Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.
This report presents the forensic synthetic code analysis of NVIDIA/SkillSpector, a Python project with 15,116 GitHub stars. SynthScan v2.0 examined 108,179 lines of code across 275 source files, recording 3334 pattern matches distributed across 18 syntactic categories. The overall adjusted score of 40.4 places this repository in the Strong AI signal band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 3334 distinct pattern matches across 18 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/test_bundled_execution_surface_acceptance.py | 89 | def test_issue_a_graph_reports_hook_mechanism_without_inventing_exfiltration( | STRING |
| LOW | tests/test_bundled_execution_surface_acceptance.py | 118 | def test_issue_b_graph_blocks_closed_project_permission_surface( | STRING |
| LOW | tests/test_bundled_execution_surface_acceptance.py | 137 | def test_bundled_project_disable_suppresses_ordinary_plugin_hook_findings(tmp_path: Path) -> None: | STRING |
| LOW | tests/test_bundled_execution_surface_acceptance.py | 162 | def test_issue_c_top_level_prefixed_zip_reports_full_chain(tmp_path: Path) -> None: | STRING |
| LOW | tests/test_bundled_execution_surface_acceptance.py | 176 | def test_issue_c_renders_all_public_report_formats(tmp_path: Path) -> None: | STRING |
| LOW | tests/test_bundled_execution_surface_acceptance.py | 209 | def test_document_surface_controls( | STRING |
| LOW | tests/test_bundled_execution_surface_acceptance.py | 223 | def test_malformed_sibling_keeps_valid_finding_and_is_incomplete(tmp_path: Path) -> None: | STRING |
| LOW | tests/test_bundled_execution_surface_acceptance.py | 244 | def test_malformed_modeled_settings_sibling_keeps_hook_findings_and_is_incomplete( | STRING |
| LOW | tests/test_bundled_execution_surface_acceptance.py | 288 | def test_public_cli_exit_contract( | STRING |
| LOW | tests/test_bundled_execution_surface_acceptance.py | 313 | def test_recursive_single_child_routes_execution_surfaces_from_child_root( | STRING |
| LOW | tests/test_bundled_execution_surface_acceptance.py | 349 | def test_cli_fail_on_incomplete_is_opt_in(tmp_path: Path) -> None: | STRING |
| LOW⚡ | tests/test_mcp_tool_poisoning.py | 675 | def test_injection_in_param_description(self): | CODE |
| LOW⚡ | tests/test_mcp_tool_poisoning.py | 938 | def test_skipped_no_description(self): | CODE |
| LOW⚡ | tests/test_mcp_tool_poisoning.py | 944 | def test_llm_call_failure_returns_empty(self, monkeypatch: pytest.MonkeyPatch): | CODE |
| LOW⚡ | tests/test_mcp_tool_poisoning.py | 951 | def test_persistently_malformed_response_returns_empty(self, monkeypatch: pytest.MonkeyPatch): | CODE |
| LOW | tests/test_mcp_tool_poisoning.py | 316 | def test_data_uri_in_metadata(self): | CODE |
| LOW | tests/test_mcp_tool_poisoning.py | 334 | def test_instruction_keyword_in_comment(self): | CODE |
| LOW | tests/test_mcp_tool_poisoning.py | 355 | def test_zero_width_word_joiner_after_refactor(self): | CODE |
| LOW | tests/test_mcp_tool_poisoning.py | 372 | def test_zero_width_bom_after_refactor(self): | CODE |
| LOW | tests/test_mcp_tool_poisoning.py | 489 | def test_identifier_field_not_scanned(self): | CODE |
| LOW | tests/test_mcp_tool_poisoning.py | 650 | def test_invisible_formatting_chars(self): | CODE |
| LOW | tests/test_mcp_tool_poisoning.py | 695 | def test_system_token_in_param(self): | CODE |
| LOW | tests/test_mcp_tool_poisoning.py | 718 | def test_exfiltration_in_param_description(self): | CODE |
| LOW | tests/test_mcp_tool_poisoning.py | 740 | def test_malicious_default_value(self): | CODE |
| LOW | tests/test_mcp_tool_poisoning.py | 763 | def test_excessive_description_length(self): | CODE |
| LOW | tests/test_mcp_tool_poisoning.py | 791 | def test_localhost_prefixed_attacker_url_is_flagged(self): | CODE |
| LOW | tests/test_mcp_tool_poisoning.py | 814 | def test_genuine_loopback_default_url_is_exempt(self): | CODE |
| LOW | tests/test_mcp_tool_poisoning.py | 922 | def test_configured_output_language_is_included(self, monkeypatch: pytest.MonkeyPatch) -> None: | CODE |
| LOW | tests/test_mcp_tool_poisoning.py | 969 | def test_malformed_response_is_retried(self, monkeypatch: pytest.MonkeyPatch): | CODE |
| LOW | tests/test_mcp_tool_poisoning.py | 985 | def test_cli_parse_error_is_retried(self, monkeypatch: pytest.MonkeyPatch): | CODE |
| LOW | tests/test_mcp_tool_poisoning.py | 1002 | def test_out_of_range_confidence_is_retried(self, monkeypatch: pytest.MonkeyPatch): | CODE |
| LOW | tests/test_mcp_tool_poisoning.py | 1023 | def test_successful_call_records_ok_true(self, monkeypatch: pytest.MonkeyPatch): | CODE |
| LOW | tests/test_mcp_tool_poisoning.py | 1029 | def test_failed_call_records_ok_false(self, monkeypatch: pytest.MonkeyPatch): | CODE |
| LOW | tests/test_mcp_tool_poisoning.py | 1043 | def test_no_llm_call_attempted_records_nothing(self): | CODE |
