Leaderboard github.com

notque/vexjoy-agent

VexJoy AI Agent with Jev Intelligent Routing - /do routes plain-English requests to the right specialist agent and gates the work with reviews, tests, and a learning loop.

View repository ↗
Python
★ 450
commit 871f649901b3
scored 2026-11-14
scoring prov-5+qual-2+sec-2

AI provenance

explicit

Confidence: 95%
Coverage: 100%

Estimated share of AI-generated code. Explicit attribution is a lower bound.

Code quality

69/100

adequate

Confidence: 90%
Coverage: 100%

Complexity, duplication, lint density, tests, CI, docs and review process.

Security

45/100

poor

Confidence: 85%
Coverage: 100%

Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.

Dispute or request a re-score Full report JSON

AI provenance

9% explicit

Explicit AI attribution on 9% of first-party code added; an estimated 9% including velocity signals.

How the score is built

Explicitly attributed share9%
Unattributed share in AI-pace bursts33%
Estimated AI-generated share9%
AI tool configuration files6
Work sessions at AI pace49
Releases at AI pacenot measured
Coding-style index (1.0+ means possible)0.62

Attributed AI tools

Tool	Commits	Lines added	First seen	Last seen
Claude Code	197	35,012	2026-03-21	2026-11-13

Lines added per month all AI-attributed share

2026-03115,909 · 0% AI
2026-0440,295 · 0% AI
2026-0550,925 · 0% AI
2026-0618,627 · 1% AI
2026-0729,317 · 0% AI
2026-0822,962 · 11% AI
2026-0952,835 · 0% AI
2026-1025,648 · 11% AI
2026-1131,591 · 93% AI

Findings in AI-attributed lines vs the rest

From git blame: 14,816 lines trace to AI-attributed commits, 157,182 to others. Reported, not scored.

Findings per 1,000 lines	AI-attributed	Other	Ratio
Code quality	1.49	1.13	1.31×
Security	1.49	1.77	0.84×

Evidence by analyzer

Explicit AI attributionok26 items

attributed_commit_share: 13.5%
attributed_commits: 197
attributed_loc: 35,012
attributed_loc_share: 9.0%
commits: 1,454
effective_loc: 388,109
tools_detected: 1

AI tool configurationok6 items

artifacts: 4
earliest_adoption: 2026-03-22
tools_configured: 3
workflow_agents: 2

Commit velocityok15 items

excluded_import_loc: 109,596
flagged_loc: 146,754
flagged_loc_share: 52.7%
flagged_units: 49
max_loc_per_hour: 6,322
measured_loc: 278,513
median_loc_per_hour: 257.46
pr_timed_units: 164
pre_ai_era_burst_loc: 0
pre_ai_era_bursts: 0
pre_ai_era_measured_loc: 0
work_units: 408

Release velocityskipped

Coding styleok8 items

count:assistant_voice: 0
count:emoji_in_code: 102
count:narrated_steps: 51
count:placeholder: 2
files:assistant_voice: 0
files:emoji_in_code: 14
files:narrated_steps: 14
files:placeholder: 1
index: 0.62
lines_scanned: 171,998
per_kloc:assistant_voice: 0
per_kloc:emoji_in_code: 0.59
per_kloc:narrated_steps: 0.30
per_kloc:placeholder: 0.01

Findings in AI-written linesok

ai_lines: 14,816
blame_failures: 0
files_blamed: 493
other_lines: 157,182
quality:ai_findings: 22
quality:ai_per_kloc: 1.49
quality:other_findings: 178
quality:other_per_kloc: 1.13
quality:ratio: 1.31
security:ai_findings: 22
security:ai_per_kloc: 1.49
security:other_findings: 278
security:other_per_kloc: 1.77
security:ratio: 0.84

Code quality

69 adequate

Code quality is adequate: test-to-source ratio 0.60, CI runs tests; 27% of function code in complex or long functions; 8% duplicated lines. Weakest area: type safety.

How the score is built

Complexity44
Duplication61
Lint and smells71
Tests and CI100
Documentation80
Type safety0
Review processnot measured

Evidence by analyzer

Complexity (lizard)ok10 items

complex_functions: 320
function_nloc: 96,590
functions: 4,944
long_functions: 68
many_param_functions: 60
mean_ccn: 6.07
p90_ccn: 13
risky_nloc_share: 27.0%

Duplication (jscpd)ok10 items

compared_lines: 132,441
duplicated_lines: 10,751
duplicated_share: 8.1%
files: 493

Lintok

category:best-practice: 68
category:correctness: 170
category:maintainability: 38
findings: 276
scanned_lines: 171,998
weighted_findings: 237

Tests and CIok5 items

CI config: .github/workflows/claude.yml .github/workflows/claude.yml
CI config: .github/workflows/pr-ai-review.yml .github/workflows/pr-ai-review.yml
CI config: .github/workflows/test.yml .github/workflows/test.yml
CI runs tests (pytest)
CI runs linters (ruff)

check:ci_present: yes
check:ci_runs_lint: yes
check:ci_runs_tests: yes
check:has_tests: yes
check:test_ratio: yes
check:tests_cochange: yes
ci_files: 3
cochange_commits: 208
cochange_share: 90.4%
source_lines: 171,998
test_lines: 103,543
test_ratio: 0.60

Documentationok3 items

README.md README.md
LICENSE LICENSE
CONTRIBUTING.md CONTRIBUTING.md

check:changelog: no
check:contributing: yes
check:license: yes
check:readme: yes
readme_lines: 209

Type safetyok1 item

TypeScript strict type checking: plugins/custom-panel/tsconfig.json plugins/custom-panel/tsconfig.json

check:low_escape_density: no
check:strict_config: no
escapes: 868
escapes_per_kloc: 5.37

Security

45 poor

Security posture is poor: 60 known vulnerabilities in 3 dependencies; 262 high-severity SAST findings; 26 high-severity workflow issues. Weakest area: posture.

How the score is built

Secrets61
Static analysis (SAST)55
Vulnerable dependencies70
CI workflows0
Security posture0
OpenSSF Scorecardnot measured

Evidence by analyzer

OpenSSF Scorecardskipped

no published OpenSSF Scorecard result for this repo

Package registriesok

checked: 28
declared: 28
lookup_errors: 0
missing: 0
recent: 0

Secrets (gitleaks)ok

secrets_current: 0
secrets_history: 0
secrets_low_confidence: 0
secrets_nonprod: 15

Static analysis (opengrep)ok

findings: 307
findings_high: 262
findings_low: 1
findings_medium: 44
parse_errors: 6
scanned_lines: 171,998
weighted_findings: 296.15

Dependencies (osv-scanner)ok

penalty: 21
vulnerabilities: 60
vulnerable_packages: 3
vulns_critical: 6
vulns_high: 34
vulns_low: 0
vulns_medium: 18
vulns_unknown: 2

CI workflows (zizmor)ok

findings: 51
findings_high: 26
findings_low: 13
findings_medium: 12
penalty: 339.90
workflows: 3

Security postureok1 item

plugins/custom-panel/package.json has no lockfile alongside it (unpinned dependencies) plugins/custom-panel/package.json

check:dependency_updates: no
check:lockfiles: no
check:security_policy: no
check:signed_commits: no
signed_commit_share: 15.5%
unpinned_manifests: 1

