Claude Code is an agentic coding tool that lives in your terminal, understands your codebase, and helps you code faster by executing routine tasks, explaining complex code, and handling git workflows - all through natural language commands.
This report summarizes scanner evidence for anthropics/claude-code, a TypeScript project with 150,025 GitHub stars. SynthScan examined 90,391 lines of code across 1176 source files, recording 373 pattern matches distributed across 14 syntactic categories. The legacy adjusted pattern signal is 7.4 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 157 finding(s).
Are imports declared and package/API names verified? 78 finding(s).
Are wrappers, guards, and repeated structures necessary? 158 finding(s).
Which changes need focused human review? 373 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 373 distinct pattern matches across 14 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …/learning-output-style/hooks-handlers/session-start.sh | 10 | "additionalContext": "You are in 'learning' output style mode, which combines interactive learning with educational | CODE |
| MEDIUM | plugins/security-guidance/hooks/_base.py | 85 | # ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | …gins/security-guidance/hooks/security_reminder_hook.py | 228 | # ===================================================================== | COMMENT |
| MEDIUM⚡ | …gins/security-guidance/hooks/security_reminder_hook.py | 230 | # ===================================================================== | COMMENT |
| MEDIUM⚡ | …gins/security-guidance/hooks/security_reminder_hook.py | 378 | # ===================================================================== | COMMENT |
| MEDIUM⚡ | …gins/security-guidance/hooks/security_reminder_hook.py | 380 | # ===================================================================== | COMMENT |
| MEDIUM⚡ | …gins/security-guidance/hooks/security_reminder_hook.py | 382 | # ===================================================================== | COMMENT |
| MEDIUM⚡ | …gins/security-guidance/hooks/security_reminder_hook.py | 384 | # ===================================================================== | COMMENT |
| MEDIUM⚡ | …gins/security-guidance/hooks/security_reminder_hook.py | 442 | # ===================================================================== | COMMENT |
| MEDIUM⚡ | …gins/security-guidance/hooks/security_reminder_hook.py | 444 | # ===================================================================== | COMMENT |
| MEDIUM | …gins/security-guidance/hooks/security_reminder_hook.py | 310 | # ===================================================================== | COMMENT |
| MEDIUM | …gins/security-guidance/hooks/security_reminder_hook.py | 319 | # ===================================================================== | COMMENT |
| MEDIUM | …gins/security-guidance/hooks/security_reminder_hook.py | 612 | # ─── push-sweep ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | plugins/security-guidance/hooks/patterns.py | 154 | # ===================================================================== | COMMENT |
| MEDIUM | plugins/security-guidance/hooks/patterns.py | 156 | # ===================================================================== | COMMENT |
| MEDIUM⚡ | plugins/security-guidance/hooks/diffstate.py | 223 | # ===================================================================== | COMMENT |
| MEDIUM⚡ | plugins/security-guidance/hooks/diffstate.py | 225 | # ===================================================================== | COMMENT |
| MEDIUM⚡ | plugins/security-guidance/hooks/diffstate.py | 227 | # ─── push-sweep reviewed-commit tracking ──────────────────────────────────── | COMMENT |
| MEDIUM | plugins/security-guidance/hooks/diffstate.py | 21 | # ===================================================================== | COMMENT |
| MEDIUM | plugins/security-guidance/hooks/diffstate.py | 23 | # ===================================================================== | COMMENT |
| MEDIUM | plugins/security-guidance/hooks/diffstate.py | 39 | # ===================================================================== | COMMENT |
| MEDIUM | plugins/security-guidance/hooks/diffstate.py | 41 | # ===================================================================== | COMMENT |
| MEDIUM | plugins/security-guidance/hooks/diffstate.py | 207 | # ─── push-sweep reviewed-commit tracking ──────────────────────────────────── | COMMENT |
| MEDIUM | plugins/security-guidance/hooks/diffstate.py | 312 | # ===================================================================== | COMMENT |
| MEDIUM | plugins/security-guidance/hooks/diffstate.py | 314 | # ===================================================================== | COMMENT |
