Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, and security risks.
This report presents the forensic synthetic code analysis of NVIDIA/SkillSpector, a Python project with 13,135 GitHub stars. SynthScan v2.0 examined 48,354 lines of code across 191 source files, recording 1947 pattern matches distributed across 18 syntactic categories. The overall adjusted score of 64.7 places this repository in the Strong AI signal band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 1947 distinct pattern matches across 18 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | tests/test_mcp_tool_poisoning.py | 395 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_mcp_tool_poisoning.py | 397 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_mcp_tool_poisoning.py | 713 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_mcp_tool_poisoning.py | 715 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_mcp_tool_poisoning.py | 29 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_mcp_tool_poisoning.py | 31 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_mcp_tool_poisoning.py | 194 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_mcp_tool_poisoning.py | 196 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_mcp_tool_poisoning.py | 312 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_mcp_tool_poisoning.py | 314 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_mcp_tool_poisoning.py | 558 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_mcp_tool_poisoning.py | 560 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_mcp_tool_poisoning.py | 612 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_mcp_tool_poisoning.py | 614 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_mcp_least_privilege.py | 27 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_mcp_least_privilege.py | 29 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_mcp_least_privilege.py | 169 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_mcp_least_privilege.py | 171 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/unit/test_agent_cli.py | 117 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/unit/test_agent_cli.py | 119 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/unit/test_agent_cli.py | 141 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/unit/test_agent_cli.py | 143 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/unit/test_agent_cli.py | 220 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/unit/test_agent_cli.py | 222 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/unit/test_agent_cli.py | 258 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/unit/test_agent_cli.py | 260 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/unit/test_agent_cli.py | 304 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/unit/test_agent_cli.py | 306 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/unit/test_agent_cli.py | 333 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/unit/test_agent_cli.py | 335 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/unit/test_agent_cli.py | 371 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/unit/test_agent_cli.py | 373 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/unit/test_agent_cli.py | 524 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/unit/test_agent_cli.py | 526 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/unit/test_agent_cli.py | 536 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/unit/test_agent_cli.py | 538 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/unit/test_agent_cli.py | 549 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/unit/test_agent_cli.py | 551 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/unit/test_agent_cli.py | 638 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/unit/test_agent_cli.py | 640 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/unit/test_agent_cli.py | 58 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/unit/test_agent_cli.py | 60 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/unit/test_agent_cli.py | 599 