| LOW | tests/test_mcp_tool_poisoning.py | 1050 | def test_use_llm_false_records_nothing(self): | CODE |
| LOW | tests/test_mcp_tool_poisoning.py | 1088 | def test_static_finding_cap_is_enforced_during_detector_construction( | CODE |
| LOW | tests/test_mcp_tool_poisoning.py | 1182 | def test_full_pipeline_poisoned_skill(self): | CODE |
| LOW | tests/test_mcp_tool_poisoning.py | 1200 | def test_full_pipeline_clean_skill(self): | CODE |
| LOW | tests/test_mcp_tool_poisoning.py | 1217 | def test_sarif_output_contains_tp_rules(self): | CODE |
| LOW | tests/conftest.py | 25 | def mock_resolve_context_length(): | CODE |
| LOW | tests/test_structured_skill.py | 38 | def test_cache_api_never_traverses_or_rereads_filesystem( | CODE |
| LOW | tests/test_structured_skill.py | 63 | def test_cache_api_accepts_bounded_text_cache(tmp_path: Path) -> None: | CODE |
| LOW | tests/test_structured_skill.py | 74 | def test_candidates_are_processed_in_deterministic_lexical_order(tmp_path: Path) -> None: | CODE |
| LOW | tests/test_structured_skill.py | 89 | def test_oversized_document_is_partial_without_json_parse( | CODE |
| LOW | tests/test_structured_skill.py | 111 | def test_later_valid_context_retains_earlier_partial_limitation( | CODE |
| LOW | tests/test_structured_skill.py | 133 | def test_total_candidate_input_bytes_are_bounded( | CODE |
| LOW | tests/test_structured_skill.py | 152 | def test_candidate_count_overflow_does_not_choose_arbitrary_subset( | CODE |
| LOW | tests/test_structured_skill.py | 174 | def test_deep_json_reports_nesting_limit(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None: | CODE |
| LOW | tests/test_structured_skill.py | 193 | def test_json_node_work_is_bounded(tmp_path: Path) -> None: | CODE |
| LOW | tests/test_structured_skill.py | 211 | def test_oversized_numeric_scalar_is_partial_instead_of_crashing(tmp_path: Path) -> None: | CODE |
| LOW | tests/test_structured_skill.py | 227 | def test_structured_output_records_are_bounded( | CODE |
| LOW | tests/test_structured_skill.py | 248 | def test_runtime_limit_is_reported_after_parser_work( | CODE |
| LOW | tests/test_structured_skill.py | 268 | def test_cache_api_honors_tighter_caller_deadline( | CODE |
| LOW | tests/test_structured_skill.py | 289 | def test_compatibility_wrapper_is_bounded_and_avoids_rglob_read_text( | CODE |
| LOW | tests/test_structured_skill.py | 308 | def test_compatibility_wrapper_fails_closed_on_directory_entry_overflow( | CODE |
| LOW | tests/test_batch_scan_reports.py | 13 | def test_json_marks_error_entries_as_unsuccessful() -> None: | CODE |
| LOW | tests/test_python_ast.py | 18 | def test_parse_python_source_exposes_import_aliases() -> None: | CODE |
| LOW | tests/test_python_ast.py | 33 | def test_parse_python_source_retains_syntax_error_result() -> None: | CODE |
| LOW | tests/test_python_ast.py | 42 | def test_parse_python_source_retains_value_error_result(monkeypatch) -> None: | CODE |
| LOW | tests/test_python_ast.py | 54 | def test_parse_python_source_retains_recursion_error_result(monkeypatch) -> None: | CODE |
| 2129 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | tests/test_mcp_tool_poisoning.py | 669 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_mcp_tool_poisoning.py | 671 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_mcp_tool_poisoning.py | 33 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_mcp_tool_poisoning.py | 35 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_mcp_tool_poisoning.py | 238 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_mcp_tool_poisoning.py | 240 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_mcp_tool_poisoning.py | 390 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_mcp_tool_poisoning.py | 392 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_mcp_tool_poisoning.py | 586 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_mcp_tool_poisoning.py | 588 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_mcp_tool_poisoning.py | 832 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_mcp_tool_poisoning.py | 834 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_mcp_tool_poisoning.py | 886 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_mcp_tool_poisoning.py | 888 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_mcp_tool_poisoning.py | 1169 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_mcp_tool_poisoning.py | 1171 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_mcp_least_privilege.py | 27 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_mcp_least_privilege.py | 29 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_mcp_least_privilege.py | 169 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_mcp_least_privilege.py | 171 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/unit/test_agent_cli.py | 117 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/unit/test_agent_cli.py | 119 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/unit/test_agent_cli.py | 141 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/unit/test_agent_cli.py | 143 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/unit/test_agent_cli.py | 225 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/unit/test_agent_cli.py | 227 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/unit/test_agent_cli.py | 267 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/unit/test_agent_cli.py | 269 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/unit/test_agent_cli.py | 313 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/unit/test_agent_cli.py | 315 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/unit/test_agent_cli.py | 342 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/unit/test_agent_cli.py | 344 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/unit/test_agent_cli.py | 380 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/unit/test_agent_cli.py | 382 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/unit/test_agent_cli.py | 533 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/unit/test_agent_cli.py | 535 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/unit/test_agent_cli.py | 545 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/unit/test_agent_cli.py | 547 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/unit/test_agent_cli.py | 558 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/unit/test_agent_cli.py | 560 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/unit/test_agent_cli.py | 647 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/unit/test_agent_cli.py | 649 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/unit/test_agent_cli.py | 738 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/unit/test_agent_cli.py | 740 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/unit/test_agent_cli.py | 58 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/unit/test_agent_cli.py | 60 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/unit/test_agent_cli.py | 608 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/unit/test_agent_cli.py | 610 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/unit/test_model_info.py | 65 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/unit/test_model_info.py | 67 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/unit/test_model_info.py | 86 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/unit/test_model_info.py | 88 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/unit/test_model_info.py | 164 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/unit/test_model_info.py | 166 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/unit/test_model_info.py | 246 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/unit/test_model_info.py | 248 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/unit/test_model_info.py | 278 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/unit/test_model_info.py | 280 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/unit/test_new_providers.py | 122 | # ── Azure OpenAI ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | tests/unit/test_new_providers.py | 223 | # ── Generic OpenAI-Compatible ─────────────────────────────────────────────── | COMMENT |
| 458 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/test_bundled_execution_surface_acceptance.py | 6 | CODE | |
| LOW | tests/test_mcp_tool_poisoning.py | 18 | CODE | |
| LOW | tests/test_structured_skill.py | 6 | CODE | |
| LOW | tests/test_batch_scan_reports.py | 6 | CODE | |
| LOW | tests/test_python_ast.py | 6 | CODE | |
| LOW | tests/test_mcp_rug_pull.py | 18 | CODE | |
| LOW | tests/test_mcp_least_privilege.py | 18 | CODE | |
| LOW | tests/test_multi_skill.py | 18 | CODE | |
| LOW | tests/unit/test_agent_cli.py | 34 | CODE | |
| LOW | tests/unit/test_inference_usage.py | 6 | CODE | |
| LOW | tests/unit/test_llm_utils.py | 23 | CODE | |
| LOW | tests/unit/test_providers.py | 23 | CODE | |
| LOW | tests/unit/test_suppression.py | 18 | CODE | |
| LOW | tests/unit/test_github_release_workflow.py | 6 | CODE | |
| LOW | tests/unit/test_model_info.py | 18 | CODE | |
| LOW | tests/unit/test_model_info.py | 33 | CODE | |
| LOW | tests/unit/test_osv_client.py | 18 | CODE | |
| LOW | tests/unit/test_create_github_release.py | 6 | CODE | |
| LOW | tests/unit/test_input_handler_ssrf.py | 18 | CODE | |
| LOW | tests/unit/test_bedrock_provider.py | 24 | CODE | |
| LOW | tests/unit/test_new_providers.py | 18 | CODE | |
| LOW | tests/unit/test_wheel_contents.py | 6 | CODE | |
| LOW | tests/unit/test_input_handler_bounds.py | 26 | CODE | |
| LOW | tests/unit/test_anthropic_proxy_provider.py | 18 | CODE | |
| LOW | tests/unit/test_compare_scan_accuracy.py | 4 | CODE | |
| LOW | tests/unit/test_constants.py | 18 | CODE | |
| LOW | tests/unit/test_sarif.py | 18 | CODE | |
| LOW | tests/unit/test_patterns_new.py | 22 | CODE | |
| LOW | tests/nodes/test_deduplicate.py | 18 | CODE | |