| MEDIUM | plugins/security-guidance/hooks/review_api.py | 23 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | plugins/security-guidance/hooks/review_api.py | 25 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | plugins/security-guidance/hooks/review_api.py | 67 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | plugins/security-guidance/hooks/review_api.py | 69 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | plugins/security-guidance/hooks/review_api.py | 179 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | plugins/security-guidance/hooks/review_api.py | 181 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | plugins/security-guidance/hooks/review_api.py | 286 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | plugins/security-guidance/hooks/review_api.py | 288 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | plugins/security-guidance/hooks/llm.py | 78 | # ===================================================================== | COMMENT |
| MEDIUM | plugins/security-guidance/hooks/llm.py | 80 | # ===================================================================== | COMMENT |
| MEDIUM | plugins/security-guidance/hooks/llm.py | 144 | # ===================================================================== | COMMENT |
| MEDIUM | plugins/security-guidance/hooks/llm.py | 146 | # ===================================================================== | COMMENT |
| MEDIUM | plugins/security-guidance/hooks/llm.py | 243 | # ── 3rd-party provider routing (Bedrock / Vertex / Foundry / Mantle) ───── | COMMENT |
| MEDIUM | plugins/security-guidance/hooks/extensibility.py | 43 | # ── caps ───────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | plugins/security-guidance/hooks/extensibility.py | 57 | # ── public API ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | plugins/security-guidance/hooks/extensibility.py | 89 | # ── claude-security-guidance.md ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | plugins/security-guidance/hooks/extensibility.py | 144 | # ── security-patterns.{yaml,json} ──────────────────────────────────────────── | COMMENT |
| MEDIUM | …planatory-output-style/hooks-handlers/session-start.sh | 10 | "additionalContext": "You are in 'explanatory' output style mode, where you should provide educational insights abou | CODE |
| MEDIUM | examples/gateway/gcp/terraform/main.tf | 24 | # ── 1 Project & API setup ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | examples/gateway/gcp/terraform/main.tf | 34 | # ── 2 Service account & IAM (least-privilege) ─────────────────────────────── | COMMENT |
| MEDIUM | examples/gateway/gcp/terraform/main.tf | 57 | # ── 3 Artifact Registry repo ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | examples/gateway/gcp/terraform/main.tf | 68 | # ── 4 VPC + Private Services Access ────────────────────────────────────────── | COMMENT |
| MEDIUM | examples/gateway/gcp/terraform/main.tf | 106 | # ── 4 Cloud SQL (private IP only) ─────────────────────────────────────────── | COMMENT |
| MEDIUM | examples/gateway/gcp/terraform/main.tf | 150 | # ── 5/6 Secrets + secretAccessor ──────────────────────────────────────────── | COMMENT |
| MEDIUM | examples/gateway/gcp/terraform/main.tf | 273 | # ── 7 Cloud Run (Direct VPC egress) ───────────────────────────────────────── | COMMENT |
| MEDIUM | examples/gateway/gcp/terraform/variables.tf | 14 | # ── Service account (§2) ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | examples/gateway/gcp/terraform/variables.tf | 21 | # ── Image (§3) ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | examples/gateway/gcp/terraform/variables.tf | 45 | # ── Networking (§4) ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | examples/gateway/gcp/terraform/variables.tf | 70 | # ── Cloud SQL (§4) ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | examples/gateway/gcp/terraform/variables.tf | 101 | # ── Secrets (§5 / §6) ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | examples/gateway/gcp/terraform/variables.tf | 139 | # ── Cloud Run (§7) ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | examples/gateway/aws/terraform/main.tf | 28 | # ── 1 Security groups ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | examples/gateway/aws/terraform/main.tf | 96 | # ── 2 IAM roles (least-privilege) ─────────────────────────────────────────── | COMMENT |
| MEDIUM | examples/gateway/aws/terraform/main.tf | 185 | # ── 6 ECR repository ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | examples/gateway/aws/terraform/main.tf | 199 | # ── 3 RDS for PostgreSQL (private subnets, no public address) ─────────────── | COMMENT |
| 8 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | plugins/security-guidance/hooks/_base.py | 52 | except Exception: | CODE |
| HIGH | plugins/security-guidance/hooks/_base.py | 37 | except OSError: | CODE |
| HIGH | plugins/security-guidance/hooks/_base.py | 45 | except OSError: | CODE |
| HIGH | …gins/security-guidance/hooks/security_reminder_hook.py | 681 | except OSError: | CODE |