Release downloadsok

binary_assets: 0
signals: 0
suspicious: 0

Findings

6 critical343 high217 medium60 low

Severity	Rule	Location	Message	Tool
critical	`osv/GHSA-332p-7hrc-92wf`	requirements.txt	[email protected] (PyPI) is affected by GHSA-332p-7hrc-92wf	Dependencies (osv-scanner)
critical	`osv/GHSA-3f63-hfp8-52jq`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-457, GHSA-3f63-hfp8-52jq	Dependencies (osv-scanner)
critical	`osv/GHSA-5x8w-8jj5-q52h`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-4330, GHSA-5x8w-8jj5-q52h	Dependencies (osv-scanner)
critical	`osv/GHSA-8g5g-8vmr-9782`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-4332, GHSA-8g5g-8vmr-9782	Dependencies (osv-scanner)
critical	`osv/GHSA-w889-685w-c8fh`	requirements.txt	[email protected] (PyPI) is affected by GHSA-w889-685w-c8fh	Dependencies (osv-scanner)
critical	`osv/GHSA-xvh5-g6gv-559v`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-4363, GHSA-xvh5-g6gv-559v	Dependencies (osv-scanner)
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	hooks/agy-hook-adapter.py:174	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.correctness.tempfile.tempfile-without-flush`	hooks/jev-route-injector-userprompt.py:127	Using 'tmp.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'tmp.name' is used. Use '.flush()' or close the file before using 'tmp.name'.	Lint
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	hooks/posttool-session-reads.py:204	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	hooks/session-task-registry.py:112	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.correctness.tempfile.tempfile-without-flush`	scripts/crontab-manager.py:112	Using 'f.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'f.name' is used. Use '.flush()' or close the file before using 'f.name'.	Lint
high	`opengrep/python.lang.correctness.tempfile.tempfile-without-flush`	scripts/d_route_model.py:61	Using 'fh.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'fh.name' is used. Use '.flush()' or close the file before using 'fh.name'.	Lint
high	`opengrep/python.lang.correctness.tempfile.tempfile-without-flush`	scripts/d_route_model.py:87	Using 'fh.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'fh.name' is used. Use '.flush()' or close the file before using 'fh.name'.	Lint
high	`opengrep/python.lang.best-practice.open-never-closed`	scripts/jev-browser-agent.py:124	file object opened without corresponding close	Lint
high	`opengrep/python.lang.correctness.tempfile.tempfile-without-flush`	scripts/jev-route.py:228	Using 'tmp.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'tmp.name' is used. Use '.flush()' or close the file before using 'tmp.name'.	Lint
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	scripts/jev-size-probe.py:111	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	scripts/jev_router_common.py:810	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.correctness.tempfile.tempfile-without-flush`	scripts/router_attachment/run_eval.py:163	Using 'fh.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'fh.name' is used. Use '.flush()' or close the file before using 'fh.name'.	Lint
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	scripts/search-engine-bulk-indexer.py:250	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	scripts/search-engine-bulk-indexer.py:278	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	scripts/validate-hook-health.py:788	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	scripts/vexinstall/lock.py:66	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	skills/content/content/scripts/publish/pagespeed.py:76	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	skills/content/image-gen/scripts/generate_image.py:266	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	skills/game/game-dev/scripts/fal_queue_image_run.py:183	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	skills/game/game-dev/scripts/with_server.py:63	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.correctness.tempfile.tempfile-without-flush`	skills/meta/toolkit/scripts/agent-comparison/optimize_loop.py:681	Using 'f.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'f.name' is used. Use '.flush()' or close the file before using 'f.name'.	Lint
high	`zizmor/unpinned-uses`	.github/workflows/claude.yml:36	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/dangerous-triggers`	.github/workflows/claude.yml:4	use of fundamentally insecure workflow trigger [confidence medium]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/pr-ai-review.yml:43	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/test.yml:119	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/test.yml:120	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/test.yml:133	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/test.yml:134	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/test.yml:145	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/test.yml:146	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/test.yml:157	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/test.yml:158	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/test.yml:169	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/test.yml:17	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/test.yml:170	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/test.yml:18	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/test.yml:180	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/test.yml:181	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/test.yml:211	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/test.yml:214	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/template-injection`	.github/workflows/test.yml:222	code injection via template expansion [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/test.yml:237	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/test.yml:238	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/test.yml:252	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/test.yml:255	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/test.yml:96	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/test.yml:97	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	conftest.py:139	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	hooks/adr-enforcement.py:144	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/adr-enforcement.py:27	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/adr-enforcement.py:27	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/adr-lifecycle-on-merge.py:31	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/adr-lifecycle-on-merge.py:31	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	hooks/adr-lifecycle-on-merge.py:81	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/afk-mode.py:33	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/afk-mode.py:33	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/agy-hook-adapter.py:38	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/agy-hook-adapter.py:38	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	hooks/agy-hook-adapter.py:685	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/ci-merge-gate.py:21	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/ci-merge-gate.py:21	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/codex-auto-review.py:42	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/codex-auto-review.py:42	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/codex-hook-adapter.py:26	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/codex-hook-adapter.py:26	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	hooks/codex-hook-adapter.py:532	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/creation-protocol-enforcer.py:37	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/creation-protocol-enforcer.py:37	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/cross-repo-agents.py:28	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/cross-repo-agents.py:28	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/fish-shell-detector.py:35	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/fish-shell-detector.py:35	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/gemini-turn-gate-userprompt.py:23	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/gemini-turn-gate-userprompt.py:23	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/herdr-state-reporter.py:20	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/herdr-state-reporter.py:20	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/hook-version-parity-check.py:39	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/hook-version-parity-check.py:39	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	hooks/jev-route-injector-userprompt.py:128	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/jev-route-injector-userprompt.py:39	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/jev-route-injector-userprompt.py:39	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	hooks/lib/installed_index.py:57	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query`	hooks/lib/learning_db_v2.py:1844	Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used...	Static analysis (opengrep)
high	`opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query`	hooks/lib/learning_db_v2.py:1851	Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used...	Static analysis (opengrep)
high	`opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query`	hooks/lib/learning_db_v2.py:1921	Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used...	Static analysis (opengrep)
high	`opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query`	hooks/lib/learning_db_v2.py:1926	Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used...	Static analysis (opengrep)
high	`opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query`	hooks/lib/learning_db_v2.py:1981	Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used...	Static analysis (opengrep)
high	`opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query`	hooks/lib/learning_db_v2.py:2169	Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used...	Static analysis (opengrep)
high	`opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query`	hooks/lib/learning_db_v2.py:2491	Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used...	Static analysis (opengrep)
high	`opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query`	hooks/lib/learning_db_v2.py:2631	Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used...	Static analysis (opengrep)
high	`opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query`	hooks/lib/learning_db_v2.py:336	Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	hooks/lib/manifest_cache.py:117	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	hooks/lib/quality_gate.py:162	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	hooks/lib/quality_gate.py:260	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.subprocess-shell-true`	hooks/lib/quality_gate.py:262	Found 'subprocess' function 'run' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	hooks/mcp-health-check.py:261	Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	hooks/mcp-health-check.py:331	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args`	hooks/mcp-health-check.py:332	Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/operator-context-detector.py:46	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/operator-context-detector.py:46	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/pending-advisory-injector-userprompt.py:32	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/pending-advisory-injector-userprompt.py:32	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/pipeline-context-detector.py:41	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/pipeline-context-detector.py:41	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/pipeline-phase-gate.py:63	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/pipeline-phase-gate.py:63	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/postcompact-handler.py:20	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/postcompact-handler.py:20	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/posttool-bash-injection-scan.py:28	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/posttool-bash-injection-scan.py:28	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/posttool-docs-drift-alert.py:25	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/posttool-docs-drift-alert.py:25	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	hooks/posttool-docs-drift-alert.py:90	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/posttool-rename-sweep.py:30	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/posttool-rename-sweep.py:30	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/posttool-security-scan.py:44	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/posttool-security-scan.py:44	