| LOW | tests/nodes/test_nested_artifacts.py | 6 | CODE | |
| LOW | tests/nodes/test_transitive_analyzer_deadlines.py | 6 | CODE | |
| LOW | tests/nodes/test_security_remediation.py | 6 | CODE | |
| LOW | tests/nodes/test_analysis_completeness.py | 6 | CODE | |
| LOW | tests/nodes/test_llm_analyzer_base.py | 18 | CODE | |
| LOW | tests/nodes/test_report.py | 18 | CODE | |
| LOW | tests/nodes/test_sarif_rules_and_empty_findings.py | 18 | CODE | |
| LOW | tests/nodes/test_security_end_to_end.py | 6 | CODE | |
| LOW | tests/nodes/test_meta_analyzer_fallback.py | 18 | CODE | |
| LOW | tests/nodes/test_finalize_inspection_ledger.py | 6 | CODE | |
| LOW | tests/nodes/test_meta_analyzer.py | 23 | CODE | |
| LOW | tests/nodes/test_build_context.py | 21 | CODE | |
| LOW | tests/nodes/test_report_sanitizer.py | 18 | CODE | |
| LOW | tests/nodes/test_semantic_quality_policy.py | 18 | CODE | |
| LOW | tests/nodes/analyzers/test_mp2_regex_backtracking.py | 18 | CODE | |
| LOW | …sts/nodes/analyzers/test_ea1_wildcard_line_boundary.py | 29 | CODE | |
| LOW | tests/nodes/analyzers/test_registry.py | 18 | CODE | |
| LOW | tests/nodes/analyzers/test_behavioral_ast.py | 18 | CODE | |
| LOW | tests/nodes/analyzers/test_semantic_developer_intent.py | 18 | CODE | |
| LOW | tests/nodes/analyzers/conftest.py | 18 | CODE | |
| LOW | tests/nodes/analyzers/test_shared_python_ast.py | 6 | CODE | |
| LOW | tests/nodes/analyzers/test_whitespace_padding.py | 18 | CODE | |
| LOW | tests/nodes/analyzers/test_static_runner_filtering.py | 18 | CODE | |
| LOW | tests/nodes/analyzers/test_structured_skill_roles.py | 18 | CODE | |
| LOW | tests/nodes/analyzers/test_static_patterns.py | 18 | CODE | |
| LOW | …ts/nodes/analyzers/test_semantic_security_discovery.py | 18 | CODE | |
| LOW | …odes/analyzers/test_static_patterns_deserialization.py | 18 | CODE | |
| LOW | tests/nodes/analyzers/test_mcp_rug_pull.py | 18 | CODE | |
| LOW | …s/nodes/analyzers/test_static_patterns_anti_refusal.py | 18 | CODE | |
| LOW | …nodes/analyzers/test_static_false_positive_controls.py | 6 | CODE | |
| LOW | tests/nodes/analyzers/test_binary_and_pe3_filtering.py | 18 | CODE | |
| 167 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | model_registry.yaml | 1 | # Model registry — context window and output token limits. | COMMENT |
| LOW | .skillspector-baseline.example.yaml | 1 | # SkillSpector baseline (example) | COMMENT |
| LOW | README.md | 261 | export SKILLSPECTOR_PROVIDER=bedrock | COMMENT |
| LOW | tests/test_mcp_tool_poisoning.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/conftest.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/__init__.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/test_mcp_rug_pull.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/test_mcp_least_privilege.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/test_multi_skill.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/unit/test_agent_cli.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/unit/test_transitive.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/unit/test_mcp_server.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/unit/test_llm_utils.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/unit/test_providers.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/unit/test_suppression.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/unit/test_patterns.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/unit/__init__.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/unit/test_model_info.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/unit/test_osv_client.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/unit/test_input_handler_ssrf.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/unit/test_bedrock_provider.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/unit/test_reviewer_nits.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/unit/test_new_providers.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/unit/test_input_handler_bounds.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/unit/test_anthropic_proxy_provider.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/unit/test_cli.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/unit/test_constants.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/unit/test_input_handler.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/unit/test_sarif.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/unit/test_patterns_new.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/nodes/test_deduplicate.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/nodes/test_llm_analyzer_base.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/nodes/__init__.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/nodes/test_report.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/nodes/test_sarif_rules_and_empty_findings.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/nodes/test_resolve_input.