| HIGH | …gins/security-guidance/hooks/security_reminder_hook.py | 1264 | except Exception: | CODE |
| HIGH | …gins/security-guidance/hooks/security_reminder_hook.py | 1459 | except (subprocess.TimeoutExpired, FileNotFoundError, OSError): | CODE |
| HIGH | …gins/security-guidance/hooks/security_reminder_hook.py | 2016 | except Exception: | CODE |
| HIGH | …gins/security-guidance/hooks/security_reminder_hook.py | 800 | except (subprocess.TimeoutExpired, FileNotFoundError, OSError): | CODE |
| HIGH | …gins/security-guidance/hooks/security_reminder_hook.py | 811 | except (subprocess.TimeoutExpired, FileNotFoundError, OSError): | CODE |
| HIGH | …gins/security-guidance/hooks/security_reminder_hook.py | 872 | except _queue.Full: | CODE |
| HIGH | …gins/security-guidance/hooks/security_reminder_hook.py | 888 | except _queue.Full: | CODE |
| HIGH | …gins/security-guidance/hooks/security_reminder_hook.py | 2003 | except OSError: | CODE |
| HIGH | …gins/security-guidance/hooks/security_reminder_hook.py | 408 | except Exception: | CODE |
| HIGH | …gins/security-guidance/hooks/security_reminder_hook.py | 421 | except Exception: | CODE |
| HIGH | …gins/security-guidance/hooks/security_reminder_hook.py | 679 | except OSError: | CODE |
| HIGH | …gins/security-guidance/hooks/security_reminder_hook.py | 1497 | except (subprocess.TimeoutExpired, FileNotFoundError, OSError): | CODE |
| HIGH | plugins/security-guidance/hooks/session_state.py | 84 | except Exception: | CODE |
| HIGH | plugins/security-guidance/hooks/session_state.py | 99 | except (json.JSONDecodeError, IOError, KeyError, TypeError): | CODE |
| HIGH | plugins/security-guidance/hooks/session_state.py | 130 | except OSError: | CODE |
| HIGH | plugins/security-guidance/hooks/session_state.py | 159 | except (OSError, IOError): | CODE |
| HIGH | plugins/security-guidance/hooks/session_state.py | 68 | except (OSError, IOError): | CODE |
| HIGH | plugins/security-guidance/hooks/session_state.py | 82 | except (OSError, IOError): | CODE |
| HIGH | plugins/security-guidance/hooks/diffstate.py | 262 | except OSError: | CODE |
| HIGH | plugins/security-guidance/hooks/diffstate.py | 308 | except OSError: | CODE |
| HIGH | plugins/security-guidance/hooks/gitutil.py | 140 | except OSError: | CODE |
| HIGH | plugins/security-guidance/hooks/gitutil.py | 222 | except (subprocess.TimeoutExpired, FileNotFoundError, OSError): | CODE |
| HIGH | plugins/security-guidance/hooks/ensure_agent_sdk.py | 103 | except Exception: | CODE |
| HIGH | plugins/security-guidance/hooks/llm.py | 1202 | except Exception: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | …s/command-development/references/advanced-workflows.md | 24 | ## Step 1: Fetch PR Details | COMMENT |
| LOW⚡ | …s/command-development/references/advanced-workflows.md | 27 | ## Step 2: Review Files | COMMENT |
| LOW⚡ | …s/command-development/references/advanced-workflows.md | 35 | ## Step 3: Run Checks | COMMENT |
| LOW⚡ | …s/command-development/references/advanced-workflows.md | 43 | ## Step 4: Provide Feedback | COMMENT |
| LOW⚡ | …s/command-development/references/advanced-workflows.md | 216 | ## Step 1: Get test results | COMMENT |
| LOW⚡ | …s/command-development/references/advanced-workflows.md | 221 | ## Step 2: Categorize failures | COMMENT |
| LOW⚡ | …s/command-development/references/advanced-workflows.md | 226 | ## Step 3: Prioritize | COMMENT |
| LOW⚡ | …s/command-development/references/advanced-workflows.md | 232 | ## Step 4: Generate fix plan | COMMENT |
| LOW | …s/command-development/references/advanced-workflows.md | 530 | ## Step 1: Tests | COMMENT |
| LOW | …s/command-development/references/advanced-workflows.md | 546 | ## Step 2: Build | COMMENT |
| LOW | …command-development/references/interactive-commands.md | 82 | ## Step 1: Gather Configuration | COMMENT |
| LOW | …command-development/references/interactive-commands.md | 113 | ## Step 2: Process Answers | COMMENT |
| LOW | …command-development/references/interactive-commands.md | 122 | ## Step 3: Generate Configuration | COMMENT |
| LOW | …command-development/references/interactive-commands.md | 144 | ## Step 4: Confirm and Next Steps | COMMENT |
| LOW | plugins/plugin-dev/skills/skill-development/SKILL.md | 91 | ### Step 1: Understanding the Skill with Concrete Examples | COMMENT |
| LOW | plugins/plugin-dev/skills/skill-development/SKILL.md | 108 | ### Step 2: Planning the Reusable Skill Contents | COMMENT |
| LOW | plugins/plugin-dev/skills/skill-development/SKILL.md | 137 | ### Step 3: Create Skill Structure | COMMENT |
| LOW | plugins/plugin-dev/skills/skill-development/SKILL.md | 148 | ### Step 4: Edit the Skill | COMMENT |
| LOW | plugins/plugin-dev/skills/skill-development/SKILL.md | 212 | ### Step 5: Validate and Test | COMMENT |
| LOW | plugins/plugin-dev/skills/skill-development/SKILL.md | 232 | ### Step 6: Iterate | COMMENT |
