💫 Toolkit to help you get started with Spec-Driven Development
This report presents the forensic synthetic code analysis of github/spec-kit, a Python project with 132,007 GitHub stars. SynthScan v2.0 examined 219,175 lines of code across 518 source files, recording 5533 pattern matches distributed across 20 syntactic categories. The overall adjusted score of 25.5 places this repository in the Moderate AI signal band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 5533 distinct pattern matches across 20 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/test_shared_infra_integrity.py | 23 | def test_matching_digest_passes(): | CODE |
| LOW | tests/test_shared_infra_integrity.py | 30 | def test_mismatch_raises_error_cls(): | CODE |
| LOW | tests/test_shared_infra_integrity.py | 43 | def test_comparison_is_case_insensitive(): | CODE |
| LOW | tests/test_shared_infra_integrity.py | 50 | def test_malformed_digest_is_rejected(): | CODE |
| LOW | tests/test_shared_infra_integrity.py | 75 | def test_absent_digest_skips_and_logs_debug(caplog): | CODE |
| LOW | tests/test_shared_infra_integrity.py | 90 | def test_blank_declared_digest_is_rejected(): | CODE |
| LOW | tests/test_check_prerequisites_python_parity.py | 142 | def test_all_variants_resolve_requested_template( | CODE |
| LOW | tests/test_check_prerequisites_python_parity.py | 185 | def test_all_variants_validate_requested_template_in_text_mode( | CODE |
| LOW | tests/test_check_prerequisites_python_parity.py | 231 | def test_python_json_output_matches_bash(prereq_repo: Path, args: tuple[str, ...]) -> None: | CODE |
| LOW | tests/test_check_prerequisites_python_parity.py | 251 | def test_python_text_output_matches_bash(prereq_repo: Path) -> None: | CODE |
| LOW | tests/test_check_prerequisites_python_parity.py | 266 | def test_python_text_output_survives_a_legacy_stdout_code_page( | CODE |
| LOW | tests/test_check_prerequisites_python_parity.py | 313 | def test_python_help_output_matches_bash(prereq_repo: Path) -> None: | CODE |
| LOW | tests/test_check_prerequisites_python_parity.py | 323 | def test_python_unknown_option_matches_bash_error_shape(prereq_repo: Path) -> None: | CODE |
| LOW | tests/test_check_prerequisites_python_parity.py | 351 | def test_python_json_output_matches_powershell( | CODE |
| LOW | tests/test_check_prerequisites_python_parity.py | 372 | def test_python_repo_copy_script_file_fallback_finds_repo_root(tmp_path: Path) -> None: | CODE |
| LOW | tests/test_check_prerequisites_python_parity.py | 393 | def test_python_paths_only_does_not_persist_feature_json(prereq_repo: Path) -> None: | CODE |
| LOW | tests/test_check_prerequisites_python_parity.py | 409 | def test_python_normal_mode_persists_feature_json(prereq_repo: Path) -> None: | CODE |
| LOW | tests/test_check_prerequisites_python_parity.py | 428 | def test_persisted_feature_json_is_lexical_when_specs_is_symlink( | CODE |
| LOW | tests/test_check_prerequisites_python_parity.py | 469 | def test_python_negative_errors_are_stderr_only( | CODE |
| LOW | tests/test_check_prerequisites_python_parity.py | 493 | def test_python_branch_falls_back_to_feature_dir_basename(prereq_repo: Path) -> None: | CODE |
| LOW | tests/test_check_prerequisites_python_parity.py | 550 | def test_non_mapping_integration_json_falls_back(self, tmp_path: Path, body: str): | CODE |
| LOW | tests/test_check_prerequisites_python_parity.py | 559 | def test_hyphen_separator_is_still_honoured(self, tmp_path: Path): | CODE |
| LOW | tests/test_check_prerequisites_python_parity.py | 572 | def test_powershell_text_output_lists_available_docs(prereq_repo: Path) -> None: | CODE |
| LOW⚡ | tests/test_workflows.py | 122 | def test_get_step_type_missing(self): | CODE |
| LOW⚡ | tests/test_workflows.py | 127 | def test_register_step_duplicate_raises(self): | CODE |
| LOW⚡ | tests/test_workflows.py | 134 | def test_register_step_empty_key_raises(self): | CODE |
| LOW⚡ | tests/test_workflows.py | 216 | def test_step_output_reference(self): | CODE |
| LOW⚡ | tests/test_workflows.py | 225 | def test_string_interpolation(self): | CODE |
| LOW⚡ | tests/test_workflows.py | 233 | def test_multi_expression_no_surrounding_text(self): | CODE |
| LOW⚡ | tests/test_workflows.py | 527 | def test_filter_from_json_parses_object(self): | CODE |
| LOW⚡ | tests/test_workflows.py | 537 | def test_filter_from_json_invalid_json_raises(self): | CODE |
| LOW⚡ | tests/test_workflows.py | 546 | def test_filter_from_json_non_string_raises(self): | CODE |
| LOW⚡ | tests/test_workflows.py | 555 | def test_filter_from_json_rejects_malformed_forms(self): | CODE |
