scanner) |
| high | osv/GHSA-xjj6-f33q-929c |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-xjj6-f33q-929c | Dependencies (osv-scanner) |
| high | osv/GHSA-xwg4-73v4-xw9w |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-xwg4-73v4-xw9w | Dependencies (osv-scanner) |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
apps/test-bot/src/app/commands/(general)/help.ts:13 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
apps/test-bot/src/app/commands/(general)/help.ts:15 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
apps/website/docusaurus.config.ts:197 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
apps/website/docusaurus.config.ts:198 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
apps/website/docusaurus.config.ts:199 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
apps/website/src/components/home/FeaturesSection.tsx:76 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
apps/website/src/plugins/tailwind-config.js:5 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
apps/website/src/theme/DocVersionBanner/index.tsx:143 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/javascript.lang.correctness.no-replaceall |
packages/commandkit/src/cli/development.ts:46 | The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... | Lint |
| medium | opengrep/javascript.lang.correctness.no-replaceall |
packages/commandkit/src/cli/development.ts:53 | The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
packages/commandkit/src/cli/information.ts:25 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
packages/commandkit/src/cli/information.ts:26 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
packages/commandkit/src/cli/information.ts:63 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
packages/commandkit/src/version.ts:6 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.javascript-confirm |
packages/create-commandkit/src/index.ts:151 | found confirm() call; should this be in production code? | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
packages/tasks/src/plugin.ts:87 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.correctness.no-replaceall |
scripts/docs/docgen-utils.ts:101 | The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... | Lint |
| medium | opengrep/javascript.lang.correctness.no-replaceall |
scripts/docs/docgen-utils.ts:102 | The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... | Lint |
| medium | zizmor/excessive-permissions |
.github/workflows/code-quality.yaml:10 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/code-quality.yaml:19 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/publish-latest.yaml:25 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/publish-rc.yaml:25 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
apps/test-bot/src/app/commands/remind.ts:43 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
apps/test-bot/src/app/commands/remind.ts:64 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
apps/test-bot/src/app/tasks/remind.ts:23 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
apps/website/docusaurus.config.ts:164 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/typescript.react.security.audit.react-dangerouslysetinnerhtml |
apps/website/src/components/MemberInfo/index.tsx:36 | Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider... | Static analysis (opengrep) |
| medium | opengrep/typescript.react.security.audit.react-dangerouslysetinnerhtml |
apps/website/src/components/MemberInfo/index.tsx:44 | Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
apps/website/src/plugins/llms-txt.js:31 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
apps/website/src/plugins/llms-txt.js:32 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
apps/website/src/plugins/llms-txt.js:33 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
apps/website/src/plugins/llms-txt.js:37 | Detected that function argument `dir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
apps/website/src/plugins/llms-txt.js:43 | Detected that function argument `dir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
apps/website/src/plugins/llms-txt.js:46 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
apps/website/src/plugins/llms-txt.js:46 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
apps/website/src/plugins/llms-txt.js:53 | Detected that function argument `dir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
apps/website/src/plugins/llms-txt.js:75 | Detected that function argument `context` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
apps/website/src/plugins/llms-txt.js:95 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
apps/website/src/plugins/llms-txt.js:97 | Detected that function argument `{ content, outDir }` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method |
packages/commandkit/src/app/commands/AppCommandRunner.ts:143 | Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method |
packages/commandkit/src/app/commands/Context.ts:395 | Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
packages/commandkit/src/cli/development.ts:78 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
packages/commandkit/src/cli/generators.ts:116 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
packages/commandkit/src/cli/generators.ts:117 | Detected that function argument `customPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
packages/commandkit/src/cli/generators.ts:117 | Detected that function argument `customPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
packages/commandkit/src/cli/generators.ts:124 | Detected that function argument `customPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
packages/commandkit/src/cli/generators.ts:124 | Detected that function argument `name` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