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/posttool-session-reads.py:54	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/posttool-session-reads.py:54	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/posttool-skill-frontmatter-check.py:25	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/posttool-skill-frontmatter-check.py:25	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	hooks/posttool-skill-frontmatter-check.py:93	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/posttooluse-joy-check-warn.py:24	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/posttooluse-joy-check-warn.py:24	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/posttooluse-sync-agent-index.py:29	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/posttooluse-sync-agent-index.py:29	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/posttooluse-sync-skill-index.py:34	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/posttooluse-sync-skill-index.py:34	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/precompact-archive.py:34	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/precompact-archive.py:34	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/pretool-adr-creation-gate.py:47	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/pretool-adr-creation-gate.py:47	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/pretool-branch-safety.py:34	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/pretool-branch-safety.py:34	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/pretool-config-protection.py:30	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/pretool-config-protection.py:30	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/pretool-dispatch-spec-gate.py:46	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/pretool-dispatch-spec-gate.py:46	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/pretool-file-backup.py:40	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/pretool-file-backup.py:40	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/pretool-plan-gate.py:36	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/pretool-plan-gate.py:36	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/pretool-private-name-leak-gate.py:103	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/pretool-private-name-leak-gate.py:103	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/pretool-prompt-injection-scanner.py:33	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/pretool-prompt-injection-scanner.py:33	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/pretool-review-before-push-gate.py:48	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/pretool-review-before-push-gate.py:48	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/pretool-routing-gate.py:26	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/pretool-routing-gate.py:26	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/pretool-ruff-format-gate.py:46	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/pretool-ruff-format-gate.py:46	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/pretool-section-integrity-validator.py:33	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/pretool-section-integrity-validator.py:33	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/pretool-synthesis-gate.py:50	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/pretool-synthesis-gate.py:50	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	hooks/pretool-unified-gate.py:1667	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/pretool-unified-gate.py:47	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/pretool-unified-gate.py:47	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	hooks/pretool-voice-publish-gate.py:64	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/pretool-worktree-edit-guard.py:60	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/pretool-worktree-edit-guard.py:60	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/prompt-capture.py:36	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/prompt-capture.py:36	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/reference-loading-enforcer.py:37	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/reference-loading-enforcer.py:37	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/review-capture.py:31	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/review-capture.py:31	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/review-false-positive-capture.py:26	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/review-false-positive-capture.py:26	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/routing-decision-recorder.py:83	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/routing-decision-recorder.py:83	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/routing-outcome-finalizer.py:94	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/routing-outcome-finalizer.py:94	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/routing-outcome-recorder.py:64	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/routing-outcome-recorder.py:64	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/routing-outcome-stop-fallback.py:56	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/routing-outcome-stop-fallback.py:56	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/rules-distill-injector.py:29	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/rules-distill-injector.py:29	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	hooks/rules-distill-trigger.py:105	Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/rules-distill-trigger.py:24	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/rules-distill-trigger.py:24	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/sapcc-go-detector.py:37	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/sapcc-go-detector.py:37	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	hooks/security-review-hook.py:183	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/security-review-hook.py:84	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/security-review-hook.py:84	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/session-adr-health-check.py:39	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/session-adr-health-check.py:39	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/session-context.py:31	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/session-context.py:31	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/session-github-briefing.py:22	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/session-github-briefing.py:22	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/session-manifest-cache.py:36	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/session-manifest-cache.py:36	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/session-no-agent-summary-check.py:32	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/session-no-agent-summary-check.py:32	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/session-summary.py:27	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/session-summary.py:27	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/session-task-registry.py:28	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/session-task-registry.py:28	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	hooks/stop-drift-guard.py:311	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/stop-drift-guard.py:71	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/stop-drift-guard.py:71	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/stop-failure-handler.py:19	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/stop-failure-handler.py:19	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/subagent-completion-guard.py:52	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/subagent-completion-guard.py:52	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/subagent-start-warmstart.py:35	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/subagent-start-warmstart.py:35	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/subagent-state-tracker.py:27	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/subagent-state-tracker.py:27	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/suggest-compact.py:42	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/suggest-compact.py:42	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	hooks/sync-to-user-claude.py:129	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/sync-to-user-claude.py:38	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/sync-to-user-claude.py:38	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/team-config-loader.py:33	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/team-config-loader.py:33	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/usage-tracker.py:27	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/usage-tracker.py:27	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`	hooks/zsh-shell-detector.py:37	Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`	hooks/zsh-shell-detector.py:37	Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	Static analysis (opengrep)
high	`osv/GHSA-22hg-r758-rrw9`	requirements.txt	[email protected] (PyPI) is affected by GHSA-22hg-r758-rrw9	Dependencies (osv-scanner)
high	`osv/GHSA-27h8-gf7j-v5hc`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-4326, GHSA-27h8-gf7j-v5hc	Dependencies (osv-scanner)
high	`osv/GHSA-3j72-p6qg-6xp7`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-4341, GHSA-3j72-p6qg-6xp7	Dependencies (osv-scanner)
high	`osv/GHSA-44wm-f244-xhp3`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-1793, GHSA-44wm-f244-xhp3	Dependencies (osv-scanner)
high	`osv/GHSA-4558-3h8r-v8xp`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-4327, GHSA-4558-3h8r-v8xp	Dependencies (osv-scanner)
high	`osv/GHSA-45hq-cxwh-f6vc`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-2255, GHSA-45hq-cxwh-f6vc	Dependencies (osv-scanner)
high	`osv/GHSA-58r4-6rv3-gfh8`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-4329, GHSA-58r4-6rv3-gfh8	Dependencies (osv-scanner)
high	`osv/GHSA-5x94-69rx-g8h2`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-2254, GHSA-5x94-69rx-g8h2	Dependencies (osv-scanner)
high	`osv/GHSA-5xm2-6676-qcp9`	requirements.txt	[email protected] (PyPI) is affected by GHSA-5xm2-6676-qcp9	Dependencies (osv-scanner)
high	`osv/GHSA-62p4-gmf7-7g93`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-3493, GHSA-62p4-gmf7-7g93	Dependencies (osv-scanner)
high	`osv/GHSA-65qm-jvmh-6pqg`	requirements.txt	[email protected] (PyPI) is affected by GHSA-65qm-jvmh-6pqg	Dependencies (osv-scanner)
high	`osv/GHSA-6r8x-57c9-28j4`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-3451, GHSA-6r8x-57c9-28j4	Dependencies (osv-scanner)
high	`osv/GHSA-7mwm-ghpf-9vrm`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-4331, GHSA-7mwm-ghpf-9vrm	Dependencies (osv-scanner)
high	`osv/GHSA-8v84-f9pq-wr9x`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-2253, GHSA-8v84-f9pq-wr9x	Dependencies (osv-scanner)
high	`osv/GHSA-9hw9-ch79-4vh6`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-3453, GHSA-9hw9-ch79-4vh6	Dependencies (osv-scanner)
high	`osv/GHSA-9v9v-9qvf-h2hj`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-4343, GHSA-9v9v-9qvf-h2hj	Dependencies (osv-scanner)
high	`osv/GHSA-c6hw-5grf-ff96`	requirements.txt	[email protected] (PyPI) is affected by GHSA-c6hw-5grf-ff96	Dependencies (osv-scanner)
high	`osv/GHSA-f2g6-542v-9j58`	requirements.txt	[email protected] (PyPI) is affected by GHSA-f2g6-542v-9j58	Dependencies (osv-scanner)
high	`osv/GHSA-g7cr-3p24-7wf7`	requirements.txt	[email protected] (PyPI) is affected by GHSA-g7cr-3p24-7wf7	Dependencies (osv-scanner)
high	`osv/GHSA-g842-9rc4-69pw`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-4338, GHSA-g842-9rc4-69pw	Dependencies (osv-scanner)
high	`osv/GHSA-gg2r-wvfm-q9rx`	requirements.txt	[email protected] (PyPI) is affected by GHSA-gg2r-wvfm-q9rx	Dependencies (osv-scanner)
high	`osv/GHSA-j4m9-6w36-pw47`	requirements.txt	[email protected] (PyPI) is affected by GHSA-j4m9-6w36-pw47	Dependencies (osv-scanner)
high	`osv/GHSA-j7hp-h8jx-5ppr`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-1794, GHSA-j7hp-h8jx-5ppr	Dependencies (osv-scanner)
high	`osv/GHSA-jg86-v3jv-hrpm`	requirements.txt	[email protected] (PyPI) is affected by GHSA-jg86-v3jv-hrpm	Dependencies (osv-scanner)
high	`osv/GHSA-jjj6-mw9f-p565`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-3495, GHSA-jjj6-mw9f-p565	Dependencies (osv-scanner)
high	`osv/GHSA-mrfp-p49p-3hf2`	requirements.txt	[email protected] (PyPI) is affected by GHSA-mrfp-p49p-3hf2	Dependencies (osv-scanner)
high	`osv/GHSA-p4wg-p73j-c528`	requirements.txt	[email protected] (PyPI) is affected by GHSA-p4wg-p73j-c528	Dependencies (osv-scanner)
high	`osv/GHSA-pchr-8j38-3x4p`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-4334, GHSA-pchr-8j38-3x4p	Dependencies (osv-scanner)