| LOW⚡ | tests/test_workflows.py | 2037 | def test_validate_rejects_non_positive_timeout(self): | CODE |
| LOW⚡ | tests/test_workflows.py | 2045 | def test_validate_rejects_non_numeric_timeout(self): | CODE |
| LOW⚡ | tests/test_workflows.py | 2055 | def test_validate_rejects_non_finite_timeout(self): | CODE |
| LOW⚡ | tests/test_workflows.py | 2411 | def test_validate_rejects_bad_script(self): | CODE |
| LOW⚡ | tests/test_workflows.py | 2418 | def test_validate_accepts_valid(self): | CODE |
| LOW⚡ | tests/test_workflows.py | 2428 | def test_docstring_lists_every_on_reject_behaviour(self): | CODE |
| LOW⚡ | tests/test_workflows.py | 2438 | def _non_tty_stdin_by_default(self, monkeypatch): | CODE |
| LOW⚡ | tests/test_workflows.py | 2445 | def test_execute_returns_paused(self): | CODE |
| LOW⚡ | tests/test_workflows.py | 3487 | def test_validate_missing_fields(self): | CODE |
| LOW⚡ | tests/test_workflows.py | 3496 | def test_validate_rejects_non_string_non_bool_condition(self, bad): | CODE |
| LOW⚡ | tests/test_workflows.py | 3504 | def test_validate_accepts_string_or_bool_condition(self, good): | CODE |
| LOW⚡ | tests/test_workflows.py | 3513 | def test_validate_invalid_max_iterations(self): | CODE |
| LOW⚡ | tests/test_workflows.py | 3619 | def test_validate_missing_fields(self): | CODE |
| LOW⚡ | tests/test_workflows.py | 3628 | def test_validate_rejects_non_string_non_bool_condition(self, bad): | CODE |
| LOW⚡ | tests/test_workflows.py | 3636 | def test_validate_accepts_string_or_bool_condition(self, good): | CODE |
| LOW⚡ | tests/test_workflows.py | 3645 | def test_validate_steps_not_list(self): | CODE |
| LOW⚡ | tests/test_workflows.py | 3913 | def test_validate_empty_wait_for(self): | CODE |
| LOW⚡ | tests/test_workflows.py | 3920 | def test_validate_wait_for_not_list(self): | CODE |
| LOW⚡ | tests/test_workflows.py | 3928 | def test_validate_rejects_non_mapping_output(self, bad_output): | CODE |
| LOW⚡ | tests/test_workflows.py | 3994 | def test_sequential_default_preserves_order(self, tmp_path): | CODE |
| LOW⚡ | tests/test_workflows.py | 3998 | def test_concurrent_runs_all_items_in_item_order(self, tmp_path): | CODE |
| LOW⚡ | tests/test_workflows.py | 4002 | def test_sequential_and_concurrent_agree(self, tmp_path): | CODE |
| LOW⚡ | tests/test_workflows.py | 4008 | def test_shuffled_completion_preserves_item_order(self, tmp_path): | CODE |
| LOW⚡ | tests/test_workflows.py | 4052 | def test_invalid_max_concurrency_coerces_to_sequential(self, tmp_path, bad): | CODE |
| LOW⚡ | tests/test_workflows.py | 4059 | def test_string_max_concurrency_is_honored(self, tmp_path): | CODE |
| LOW⚡ | tests/test_workflows.py | 4063 | def test_context_item_isolation_across_threads(self, tmp_path): | CODE |
| LOW⚡ | tests/test_workflows.py | 4069 | def test_marks_item_context_as_inside_fan_out(self, tmp_path, max_concurrency): | CODE |
| 4408 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/test_workflows.py | 30 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_workflows.py | 32 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/conftest.py | 71 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/conftest.py | 73 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_self_upgrade_execution.py | 18 | # =========================================================================== | COMMENT |
| MEDIUM | tests/test_self_upgrade_execution.py | 20 | # =========================================================================== | COMMENT |
| MEDIUM⚡ | tests/test_self_upgrade_detection.py | 600 | # =========================================================================== | COMMENT |
| MEDIUM⚡ | tests/test_self_upgrade_detection.py | 602 | # =========================================================================== | COMMENT |
| MEDIUM⚡ | tests/test_setup_tasks.py | 181 | # =========================================================================== | COMMENT |
| MEDIUM⚡ | tests/test_setup_tasks.py | 183 | # =========================================================================== | COMMENT |
| MEDIUM⚡ | tests/test_setup_tasks.py | 703 | # =========================================================================== | COMMENT |
| MEDIUM⚡ | tests/test_setup_tasks.py | 705 | # =========================================================================== | COMMENT |