packages/commandkit/src/cli/generators.ts:124 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
packages/commandkit/src/cli/generators.ts:124 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
packages/commandkit/src/cli/generators.ts:132 | Detected that function argument `customPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
packages/commandkit/src/cli/generators.ts:132 | Detected that function argument `name` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
packages/commandkit/src/cli/generators.ts:132 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
packages/commandkit/src/cli/generators.ts:132 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
packages/commandkit/src/cli/generators.ts:146 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
packages/commandkit/src/cli/generators.ts:146 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
packages/commandkit/src/cli/generators.ts:147 | Detected that function argument `customPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
packages/commandkit/src/cli/generators.ts:147 | Detected that function argument `name` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
packages/commandkit/src/cli/generators.ts:147 | Detected that function argument `customPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
packages/commandkit/src/cli/generators.ts:147 | Detected that function argument `name` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
packages/commandkit/src/cli/generators.ts:154 | Detected that function argument `customPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
packages/commandkit/src/cli/generators.ts:154 | Detected that function argument `name` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
packages/commandkit/src/cli/generators.ts:154 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
packages/commandkit/src/cli/generators.ts:155 | Detected that function argument `customPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
packages/commandkit/src/cli/generators.ts:155 | Detected that function argument `name` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
packages/commandkit/src/cli/generators.ts:163 | Detected that function argument `customPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
packages/commandkit/src/cli/generators.ts:163 | Detected that function argument `name` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
packages/commandkit/src/cli/generators.ts:163 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
packages/commandkit/src/cli/generators.ts:163 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-require |
packages/commandkit/src/cli/information.ts:63 | Detected the use of require(variable). Calling require with a non-literal argument might allow an attacker to load and run arbitrary code, or access arbitrary files. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
packages/commandkit/src/cli/production.ts:20 | Detected that function argument `configPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop |
packages/commandkit/src/kv/dotprops.ts:24 | Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop |
packages/commandkit/src/kv/dotprops.ts:9 | Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-regexp |
packages/commandkit/src/kv/serde.ts:93 | RegExp() called with a `serialized` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method |
packages/commandkit/src/logger/DefaultLogger.ts:126 | Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method |
packages/commandkit/src/logger/DefaultLogger.ts:141 | Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method |
packages/commandkit/src/logger/DefaultLogger.ts:168 | Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
packages/commandkit/src/utils/resolve-file-url.ts:10 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
packages/commandkit/src/utils/types-package.ts:24 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
packages/i18n/src/cli.ts:57 | Detected that function argument `args` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
packages/i18n/src/cli.ts:61 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
packages/i18n/src/cli.ts:63 | Detected that function argument `args` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
packages/i18n/src/cli.ts:69 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
packages/i18n/src/cli.ts:71 | Detected that function argument `args` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
packages/i18n/src/cli.ts:72 | Detected that function argument `args` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
packages/i18n/src/cli.ts:82 | Detected that function argument `args` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
packages/i18n/src/i18n.ts:220 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
packages/i18n/src/i18n.ts:220 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
packages/i18n/src/i18n.ts:331 | Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
packages/legacy/src/cli.ts:100 | Detected that function argument `args` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
packages/legacy/src/cli.ts:112 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
packages/legacy/src/cli.ts:115 | Detected that function argument `args` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
packages/legacy/src/cli.ts:116 | Detected that function argument `args` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
packages/legacy/src/cli.ts:121 | Detected that function argument `args` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
packages/legacy/src/cli.ts:126 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
packages/legacy/src/cli.ts:126 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
packages/legacy/src/cli.ts:129 | Detected that function argument `args` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