high	`osv/GHSA-phj9-mv4w-65pm`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-2256, GHSA-phj9-mv4w-65pm	Dependencies (osv-scanner)
high	`osv/GHSA-q45j-58j2-45rg`	requirements.txt	[email protected] (PyPI) is affected by GHSA-q45j-58j2-45rg	Dependencies (osv-scanner)
high	`osv/GHSA-vjc4-5qp5-m44j`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-3496, GHSA-vjc4-5qp5-m44j	Dependencies (osv-scanner)
high	`osv/GHSA-xcvg-w56q-r89m`	requirements.txt	[email protected] (PyPI) is affected by GHSA-xcvg-w56q-r89m	Dependencies (osv-scanner)
high	`osv/GHSA-xgh8-jp6q-p5x8`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-4335, GHSA-xgh8-jp6q-p5x8	Dependencies (osv-scanner)
high	`osv/GHSA-xj96-63gp-2gmr`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-3454, GHSA-xj96-63gp-2gmr	Dependencies (osv-scanner)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/agent-scheduler.py:445	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/benchmark-hooks.py:117	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/build-dispatch.py:1401	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/check-routing-drift.py:148	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/d_route_model.py:139	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/d_route_model.py:67	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/d_route_model.py:74	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/d_route_model.py:89	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/generate-skill-index.py:823	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/generate-skills-doc.py:85	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/github-notification-triage.py:168	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/handoff.py:92	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/install-doctor.py:127	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/install-doctor.py:768	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/jev-browser-agent.py:404	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query`	scripts/jev-compact-evidence.py:279	Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/jev-cost-report.py:215	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/jev-route.py:229	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/jev-route.py:266	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/jev_alt_model.py:217	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query`	scripts/learning-db.py:270	Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used...	Static analysis (opengrep)
high	`opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query`	scripts/learning-db.py:284	Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used...	Static analysis (opengrep)
high	`opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query`	scripts/learning-db.py:504	Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/lib/index_freshness.py:101	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/manifest.py:283	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/mutation_check/engine.py:102	Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/pr-risk-classify.py:169	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/pre-route.py:98	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/probe-codex-hooks.py:316	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/probe-codex-hooks.py:372	Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/probe-codex-hooks.py:813	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.django.security.injection.command.subprocess-injection`	scripts/record-misroute.py:58	Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/record-misroute.py:58	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/register-hook.py:155	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/right-size-review.py:116	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/router-self-audit.py:72	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/router_attachment/run_eval.py:165	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/router_attachment/run_eval.py:57	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.django.security.injection.command.subprocess-injection`	scripts/routing-ab-test.py:248	Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/routing-ab-test.py:248	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/routing-ab-test.py:261	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/routing-ab-test.py:274	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/rules-distill.py:324	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/scheduler-ctl.py:168	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.use-defused-xml`	scripts/search-engine-bulk-indexer.py:32	The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/session-bootstrap-replay.py:75	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/smoke-test-hooks.py:236	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/trajectory-ab-test.py:448	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/trajectory-ab-test.py:454	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/trajectory-ab-test.py:482	Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/validate-doc-commands.py:151	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/validate-hook-health.py:812	Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/validate-hook-health.py:832	Detected subprocess function 'CompletedProcess' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/validate-hook-health.py:916	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/vexinstall/interp.py:115	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/vexinstall/interp.py:403	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/video-transcript.py:355	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/video-transcript.py:482	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	skills/content/video-editing/scripts/image_to_video.py:343	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	skills/content/video-editing/scripts/image_to_video.py:59	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	skills/frontend/frontend/scripts-html-artifact/pptx-bridge/render_pptx.py:108	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	skills/frontend/frontend/scripts-html-artifact/pptx-bridge/render_pptx.py:134	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	skills/frontend/frontend/scripts-html-artifact/pptx-bridge/render_pptx.py:65	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	skills/frontend/frontend/scripts-html-artifact/pptx-bridge/run-unified.py:72	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/javascript.lang.security.detect-child-process`	skills/game/game-dev/scripts/optimize-glb.mjs:50	Detected calls to child_process from a function argument `inputPath`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly...	Static analysis (opengrep)
high	`opengrep/javascript.lang.security.detect-child-process`	skills/game/game-dev/scripts/optimize-glb.mjs:50	Detected calls to child_process from a function argument `outputPath`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly...	Static analysis (opengrep)
high	`opengrep/javascript.lang.security.detect-child-process`	skills/game/game-dev/scripts/optimize-glb.mjs:51	Detected calls to child_process from a function argument `outputPath`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly...	Static analysis (opengrep)
high	`opengrep/javascript.lang.security.detect-child-process`	skills/game/game-dev/scripts/optimize-glb.mjs:55	Detected calls to child_process from a function argument `outputPath`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly...	Static analysis (opengrep)
high	`opengrep/javascript.lang.security.detect-child-process`	skills/game/game-dev/scripts/optimize-glb.mjs:62	Detected calls to child_process from a function argument `outputPath`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly...	Static analysis (opengrep)
high	`opengrep/javascript.lang.security.detect-child-process`	skills/game/game-dev/scripts/optimize-glb.mjs:70	Detected calls to child_process from a function argument `outputPath`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly...	Static analysis (opengrep)
high	`opengrep/javascript.lang.security.detect-child-process`	skills/game/game-dev/scripts/optimize-glb.mjs:73	Detected calls to child_process from a function argument `outputPath`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	skills/game/game-dev/scripts/sprite_generate.py:181	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	skills/game/game-dev/scripts/sprite_generate.py:254	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	skills/game/game-dev/scripts/video_extract_frames.py:80	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	skills/game/game-dev/scripts/with_server.py:177	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args`	skills/game/game-dev/scripts/with_server.py:178	Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.subprocess-shell-true`	skills/game/game-dev/scripts/with_server.py:179	Found 'subprocess' function 'run' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	skills/meta/docs-sync-checker/scripts/validate.py:171	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	skills/meta/toolkit/scripts/agent-comparison/generate_variant.py:230	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	skills/meta/toolkit/scripts/agent-comparison/optimize_loop.py:216	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	skills/meta/toolkit/scripts/agent-comparison/optimize_loop.py:724	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	skills/meta/toolkit/scripts/agent-comparison/trigger_eval.py:242	Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	skills/meta/toolkit/scripts/skill-creator/eval_compare.py:102	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	skills/meta/toolkit/scripts/skill-creator/run_eval.py:124	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	skills/process/pr-workflow/scripts/validate_state.py:82	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	hooks/adr-enforcement.py:115	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/javascript.lang.best-practice.lazy-load-module`	hooks/no-agent-summary/no-agent-summary.js:106	Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The...	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	hooks/precompact-archive.py:69	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	hooks/pretool-section-integrity-validator.py:62	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	hooks/pretool-unified-gate.py:2832	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	hooks/pretool-unified-gate.py:2837	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	hooks/pretool-unified-gate.py:2848	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	hooks/pretool-unified-gate.py:2855	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	hooks/pretool-unified-gate.py:2981	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	hooks/pretool-unified-gate.py:2989	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	hooks/pretool-unified-gate.py:2997	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	hooks/pretool-unified-gate.py:3001	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	hooks/pretool-unified-gate.py:3009	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	hooks/pretool-unified-gate.py:3016	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	hooks/pretool-unified-gate.py:3029	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	hooks/pretool-unified-gate.py:3034	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	hooks/pretool-unified-gate.py:3043	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	hooks/pretool-unified-gate.py:3050	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	hooks/pretool-unified-gate.py:3055	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	hooks/pretool-unified-gate.py:3062	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	hooks/pretool-unified-gate.py:3067	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	hooks/pretool-unified-gate.py:3241	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	hooks/pretool-unified-gate.py:3244	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	hooks/pretool-unified-gate.py:3250	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	hooks/pretool-unified-gate.py:3256	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	hooks/pretool-unified-gate.py:3266	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	hooks/pretool-unified-gate.py:3272	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	hooks/pretool-unified-gate.py:3278	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	hooks/pretool-unified-gate.py:3286	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	hooks/pretool-unified-gate.py:3292	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	hooks/pretool-unified-gate.py:3299	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	hooks/session-no-agent-summary-check.py:77	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	hooks/session-task-registry.py:219	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	hooks/stop-failure-handler.py:53	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	hooks/suggest-compact.py:103	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/javascript.lang.correctness.no-stringify-keys`	plugins/jev-auto-compact/hooks/jev-auto-compact.mjs:612	JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	scripts/adr-decision-coverage.py:474	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	scripts/bench-http.py:108	Is "is_loopback" a function or an attribute? If it is a function, you may have meant ipaddress.ip_address(host).is_loopback() because ipaddress.ip_address(host).is_loopback is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	scripts/bench-http.py:115	Is "is_loopback" a function or an attribute? If it is a function, you may have meant ipaddress.ip_address(info[4][0]).is_loopback() because ipaddress.ip_address(info[4][0]).is_loopback is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	scripts/build-dispatch.py:1060	Is "is_sensitive_path" a function or an attribute? If it is a function, you may have meant module.is_sensitive_path() because module.is_sensitive_path is always true.	