| LOW | …skill-development/references/skill-creator-original.md | 91 | ### Step 1: Understanding the Skill with Concrete Examples | COMMENT |
| LOW | …skill-development/references/skill-creator-original.md | 108 | ### Step 2: Planning the Reusable Skill Contents | COMMENT |
| LOW | …skill-development/references/skill-creator-original.md | 132 | ### Step 3: Initializing the Skill | COMMENT |
| LOW | …skill-development/references/skill-creator-original.md | 155 | ### Step 4: Edit the Skill | COMMENT |
| LOW | …skill-development/references/skill-creator-original.md | 175 | ### Step 5: Packaging a Skill | COMMENT |
| LOW | …skill-development/references/skill-creator-original.md | 201 | ### Step 6: Iterate | COMMENT |
| LOW | …ls/plugin-settings/examples/create-settings-command.md | 12 | ### Step 1: Ask User for Preferences | COMMENT |
| LOW | …ls/plugin-settings/examples/create-settings-command.md | 57 | ### Step 2: Parse Answers | COMMENT |
| LOW | …ls/plugin-settings/examples/create-settings-command.md | 64 | ### Step 3: Create Settings File | COMMENT |
| LOW | …ls/plugin-settings/examples/create-settings-command.md | 83 | ### Step 4: Inform User | COMMENT |
| LOW | …ls/agent-development/examples/agent-creation-prompt.md | 7 | ### Step 1: Describe Your Agent Need | COMMENT |
| LOW | …ls/agent-development/examples/agent-creation-prompt.md | 15 | ### Step 2: Use the Generation Prompt | COMMENT |
| LOW | …ls/agent-development/examples/agent-creation-prompt.md | 27 | ### Step 3: Claude Returns JSON | COMMENT |
| LOW | …ls/agent-development/examples/agent-creation-prompt.md | 39 | ### Step 4: Convert to Agent File | COMMENT |
| LOW | plugins/hookify/commands/hookify.md | 17 | ### Step 1: Gather Behavior Information | COMMENT |
| LOW | plugins/hookify/commands/hookify.md | 60 | ### Step 2: Present Findings to User | COMMENT |
| LOW | plugins/hookify/commands/hookify.md | 82 | ### Step 3: Generate Rule Files | COMMENT |
| LOW | plugins/hookify/commands/hookify.md | 126 | ### Step 4: Create Files and Confirm | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | plugins/security-guidance/hooks/_base.py | 52 | except Exception: | CODE |
| LOW | plugins/security-guidance/hooks/_base.py | 78 | except Exception: | CODE |
| MEDIUM | …gins/security-guidance/hooks/security_reminder_hook.py | 339 | def _sweep(state): | CODE |
| MEDIUM | …gins/security-guidance/hooks/security_reminder_hook.py | 865 | def _agentic() -> None: | CODE |
| LOW⚡ | …gins/security-guidance/hooks/security_reminder_hook.py | 371 | except Exception as e: | CODE |
| LOW⚡ | …gins/security-guidance/hooks/security_reminder_hook.py | 868 | except Exception as e: # pragma: no cover — crash → let fallback win | CODE |
| LOW⚡ | …gins/security-guidance/hooks/security_reminder_hook.py | 884 | except Exception as e: # pragma: no cover | CODE |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 399 | except Exception: | CODE |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 408 | except Exception: | CODE |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 421 | except Exception: | CODE |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 1264 | except Exception: | CODE |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 2016 | except Exception: | CODE |
| LOW | plugins/security-guidance/hooks/session_state.py | 84 | except Exception: | CODE |
| LOW | plugins/security-guidance/hooks/ensure_agent_sdk.py | 41 | except Exception: | CODE |
| LOW | plugins/security-guidance/hooks/ensure_agent_sdk.py | 53 | except Exception: | CODE |
| LOW | plugins/security-guidance/hooks/ensure_agent_sdk.py | 103 | except Exception: | CODE |
| LOW | plugins/security-guidance/hooks/ensure_agent_sdk.py | 177 | except Exception as e: | CODE |
| LOW⚡ | plugins/security-guidance/hooks/ensure_agent_sdk.py | 199 | except Exception as exc: | CODE |
| MEDIUM | plugins/security-guidance/hooks/llm.py | 1194 | def _tolerant(data): | CODE |
| LOW⚡ | plugins/security-guidance/hooks/llm.py | 1115 | except Exception as e: # ImportError or transitive failure | CODE |
| LOW | plugins/security-guidance/hooks/llm.py | 293 | except Exception: | CODE |
| LOW | plugins/security-guidance/hooks/llm.py | 315 | except Exception as e: | CODE |
| LOW | plugins/security-guidance/hooks/llm.py | 376 | except Exception as e: | CODE |
| LOW | plugins/security-guidance/hooks/llm.py | 1086 | except Exception: | CODE |
| LOW | plugins/security-guidance/hooks/llm.py | 1197 | except Exception: | CODE |
| LOW | plugins/security-guidance/hooks/llm.py | 1202 | except Exception: | CODE |
| LOW | plugins/security-guidance/hooks/llm.py | 1310 | except Exception as e: | CODE |
| LOW | plugins/security-guidance/hooks/llm.py | 1377 | except Exception: | CODE |
| LOW | plugins/security-guidance/hooks/llm.py | 1545 | except Exception: | CODE |
| LOW | plugins/security-guidance/hooks/extensibility.py | 69 | except Exception as e: | CODE |