packages/legacy/src/cli.ts:93 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
packages/legacy/src/cli.ts:96 | Detected that function argument `args` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
packages/ratelimit/src/plugin.ts:611 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-regexp |
packages/ratelimit/src/storage/memory.ts:354 | RegExp() called with a `glob` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... | Static analysis (opengrep) |
| medium | osv/GHSA-3g3m-2fjr-6pw4 |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-3g3m-2fjr-6pw4 | Dependencies (osv-scanner) |
| medium | osv/GHSA-46wx-v44x-9hh2 |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-46wx-v44x-9hh2 | Dependencies (osv-scanner) |
| medium | osv/GHSA-4h7h-rv7c-7m2v |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-4h7h-rv7c-7m2v | Dependencies (osv-scanner) |
| medium | osv/GHSA-4m76-xfj5-7975 |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-4m76-xfj5-7975 | Dependencies (osv-scanner) |
| medium | osv/GHSA-4q55-j62x-fr9h |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-4q55-j62x-fr9h | Dependencies (osv-scanner) |
| medium | osv/GHSA-4qv8-2p9j-2685 |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-4qv8-2p9j-2685 | Dependencies (osv-scanner) |
| medium | osv/GHSA-4qv8-2p9j-2685 |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-4qv8-2p9j-2685 | Dependencies (osv-scanner) |
| medium | osv/GHSA-55wc-3pg8-jfw6 |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-55wc-3pg8-jfw6 | Dependencies (osv-scanner) |
| medium | osv/GHSA-698v-4r3x-3vcv |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-698v-4r3x-3vcv | Dependencies (osv-scanner) |
| medium | osv/GHSA-6pq8-jhm2-2vcw |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-6pq8-jhm2-2vcw | Dependencies (osv-scanner) |
| medium | osv/GHSA-9fm3-97px-rjf6 |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-9fm3-97px-rjf6 | Dependencies (osv-scanner) |
| medium | osv/GHSA-9fm3-97px-rjf6 |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-9fm3-97px-rjf6 | Dependencies (osv-scanner) |
| medium | osv/GHSA-c6gr-qvv4-5v3f |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-c6gr-qvv4-5v3f | Dependencies (osv-scanner) |
| medium | osv/GHSA-f72v-6w45-q472 |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-f72v-6w45-q472 | Dependencies (osv-scanner) |
| medium | osv/GHSA-g3hv-75wg-m249 |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-g3hv-75wg-m249 | Dependencies (osv-scanner) |
| medium | osv/GHSA-g3hv-75wg-m249 |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-g3hv-75wg-m249 | Dependencies (osv-scanner) |
| medium | osv/GHSA-gcqx-w48m-w2h4 |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-gcqx-w48m-w2h4 | Dependencies (osv-scanner) |
| medium | osv/GHSA-h7mg-cq63-vhpq |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-h7mg-cq63-vhpq | Dependencies (osv-scanner) |
| medium | osv/GHSA-hx4r-w6wj-j8fg |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-hx4r-w6wj-j8fg | Dependencies (osv-scanner) |
| medium | osv/GHSA-jpvv-r467-5p4w |
pnpm-lock.yaml | @hono/[email protected] (npm) is affected by GHSA-jpvv-r467-5p4w | Dependencies (osv-scanner) |
| medium | osv/GHSA-qj8w-gfj5-8c6v |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-qj8w-gfj5-8c6v | Dependencies (osv-scanner) |
| medium | osv/GHSA-qv5m-9pm6-hqp3 |
pnpm-lock.yaml | @hono/[email protected] (npm) is affected by GHSA-qv5m-9pm6-hqp3 | Dependencies (osv-scanner) |
| medium | osv/GHSA-qxg6-89mg-rqv8 |
pnpm-lock.yaml | @vitest/[email protected] (npm) is affected by GHSA-qxg6-89mg-rqv8 | Dependencies (osv-scanner) |
| medium | osv/GHSA-r825-w8mm-5pxw |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-r825-w8mm-5pxw | Dependencies (osv-scanner) |
| medium | osv/GHSA-rj75-hqrm-r3gf |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-rj75-hqrm-r3gf | Dependencies (osv-scanner) |
| medium | osv/GHSA-rq7h-c2jc-7f22 |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-rq7h-c2jc-7f22 | Dependencies (osv-scanner) |
| medium | osv/GHSA-w74x-v6f9-j3xg |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-w74x-v6f9-j3xg | Dependencies (osv-scanner) |
| medium | osv/GHSA-wjr9-j795-jxcr |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-wjr9-j795-jxcr | Dependencies (osv-scanner) |
| medium | osv/GHSA-xp26-3454-mjgp |
pnpm-lock.yaml | @vitest/[email protected] (npm) is affected by GHSA-xp26-3454-mjgp | Dependencies (osv-scanner) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
scripts/docs/docgen-utils.ts:58 | Detected that function argument `outputPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
scripts/docs/docgen-utils.ts:65 | Detected that function argument `outputPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
scripts/docs/docgen-utils.ts:67 | Detected that function argument `outputPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
scripts/docs/generate-typescript-docs.ts:161 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
scripts/docs/generate-typescript-docs.ts:171 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
scripts/docs/typescript-docs-parser.ts:44 | Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
scripts/docs/typescript-docs-renderer.ts:480 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
scripts/docs/typescript-docs-renderer.ts:524 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
scripts/docs/typescript-docs-renderer.ts:545 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
scripts/docs/typescript-docs-renderer.ts:567 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
scripts/docs/typescript-docs-renderer.ts:586 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
scripts/docs/typescript-docs-renderer.ts:590 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