| MEDIUM | tests/test_setup_tasks.py | 26 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_setup_tasks.py | 28 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_setup_tasks.py | 150 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_setup_tasks.py | 152 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_setup_tasks.py | 994 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_setup_tasks.py | 997 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_live_transient_windows.py | 18 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_live_transient_windows.py | 20 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_live_transient_windows.py | 66 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_live_transient_windows.py | 68 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_setup_plan_no_overwrite.py | 90 | # ── Bash tests ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_setup_plan_no_overwrite.py | 178 | # ── PowerShell tests ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | tests/test_timestamp_branches.py | 445 | # ── check_feature_branch Tests ─────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | tests/test_timestamp_branches.py | 459 | # ── find_feature_dir_by_prefix Tests ───────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | tests/test_timestamp_branches.py | 470 | # ── get_feature_paths + single-prefix integration ─────────────────────────── | COMMENT |
| MEDIUM⚡ | tests/test_timestamp_branches.py | 764 | # ── Dry-Run Tests ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | tests/test_timestamp_branches.py | 1210 | # ── Feature Directory Resolution Tests ─────────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_timestamp_branches.py | 179 | # ── Timestamp Branch Tests ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_timestamp_branches.py | 225 | # ── Sequential Branch Tests ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_timestamp_branches.py | 513 | # ── get_current_branch Tests ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_timestamp_branches.py | 524 | # ── No-git Tests ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_timestamp_branches.py | 537 | # ── E2E Flow Tests ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_timestamp_branches.py | 604 | # ── Allow Existing Branch Tests ────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_timestamp_branches.py | 978 | # ── PowerShell Dry-Run Tests ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_timestamp_branches.py | 1062 | # ── Short-Word / Acronym Branch-Name Tests ────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_timestamp_branches.py | 1108 | # ── GIT_BRANCH_NAME Override Tests ────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_timestamp_branches.py | 1366 | # ── Description Quoting Tests (issue #2339) ────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_self_upgrade_guidance.py | 14 | # =========================================================================== | COMMENT |
| MEDIUM | tests/test_self_upgrade_guidance.py | 16 | # =========================================================================== | COMMENT |
| MEDIUM⚡ | tests/test_init_dir.py | 115 | # ── Bash: positive cases ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | tests/test_init_dir.py | 350 | # ubuntu/windows runners ship pwsh, so these DO run there) ───────────────── | COMMENT |
| MEDIUM | tests/test_init_dir.py | 199 | # ── Bash: negative / contract cases ───────────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_init_dir.py | 292 | # ── Bash: bundled Git extension entrypoint ────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_init_dir.py | 480 | # ── Windows PowerShell 5.1 compatibility (issue #3749) ────────────────────── | COMMENT |
| MEDIUM⚡ | tests/test_authentication.py | 70 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_authentication.py | 72 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_authentication.py | 431 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_authentication.py | 433 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_authentication.py | 471 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_authentication.py | 473 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_authentication.py | 827 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_authentication.py | 829 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_authentication.py | 998 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_authentication.py | 1000 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_authentication.py | 1069 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_authentication.py | 1071 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_authentication.py | 1434 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_authentication.py | 1436 | # --------------------------------------------------------------------------- | COMMENT |