| LOW | plugins/security-guidance/hooks/extensibility.py | 74 | except Exception as e: | CODE |
| LOW | plugins/hookify/core/config_loader.py | 236 | except Exception as e: | CODE |
| MEDIUM⚡ | plugins/hookify/core/config_loader.py | 264 | print(f"Error: Cannot read {file_path}: {e}", file=sys.stderr) | CODE |
| MEDIUM⚡ | plugins/hookify/core/config_loader.py | 267 | print(f"Error: Malformed rule file {file_path}: {e}", file=sys.stderr) | CODE |
| MEDIUM⚡ | plugins/hookify/core/config_loader.py | 270 | print(f"Error: Invalid encoding in {file_path}: {e}", file=sys.stderr) | CODE |
| LOW⚡ | plugins/hookify/core/config_loader.py | 272 | except Exception as e: | CODE |
| MEDIUM⚡ | plugins/hookify/core/config_loader.py | 273 | print(f"Error: Unexpected error parsing {file_path} ({type(e).__name__}): {e}", file=sys.stderr) | CODE |
| LOW | plugins/hookify/hooks/userpromptsubmit.py | 46 | except Exception as e: | CODE |
| LOW | plugins/hookify/hooks/stop.py | 46 | except Exception as e: | CODE |
| LOW | plugins/hookify/hooks/pretooluse.py | 61 | except Exception as e: | CODE |
| LOW | plugins/hookify/hooks/posttooluse.py | 54 | except Exception as e: | CODE |
| MEDIUM | examples/hooks/bash_command_validator_example.py | 60 | print(f"Error: Invalid JSON input: {e}", file=sys.stderr) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | CHANGELOG.md | 4060 | - Changed `/review <pr>` back to a fast single-pass review; use `/code-review <level> <pr#>` for the multi-agent review | CODE |
| MEDIUM | plugins/plugin-dev/skills/plugin-settings/SKILL.md | 426 | ### multi-agent-swarm Plugin | COMMENT |
| MEDIUM | …ills/plugin-settings/references/real-world-examples.md | 5 | ## multi-agent-swarm Plugin | COMMENT |
| MEDIUM | …ev/skills/plugin-structure/examples/advanced-plugin.md | 225 | ### agents/orchestration/deployment-orchestrator.md | COMMENT |
| MEDIUM⚡ | …gins/security-guidance/hooks/security_reminder_hook.py | 1290 | # `agentic` = which path produced the result, not which was attempted. | COMMENT |
| MEDIUM⚡ | …gins/security-guidance/hooks/security_reminder_hook.py | 1291 | # On race-loss the _fallback() metrics dict has agentic=False — emitting | COMMENT |
| MEDIUM⚡ | …gins/security-guidance/hooks/security_reminder_hook.py | 1293 | # `agentic=true` queries and overstates agentic yield. | COMMENT |
| MEDIUM⚡ | …gins/security-guidance/hooks/security_reminder_hook.py | 1300 | # 1 = agentic won, 2 = single-shot fallback won. review_ms already | COMMENT |
| MEDIUM | …gins/security-guidance/hooks/security_reminder_hook.py | 73 | # review_api is the importable surface for the agentic-review prompts, | COMMENT |
| MEDIUM | …gins/security-guidance/hooks/security_reminder_hook.py | 74 | # schemas, and pure filters. External callers (e.g. agentic review harnesses) | COMMENT |
| MEDIUM | …gins/security-guidance/hooks/security_reminder_hook.py | 155 | # Lets multi-agent / shared-worktree deployments keep the commit reviewer | COMMENT |
| MEDIUM⚡ | …gins/security-guidance/hooks/security_reminder_hook.py | 878 | return # agentic finished within the delay — never start fallback | CODE |
| MEDIUM | …gins/security-guidance/hooks/security_reminder_hook.py | 1237 | # Fall back to single-shot only on agentic FAILURE (SDK/investigate | COMMENT |
| MEDIUM | …gins/security-guidance/hooks/security_reminder_hook.py | 1238 | # crash). If agentic completed and returned 0 findings, trust that. | COMMENT |
| MEDIUM | …gins/security-guidance/hooks/security_reminder_hook.py | 1629 | # Metrics — keep within the 10-key cap; agentic sub-metrics are dropped | COMMENT |
| MEDIUM | …gins/security-guidance/hooks/security_reminder_hook.py | 1631 | # to the per-commit fires for agentic detail). rewake_summary must ride | COMMENT |
| MEDIUM | plugins/security-guidance/hooks/gitutil.py | 483 | # single-shot and agentic reviews disagree on most (auth, routing, IPC, | COMMENT |
| MEDIUM | plugins/security-guidance/hooks/llm.py | 296 | # the agentic path to have run first. | COMMENT |
| MEDIUM | plugins/security-guidance/hooks/llm.py | 1036 | # core.pager, core.sshCommand, or an inherited GIT_* var. The agentic | COMMENT |