scripts/docs/typescript-docs-renderer.ts:612 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/ai/src/cli-plugin.ts:5 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/ai/src/cli-plugin.ts:5 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
packages/commandkit/analytics.cjs:1 | `const` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
packages/commandkit/analytics.cjs:2 | `const` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
packages/commandkit/analytics.cjs:3 | `const` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
packages/commandkit/config.cjs:1 | `const` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
packages/commandkit/hooks.cjs:1 | `const` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
packages/commandkit/logger.cjs:1 | `const` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
packages/commandkit/logger.cjs:2 | `const` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/commandkit/src/cli/build.ts:279 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
packages/commandkit/src/cli/development.ts:230 | `ps` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/commandkit/src/cli/generators.ts:32 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/commandkit/src/cli/generators.ts:32 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/commandkit/src/cli/generators.ts:54 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/commandkit/src/cli/generators.ts:54 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/commandkit/src/cli/generators.ts:59 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/commandkit/src/cli/generators.ts:66 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/commandkit/src/cli/generators.ts:84 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/commandkit/src/cli/generators.ts:84 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
packages/commandkit/src/config/config.ts:23 | `defined` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/commandkit/src/utils/types-package.ts:38 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/commandkit/src/utils/types-package.ts:38 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/legacy/src/cli.ts:45 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/legacy/src/cli.ts:45 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/legacy/src/cli.ts:49 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/legacy/src/cli.ts:58 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/legacy/src/cli.ts:58 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/legacy/src/cli.ts:63 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/ratelimit/src/storage/redis.ts:14 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/ratelimit/src/storage/redis.ts:14 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/ratelimit/src/storage/redis.ts:26 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/ratelimit/src/storage/redis.ts:26 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
skills/commandkit-ai/tools/generate-ai-command-template.mjs:3 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
skills/commandkit-ai/tools/generate-ai-command-template.mjs:3 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
skills/commandkit-plugin-development/tools/generate-compiler-plugin-template.mjs:3 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
skills/commandkit-plugin-development/tools/generate-compiler-plugin-template.mjs:3 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
skills/commandkit-plugin-development/tools/generate-runtime-plugin-template.mjs:3 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
skills/commandkit-plugin-development/tools/generate-runtime-plugin-template.mjs:3 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
skills/commandkit-ratelimit/tools/generate-ratelimit-config.mjs:3 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
skills/commandkit-ratelimit/tools/generate-ratelimit-config.mjs:3 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
skills/commandkit-tasks/tools/generate-task-template.mjs:14 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
skills/commandkit-tasks/tools/generate-task-template.mjs:14 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
skills/commandkit-tasks/tools/generate-task-template.mjs:6 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
skills/commandkit-tasks/tools/generate-task-template.mjs:6 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
turbo/generators/config.ts:27 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
turbo/generators/config.ts:27 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | gitleaks/generic-api-key |
apps/website/docusaurus.config.ts:115 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | osv/GHSA-238p-pmpm-9mq7 |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-238p-pmpm-9mq7 | Dependencies (osv-scanner) |
| low | osv/GHSA-333x-w4r6-6crp |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-333x-w4r6-6crp | Dependencies (osv-scanner) |
| low | osv/GHSA-3gg2-335m-rxc6 |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-3gg2-335m-rxc6 | Dependencies (osv-scanner) |
| low | osv/GHSA-9jrq-w75r-8gcw |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-9jrq-w75r-8gcw | Dependencies (osv-scanner) |
| low | osv/GHSA-m5mm-p8h7-m29v |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-m5mm-p8h7-m29v | Dependencies (osv-scanner) |
| low | osv/GHSA-wf3x-273g-mvxv |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-wf3x-273g-mvxv | Dependencies (osv-scanner) |
| low | osv/GHSA-xhq7-xmqj-769h |
pnpm-lock.yaml | [email protected] (npm) is affected by GHSA-xhq7-xmqj-769h | Dependencies (osv-scanner) |
| info | zizmor/superfluous-actions |
.github/workflows/publish-latest.yaml:255 | action functionality is already included by the runner [confidence high] | CI workflows (zizmor) |
Tools and coverage
Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.