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/unit/test_agent_cli.py | 601 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/unit/test_model_info.py | 65 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/unit/test_model_info.py | 67 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/unit/test_model_info.py | 86 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/unit/test_model_info.py | 88 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/unit/test_model_info.py | 164 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/unit/test_model_info.py | 166 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/unit/test_model_info.py | 246 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/unit/test_model_info.py | 248 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/unit/test_model_info.py | 278 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/unit/test_model_info.py | 280 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/unit/test_patterns_new.py | 1131 | # ── Supply Chain Helpers ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/unit/test_patterns_new.py | 52 | # ── Helpers ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/unit/test_patterns_new.py | 81 | # ── Excessive Agency (EA1–EA4) ───────────────────────────────────────── | COMMENT |
| MEDIUM | tests/unit/test_patterns_new.py | 211 | # ── Output Handling (OH1–OH3) ────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/unit/test_patterns_new.py | 300 | # ── System Prompt Leakage (P6–P8) ────────────────────────────────────── | COMMENT |
| MEDIUM | tests/unit/test_patterns_new.py | 366 | # ── Memory Poisoning (MP1–MP3) ───────────────────────────────────────── | COMMENT |
| 426 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | tests/test_mcp_tool_poisoning.py | 401 | def test_injection_in_param_description(self): | CODE |
| LOW⚡ | tests/test_mcp_tool_poisoning.py | 700 | def test_no_llm_call_attempted_records_nothing(self): | CODE |
| LOW⚡ | tests/test_mcp_tool_poisoning.py | 707 | def test_use_llm_false_records_nothing(self): | CODE |
| LOW | tests/test_mcp_tool_poisoning.py | 272 | def test_data_uri_in_metadata(self): | CODE |
| LOW | tests/test_mcp_tool_poisoning.py | 290 | def test_instruction_keyword_in_comment(self): | CODE |
| LOW | tests/test_mcp_tool_poisoning.py | 376 | def test_invisible_formatting_chars(self): | CODE |
| LOW | tests/test_mcp_tool_poisoning.py | 421 | def test_system_token_in_param(self): | CODE |
| LOW | tests/test_mcp_tool_poisoning.py | 444 | def test_exfiltration_in_param_description(self): | CODE |
| LOW | tests/test_mcp_tool_poisoning.py | 466 | def test_malicious_default_value(self): | CODE |
| LOW | tests/test_mcp_tool_poisoning.py | 489 | def test_excessive_description_length(self): | CODE |
| LOW | tests/test_mcp_tool_poisoning.py | 517 | def test_localhost_prefixed_attacker_url_is_flagged(self): | CODE |
| LOW | tests/test_mcp_tool_poisoning.py | 540 | def test_genuine_loopback_default_url_is_exempt(self): | CODE |
| LOW | tests/test_mcp_tool_poisoning.py | 640 | def test_skipped_no_description(self): | CODE |
| LOW | tests/test_mcp_tool_poisoning.py | 646 | def test_llm_call_failure_returns_empty(self): | CODE |
| LOW | tests/test_mcp_tool_poisoning.py | 658 | def test_unparseable_response_returns_empty(self): | CODE |
| LOW | tests/test_mcp_tool_poisoning.py | 675 | def test_successful_call_records_ok_true(self): | CODE |
| LOW | tests/test_mcp_tool_poisoning.py | 686 | def test_failed_call_records_ok_false(self): | CODE |
| LOW | tests/test_mcp_tool_poisoning.py | 726 | def test_full_pipeline_poisoned_skill(self): | CODE |
| LOW | tests/test_mcp_tool_poisoning.py | 744 | def test_full_pipeline_clean_skill(self): | CODE |
| LOW | tests/test_mcp_tool_poisoning.py | 761 | def test_sarif_output_contains_tp_rules(self): | CODE |
| LOW | tests/conftest.py | 25 | def mock_resolve_context_length(): | CODE |
| LOW | tests/test_mcp_rug_pull.py | 129 | def test_empty_state_returns_no_findings(): | CODE |
| LOW | tests/test_mcp_least_privilege.py | 191 | def test_underdeclared_detected(self): | CODE |