| MEDIUM | plugins/security-guidance/hooks/llm.py | 1253 | # cause of agentic fallbacks in remote sessions. Clearing them | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 59 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 60 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 67 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 68 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 69 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 70 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 79 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 80 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 80 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 80 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 80 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 80 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 80 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 80 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 80 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 87 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 87 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 87 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 87 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 87 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 87 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 87 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 93 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 93 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 93 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 93 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 93 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 97 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 97 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 97 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 97 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 97 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 97 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 97 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 97 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 97 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 97 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 97 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 97 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 97 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 97 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 97 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 97 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 111 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 111 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 111 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 111 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 111 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 111 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 111 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 121 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 121 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 121 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 121 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 121 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 121 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 121 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 121 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 121 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 121 | CODE | |
| 11 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | plugins/security-guidance/hooks/_base.py | 81 | COMMENT | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 141 | # Empty string or unset = enabled (default); "0" = disabled | COMMENT |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 301 | return False, len(ts_list) | COMMENT |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 481 | # touched_paths is still populated because consume_stop_state is the only | COMMENT |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 581 | re.compile(r'^ delete mode ', re.MULTILINE), | COMMENT |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 601 | # docstring for the rationale that motivated the switch from a lifetime cap. | COMMENT |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 621 | # `gh pr create` is intentionally NOT a separate hooks.json matcher: gh runs | COMMENT |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 941 | commit_succeeded = ( | COMMENT |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 1021 | debug_log("Commit review: not in a git repo") | COMMENT |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 1041 | # Output-based detection already failed above; the reflog SHAs are the | COMMENT |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 1061 | _base = {**_base, "sha_via_reflog": True, | COMMENT |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 1081 | # already populates `shas` with every fresh commit (amend + any | COMMENT |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 1261 | if r.returncode == 0: | COMMENT |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 1441 | # `git fetch && git push` produces fetch range lines that the regex would | COMMENT |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 1561 | sys.exit(0) | COMMENT |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 2081 | # | COMMENT |
| LOW | plugins/security-guidance/hooks/diffstate.py | 21 | # ===================================================================== | COMMENT |