| Analyzer | Pillar | Status | Version | Findings | Note |
|---|---|---|---|---|---|
| AI tool configuration | AI provenance | ok | signatures-v1 | 0 | |
| Explicit AI attribution | AI provenance | ok | signatures-v1 | 0 | |
| Release velocity | AI provenance | ok | prov-4 | 0 | |
| Coding style | AI provenance | ok | — | 0 | |
| Commit velocity | AI provenance | ok | prov-4 | 0 | |
| Findings in AI-written lines | AI provenance | ok | git-blame | 0 | |
| Complexity (lizard) | Code quality | ok | lizard 1.25.1 | 0 | |
| Documentation | Code quality | ok | — | 0 | |
| Duplication (jscpd) | Code quality | ok | repotrust-dup-w6 | 0 | |
| Lint | Code quality | ok | opengrep 1.33.1; rules f1d2b562b414 | 65 | |
| Tests and CI | Code quality | ok | — | 0 | |
| Type safety | Code quality | ok | — | 0 | |
| CI workflows (zizmor) | Security | ok | zizmor 1.32.0 | 20 | |
| Dependencies (osv-scanner) | Security | ok | osv-scanner version: 2.7.1 | 62 | |
| Release downloads | Security | ok | — | 0 | |
| Security posture | Security | ok | — | 0 | |
| Package registries | Security | ok | — | 0 | |
| Static analysis (opengrep) | Security | ok | opengrep 1.33.1; rules f1d2b562b414 | 91 | |
| OpenSSF Scorecard | Security | skipped | — | 0 | no published OpenSSF Scorecard result for this repo |
| Secrets (gitleaks) | Security | ok | gitleaks 8.30.1 | 1 |
Score history
Scores from different scoring versions aren't directly comparable.
| Scored | Commit | Scoring | AI provenance | Quality | Security |
|---|---|---|---|---|---|
| 2026-11-14 | e65f24305f2e | prov-5+qual-2+sec-2 | 0% | 72 | 56 |
| 2026-11-14 | e65f24305f2e | prov-4+qual-2+sec-2 | 0% | 72 | 56 |
Full text report
- Repository: https://github.com/neplexlabs/commandkit
- Commit:
e65f24305f2e05780dda4c5b86de2df2752fc09a - Generated: 2026-11-14T14:52:06+00:00
- Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 0 | explicit | 95% | 100% |
| Code quality | 72 | adequate | 90% | 100% |
| Security | 56 | weak | 85% | 100% |
AI provenance
Explicit AI attribution on 0% of first-party code added; an estimated 0% including velocity signals.
- Explicitly attributed share (lower bound): 0.2%
- Unattributed share in AI-consistent velocity bursts: 10.6%
- Estimated AI-generated share: 0.2%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| GitHub Copilot coding agent | 8 | 118 |
| OpenAI Codex | 3 | 45 |
- AI tooling configured in repo: generic-agent
Current source lines last changed by AI-attributed commits: 159 of 37,938.
Too few lines in one group to compare finding densities.