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/nodes/test_meta_analyzer_fallback.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/nodes/test_meta_analyzer.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/nodes/test_build_context.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/nodes/test_report_sanitizer.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/nodes/test_semantic_quality_policy.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/nodes/analyzers/test_mp2_regex_backtracking.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | …sts/nodes/analyzers/test_ea1_wildcard_line_boundary.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/nodes/analyzers/test_registry.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/nodes/analyzers/test_behavioral_ast.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/nodes/analyzers/test_semantic_developer_intent.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/nodes/analyzers/conftest.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/nodes/analyzers/test_whitespace_padding.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/nodes/analyzers/test_static_runner_filtering.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/nodes/analyzers/test_structured_skill_roles.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/nodes/analyzers/test_static_patterns.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | …ts/nodes/analyzers/test_semantic_security_discovery.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/nodes/analyzers/test_sc8_shipped_bytecode.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | …odes/analyzers/test_static_patterns_deserialization.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/nodes/analyzers/test_mcp_rug_pull.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | …alyzers/test_static_patterns_supply_chain_lockfiles.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | …s/nodes/analyzers/test_static_patterns_anti_refusal.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/nodes/analyzers/test_binary_and_pe3_filtering.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/nodes/analyzers/test_static_yara.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tests/nodes/analyzers/test_behavioral_taint_tracking.py | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| 132 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/test_mcp_tool_poisoning.py | 90 | CODE | |
| LOW | tests/test_mcp_least_privilege.py | 84 | CODE | |
| LOW | tests/unit/test_cli.py | 3601 | CODE | |
| LOW | tests/nodes/test_security_end_to_end.py | 109 | CODE | |
| LOW | tests/nodes/test_security_end_to_end.py | 778 | CODE | |
| LOW | contrib/batch_scan/detection.py | 50 | CODE | |
| LOW | contrib/batch_scan/batch_scan.py | 192 | CODE | |
| LOW | contrib/batch_scan/api_pool.py | 165 | CODE | |
| LOW | contrib/batch_scan/reports.py | 376 | CODE | |
| LOW | contrib/batch_scan/tests/tests-pro/mutation_max.py | 120 | CODE | |
| LOW | src/skillspector/references.py | 59 | CODE | |
| LOW | src/skillspector/references.py | 140 | CODE | |
| LOW | src/skillspector/inspection_ledger.py | 336 | CODE | |
| LOW | src/skillspector/inspection_ledger.py | 672 | CODE | |
| LOW | src/skillspector/structured_skill.py | 277 | CODE | |
| LOW | src/skillspector/structured_skill.py | 339 | CODE | |
| LOW | src/skillspector/structured_skill.py | 392 | CODE | |
| LOW | src/skillspector/structured_skill.py | 689 | CODE | |
| LOW | src/skillspector/structured_skill.py | 355 | CODE | |
| LOW | src/skillspector/structured_skill.py | 400 | CODE | |
| LOW | src/skillspector/nested_artifacts.py | 549 | CODE | |
| LOW | src/skillspector/nested_artifacts.py | 1002 | CODE | |
| LOW | src/skillspector/cli.py | 873 | CODE | |
| LOW | src/skillspector/cli.py | 1326 | CODE | |
| LOW | src/skillspector/cli.py | 1416 | CODE | |
| LOW | src/skillspector/cli.py | 2064 | CODE | |
| LOW | src/skillspector/python_ast.py | 114 | CODE | |
| LOW | src/skillspector/transitive.py | 376 | CODE | |
| LOW | src/skillspector/input_handler.py | 781 | CODE | |
| LOW | src/skillspector/input_handler.py | 989 | CODE | |
| LOW | src/skillspector/input_handler.py | 1081 | CODE | |
| LOW | src/skillspector/input_handler.py | 1177 | CODE | |
| LOW | src/skillspector/input_handler.py | 1225 | CODE | |
| LOW | src/skillspector/input_handler.py | 1364 | CODE | |
| LOW | src/skillspector/artifacts.py | 150 | CODE | |
| LOW | src/skillspector/artifacts.py | 264 | CODE | |
| LOW | src/skillspector/multi_skill.py | 229 | CODE | |
| LOW | src/skillspector/multi_skill.py | 329 | CODE | |
| LOW | src/skillspector/multi_skill.py | 388 | CODE | |
| LOW | src/skillspector/nodes/build_context.py | 265 | CODE | |
| LOW | src/skillspector/nodes/build_context.py | 779 | CODE | |
| LOW | src/skillspector/nodes/build_context.py | 1290 | CODE | |
| LOW | src/skillspector/nodes/build_context.py | 1368 | CODE | |