| LOW | plugins/security-guidance/hooks/diffstate.py | 201 | return sha if sha else None | COMMENT |
| LOW | plugins/security-guidance/hooks/diffstate.py | 221 | COMMENT | |
| LOW | plugins/security-guidance/hooks/gitutil.py | 441 | COMMENT | |
| LOW | plugins/security-guidance/hooks/gitutil.py | 561 | if ext in SOURCE_CODE_EXTENSIONS: | COMMENT |
| LOW | plugins/security-guidance/hooks/ensure_agent_sdk.py | 201 | BUILD_FAILED, "main", f"exc:{type(exc).__name__}" | COMMENT |
| LOW | plugins/security-guidance/hooks/llm.py | 61 | # interruptive review surfaces — false positives are the dominant uninstall | COMMENT |
| LOW | plugins/security-guidance/hooks/llm.py | 1161 | # CLAUDE_CODE_EXECPATH is the absolute path to the running CC binary | COMMENT |
| LOW | plugins/security-guidance/hooks/llm.py | 1221 | # a write/exec tool to allowed_tools is caught by the gate. | COMMENT |
| LOW | plugins/security-guidance/hooks/llm.py | 1241 | # OAuth token) injected by Claude Code. The SDK builds the child | COMMENT |
| LOW | plugins/security-guidance/hooks/llm.py | 1321 | # before refute drops most real findings; the eval-validated config keeps | COMMENT |
| LOW | plugins/security-guidance/hooks/sg-python.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | examples/gateway/gcp/setup.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | examples/gateway/gcp/setup.sh | 381 | --data-file="${GATEWAY_YAML}" --project="${PROJECT_ID}" | COMMENT |
| LOW | examples/gateway/gcp/setup.sh | 421 | SECRET_MOUNTS="/etc/claude/gateway.yaml=${CONFIG_SECRET}:latest" # file mount (alone in /etc/claude) | COMMENT |
| LOW | examples/gateway/gcp/terraform/main.tf | 41 | COMMENT | |
| LOW | examples/gateway/aws/setup.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | examples/gateway/aws/setup.sh | 21 | # -> build & push image, config baked in (§6 + §4) -> DB subnet group | COMMENT |
| LOW | examples/gateway/aws/setup.sh | 61 | VERSION="${VERSION:-}" # REQUIRED — the gateway release tag you build and push (e.g. | COMMENT |
| LOW | examples/gateway/aws/setup.sh | 601 | fi | COMMENT |
| LOW | examples/gateway/aws/terraform/main.tf | 201 | name = var.db_instance | COMMENT |
| LOW | examples/gateway/aws/terraform/main.tf | 261 | # ── 5 Secrets Manager ─────────────────────────────────────────────────────── | COMMENT |
| LOW | .github/egress-firewall.yaml | 1 | # Hosts that jobs on GitHub's egress-firewall runner (runs-on: ubuntu-24.04-firewall) | COMMENT |
| LOW | mods/types/claude-code.d.ts | 1 | // Written by Claude Code 2.1.277. | COMMENT |
| LOW | mods/types/claude-code.d.ts | 21 | // is no `require`. The elements a render hook draws with (`Box`, `Text`, | COMMENT |
| LOW | mods/types/claude-code.d.ts | 41 | // | COMMENT |
| LOW | mods/types/claude-code.d.ts | 61 | // export const register = (on, options) => { ... } | COMMENT |
| LOW | mods/types/claude-code.d.ts | 81 | // would shadow the element. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …gins/security-guidance/hooks/security_reminder_hook.py | 525 | cross-repo case (`cd ../other && git commit --amend && cd -`) where | STRING |
| HIGH | …gins/security-guidance/hooks/security_reminder_hook.py | 649 | `git commit -m x && git push` matches both `Bash(git commit:*)` and | STRING |
| HIGH | …gins/security-guidance/hooks/security_reminder_hook.py | 751 | that ran *before* the push, e.g. `git fetch && git push`), and end at | STRING |
| HIGH | …gins/security-guidance/hooks/security_reminder_hook.py | 753 | *after* the push, e.g. `git push && git fetch`). | STRING |
| HIGH | plugins/security-guidance/hooks/gitutil.py | 238 | pushed the success line off — `git commit && git push` makes HEAD@{0} | STRING |
| HIGH | plugins/security-guidance/hooks/gitutil.py | 244 | - cross-repo (`cd ../other && git commit`): repo_root's own reflog has | STRING |
| HIGH⚡ | plugins/security-guidance/hooks/ensure_agent_sdk.py | 209 | # null). Stay inside the 10-key emit cap. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …gin-dev/skills/hook-development/scripts/hook-linter.sh | 3 | # Checks hook scripts for common issues and best practices | COMMENT |
| MEDIUM⚡ | plugins/security-guidance/hooks/ensure_agent_sdk.py | 190 | # Tell the harness this is async — venv create + pip install can take | COMMENT |
| MEDIUM⚡ | plugins/security-guidance/hooks/llm.py | 1125 | # eval harness it's a temp dir with ONLY touched_paths — the agent can't | COMMENT |
| MEDIUM⚡ | plugins/security-guidance/hooks/llm.py | 1126 | # trace cross-file data flow. The harness sets SG_AGENTIC_CONTEXT_DIR to a | COMMENT |
| MEDIUM | mods/types/claude-code.d.ts | 2793 | * // allow-list under it is the robust guard, a deny-list on spellings | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | …gins/security-guidance/hooks/security_reminder_hook.py | 237 | def atomic_check_and_mark_warning(session_id, warning_key): | CODE |