| LOW | tests/test_mcp_least_privilege.py | 248 | def test_no_permissions_field(self): | CODE |
| LOW | tests/test_mcp_least_privilege.py | 329 | def test_over_declared_detected(self): | CODE |
| LOW | tests/test_mcp_least_privilege.py | 371 | def test_docs_only_skill_skips(self): | CODE |
| LOW | tests/test_mcp_least_privilege.py | 405 | def test_permission_matching_case_insensitive(self): | CODE |
| LOW⚡ | tests/test_multi_skill.py | 71 | def test_multi_skill_directory_detected(self, multi_skill_dir: Path) -> None: | CODE |
| LOW⚡ | tests/test_multi_skill.py | 78 | def test_skill_names_extracted_from_frontmatter(self, multi_skill_dir: Path) -> None: | CODE |
| LOW⚡ | tests/test_multi_skill.py | 84 | def test_single_skill_not_multi(self, single_skill_dir: Path) -> None: | CODE |
| LOW⚡ | tests/test_multi_skill.py | 91 | def test_root_skill_overrides_nested(self, nested_with_root: Path) -> None: | CODE |
| LOW⚡ | tests/test_multi_skill.py | 97 | def test_empty_directory_not_multi(self, tmp_path: Path) -> None: | CODE |
| LOW⚡ | tests/test_multi_skill.py | 103 | def test_single_sub_skill_not_multi(self, tmp_path: Path) -> None: | CODE |
| LOW⚡ | tests/test_multi_skill.py | 112 | def test_hidden_directories_skipped(self, tmp_path: Path) -> None: | CODE |
| LOW⚡ | tests/test_multi_skill.py | 132 | def test_skill_directory_paths_are_absolute(self, multi_skill_dir: Path) -> None: | CODE |
| LOW⚡ | tests/test_multi_skill.py | 138 | def test_relative_path_is_dirname(self, multi_skill_dir: Path) -> None: | CODE |
| LOW⚡ | tests/test_multi_skill.py | 145 | def test_fallback_name_from_dirname(self, tmp_path: Path) -> None: | CODE |
| LOW | tests/test_multi_skill.py | 156 | def test_lowercase_skill_md_detected(self, tmp_path: Path) -> None: | CODE |
| LOW⚡ | tests/unit/test_agent_cli.py | 128 | def test_label_starting_with_dash_raises(self) -> None: | CODE |
| LOW⚡ | tests/unit/test_agent_cli.py | 136 | def test_label_with_special_chars_raises(self) -> None: | CODE |
| LOW⚡ | tests/unit/test_agent_cli.py | 147 | def test_shell_false_implied_by_list(self) -> None: | CODE |
| LOW⚡ | tests/unit/test_agent_cli.py | 170 | def test_model_flag_omitted_when_empty(self) -> None: | CODE |
| LOW⚡ | tests/unit/test_agent_cli.py | 176 | def test_allowed_tools_deny_by_default(self) -> None: | CODE |
| LOW⚡ | tests/unit/test_agent_cli.py | 185 | def test_permission_mode_dont_ask(self) -> None: | CODE |
| LOW⚡ | tests/unit/test_agent_cli.py | 191 | def test_strict_mcp_config_present(self) -> None: | CODE |
| LOW⚡ | tests/unit/test_agent_cli.py | 203 | def test_disable_slash_commands_present(self) -> None: | CODE |
| LOW⚡ | tests/unit/test_agent_cli.py | 207 | def test_dangerously_skip_permissions_never_in_argv(self) -> None: | CODE |
| LOW⚡ | tests/unit/test_agent_cli.py | 214 | def test_no_injection_in_argv(self) -> None: | CODE |
| LOW⚡ | tests/unit/test_agent_cli.py | 244 | def test_ignore_user_config_present(self) -> None: | CODE |
| LOW⚡ | tests/unit/test_agent_cli.py | 248 | def test_ignore_rules_present(self) -> None: | CODE |
| LOW⚡ | tests/unit/test_agent_cli.py | 252 | def test_dangerous_bypass_never_present(self) -> None: | CODE |
| LOW⚡ | tests/unit/test_agent_cli.py | 264 | def test_strips_anthropic_api_key(self, monkeypatch: pytest.MonkeyPatch) -> None: | CODE |
| LOW⚡ | tests/unit/test_agent_cli.py | 269 | def test_strips_openai_api_key(self, monkeypatch: pytest.MonkeyPatch) -> None: | CODE |
| LOW⚡ | tests/unit/test_agent_cli.py | 274 | def test_strips_nvidia_inference_key(self, monkeypatch: pytest.MonkeyPatch) -> None: | CODE |
| LOW⚡ | tests/unit/test_agent_cli.py | 279 | def test_strips_aws_credentials(self, monkeypatch: pytest.MonkeyPatch) -> None: | CODE |
| LOW⚡ | tests/unit/test_agent_cli.py | 286 | def test_strips_ssh_auth_sock(self, monkeypatch: pytest.MonkeyPatch) -> None: | CODE |
| LOW⚡ | tests/unit/test_agent_cli.py | 313 | def test_returns_response_text(self) -> None: | CODE |
| LOW⚡ | tests/unit/test_agent_cli.py | 316 | def test_strips_surrounding_whitespace(self) -> None: | CODE |