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	scripts/check-scope-overlap.py:380	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	scripts/disprove-findings.py:88	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	scripts/feature-state.py:121	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	scripts/feature-state.py:532	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	scripts/feature-state.py:620	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.correctness.use-sys-exit`	scripts/generate-agent-index.py:283	Detected use of `exit`. Use `sys.exit` over the python shell `exit` built-in. `exit` is a helper for the interactive shell and may not be available on all Python implementations.	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	scripts/github-api-fetcher.py:189	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	scripts/github-api-fetcher.py:344	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	scripts/github-api-fetcher.py:436	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	scripts/install-doctor.py:181	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	scripts/install-doctor.py:596	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	scripts/install-doctor.py:607	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	scripts/install-doctor.py:77	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	scripts/jev-browser-agent.py:585	Is "is_loopback" a function or an attribute? If it is a function, you may have meant ipaddress.ip_address(host).is_loopback() because ipaddress.ip_address(host).is_loopback is always true.	Lint
medium	`opengrep/python.lang.best-practice.manual-defaultdict-list-create`	scripts/jev-call-stats.py:32	manually creating a defaultdict - use collections.defaultdict(list)	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	scripts/jev-eval-live.py:169	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	scripts/jev_alt_model.py:79	Is "is_loopback" a function or an attribute? If it is a function, you may have meant ipaddress.ip_address(host).is_loopback() because ipaddress.ip_address(host).is_loopback is always true.	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	scripts/jev_images.py:396	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.maintainability.return-not-in-function`	scripts/lib/jev_harness/__init__.py:82	`return` only makes sense inside a function	Lint
medium	`opengrep/python.lang.maintainability.return-not-in-function`	scripts/lib/jev_harness/__init__.py:86	`return` only makes sense inside a function	Lint
medium	`opengrep/python.lang.best-practice.manual-defaultdict-list-create`	scripts/lib/jev_harness/__init__.py:942	manually creating a defaultdict - use collections.defaultdict(list)	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	scripts/motion-pipeline.py:191	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	scripts/nano-banana-generate.py:244	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	scripts/plan-manager.py:260	Is "is_stale" a function or an attribute? If it is a function, you may have meant plan.is_stale() because plan.is_stale is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	scripts/plan-manager.py:271	Is "is_stale" a function or an attribute? If it is a function, you may have meant plan.is_stale() because plan.is_stale is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	scripts/plan-manager.py:282	Is "is_stale" a function or an attribute? If it is a function, you may have meant plan.is_stale() because plan.is_stale is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	scripts/plan-manager.py:558	Is "is_stale" a function or an attribute? If it is a function, you may have meant plan.is_stale() because plan.is_stale is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	scripts/plan-manager.py:614	Is "is_stale" a function or an attribute? If it is a function, you may have meant plan.is_stale() because plan.is_stale is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	scripts/plan-manager.py:718	Is "is_stale" a function or an attribute? If it is a function, you may have meant plan.is_stale() because plan.is_stale is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	scripts/plan-manager.py:735	Is "is_stale" a function or an attribute? If it is a function, you may have meant plan.is_stale() because plan.is_stale is always true.	Lint
medium	`opengrep/python.lang.maintainability.useless-if-body`	scripts/python-doc-verifier.py:224	Useless if statement; both blocks have the same body	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	scripts/python-doc-verifier.py:249	Is "is_method" a function or an attribute? If it is a function, you may have meant func.is_method() because func.is_method is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	scripts/python-doc-verifier.py:550	Is "is_async" a function or an attribute? If it is a function, you may have meant f.is_async() because f.is_async is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	scripts/python-doc-verifier.py:562	Is "is_private" a function or an attribute? If it is a function, you may have meant f.is_private() because f.is_private is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	scripts/python-doc-verifier.py:569	Is "is_dataclass" a function or an attribute? If it is a function, you may have meant c.is_dataclass() because c.is_dataclass is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	scripts/python-doc-verifier.py:67	Is "is_public" a function or an attribute? If it is a function, you may have meant m.is_public() because m.is_public is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	scripts/python-doc-verifier.py:88	Is "is_public" a function or an attribute? If it is a function, you may have meant f.is_public() because f.is_public is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	scripts/research-stats-checkpoint.py:222	Is "is_primary" a function or an attribute? If it is a function, you may have meant art.is_primary() because art.is_primary is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	scripts/research-stats-checkpoint.py:79	Is "is_primary" a function or an attribute? If it is a function, you may have meant a.is_primary() because a.is_primary is always true.	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	scripts/review-record.py:110	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	scripts/routing-ab-results/planning-unknowns-v1/gen-prompts.py:32	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	scripts/routing-ab-results/planning-unknowns-v1/gen-prompts.py:42	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	scripts/routing-ab-results/planning-unknowns-v1/gen-prompts.py:49	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	scripts/routing-ab-results/planning-unknowns-v1/gen-prompts.py:58	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	scripts/routing-ab-results/planning-unknowns-v1/gen-prompts.py:66	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	scripts/routing-ab-results/planning-unknowns-v1/gen-prompts.py:74	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	scripts/routing-ab-results/planning-unknowns-v2/gen-prompts.py:106	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	scripts/routing-ab-results/planning-unknowns-v2/gen-prompts.py:114	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	scripts/routing-ab-results/planning-unknowns-v2/gen-prompts.py:122	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	scripts/routing-ab-results/planning-unknowns-v2/gen-prompts.py:32	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	scripts/routing-ab-results/planning-unknowns-v2/gen-prompts.py:42	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	scripts/routing-ab-results/planning-unknowns-v2/gen-prompts.py:49	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	scripts/routing-ab-results/planning-unknowns-v2/gen-prompts.py:58	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	scripts/routing-ab-results/planning-unknowns-v2/gen-prompts.py:66	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	scripts/routing-ab-results/planning-unknowns-v2/gen-prompts.py:74	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	scripts/routing-ab-results/planning-unknowns-v2/gen-prompts.py:82	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	scripts/routing-ab-results/planning-unknowns-v2/gen-prompts.py:89	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	scripts/routing-ab-results/planning-unknowns-v2/gen-prompts.py:98	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	scripts/rules-compiler.py:322	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	scripts/rules-compiler.py:367	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	scripts/rules-compiler.py:390	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	scripts/rules-compiler.py:407	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	scripts/rules-compiler.py:426	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	scripts/rules-compiler.py:436	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	scripts/rules-compiler.py:443	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	scripts/rules-compiler.py:62	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	scripts/rules-compiler.py:67	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	scripts/rules-compiler.py:73	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	scripts/rules-compiler.py:78	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	scripts/scan-ai-patterns.py:39	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.requests.best-practice.use-raise-for-status`	scripts/search-engine-indexer.py:210	There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a...	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	scripts/smoke-test-hooks.py:104	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	scripts/validate-doc-commands.py:214	Is "is_open" a function or an attribute? If it is a function, you may have meant self.is_open() because self.is_open is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	scripts/validate-doc-commands.py:339	Is "is_parent" a function or an attribute? If it is a function, you may have meant parent.is_parent() because parent.is_parent is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	scripts/validate-doc-commands.py:342	Is "is_open" a function or an attribute? If it is a function, you may have meant spec.is_open() because spec.is_open is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	scripts/validate-doc-commands.py:383	Is "is_child" a function or an attribute? If it is a function, you may have meant child.is_child() because child.is_child is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	scripts/validate-doc-commands.py:419	Is "is_open" a function or an attribute? If it is a function, you may have meant target.is_open() because target.is_open is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	scripts/validate-doc-commands.py:448	Is "is_open" a function or an attribute? If it is a function, you may have meant value.is_open() because value.is_open is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	scripts/validate-doc-commands.py:461	Is "is_child" a function or an attribute? If it is a function, you may have meant spec.is_child() because spec.is_child is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	scripts/validate-doc-commands.py:461	Is "is_parent" a function or an attribute? If it is a function, you may have meant spec.is_parent() because spec.is_parent is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	scripts/validate-doc-commands.py:482	Is "is_open" a function or an attribute? If it is a function, you may have meant pool.is_open() because pool.is_open is always true.	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	scripts/validate-hook-health.py:652	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	scripts/validate-references.py:666	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	scripts/validate-review-output.py:1114	Is "is_json" a function or an attribute? If it is a function, you may have meant args.is_json() because args.is_json is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	scripts/video-transcript.py:159	Is "is_generated" a function or an attribute? If it is a function, you may have meant transcript.is_generated() because transcript.is_generated is always true.	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	scripts/voice-stylometry.py:161	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	scripts/voice-stylometry.py:326	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.requests.best-practice.use-raise-for-status`	scripts/x-api-poster.py:374	There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a...	Lint