- Stylometry index: 0.62 per 1,000 lines (narrated steps 4, placeholders 1, assistant phrasing 0, emoji 35). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2025-09 | 779 | 0% |
| 2025-10 | 3,538 | 2% |
| 2025-11 | 395 | 0% |
| 2025-12 | 2 | 0% |
| 2026-01 | 207 | 20% |
| 2026-02 | 105 | 2% |
| 2026-03 | 6,957 | 0% |
| 2026-04 | 4,713 | 0% |
| 2026-06 | 522 | 0% |
| 2026-07 | 48 | 0% |
| 2026-09 | 256 | 0% |
| 2026-10 | 168 | 27% |
Evidence
- OpenAI Codex: PR branch 'codex/issue-641-event-handler-docs' (e65f24305f2e)
- OpenAI Codex: trailer 'Co-authored-by: Codex' (73b3e1330de3)
- OpenAI Codex: trailer 'Co-authored-by: Codex' (746554dadb48)
- GitHub Copilot coding agent: author Copilot (1393c5e7256b)
- GitHub Copilot coding agent: author Copilot (7dffdfd7a9c5)
- GitHub Copilot coding agent: author Copilot (36604777aef2)
- GitHub Copilot coding agent: author Copilot (a1ed97a3bed9)
- GitHub Copilot coding agent: author copilot-swe-agent[bot] (9d177f4b2d23)
- GitHub Copilot coding agent: author copilot-swe-agent[bot] (79953af3a99e)
- GitHub Copilot coding agent: author copilot-swe-agent[bot] (ac0b5b05141c)
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot' (af979e990201)
- AGENTS.md (generic-agent configuration) (AGENTS.md)
- 1,938 lines of first-party code in ~1.9h (1,011 lines/hour, 3 commit session) (9c01fc3ffb90)
- 2,414 lines of first-party code in ~4.0h (604 lines/hour, 1 commit session) (855609bc8ce0)
- 2,216 lines of first-party code in ~4.0h (554 lines/hour, 1 commit session) (283f9353c9ba)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is adequate: test-to-source ratio 0.10, CI runs tests; 11% of function code in complex or long functions; 9% duplicated lines. Weakest area: duplication.
| Area | Score |
|---|---|
| Complexity (lizard) | 72 |
| Duplication | 58 |
| Code smells (Opengrep) | 81 |
| Tests and CI | 73 |
| Documentation | 80 |
| Type safety | 60 |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 1,906; mean complexity 2.6, 90th percentile 6; 21 complex and 9 long functions
- Duplicated lines: 9.1% of 23,816 compared
- Tests: 3,721 test lines for 37,938 source lines (ratio 0.10); CI test commands: npm run test; 7% of recent source commits also change tests
- Docs missing or thin: changelog
Most complex functions:
- traverseDirectory in packages/commandkit/src/app/router/CommandsRouter.ts: complexity 39, 200 lines
- beforeExecute in packages/commandkit/src/app/middlewares/permissions.ts: complexity 38, 117 lines
- executeCommand in packages/ratelimit/src/plugin.ts: complexity 37, 206 lines
- prepareCommandRun in packages/commandkit/src/app/handlers/AppCommandHandler.ts: complexity 35, 113 lines
- parseMembers in scripts/docs/typescript-docs-parser.ts: complexity 29, 106 lines
Security
Security posture is weak: 62 known vulnerabilities in 26 dependencies; 15 high-severity workflow issues. Weakest area: ci actions.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 97 |
| Static analysis (Opengrep) | 80 |
| Vulnerable dependencies (OSV) | 6 |
| CI workflows (zizmor) | 5 |
| Posture (policy, updates, signing, lockfiles) | 80 |
| OpenSSF Scorecard | n/a |
-
Known vulnerabilities: 62 in 26 packages (critical 3, high 23, medium 28, low 7)