| LOW⚡ | tests/unit/test_agent_cli.py | 323 | def test_whitespace_only_raises(self) -> None: | CODE |
| LOW⚡ | tests/unit/test_agent_cli.py | 327 | def test_multiline_response_preserved(self) -> None: | CODE |
| 953 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/test_mcp_tool_poisoning.py | 18 | CODE | |
| LOW | tests/test_mcp_rug_pull.py | 18 | CODE | |
| LOW | tests/test_mcp_least_privilege.py | 18 | CODE | |
| LOW | tests/test_multi_skill.py | 18 | CODE | |
| LOW | tests/unit/test_agent_cli.py | 34 | CODE | |
| LOW | tests/unit/test_llm_utils.py | 23 | CODE | |
| LOW | tests/unit/test_providers.py | 23 | CODE | |
| LOW | tests/unit/test_suppression.py | 18 | CODE | |
| LOW | tests/unit/test_model_info.py | 18 | CODE | |
| LOW | tests/unit/test_model_info.py | 33 | CODE | |
| LOW | tests/unit/test_osv_client.py | 18 | CODE | |
| LOW | tests/unit/test_input_handler_ssrf.py | 18 | CODE | |
| LOW | tests/unit/test_bedrock_provider.py | 24 | CODE | |
| LOW | tests/unit/test_anthropic_proxy_provider.py | 18 | CODE | |
| LOW | tests/unit/test_constants.py | 18 | CODE | |
| LOW | tests/unit/test_sarif.py | 18 | CODE | |
| LOW | tests/unit/test_patterns_new.py | 22 | CODE | |
| LOW | tests/nodes/test_deduplicate.py | 18 | CODE | |
| LOW | tests/nodes/test_analysis_completeness.py | 18 | CODE | |
| LOW | tests/nodes/test_llm_analyzer_base.py | 18 | CODE | |
| LOW | tests/nodes/test_report.py | 18 | CODE | |
| LOW | tests/nodes/test_sarif_rules_and_empty_findings.py | 18 | CODE | |
| LOW | tests/nodes/test_meta_analyzer_fallback.py | 18 | CODE | |
| LOW | tests/nodes/test_meta_analyzer.py | 23 | CODE | |
| LOW | tests/nodes/test_build_context.py | 21 | CODE | |
| LOW | tests/nodes/test_report_sanitizer.py | 18 | CODE | |
| LOW | tests/nodes/test_semantic_quality_policy.py | 18 | CODE | |
| LOW | tests/nodes/analyzers/test_mp2_regex_backtracking.py | 18 | CODE | |
| LOW | tests/nodes/analyzers/test_registry.py | 18 | CODE | |
| LOW | tests/nodes/analyzers/test_behavioral_ast.py | 18 | CODE | |
| LOW | tests/nodes/analyzers/test_semantic_developer_intent.py | 18 | CODE | |
| LOW | tests/nodes/analyzers/conftest.py | 18 | CODE | |
| LOW | tests/nodes/analyzers/test_static_runner_filtering.py | 18 | CODE | |
| LOW | tests/nodes/analyzers/test_static_patterns.py | 18 | CODE | |
| LOW | …ts/nodes/analyzers/test_semantic_security_discovery.py | 18 | CODE | |
| LOW | tests/nodes/analyzers/test_mcp_rug_pull.py | 18 | CODE | |
| LOW | …s/nodes/analyzers/test_static_patterns_anti_refusal.py | 18 | CODE | |
| LOW | tests/nodes/analyzers/test_binary_and_pe3_filtering.py | 18 | CODE | |
| LOW | tests/nodes/analyzers/test_static_yara.py | 22 | CODE | |
| LOW | tests/nodes/analyzers/test_behavioral_taint_tracking.py | 18 | CODE | |
| LOW | tests/integration/test_agent_cli_live.py | 51 | CODE | |
| LOW | tests/provider/test_provider_endpoint.py | 18 | CODE | |
| LOW | contrib/batch_scan/detection.py | 28 | CODE | |
| LOW | contrib/batch_scan/annotation.py | 22 | CODE | |
| LOW | contrib/batch_scan/runner.py | 32 | CODE | |
| LOW | contrib/batch_scan/runner.py | 35 | CODE | |
| LOW | contrib/batch_scan/batch_scan.py | 48 | CODE | |
| LOW | contrib/batch_scan/discovery.py | 22 | CODE | |
| LOW | contrib/batch_scan/__init__.py | 34 | CODE | |
| LOW | contrib/batch_scan/__init__.py | 47 | CODE | |
| LOW | contrib/batch_scan/__init__.py | 47 | CODE | |
| LOW | contrib/batch_scan/__init__.py | 48 | CODE | |
| LOW | contrib/batch_scan/__init__.py | 48 | CODE | |
| LOW | contrib/batch_scan/__init__.py | 48 | CODE | |
| LOW | contrib/batch_scan/__init__.py | 48 | CODE | |
| LOW | contrib/batch_scan/__init__.py | 49 | CODE | |
| LOW | contrib/batch_scan/__init__.py | 49 | CODE | |
| LOW | contrib/batch_scan/__init__.py | 50 | CODE | |
| LOW | contrib/batch_scan/__init__.py | 51 | CODE | |
| LOW | contrib/batch_scan/__init__.py | 51 | CODE | |
| 114 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | model_registry.yaml | 1 | # Model registry — context window and output token limits. | COMMENT |
| LOW | .skillspector-baseline.example.yaml | 1 | # SkillSpector baseline (example) | COMMENT |