medium	`opengrep/python.requests.best-practice.use-timeout`	scripts/x-api-poster.py:374	Detected a 'requests' call without a timeout set. By default, 'requests' calls wait until the connection is closed. This means a 'requests' call without a timeout will hang the program if a response is never received. Consider setting a...	Lint
medium	`opengrep/python.requests.best-practice.use-raise-for-status`	scripts/x-api-poster.py:387	There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a...	Lint
medium	`opengrep/python.requests.best-practice.use-timeout`	scripts/x-api-poster.py:387	Detected a 'requests' call without a timeout set. By default, 'requests' calls wait until the connection is closed. This means a 'requests' call without a timeout will hang the program if a response is never received. Consider setting a...	Lint
medium	`opengrep/python.requests.best-practice.use-raise-for-status`	scripts/x-api-poster.py:429	There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a...	Lint
medium	`opengrep/python.requests.best-practice.use-timeout`	scripts/x-api-poster.py:429	Detected a 'requests' call without a timeout set. By default, 'requests' calls wait until the connection is closed. This means a 'requests' call without a timeout will hang the program if a response is never received. Consider setting a...	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	skills/analysis/assessment/scripts/cartographer.py:327	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	skills/analysis/assessment/scripts/cartographer_omni.py:2104	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	skills/analysis/assessment/scripts/cartographer_ultimate.py:309	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	skills/content/content/scripts/publish/wordpress-media-upload.py:44	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.requests.best-practice.use-raise-for-status`	skills/content/content/scripts/publish/wordpress-scraper.py:60	There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a...	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	skills/content/content/scripts/reddit-moderate/reddit-mod.py:1667	Is "is_highlighted" a function or an attribute? If it is a function, you may have meant conv.is_highlighted() because conv.is_highlighted is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	skills/content/content/scripts/reddit-moderate/reddit-mod.py:349	Is "is_suspended" a function or an attribute? If it is a function, you may have meant self.is_suspended() because self.is_suspended is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	skills/content/content/scripts/reddit-moderate/reddit-mod.py:374	Is "is_suspended" a function or an attribute? If it is a function, you may have meant self.is_suspended() because self.is_suspended is always true.	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	skills/content/image-gen/scripts/generate_image.py:231	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	skills/content/image-gen/scripts/nano-banana-generate.py:244	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	skills/frontend/frontend/scripts-html-artifact/pptx-bridge/_pptx_engine.py:909	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	skills/frontend/frontend/scripts-html-artifact/pptx-bridge/_pptx_engine.py:911	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.maintainability.return-not-in-function`	skills/game/game-dev/scripts/sprite_prompt.py:468	`return` only makes sense inside a function	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	skills/process/pr-workflow/scripts/miner.py:231	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`zizmor/excessive-permissions`	.github/workflows/test.yml:1	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/test.yml:109	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/test.yml:130	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/test.yml:14	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/test.yml:142	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/test.yml:154	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/test.yml:166	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/test.yml:177	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/test.yml:206	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/test.yml:232	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/test.yml:246	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/test.yml:90	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`opengrep/python.lang.security.insecure-hash-algorithm-md5`	hooks/lib/hook_utils.py:327	Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium]	Static analysis (opengrep)
medium	`opengrep/python.lang.security.audit.non-literal-import`	hooks/lib/hook_utils.py:41	Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code. [confidence low]	Static analysis (opengrep)
medium	`opengrep/python.lang.security.insecure-hash-algorithm-md5`	hooks/lib/learning_db_v2.py:2377	Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium]	Static analysis (opengrep)
medium	`opengrep/python.lang.security.audit.formatted-sql-query`	hooks/lib/learning_db_v2.py:336	Detected possible formatted SQL query. Use parameterized queries instead. [confidence low]	Static analysis (opengrep)
medium	`opengrep/python.lang.security.audit.insecure-file-permissions`	hooks/lib/learning_db_v2.py:90	These permissions `0o700` are widely permissive and grant access to more people than may be necessary. A good default is `0o644` which gives read and write access to yourself and read access to everyone else. [confidence medium]	Static analysis (opengrep)
medium	`opengrep/python.lang.security.audit.dynamic-urllib-use-detected`	hooks/mcp-health-check.py:240	Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control...	Static analysis (opengrep)
medium	`opengrep/python.lang.security.audit.regex_dos`	hooks/pretool-private-name-leak-gate.py:631	Detected usage of re.compile with an inefficient regular expression. This can lead to regular expression denial of service, which can result in service down time. Instead, check all regexes or use safer alternatives such as pyre2....	Static analysis (opengrep)
medium	`opengrep/python.lang.security.audit.non-literal-import`	hooks/pretool-unified-gate.py:78	Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code. [confidence low]	Static analysis (opengrep)
medium	`opengrep/python.lang.security.insecure-hash-algorithm-md5`	hooks/prompt-capture.py:76	Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium]	Static analysis (opengrep)
medium	`opengrep/python.lang.security.insecure-hash-algorithm-md5`	hooks/review-capture.py:188	Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium]	Static analysis (opengrep)
medium	`opengrep/python.lang.security.insecure-hash-algorithm-md5`	hooks/routing-decision-recorder.py:551	Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium]	Static analysis (opengrep)
medium	`opengrep/python.lang.security.insecure-hash-algorithm-md5`	hooks/routing-decision-recorder.py:565	Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium]	Static analysis (opengrep)
medium	`opengrep/python.lang.security.audit.insecure-file-permissions`	hooks/subagent-state-tracker.py:62	These permissions `0o700` are widely permissive and grant access to more people than may be necessary. A good default is `0o644` which gives read and write access to yourself and read access to everyone else. [confidence medium]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	plugins/jev-auto-compact/hooks/redact.mjs:21	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	plugins/jev-auto-compact/hooks/redact.mjs:21	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`osv/GHSA-24rc-8hj2-v98c`	requirements.txt	[email protected] (PyPI) is affected by GHSA-24rc-8hj2-v98c	Dependencies (osv-scanner)
medium	`osv/GHSA-254f-3936-288h`	requirements.txt	[email protected] (PyPI) is affected by GHSA-254f-3936-288h	Dependencies (osv-scanner)
medium	`osv/GHSA-462x-pgg6-55fp`	requirements.txt	[email protected] (PyPI) is affected by GHSA-462x-pgg6-55fp	Dependencies (osv-scanner)
medium	`osv/GHSA-4rm8-3hmm-39fg`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-4340, GHSA-4rm8-3hmm-39fg	Dependencies (osv-scanner)
medium	`osv/GHSA-4x4j-2g7c-83w6`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-2257, GHSA-4x4j-2g7c-83w6	Dependencies (osv-scanner)
medium	`osv/GHSA-74r2-7ff9-mjj2`	requirements.txt	[email protected] (PyPI) is affected by GHSA-74r2-7ff9-mjj2	Dependencies (osv-scanner)
medium	`osv/GHSA-9hjg-9r4m-mvj7`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-1872, GHSA-9hjg-9r4m-mvj7	Dependencies (osv-scanner)
medium	`osv/GHSA-9wx4-h78v-vm56`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-1873, GHSA-9wx4-h78v-vm56	Dependencies (osv-scanner)
medium	`osv/GHSA-fc9g-5qg7-mf45`	requirements.txt	[email protected] (PyPI) is affected by GHSA-fc9g-5qg7-mf45	Dependencies (osv-scanner)
medium	`osv/GHSA-fj7v-r99m-22gq`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-3494, GHSA-fj7v-r99m-22gq	Dependencies (osv-scanner)
medium	`osv/GHSA-gc5v-m9x4-r6x2`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-2275, GHSA-gc5v-m9x4-r6x2	Dependencies (osv-scanner)
medium	`osv/GHSA-j8r2-6x86-q33q`	requirements.txt	[email protected] (PyPI) is affected by GHSA-j8r2-6x86-q33q	Dependencies (osv-scanner)
medium	`osv/GHSA-mf9w-mj56-hr94`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-2270, GHSA-mf9w-mj56-hr94	Dependencies (osv-scanner)
medium	`osv/GHSA-p8hx-v2p6-rp84`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-4337, GHSA-p8hx-v2p6-rp84	Dependencies (osv-scanner)
medium	`osv/GHSA-r73j-pqj5-w3x7`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-2874, GHSA-r73j-pqj5-w3x7	Dependencies (osv-scanner)
medium	`osv/GHSA-rfgq-q3w2-pmv2`	requirements.txt	[email protected] (PyPI) is affected by GHSA-rfgq-q3w2-pmv2	Dependencies (osv-scanner)
medium	`osv/GHSA-vx6w-vv9f-6gvg`	requirements.txt	[email protected] (PyPI) is affected by GHSA-vx6w-vv9f-6gvg	Dependencies (osv-scanner)
medium	`osv/GHSA-wjx4-4jcj-g98j`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-165, GHSA-wjx4-4jcj-g98j	Dependencies (osv-scanner)
medium	`osv/GHSA-wqgw-9xfh-qf2g`	requirements.txt	[email protected] (PyPI) is affected by GHSA-wqgw-9xfh-qf2g	Dependencies (osv-scanner)
medium	`osv/PYSEC-2023-175`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2023-175	Dependencies (osv-scanner)
medium	`opengrep/javascript.lang.security.audit.unknown-value-with-script-tag`	scripts/bench-frames.mjs:465	Cannot determine what 'file' is and it is used with a '<script>' tag. This could be susceptible to cross-site scripting (XSS). Ensure 'file' is not externally controlled, or sanitize this data. [confidence low]	Static analysis (opengrep)
medium	`opengrep/python.lang.security.audit.dynamic-urllib-use-detected`	scripts/bench-http.py:172	Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control...	Static analysis (opengrep)
medium	`opengrep/python.lang.security.audit.regex_dos`	scripts/check-index-colocation.py:44	Detected usage of re.compile with an inefficient regular expression. This can lead to regular expression denial of service, which can result in service down time. Instead, check all regexes or use safer alternatives such as pyre2....	Static analysis (opengrep)
medium	`opengrep/python.lang.security.audit.dynamic-urllib-use-detected`	scripts/github-api-fetcher.py:44	Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control...	Static analysis (opengrep)
medium	`opengrep/python.lang.security.audit.non-literal-import`	scripts/install-doctor.py:295	Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code. [confidence low]	Static analysis (opengrep)