-
Posture checks passed: security policy, dependency updates; missing: signed commits, lockfiles
Top findings
| Severity | Finding | Location |
|---|---|---|
| critical | osv/GHSA-cg2g-xh64-v4q7: [email protected] (npm) is affected by GHSA-cg2g-xh64-v4q7 |
pnpm-lock.yaml |
| critical | osv/GHSA-5gmw-xhrv-c9v3: [email protected] (npm) is affected by GHSA-5gmw-xhrv-c9v3 |
pnpm-lock.yaml |
| critical | osv/GHSA-85c8-ppgw-ccpr: [email protected] (npm) is affected by GHSA-85c8-ppgw-ccpr |
pnpm-lock.yaml |
| high | osv/GHSA-27r3-jxmh-p828: [email protected] (npm) is affected by GHSA-27r3-jxmh-p828 |
pnpm-lock.yaml |
| high | osv/GHSA-j22f-vq7h-c4qm: [email protected] (npm) is affected by GHSA-j22f-vq7h-c4qm |
pnpm-lock.yaml |
| high | osv/GHSA-mcm9-63f2-9j32: [email protected] (npm) is affected by GHSA-mcm9-63f2-9j32 |
pnpm-lock.yaml |
| high | osv/GHSA-r9w8-h9r3-54w4: [email protected] (npm) is affected by GHSA-r9w8-h9r3-54w4 |
pnpm-lock.yaml |
| high | osv/GHSA-x5rw-q4pp-hg5g: [email protected] (npm) is affected by GHSA-x5rw-q4pp-hg5g |
pnpm-lock.yaml |
| high | osv/GHSA-mrv2-3pqr-j5jr: [email protected] (npm) is affected by GHSA-mrv2-3pqr-j5jr |
pnpm-lock.yaml |
| high | osv/GHSA-mrwp-f3q8-3g9p: [email protected] (npm) is affected by GHSA-mrwp-f3q8-3g9p |
pnpm-lock.yaml |
| high | osv/GHSA-4528-x5fx-h6hg: [email protected] (npm) is affected by GHSA-4528-x5fx-h6hg |
pnpm-lock.yaml |
| high | osv/GHSA-28wg-ghj8-5hjv: [email protected] (npm) is affected by GHSA-28wg-ghj8-5hjv |
pnpm-lock.yaml |
| high | osv/GHSA-xwg4-73v4-xw9w: [email protected] (npm) is affected by GHSA-xwg4-73v4-xw9w |
pnpm-lock.yaml |
| high | osv/GHSA-5c6j-r48x-rmvq: [email protected] (npm) is affected by GHSA-5c6j-r48x-rmvq |
pnpm-lock.yaml |
| high | osv/GHSA-2m5v-pch6-74hx: [email protected] (npm) is affected by GHSA-2m5v-pch6-74hx |
pnpm-lock.yaml |
| high | osv/GHSA-qrxm-fqhp-jwvm: [email protected] (npm) is affected by GHSA-qrxm-fqhp-jwvm |
pnpm-lock.yaml |
| high | osv/GHSA-xjj6-f33q-929c: [email protected] (npm) is affected by GHSA-xjj6-f33q-929c |
pnpm-lock.yaml |
| high | osv/GHSA-2m5v-pch6-74hx: [email protected] (npm) is affected by GHSA-2m5v-pch6-74hx |
pnpm-lock.yaml |
| high | osv/GHSA-4w7w-5xrc-9h26: [email protected] (npm) is affected by GHSA-4w7w-5xrc-9h26 |
pnpm-lock.yaml |
| high | osv/GHSA-qrxm-fqhp-jwvm: [email protected] (npm) is affected by GHSA-qrxm-fqhp-jwvm |
pnpm-lock.yaml |
| high | osv/GHSA-xjj6-f33q-929c: [email protected] (npm) is affected by GHSA-xjj6-f33q-929c |
pnpm-lock.yaml |
| high | osv/GHSA-w5hq-g745-h8pq: [email protected] (npm) is affected by GHSA-w5hq-g745-h8pq |
pnpm-lock.yaml |
| high | osv/GHSA-587h-7wmj-h5pm: [email protected] (npm) is affected by GHSA-587h-7wmj-h5pm |
pnpm-lock.yaml |
| high | osv/GHSA-mrhx-c7xc-m3w5: [email protected] (npm) is affected by GHSA-mrhx-c7xc-m3w5 |
pnpm-lock.yaml |
| high | osv/GHSA-mrhx-c7xc-m3w5: [email protected] (npm) is affected by GHSA-mrhx-c7xc-m3w5 |
pnpm-lock.yaml |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Repository profile
- Source lines: 37,938; test lines: 3,721
| Language | Lines |
|---|---|
| TypeScript | 40,890 |
| JavaScript | 733 |
| SQL | 36 |