| LOW | tests/test_mcp_tool_poisoning.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/conftest.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/__init__.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/test_mcp_rug_pull.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/test_mcp_least_privilege.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/test_multi_skill.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/unit/test_agent_cli.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/unit/test_mcp_server.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/unit/test_llm_utils.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/unit/test_providers.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/unit/test_suppression.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/unit/test_patterns.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/unit/__init__.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/unit/test_model_info.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/unit/test_osv_client.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/unit/test_input_handler_ssrf.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/unit/test_bedrock_provider.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/unit/test_reviewer_nits.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/unit/test_anthropic_proxy_provider.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/unit/test_cli.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/unit/test_constants.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/unit/test_input_handler.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/unit/test_sarif.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/unit/test_patterns_new.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/nodes/test_deduplicate.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/nodes/test_analysis_completeness.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/nodes/test_llm_analyzer_base.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/nodes/__init__.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/nodes/test_report.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/nodes/test_sarif_rules_and_empty_findings.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/nodes/test_resolve_input.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/nodes/test_meta_analyzer_fallback.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/nodes/test_meta_analyzer.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/nodes/test_build_context.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/nodes/test_report_sanitizer.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/nodes/test_semantic_quality_policy.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/nodes/analyzers/test_mp2_regex_backtracking.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/nodes/analyzers/test_registry.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/nodes/analyzers/test_behavioral_ast.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/nodes/analyzers/test_semantic_developer_intent.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/nodes/analyzers/conftest.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/nodes/analyzers/test_static_runner_filtering.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/nodes/analyzers/test_static_patterns.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | …ts/nodes/analyzers/test_semantic_security_discovery.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/nodes/analyzers/test_mcp_rug_pull.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | …s/nodes/analyzers/test_static_patterns_anti_refusal.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/nodes/analyzers/test_binary_and_pe3_filtering.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/nodes/analyzers/test_static_yara.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/nodes/analyzers/test_behavioral_taint_tracking.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/integration/conftest.