medium	`opengrep/python.lang.security.audit.regex_dos`	scripts/pre-route.py:46	Detected usage of re.compile with an inefficient regular expression. This can lead to regular expression denial of service, which can result in service down time. Instead, check all regexes or use safer alternatives such as pyre2....	Static analysis (opengrep)
medium	`opengrep/python.lang.security.insecure-hash-algorithm-md5`	scripts/rules-distill.py:489	Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium]	Static analysis (opengrep)
medium	`opengrep/python.lang.security.audit.regex_dos`	scripts/validate-review-output.py:136	Detected usage of re.compile with an inefficient regular expression. This can lead to regular expression denial of service, which can result in service down time. Instead, check all regexes or use safer alternatives such as pyre2....	Static analysis (opengrep)
medium	`opengrep/python.lang.security.audit.regex_dos`	scripts/vexinstall/githooks.py:33	Detected usage of re.compile with an inefficient regular expression. This can lead to regular expression denial of service, which can result in service down time. Instead, check all regexes or use safer alternatives such as pyre2....	Static analysis (opengrep)
medium	`opengrep/python.lang.security.audit.dynamic-urllib-use-detected`	skills/analysis/assessment/scripts/check-cve-sources.py:152	Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control...	Static analysis (opengrep)
medium	`opengrep/python.lang.security.audit.dynamic-urllib-use-detected`	skills/content/content/scripts/publish/link_scanner.py:239	Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control...	Static analysis (opengrep)
medium	`opengrep/python.lang.security.audit.dynamic-urllib-use-detected`	skills/content/content/scripts/publish/link_scanner.py:254	Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control...	Static analysis (opengrep)
medium	`opengrep/python.lang.security.audit.dynamic-urllib-use-detected`	skills/content/content/scripts/publish/pagespeed.py:68	Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control...	Static analysis (opengrep)
medium	`opengrep/python.lang.security.audit.dynamic-urllib-use-detected`	skills/game/game-dev/scripts/fal_queue_image_run.py:78	Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control...	Static analysis (opengrep)
medium	`opengrep/python.lang.security.audit.dynamic-urllib-use-detected`	skills/game/game-dev/scripts/fal_queue_image_run.py:91	Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	skills/game/game-dev/scripts/meshy-generate.mjs:108	Detected that function argument `outputPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	skills/game/game-dev/scripts/meshy-generate.mjs:111	Detected that function argument `outputPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	skills/game/game-dev/scripts/meshy-generate.mjs:113	Detected that function argument `outputPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	skills/game/game-dev/scripts/meshy-generate.mjs:113	Detected that function argument `outputPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	skills/game/game-dev/scripts/meshy-generate.mjs:120	Detected that function argument `outputPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	skills/game/game-dev/scripts/meshy-generate.mjs:185	Detected that function argument `args` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`	skills/game/game-dev/scripts/meshy-generate.mjs:318	Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	skills/game/game-dev/scripts/optimize-glb.mjs:39	Detected that function argument `inputPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
low	`opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command`	install.sh:344	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may...	Lint
low	`opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command`	scripts/auto-dream-cron.sh:123	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may...	Lint
low	`opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command`	scripts/auto-dream-cron.sh:17	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may...	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	scripts/bench-frames.mjs:191	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	scripts/bench-frames.mjs:191	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	scripts/bench-frames.mjs:438	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	scripts/bench-frames.mjs:438	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	scripts/lib/jev_browser/cdp_driver.mjs:313	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	scripts/lib/jev_browser/cdp_driver.mjs:316	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	scripts/lib/jev_browser/cdp_driver.mjs:342	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	scripts/lib/jev_browser/cdp_driver.mjs:342	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	scripts/lib/jev_browser/cdp_driver.mjs:349	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	scripts/lib/jev_browser/cdp_driver.mjs:350	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	scripts/lib/jev_browser/cdp_driver.mjs:416	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	scripts/lib/jev_browser/cdp_driver.mjs:416	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command`	scripts/reference-enrichment-cron.sh:20	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may...	Lint
low	`opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command`	scripts/reference-enrichment-cron.sh:353	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may...	Lint
low	`opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command`	scripts/session-bootstrap.sh:38	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may...	Lint
low	`opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command`	scripts/toolkit-evolution-cron.sh:139	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may...	Lint
low	`opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command`	scripts/toolkit-evolution-cron.sh:17	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may...	Lint
low	`opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command`	skills/content/content/scripts/reddit-moderate/reddit-automod-cron.sh:106	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may...	Lint
low	`opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command`	skills/content/content/scripts/reddit-moderate/reddit-automod-cron.sh:18	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may...	Lint
low	`opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command`	skills/kb/scripts/kb-compile-cron.sh:128	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may...	Lint
low	`opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command`	skills/kb/scripts/kb-compile-cron.sh:13	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may...	Lint
low	`opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command`	skills/programming/programming/scripts/bench-compare.sh:122	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may...	Lint
low	`opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command`	skills/programming/programming/scripts/bench-compare.sh:133	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may...	Lint
low	`opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command`	skills/programming/programming/scripts/bench-compare.sh:145	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may...	Lint
low	`opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command`	skills/programming/programming/scripts/bench-compare.sh:158	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may...	Lint
low	`opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command`	skills/programming/programming/scripts/bench-compare.sh:158	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may...	Lint
low	`opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command`	skills/programming/programming/scripts/bench-compare.sh:173	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may...	Lint
low	`opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command`	skills/programming/programming/scripts/bench-compare.sh:65	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may...	Lint
low	`opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command`	skills/programming/programming/scripts/bench-compare.sh:9	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may...	Lint
low	`zizmor/artipacked`	.github/workflows/claude.yml:35	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
low	`zizmor/artipacked`	.github/workflows/pr-ai-review.yml:42	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
low	`zizmor/artipacked`	.github/workflows/test.yml:119	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
low	`zizmor/artipacked`	.github/workflows/test.yml:133	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
low	`zizmor/artipacked`	.github/workflows/test.yml:145	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
low	`zizmor/artipacked`	.github/workflows/test.yml:157	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
low	`zizmor/artipacked`	.github/workflows/test.yml:169	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
low	`zizmor/artipacked`	.github/workflows/test.yml:17	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
low	`zizmor/artipacked`	.github/workflows/test.yml:180	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
low	`zizmor/artipacked`	.github/workflows/test.yml:211	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
low	`zizmor/artipacked`	.github/workflows/test.yml:237	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
low	`zizmor/artipacked`	.github/workflows/test.yml:252	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
low	`zizmor/artipacked`	.github/workflows/test.yml:96	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
low	`gitleaks/generic-api-key`	agents/php-general-engineer.md:509	Possible generic-api-key secret in history (commit 4ce36a51dd); removed from the current tree but still retrievable	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	agents/php-general-engineer/references/php-security-testing.md:100	Possible generic-api-key secret in history (commit 579d755530); removed from the current tree but still retrievable	Secrets (gitleaks)
low	`gitleaks/curl-auth-user`	agents/rabbitmq-messaging-engineer/references/performance.md:225	Possible curl-auth-user secret in the current tree (test/docs/example file)	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	agents/skill-creator-engineer/references/anti-patterns.md:236	Possible generic-api-key secret in history (commit d77eb5c8f4); removed from the current tree but still retrievable	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	agents/skill-creator-engineer/references/error-catalog.md:424	Possible generic-api-key secret in history (commit d77eb5c8f4); removed from the current tree but still retrievable	Secrets (gitleaks)
low	`gitleaks/curl-auth-header`	agents/technical-documentation-engineer.md:153	Possible curl-auth-header secret in history (commit d77eb5c8f4); removed from the current tree but still retrievable	Secrets (gitleaks)
low	`gitleaks/curl-auth-header`	agents/technical-documentation-engineer/references/api-doc-anti-patterns.md:94	Possible curl-auth-header secret in history (commit 7408b6afc0); removed from the current tree but still retrievable	Secrets (gitleaks)
low	`gitleaks/curl-auth-header`	agents/technical-documentation-engineer/references/api-doc-verification-failures.md:102	Possible curl-auth-header secret in the current tree (test/docs/example file)	Secrets (gitleaks)
low	`gitleaks/curl-auth-header`	agents/technical-documentation-engineer/references/documentation-templates.md:25	Possible curl-auth-header secret in the current tree (test/docs/example file)	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	docs/evaluations/philosophy-2026-09-04/archive-index.json:93	Possible generic-api-key secret in history (commit eb6f8cbb52); removed from the current tree but still retrievable	Secrets (gitleaks)
low	`gitleaks/jwt`	plugins/jev-auto-compact/tests/redact.test.mjs:14	Possible jwt secret in the current tree (test/docs/example file)	Secrets (gitleaks)
low	`gitleaks/stripe-access-token`	plugins/jev-auto-compact/tests/redact.test.mjs:37	Possible stripe-access-token secret in the current tree (test/docs/example file)	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	plugins/jev-auto-compact/tests/redact.test.mjs:45	Possible generic-api-key secret in the current tree (test/docs/example file)	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	scripts/tests/test_learning_source_filter.py:67	Possible generic-api-key secret in the current tree (test/docs/example file)	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	skills/meta/toolkit/references/skill-creator/error-catalog.md:424	Possible generic-api-key secret in the current tree (test/docs/example file)	Secrets (gitleaks)