| LOW⚡ | …gins/security-guidance/hooks/security_reminder_hook.py | 446 | def handle_user_prompt_submit(input_data): | CODE |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 429 | def extract_content_from_input(tool_name, tool_input): | CODE |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 832 | def _agentic_review_with_race( | CODE |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 901 | def handle_commit_review_posttooluse(input_data): | CODE |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 1378 | def handle_push_sweep_posttooluse(input_data): | CODE |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 1979 | def _maybe_bootstrap_agent_sdk_async(): | CODE |
| LOW | plugins/security-guidance/hooks/diffstate.py | 116 | def restore_unreviewed_stop_state(session_id, paths, baseline_sha): | CODE |
| LOW | plugins/security-guidance/hooks/diffstate.py | 140 | def get_baseline_file_content(session_id, file_path, cwd): | CODE |
| LOW | plugins/security-guidance/hooks/diffstate.py | 390 | def _unchanged_since_baseline(p): | CODE |
| LOW | plugins/security-guidance/hooks/gitutil.py | 227 | def _git_reflog_recent_commits(repo_root, max_age_s=120, max_n=5): | CODE |
| LOW | plugins/security-guidance/hooks/gitutil.py | 587 | def extract_file_paths_from_diff(diff_output): | CODE |
| LOW | plugins/security-guidance/hooks/gitutil.py | 657 | def filter_preexisting_from_diff(diff_files, cwd, baseline_sha): | CODE |
| LOW | plugins/security-guidance/hooks/llm.py | 113 | def _strip_anthropic_from_no_proxy() -> None: | CODE |
| LOW | plugins/security-guidance/hooks/llm.py | 122 | def ensure_anthropic_reachable() -> bool: | CODE |
| LOW | plugins/security-guidance/hooks/llm.py | 226 | def _model_supports_adaptive_thinking(model: str) -> bool: | CODE |
| LOW | plugins/security-guidance/hooks/llm.py | 982 | def _agentic_commit_review_enabled() -> bool: | CODE |
| LOW | plugins/security-guidance/hooks/llm.py | 1570 | def analyze_security_concerns(files: List[Tuple[str, str]], is_diff: bool = False) -> Optional[str]: | CODE |
| LOW | scripts/auto-close-duplicates.ts | 49 | function extractDuplicateIssueNumber(commentBody: string): number | null { | CODE |
| LOW | scripts/backfill-duplicate-comments.ts | 72 | async function backfillDuplicateComments(): Promise<void> { | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 332 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 386 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 429 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 646 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 1378 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 2019 | CODE | |
| LOW | …gins/security-guidance/hooks/security_reminder_hook.py | 339 | CODE | |
| LOW | plugins/security-guidance/hooks/session_state.py | 49 | CODE | |
| LOW | plugins/security-guidance/hooks/diffstate.py | 250 | CODE | |
| LOW | plugins/security-guidance/hooks/diffstate.py | 267 | CODE | |
| LOW | plugins/security-guidance/hooks/gitutil.py | 330 | CODE | |
| LOW | plugins/security-guidance/hooks/gitutil.py | 657 | CODE | |
| LOW | plugins/security-guidance/hooks/ensure_agent_sdk.py | 57 | CODE | |
| LOW | plugins/security-guidance/hooks/llm.py | 1059 | CODE | |
| LOW | plugins/security-guidance/hooks/extensibility.py | 147 | CODE | |
| LOW | plugins/security-guidance/hooks/extensibility.py | 272 | CODE | |
| LOW | plugins/hookify/core/config_loader.py | 87 | CODE | |
| LOW | plugins/hookify/core/config_loader.py | 198 | CODE | |
| LOW | plugins/hookify/core/rule_engine.py | 144 | CODE | |
| LOW | plugins/hookify/core/rule_engine.py | 182 | CODE | |
| LOW | .github/scripts/check_workflow_hardening.py | 231 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …n-dev/skills/hook-development/examples/load-context.sh | 17 | # Check if TypeScript | COMMENT |
| LOW | …kills/hook-development/scripts/validate-hook-schema.sh | 123 | # Check if prompt-based hooks are used on supported events | COMMENT |
| LOW | plugins/ralph-wiggum/hooks/stop-hook.sh | 12 | # Check if ralph-loop is active | COMMENT |
| LOW | plugins/ralph-wiggum/hooks/stop-hook.sh | 50 | # Check if max iterations reached | COMMENT |
| LOW | plugins/ralph-wiggum/hooks/stop-hook.sh | 97 | # Check if jq succeeded | COMMENT |
| LOW | plugins/security-guidance/hooks/diffstate.py | 177 | # Check if HEAD exists (i.e., repo has at least one commit) | COMMENT |
| LOW | plugins/hookify/core/config_loader.py | 163 | # Check if this is an inline dict (key: value on same line) | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …gins/pr-review-toolkit/agents/silent-failure-hunter.md | 3 | description: Use this agent when reviewing code changes in a pull request to identify silent failures, inadequate error | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/gh.sh | 7 | # Usage: | COMMENT |