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/integration/test_meta_analyzer_use_llm.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/integration/test_graph_scanner.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/integration/__init__.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/integration/test_agent_cli_live.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/integration/test_graph.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/provider/__init__.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/provider/test_provider_endpoint.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | contrib/batch_scan/detection.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| 105 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/unit/test_input_handler_ssrf.py | 145 | except Exception: | CODE |
| LOW | docs/LLM_ANALYZER_BASE_GUIDE.md | 89 | except Exception as e: | CODE |
| LOW | contrib/batch_scan/runner.py | 155 | except Exception as exc: | CODE |
| LOW | contrib/batch_scan/runner.py | 200 | except Exception as exc: | CODE |
| LOW | contrib/batch_scan/runner.py | 756 | except Exception as exc: | CODE |
| LOW | contrib/batch_scan/batch_scan.py | 371 | except Exception: | CODE |
| LOW | contrib/batch_scan/api_pool.py | 456 | except Exception as exc: | CODE |
| LOW | contrib/batch_scan/api_pool.py | 491 | except Exception as exc: | CODE |
| LOW | contrib/batch_scan/gap_fill.py | 237 | except Exception as exc: | CODE |
| LOW | contrib/batch_scan/gap_fill.py | 303 | except Exception as exc: | CODE |
| LOW | …trib/batch_scan/tests/test_monkeypatch_invasiveness.py | 281 | except Exception as exc: | CODE |
| LOW⚡ | contrib/batch_scan/tests/tests-pro/mutation_max.py | 479 | except Exception: | CODE |
| LOW | contrib/batch_scan/tests/tests-pro/mutation_max.py | 321 | except Exception: | CODE |
| LOW | contrib/batch_scan/tests/tests-pro/mutation_max.py | 349 | except Exception: | CODE |
| LOW | contrib/batch_scan/tests/tests-pro/mutation_max.py | 396 | except Exception: | CODE |
| MEDIUM | contrib/batch_scan/tests/tests-pro/test_api_pool.py | 400 | def worker(): | CODE |
| LOW | contrib/batch_scan/tests/tests-pro/test_api_pool.py | 407 | except Exception as e: | CODE |
| MEDIUM | …trib/batch_scan/tests/tests-pro/test_runner_patches.py | 393 | def test_chatopenai_init_receives_both_timeout_and_request_timeout(self): | CODE |
| LOW | …trib/batch_scan/tests/tests-pro/test_runner_patches.py | 469 | except Exception: | CODE |
| LOW | contrib/batch_scan/docs/DESIGN.md | 164 | except Exception: | CODE |
| LOW | contrib/batch_scan/docs/archive/PITFALLS.md | 120 | except Exception: | CODE |
| LOW | src/skillspector/cli.py | 340 | except Exception as e: | CODE |
| LOW | src/skillspector/cli.py | 400 | except Exception as e: | CODE |
| LOW | src/skillspector/cli.py | 575 | except Exception as e: | CODE |
| LOW | src/skillspector/nodes/meta_analyzer.py | 572 | except Exception as e: | CODE |
| LOW | …spector/nodes/analyzers/semantic_security_discovery.py | 105 | except Exception as exc: | CODE |
| LOW | src/skillspector/nodes/analyzers/static_yara.py | 246 | except Exception as exc: | CODE |
| LOW | …killspector/nodes/analyzers/semantic_quality_policy.py | 153 | except Exception as exc: | CODE |
| LOW | …llspector/nodes/analyzers/semantic_developer_intent.py | 184 | except Exception as exc: | CODE |
| LOW⚡ | src/skillspector/nodes/analyzers/mcp_tool_poisoning.py | 816 | except Exception as exc: | CODE |
| LOW | src/skillspector/nodes/analyzers/mcp_tool_poisoning.py | 274 | except Exception: | CODE |
| LOW | src/skillspector/nodes/analyzers/mcp_tool_poisoning.py | 322 | except Exception: | CODE |
| LOW | src/skillspector/providers/registry.py | 57 | except Exception: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/unit/test_patterns_new.py | 572 | pytest.param("ls && rm -rf /tmp", "cleanup.sh", "shell", id="chain_rm"), | CODE |
| HIGH | tests/unit/test_patterns_new.py | 618 | "RUN apt-get update && apt-get install -y curl && rm -rf /var/lib/apt/lists/*\n" | CODE |