| LOW | src/skillspector/nodes/build_context.py | 1508 | CODE | |
| LOW | src/skillspector/nodes/build_context.py | 1683 | CODE | |
| LOW | src/skillspector/nodes/build_context.py | 1402 | CODE | |
| LOW | src/skillspector/nodes/meta_analyzer.py | 381 | CODE | |
| LOW | src/skillspector/nodes/report.py | 883 | CODE | |
| LOW | src/skillspector/nodes/report.py | 1277 | CODE | |
| LOW | …tor/nodes/analyzers/static_patterns_harmful_content.py | 85 | CODE | |
| LOW | …tor/nodes/analyzers/static_patterns_harmful_content.py | 198 | CODE | |
| LOW | …tor/nodes/analyzers/static_patterns_output_handling.py | 221 | CODE | |
| LOW | …tor/nodes/analyzers/static_patterns_output_handling.py | 340 | CODE | |
| LOW | …tor/nodes/analyzers/static_patterns_output_handling.py | 382 | CODE | |
| LOW | …tor/nodes/analyzers/static_patterns_output_handling.py | 404 | CODE | |
| LOW | src/skillspector/nodes/analyzers/mcp_least_privilege.py | 283 | CODE | |
| LOW | src/skillspector/nodes/analyzers/mcp_least_privilege.py | 458 | CODE | |
| LOW | …or/nodes/analyzers/static_patterns_prompt_injection.py | 226 | CODE | |
| LOW | …llspector/nodes/analyzers/behavioral_taint_tracking.py | 418 | CODE | |
| LOW | …llspector/nodes/analyzers/behavioral_taint_tracking.py | 454 | CODE | |
| 31 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/unit/test_providers.py | 0 | isolate provider-related env vars and the yaml cache for each test. | STRING |
| HIGH | tests/unit/test_bedrock_provider.py | 0 | isolate provider-related env vars and the yaml cache for each test. | STRING |
| HIGH | tests/unit/test_new_providers.py | 0 | isolate provider-related env vars and the yaml cache for each test. | STRING |
| HIGH | src/skillspector/providers/azure_openai/provider.py | 0 | resolve model: ``skillspector_model`` env > slot default > ``default_model``. | STRING |
| HIGH | src/skillspector/providers/bedrock/provider.py | 0 | resolve model: ``skillspector_model`` env > slot default > ``default_model``. | STRING |
| HIGH | src/skillspector/providers/nv_build/provider.py | 0 | resolve model: ``skillspector_model`` env > slot default > ``default_model``. | STRING |
| HIGH | …c/skillspector/providers/openai_compatible/provider.py | 0 | resolve model: ``skillspector_model`` env > slot default > ``default_model``. | STRING |
| HIGH | src/skillspector/providers/anthropic/provider.py | 0 | resolve model: ``skillspector_model`` env > slot default > ``default_model``. | STRING |
| HIGH | src/skillspector/providers/ollama/provider.py | 0 | resolve model: ``skillspector_model`` env > slot default > ``default_model``. | STRING |
| HIGH | src/skillspector/providers/openai/provider.py | 0 | resolve model: ``skillspector_model`` env > slot default > ``default_model``. | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/unit/test_patterns.py | 389 | content = "cat /etc/passwd && docker run -v /etc/passwd:/etc/passwd:ro image" | CODE |
| HIGH | tests/unit/test_patterns_new.py | 374 | "const match = condition ? /yes/.exec(output) : null;", | CODE |
| HIGH | tests/unit/test_patterns_new.py | 1544 | 'rm -rf "$BRANCH_CTX_PARENT" 2>/dev/null || true', | CODE |
| HIGH | tests/unit/test_patterns_new.py | 1584 | pytest.param("ls && rm -rf /tmp", "cleanup.sh", "shell", id="chain_rm"), | CODE |
| HIGH | tests/unit/test_patterns_new.py | 1630 | "RUN apt-get update && apt-get install -y curl && rm -rf /var/lib/apt/lists/*\n" | CODE |
| HIGH | tests/unit/test_patterns_new.py | 1644 | "RUN apt-get update && apt-get install -y curl && rm -rf /var/lib/apt/lists/*\n" | CODE |
| HIGH | tests/unit/test_patterns_new.py | 1658 | "RUN useradd --create-home appuser && chown -R appuser:appuser /app\n" | CODE |
| HIGH⚡ | tests/nodes/analyzers/test_static_yara.py | 465 | ssh target 'rm -rf ~/trt_profile_model && mkdir -p ~/trt_profile_model/results' | CODE |
| HIGH | contrib/batch_scan/runner.py | 216 | '"end_line": null, "confidence": 0.0-1.0, ' | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/unit/test_input_handler_ssrf.py | 167 | except Exception: | CODE |
| LOW | docs/LLM_ANALYZER_BASE_GUIDE.md | 89 | except Exception as e: | CODE |
| LOW | contrib/batch_scan/runner.py | 157 | except Exception as exc: | CODE |
| LOW | contrib/batch_scan/runner.py | 202 | except Exception as exc: | CODE |
| LOW | contrib/batch_scan/runner.py | 766 | except Exception as exc: | CODE |
| LOW | contrib/batch_scan/batch_scan.py | 371 | except Exception: | CODE |
| LOW | contrib/batch_scan/api_pool.py | 472 | except Exception as exc: | CODE |
| LOW | contrib/batch_scan/api_pool.py | 515 | except Exception as exc: | CODE |
| LOW | contrib/batch_scan/gap_fill.py | 237 | except Exception as exc: | CODE |
| LOW | contrib/batch_scan/gap_fill.py | 303 | except Exception as exc: | CODE |
| LOW | …trib/batch_scan/tests/test_monkeypatch_invasiveness.py | 281 | except Exception as exc: | CODE |