Tools and coverage

Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.

Analyzer	Pillar	Status	Version	Findings	Note
AI tool configuration	AI provenance	ok	`signatures-v1`	0
Explicit AI attribution	AI provenance	ok	`signatures-v1`	0
Release velocity	AI provenance	skipped	`—`	0
Coding style	AI provenance	ok	`—`	0
Commit velocity	AI provenance	ok	`prov-4`	0
Findings in AI-written lines	AI provenance	ok	`git-blame`	0
Complexity (lizard)	Code quality	ok	`lizard 1.25.1`	0
Documentation	Code quality	ok	`—`	0
Duplication (jscpd)	Code quality	ok	`repotrust-dup-w6`	0
Lint	Code quality	ok	`opengrep 1.33.1; rules f1d2b562b414`	200
Tests and CI	Code quality	ok	`—`	0
Type safety	Code quality	ok	`—`	0
CI workflows (zizmor)	Security	ok	`zizmor 1.32.0`	51
Dependencies (osv-scanner)	Security	ok	`osv-scanner version: 2.7.1`	60
Release downloads	Security	ok	`—`	0
Security posture	Security	ok	`—`	0
Package registries	Security	ok	`—`	0
Static analysis (opengrep)	Security	ok	`opengrep 1.33.1; rules f1d2b562b414`	300
OpenSSF Scorecard	Security	skipped	`—`	0	no published OpenSSF Scorecard result for this repo
Secrets (gitleaks)	Security	ok	`gitleaks 8.30.1`	15

Score history

Scores from different scoring versions aren't directly comparable.

Scored	Commit	Scoring	AI provenance	Quality	Security
2026-11-14	`871f649901b3`	`prov-5+qual-2+sec-2`	9%	69	45
2026-11-14	`871f649901b3`	`prov-4+qual-2+sec-2`	9%	69	45

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/notque/vexjoy-agent/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/notque/vexjoy-agent/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/notque/vexjoy-agent/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/notque/vexjoy-agent/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/notque/vexjoy-agent/security.svg)](https://repotrust.synapticcyber.com/r/github.com/notque/vexjoy-agent/)

Full text report

Repository: https://github.com/notque/vexjoy-agent
Commit: 871f649901b317d675e63f2dcce2b6515e046230
Generated: 2026-11-14T14:52:06+00:00
Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	9	explicit	95%	100%
Code quality	69	adequate	90%	100%
Security	45	poor	85%	100%

AI provenance

Explicit AI attribution on 9% of first-party code added; an estimated 9% including velocity signals.

Explicitly attributed share (lower bound): 9.0%
Unattributed share in AI-consistent velocity bursts: 33.1%
Estimated AI-generated share: 9.0%

AI tool	Attributed commits	Lines added
Claude Code	197	35,012

AI tooling configured in repo: claude-code, gemini, generic-agent

Current source lines last changed by AI-attributed commits: 14,816 of 171,998.

Findings per 1,000 lines	AI-attributed	Other	Ratio
Quality	1.485	1.132	1.31x
Security	1.485	1.769	0.84x

Stylometry index: 0.62 per 1,000 lines (narrated steps 51, placeholders 2, assistant phrasing 0, emoji 102). Reported as a signal, not scored.

Month	Lines added	Attributed to AI
2026-03	115,909	0%
2026-04	40,295	0%
2026-05	50,925	0%
2026-06	18,627	1%
2026-07	29,317	0%
2026-08	22,962	11%
2026-09	52,835	0%
2026-10	25,648	11%
2026-11	31,591	93%

Evidence

Claude Code: message 'claude.ai/code' (b09beebf1644)
Claude Code: message 'claude.ai/code' (14fb687d1b69)
Claude Code: message 'claude.ai/code' (d8c4152eec7a)
Claude Code: message 'claude.ai/code' (54aecd92c859)
Claude Code: message 'claude.ai/code' (c660af35c423)
Claude Code: message 'claude.ai/code' (2ec12defea42)
Claude Code: message 'claude.ai/code' (b59767f633fd)
Claude Code: message 'claude.ai/code' (3f645f24df75)
Claude Code: message 'claude.ai/code' (7460fc9bc648)
Claude Code: message 'claude.ai/code' (6c14da78cbf1)
Claude Code: message 'claude.ai/code' (58796653caca)
Claude Code: message 'claude.ai/code' (bad5247d539f)
Claude Code: message 'claude.ai/code' (8764fade1bbf)
Claude Code: message 'claude.ai/code' (c92d2bd0fbb9)
Claude Code: message 'claude.ai/code' (5c5d0d00465e)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is adequate: test-to-source ratio 0.60, CI runs tests; 27% of function code in complex or long functions; 8% duplicated lines. Weakest area: type safety.

Area	Score
Complexity (lizard)	44
Duplication	61
Code smells (Opengrep)	71
Tests and CI	100
Documentation	80
Type safety	0
Process (Scorecard review/maintenance)	n/a

Functions: 4,944; mean complexity 6.1, 90th percentile 13; 320 complex and 68 long functions
Duplicated lines: 8.1% of 132,441 compared
Tests: 103,543 test lines for 171,998 source lines (ratio 0.60); CI test commands: pytest; 90% of recent source commits also change tests
Docs missing or thin: changelog

Most complex functions:

Security

Security posture is poor: 60 known vulnerabilities in 3 dependencies; 262 high-severity SAST findings; 26 high-severity workflow issues. Weakest area: posture.

Area	Score
Secrets (gitleaks, tree + history)	61
Static analysis (Opengrep)	55
Vulnerable dependencies (OSV)	70
CI workflows (zizmor)	0
Posture (policy, updates, signing, lockfiles)	0
OpenSSF Scorecard	n/a

Known vulnerabilities: 60 in 3 packages (critical 6, high 34, medium 18, low 0)
Posture checks passed: none; missing: security policy, dependency updates, signed commits, lockfiles

Top findings

Severity	Finding	Location
critical	`osv/GHSA-5x8w-8jj5-q52h`: [email protected] (PyPI) is affected by PYSEC-2026-4330, GHSA-5x8w-8jj5-q52h	requirements.txt
critical	`osv/GHSA-8g5g-8vmr-9782`: [email protected] (PyPI) is affected by PYSEC-2026-4332, GHSA-8g5g-8vmr-9782	requirements.txt
critical	`osv/GHSA-xvh5-g6gv-559v`: [email protected] (PyPI) is affected by PYSEC-2026-4363, GHSA-xvh5-g6gv-559v	requirements.txt
critical	`osv/GHSA-3f63-hfp8-52jq`: [email protected] (PyPI) is affected by PYSEC-2026-457, GHSA-3f63-hfp8-52jq	requirements.txt
critical	`osv/GHSA-332p-7hrc-92wf`: [email protected] (PyPI) is affected by GHSA-332p-7hrc-92wf	requirements.txt
critical	`osv/GHSA-w889-685w-c8fh`: [email protected] (PyPI) is affected by GHSA-w889-685w-c8fh	requirements.txt
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]	conftest.py:139
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`: Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	hooks/adr-enforcement.py:27
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`: Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	hooks/adr-enforcement.py:27
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]	hooks/adr-enforcement.py:144
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`: Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	hooks/adr-lifecycle-on-merge.py:31
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`: Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	hooks/adr-lifecycle-on-merge.py:31
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]	hooks/adr-lifecycle-on-merge.py:81
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`: Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	hooks/afk-mode.py:33
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`: Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	hooks/afk-mode.py:33
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`: Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	hooks/agy-hook-adapter.py:38
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`: Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	hooks/agy-hook-adapter.py:38
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]	hooks/agy-hook-adapter.py:685
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`: Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	hooks/ci-merge-gate.py:21
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`: Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	hooks/ci-merge-gate.py:21
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`: Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	hooks/codex-auto-review.py:42
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`: Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	hooks/codex-auto-review.py:42
high	`opengrep/python.lang.security.audit.dangerous-os-exec-audit`: Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]	hooks/codex-hook-adapter.py:26
high	`opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args`: Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]	hooks/codex-hook-adapter.py:26
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]	hooks/codex-hook-adapter.py:532

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

Source lines: 171,998; test lines: 103,543

Language	Lines
Python	262,906
JavaScript	8,393
Shell	4,014
TypeScript	228