| HIGH | tests/unit/test_patterns_new.py | 632 | "RUN apt-get update && apt-get install -y curl && rm -rf /var/lib/apt/lists/*\n" | CODE |
| HIGH | tests/unit/test_patterns_new.py | 646 | "RUN useradd --create-home appuser && chown -R appuser:appuser /app\n" | CODE |
| HIGH | contrib/batch_scan/runner.py | 214 | '"end_line": null, "confidence": 0.0-1.0, ' | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/test_mcp_tool_poisoning.py | 86 | CODE | |
| LOW | tests/test_mcp_least_privilege.py | 84 | CODE | |
| LOW | contrib/batch_scan/detection.py | 50 | CODE | |
| LOW | contrib/batch_scan/batch_scan.py | 192 | CODE | |
| LOW | contrib/batch_scan/api_pool.py | 165 | CODE | |
| LOW | contrib/batch_scan/reports.py | 309 | CODE | |
| LOW | contrib/batch_scan/tests/tests-pro/mutation_max.py | 120 | CODE | |
| LOW | src/skillspector/cli.py | 369 | CODE | |
| LOW | src/skillspector/input_handler.py | 243 | CODE | |
| LOW | src/skillspector/nodes/meta_analyzer.py | 364 | CODE | |
| LOW | …tor/nodes/analyzers/static_patterns_harmful_content.py | 85 | CODE | |
| LOW | …tor/nodes/analyzers/static_patterns_harmful_content.py | 198 | CODE | |
| LOW | src/skillspector/nodes/analyzers/mcp_least_privilege.py | 208 | CODE | |
| LOW | …or/nodes/analyzers/static_patterns_prompt_injection.py | 200 | CODE | |
| LOW | …llspector/nodes/analyzers/behavioral_taint_tracking.py | 290 | CODE | |
| LOW | …llspector/nodes/analyzers/behavioral_taint_tracking.py | 320 | CODE | |
| LOW | …pector/nodes/analyzers/static_patterns_supply_chain.py | 456 | CODE | |
| LOW | …pector/nodes/analyzers/static_patterns_supply_chain.py | 742 | CODE | |
| LOW | …pector/nodes/analyzers/static_patterns_anti_refusal.py | 125 | CODE | |
| LOW | src/skillspector/nodes/analyzers/common.py | 208 | CODE | |
| LOW | src/skillspector/nodes/analyzers/common.py | 239 | CODE | |
| LOW | src/skillspector/nodes/analyzers/mcp_rug_pull.py | 363 | CODE | |
| LOW | src/skillspector/nodes/analyzers/static_runner.py | 252 | CODE | |
| LOW | src/skillspector/nodes/analyzers/behavioral_ast.py | 151 | CODE | |
| LOW | src/skillspector/nodes/analyzers/mcp_tool_poisoning.py | 344 | CODE | |
| LOW | src/skillspector/providers/_agent_cli.py | 322 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | model_registry.yaml | 1 | # Model registry — context window and output token limits. | COMMENT |
| MEDIUM | model_registry.yaml | 10 | # context_length: <int> # total context window in tokens (required) | COMMENT |
| MEDIUM | docs/LLM_ANALYZER_BASE_GUIDE.md | 627 | context_length: 128000 # total context window in tokens (required) | CODE |
| MEDIUM | src/skillspector/providers/bedrock/model_registry.yaml | 8 | # context_length: <int> # total context window in tokens (required) | COMMENT |
| MEDIUM | src/skillspector/providers/nv_build/model_registry.yaml | 8 | # context_length: <int> # total context window in tokens (required) | COMMENT |
| MEDIUM | …c/skillspector/providers/anthropic/model_registry.yaml | 8 | # context_length: <int> # total context window in tokens (required) | COMMENT |
| MEDIUM | src/skillspector/providers/openai/model_registry.yaml | 8 | # context_length: <int> # total context window in tokens (required) | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | src/skillspector/providers/bedrock/provider.py | 0 | resolve model: ``skillspector_model`` env > slot default > ``default_model``. | STRING |
| HIGH | src/skillspector/providers/nv_build/provider.py | 0 | resolve model: ``skillspector_model`` env > slot default > ``default_model``. | STRING |
| HIGH | src/skillspector/providers/anthropic/provider.py | 0 | resolve model: ``skillspector_model`` env > slot default > ``default_model``. | STRING |
| HIGH | src/skillspector/providers/openai/provider.py | 0 | resolve model: ``skillspector_model`` env > slot default > ``default_model``. | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | contrib/batch_scan/runner.py | 58 | def set_api_pool(pool: "ApiKeyPool | None") -> None: | CODE |
| LOW | contrib/batch_scan/__init__.py | 54 | __all__ = [ | CODE |
| LOW | src/skillspector/logging_config.py | 64 | def set_level(level: int | str) -> None: | CODE |