| LOW⚡ | contrib/batch_scan/tests/tests-pro/mutation_max.py | 479 | except Exception: | CODE |
| LOW | contrib/batch_scan/tests/tests-pro/mutation_max.py | 321 | except Exception: | CODE |
| LOW | contrib/batch_scan/tests/tests-pro/mutation_max.py | 349 | except Exception: | CODE |
| LOW | contrib/batch_scan/tests/tests-pro/mutation_max.py | 396 | except Exception: | CODE |
| MEDIUM | contrib/batch_scan/tests/tests-pro/test_api_pool.py | 401 | def worker(): | CODE |
| LOW | contrib/batch_scan/tests/tests-pro/test_api_pool.py | 408 | except Exception as e: | CODE |
| MEDIUM | …trib/batch_scan/tests/tests-pro/test_runner_patches.py | 393 | def test_chatopenai_init_receives_both_timeout_and_request_timeout(self): | CODE |
| LOW | …trib/batch_scan/tests/tests-pro/test_runner_patches.py | 469 | except Exception: | CODE |
| LOW | contrib/batch_scan/docs/DESIGN.md | 164 | except Exception: | CODE |
| LOW | contrib/batch_scan/docs/archive/PITFALLS.md | 120 | except Exception: | CODE |
| LOW | scripts/compare_scan_accuracy.py | 793 | except Exception as error: | CODE |
| LOW | src/skillspector/inspection_ledger.py | 1024 | except Exception as exc: # pragma: no cover - exact exception is node-dependent | CODE |
| LOW | src/skillspector/cli.py | 578 | except Exception as e: | CODE |
| LOW | src/skillspector/cli.py | 712 | except Exception as e: | CODE |
| LOW | src/skillspector/cli.py | 1752 | except Exception: | CODE |
| LOW | src/skillspector/cli.py | 2208 | except Exception as e: | CODE |
| LOW | src/skillspector/cli.py | 2522 | except Exception as e: | CODE |
| LOW | src/skillspector/llm_analyzer_base.py | 725 | except Exception as exc: | CODE |
| LOW | src/skillspector/llm_analyzer_base.py | 794 | except Exception as exc: | CODE |
| LOW | src/skillspector/llm_analyzer_base.py | 866 | except Exception as exc: | CODE |
| LOW | src/skillspector/nodes/meta_analyzer.py | 860 | except Exception as e: | CODE |
| LOW | …spector/nodes/analyzers/semantic_security_discovery.py | 283 | except Exception as exc: | CODE |
| LOW | …llspector/nodes/analyzers/bundled_execution_surface.py | 1727 | except Exception as exc: | CODE |
| LOW | src/skillspector/nodes/analyzers/__init__.py | 48 | except Exception as exc: | CODE |
| LOW | src/skillspector/nodes/analyzers/static_yara.py | 875 | except Exception as exc: | CODE |
| LOW | …killspector/nodes/analyzers/semantic_quality_policy.py | 243 | except Exception as exc: | CODE |
| LOW | …llspector/nodes/analyzers/semantic_developer_intent.py | 275 | except Exception as exc: | CODE |
| LOW | src/skillspector/nodes/analyzers/static_runner.py | 1209 | except Exception as exc: | CODE |
| LOW | src/skillspector/nodes/analyzers/mcp_tool_poisoning.py | 371 | except Exception: | CODE |
| LOW | src/skillspector/nodes/analyzers/mcp_tool_poisoning.py | 482 | except Exception: | CODE |
| LOW | src/skillspector/nodes/analyzers/mcp_tool_poisoning.py | 1468 | except Exception as exc: | CODE |
| LOW | src/skillspector/providers/registry.py | 57 | except Exception: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | model_registry.yaml | 1 | # Model registry — context window and output token limits. | COMMENT |
| MEDIUM | model_registry.yaml | 10 | # context_length: <int> # total context window in tokens (required) | COMMENT |
| MEDIUM | docs/LLM_ANALYZER_BASE_GUIDE.md | 627 | context_length: 128000 # total context window in tokens (required) | CODE |
| MEDIUM | …killspector/providers/azure_openai/model_registry.yaml | 8 | # context_length: <int> # total context window in tokens (required) | COMMENT |
| MEDIUM | src/skillspector/providers/bedrock/model_registry.yaml | 8 | # context_length: <int> # total context window in tokens (required) | COMMENT |
| MEDIUM | src/skillspector/providers/nv_build/model_registry.yaml | 8 | # context_length: <int> # total context window in tokens (required) | COMMENT |
| MEDIUM | …pector/providers/openai_compatible/model_registry.yaml | 9 | # context_length: <int> # total context window in tokens (required) | COMMENT |
| MEDIUM | …c/skillspector/providers/anthropic/model_registry.yaml | 8 | # context_length: <int> # total context window in tokens (required) | COMMENT |
| MEDIUM | src/skillspector/providers/ollama/model_registry.yaml | 8 | # context_length: <int> # total context window in tokens (required) | COMMENT |
| MEDIUM | src/skillspector/providers/openai/model_registry.yaml | 8 | # context_length: <int> # total context window in tokens (required) | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | contrib/batch_scan/runner.py | 58 | def set_api_pool(pool: "ApiKeyPool | None") -> None: | CODE |
| LOW | contrib/batch_scan/__init__.py | 54 | __all__ = [ | CODE |
| LOW | src/skillspector/logging_config.py | 64 | def set_level(level: int | str) -> None: | CODE |
| LOW | src/skillspector/inspection_ledger.py | 16 | logger = logging.getLogger(__name__) | CODE |
| LOW | src/skillspector/constants.py | 23 | logger = logging.getLogger(__name__) | CODE |