| LOW | src/skillspector/constants.py | 23 | logger = logging.getLogger(__name__) | CODE |
| LOW | src/skillspector/__init__.py | 37 | __all__ = ["create_graph", "graph", "__version__"] | CODE |
| LOW | src/skillspector/nodes/analyzers/__init__.py | 132 | __all__ = ["ANALYZER_NODE_IDS", "ANALYZER_NODES"] | CODE |
| LOW⚡ | src/skillspector/nodes/analyzers/mcp_tool_poisoning.py | 36 | logger = logging.getLogger(__name__) | CODE |
| LOW | src/skillspector/providers/chat_models.py | 27 | logger = logging.getLogger(__name__) | CODE |
| LOW | src/skillspector/providers/__init__.py | 242 | __all__ = [ | CODE |
| LOW | src/skillspector/providers/codex_cli/__init__.py | 29 | __all__ = ["CodexCLIProvider"] | CODE |
| LOW | src/skillspector/providers/anthropic_proxy/__init__.py | 20 | __all__ = ["REGISTRY_PATH", "AnthropicProxyProvider"] | CODE |
| LOW | src/skillspector/providers/bedrock/__init__.py | 25 | __all__ = [ | CODE |
| LOW | src/skillspector/providers/claude_cli/__init__.py | 25 | __all__ = ["ClaudeCLIProvider"] | CODE |
| LOW | src/skillspector/providers/gemini_cli/__init__.py | 22 | __all__ = ["GeminiCLIProvider"] | CODE |
| LOW | src/skillspector/providers/nv_build/__init__.py | 20 | __all__ = ["BUILD_BASE_URL", "REGISTRY_PATH", "NvBuildProvider"] | CODE |
| LOW | src/skillspector/providers/antigravity_cli/__init__.py | 22 | __all__ = ["AntigravityCLIProvider"] | CODE |
| LOW | src/skillspector/providers/anthropic/__init__.py | 20 | __all__ = ["ANTHROPIC_BASE_URL", "REGISTRY_PATH", "AnthropicProvider"] | CODE |
| LOW | src/skillspector/providers/openai/__init__.py | 20 | __all__ = ["OPENAI_DEFAULT_BASE_URL", "REGISTRY_PATH", "OpenAIProvider"] | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | src/skillspector/llm_utils.py | 301 | Run an async coroutine in a synchronous context, even if there's already a running event loop. This function s | STRING |
| HIGH | src/skillspector/input_handler.py | 95 | Resolve input to a scannable directory. Args: input_path: Path or URL to resolve | STRING |
| HIGH | src/skillspector/providers/_agent_cli.py | 708 | Run an agent CLI and return the assistant response text. This is the single security-hardened entry point. All sec | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | …trib/batch_scan/tests/tests-pro/test_runner_patches.py | 445 | # Create a loop via _patched_asyncio_run — it calls _make_quiet_loop internally | COMMENT |
| MEDIUM⚡ | …trib/batch_scan/tests/tests-pro/test_runner_patches.py | 454 | # Create a loop, then manually invoke the quiet-loop logic from the patch | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | contrib/batch_scan/api_pool.py | 198 | # Step 1: recover rate-limited keys whose backoff has expired | COMMENT |
| LOW⚡ | contrib/batch_scan/api_pool.py | 201 | # Step 2: find available keys (not rate-limited, slots open) | COMMENT |
| LOW | contrib/batch_scan/api_pool.py | 219 | # Step 3: no capacity — compute wait time | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | contrib/batch_scan/api_pool.py | 198 | # Step 1: recover rate-limited keys whose backoff has expired | COMMENT |
| LOW⚡ | contrib/batch_scan/api_pool.py | 201 | # Step 2: find available keys (not rate-limited, slots open) | COMMENT |
| LOW | contrib/batch_scan/api_pool.py | 219 | # Step 3: no capacity — compute wait time | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/integration/test_agent_cli_live.py | 59 | #: Real ``stdin -> stdout`` agent CLIs this harness can drive. Add a new CLI here | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/unit/test_anthropic_proxy_provider.py | 146 | def handle_request(self, request: httpx.Request) -> httpx.Response: | CODE |
| LOW | src/skillspector/providers/anthropic_proxy/provider.py | 108 | def handle_request(self, request: httpx.Request) -> httpx.Response: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/skillspector/nodes/analyzers/mcp_tool_poisoning.py | 258 | # Check if this match overlaps with a data URI range | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/skillspector/cli.py | 185 | CODE |