| LOW | src/skillspector/__init__.py | 37 | __all__ = ["create_graph", "graph", "__version__"] | CODE |
| LOW | src/skillspector/inference_usage.py | 337 | def set_provider(self, provider: str) -> None: | CODE |
| LOW | src/skillspector/nodes/analyzers/__init__.py | 63 | __all__ = ["ANALYZER_NODE_IDS", "ANALYZER_NODES", "ANALYZER_MODULES"] | CODE |
| LOW⚡ | src/skillspector/nodes/analyzers/mcp_tool_poisoning.py | 65 | logger = logging.getLogger(__name__) | CODE |
| LOW | src/skillspector/providers/chat_models.py | 28 | logger = logging.getLogger(__name__) | CODE |
| LOW | src/skillspector/providers/__init__.py | 299 | __all__ = [ | CODE |
| LOW | src/skillspector/providers/codex_cli/__init__.py | 29 | __all__ = ["CodexCLIProvider"] | CODE |
| LOW | src/skillspector/providers/azure_openai/__init__.py | 20 | __all__ = ["REGISTRY_PATH", "AzureOpenAIProvider"] | CODE |
| LOW | src/skillspector/providers/anthropic_proxy/__init__.py | 20 | __all__ = ["REGISTRY_PATH", "AnthropicProxyProvider"] | CODE |
| LOW | src/skillspector/providers/bedrock/__init__.py | 25 | __all__ = [ | CODE |
| LOW | src/skillspector/providers/claude_cli/__init__.py | 25 | __all__ = ["ClaudeCLIProvider"] | CODE |
| LOW | src/skillspector/providers/gemini_cli/__init__.py | 22 | __all__ = ["GeminiCLIProvider"] | CODE |
| LOW | src/skillspector/providers/nv_build/__init__.py | 20 | __all__ = ["BUILD_BASE_URL", "REGISTRY_PATH", "NvBuildProvider"] | CODE |
| LOW | …c/skillspector/providers/openai_compatible/__init__.py | 20 | __all__ = ["REGISTRY_PATH", "OpenAICompatibleProvider"] | CODE |
| LOW | src/skillspector/providers/antigravity_cli/__init__.py | 22 | __all__ = ["AntigravityCLIProvider"] | CODE |
| LOW | src/skillspector/providers/anthropic/__init__.py | 20 | __all__ = ["ANTHROPIC_BASE_URL", "REGISTRY_PATH", "AnthropicProvider"] | CODE |
| LOW | src/skillspector/providers/ollama/__init__.py | 20 | __all__ = ["OLLAMA_DEFAULT_BASE_URL", "REGISTRY_PATH", "OllamaProvider"] | CODE |
| LOW | src/skillspector/providers/openai/__init__.py | 20 | __all__ = ["OPENAI_DEFAULT_BASE_URL", "REGISTRY_PATH", "OpenAIProvider"] | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | src/skillspector/llm_utils.py | 495 | Run an async coroutine in a synchronous context, even if there's already a running event loop. This function s | STRING |
| HIGH | src/skillspector/input_handler.py | 666 | Resolve input to a scannable directory. Args: input_path: Path or URL to resolve | STRING |
| HIGH | src/skillspector/providers/_agent_cli.py | 747 | Run an agent CLI and return the assistant response text. This is the single security-hardened entry point. All sec | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | …trib/batch_scan/tests/tests-pro/test_runner_patches.py | 445 | # Create a loop via _patched_asyncio_run — it calls _make_quiet_loop internally | COMMENT |
| MEDIUM⚡ | …trib/batch_scan/tests/tests-pro/test_runner_patches.py | 454 | # Create a loop, then manually invoke the quiet-loop logic from the patch | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | contrib/batch_scan/api_pool.py | 198 | # Step 1: recover rate-limited keys whose backoff has expired | COMMENT |
| LOW⚡ | contrib/batch_scan/api_pool.py | 201 | # Step 2: find available keys (not rate-limited, slots open) | COMMENT |
| LOW | contrib/batch_scan/api_pool.py | 219 | # Step 3: no capacity — compute wait time | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | contrib/batch_scan/api_pool.py | 198 | # Step 1: recover rate-limited keys whose backoff has expired | COMMENT |
| LOW⚡ | contrib/batch_scan/api_pool.py | 201 | # Step 2: find available keys (not rate-limited, slots open) | COMMENT |
| LOW | contrib/batch_scan/api_pool.py | 219 | # Step 3: no capacity — compute wait time | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/unit/test_suppression.py | 46 | CODE | |
| LOW | src/skillspector/inspection_ledger.py | 336 | CODE | |
| LOW | src/skillspector/nested_artifacts.py | 439 | CODE | |
| LOW | src/skillspector/cli.py | 386 | CODE | |
| LOW | src/skillspector/cli.py | 2064 | CODE | |
| LOW | src/skillspector/nodes/report.py | 1150 | CODE | |
| LOW | src/skillspector/nodes/analyzers/mcp_tool_poisoning.py | 995 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/integration/test_agent_cli_live.py | 59 | #: Real ``stdin -> stdout`` agent CLIs this harness can drive. Add a new CLI here | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/unit/test_anthropic_proxy_provider.py | 210 | def handle_request(self, request: httpx.Request) -> httpx.Response: | CODE |
| LOW | src/skillspector/providers/anthropic_proxy/provider.py | 109 | def handle_request(self, request: httpx.Request) -> httpx.Response: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/skillspector/nodes/analyzers/mcp_tool_poisoning.py | 355 | # Check if this match overlaps with a data URI range | COMMENT |