| 133 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/test_workflows.py | 0 | user-editable catalog name/url/description must not be parsed as rich markup. | STRING |
| HIGH | tests/test_presets.py | 0 | user-editable catalog name/url/description must not be parsed as rich markup. | STRING |
| HIGH | tests/integrations/test_integration_catalog.py | 0 | user-editable catalog name/url/description must not be parsed as rich markup. | STRING |
| HIGH | tests/workflows/conftest.py | 0 | create a mock spec-kit project with ``.specify/workflows/`` directory. | STRING |
| HIGH | tests/workflows/test_overlay_commands.py | 0 | create a mock spec-kit project with ``.specify/workflows/`` directory. | STRING |
| HIGH | tests/workflows/test_overlay_security.py | 0 | create a mock spec-kit project with ``.specify/workflows/`` directory. | STRING |
| HIGH | tests/integrations/test_integration_base_markdown.py | 0 | the generated plan skill must not carry a context-file placeholder. agent context files are owned entirely by the opt-in | STRING |
| HIGH | tests/integrations/test_integration_base_toml.py | 0 | the generated plan skill must not carry a context-file placeholder. agent context files are owned entirely by the opt-in | STRING |
| HIGH | tests/integrations/test_integration_base_yaml.py | 0 | the generated plan skill must not carry a context-file placeholder. agent context files are owned entirely by the opt-in | STRING |
| HIGH | tests/integrations/test_integration_base_skills.py | 0 | the generated plan skill must not carry a context-file placeholder. agent context files are owned entirely by the opt-in | STRING |
| HIGH | tests/integrations/test_integration_base_markdown.py | 0 | setup must not create or manage any agent context file — that is owned entirely by the opt-in agent-context extension. | STRING |
| HIGH | tests/integrations/test_integration_base_skills.py | 0 | setup must not create or manage any agent context file — that is owned entirely by the opt-in agent-context extension. | STRING |
| HIGH | tests/integrations/test_integration_base_toml.py | 0 | setup must not create or manage any agent context file — that is owned entirely by the opt-in agent-context extension. | STRING |
| HIGH | tests/integrations/test_integration_base_yaml.py | 0 | setup must not create or manage any agent context file — that is owned entirely by the opt-in agent-context extension. | STRING |
| HIGH | tests/integrations/test_integration_base_markdown.py | 0 | a user-authored context file must survive setup + teardown untouched. | STRING |
| HIGH | tests/integrations/test_integration_base_skills.py | 0 | a user-authored context file must survive setup + teardown untouched. | STRING |
| HIGH | tests/integrations/test_integration_base_toml.py | 0 | a user-authored context file must survive setup + teardown untouched. | STRING |
| HIGH | tests/integrations/test_integration_base_yaml.py | 0 | a user-authored context file must survive setup + teardown untouched. | STRING |
| HIGH | tests/integrations/test_integration_base_markdown.py | 0 | build the expected file list for this integration + script variant. | STRING |
| HIGH | tests/integrations/test_integration_base_toml.py | 0 | build the expected file list for this integration + script variant. | STRING |
| HIGH | tests/integrations/test_integration_base_yaml.py | 0 | build the expected file list for this integration + script variant. | STRING |
| HIGH | tests/integrations/test_integration_base_markdown.py | 0 | every file produced by specify init --integration <key> --script sh. | STRING |
| HIGH | tests/integrations/test_integration_base_skills.py | 0 | every file produced by specify init --integration <key> --script sh. | STRING |
| HIGH | tests/integrations/test_integration_base_toml.py | 0 | every file produced by specify init --integration <key> --script sh. | STRING |
| HIGH | tests/integrations/test_integration_base_yaml.py | 0 | every file produced by specify init --integration <key> --script sh. | STRING |
| HIGH | tests/integrations/test_integration_base_markdown.py | 0 | every file produced by specify init --integration <key> --script ps. | STRING |
| HIGH | tests/integrations/test_integration_base_skills.py | 0 | every file produced by specify init --integration <key> --script ps. | STRING |
| HIGH | tests/integrations/test_integration_base_toml.py | 0 | every file produced by specify init --integration <key> --script ps. | STRING |
| HIGH | tests/integrations/test_integration_base_yaml.py | 0 | every file produced by specify init --integration <key> --script ps. | STRING |
| HIGH | tests/integrations/test_integration_bob.py | 0 | skill.md must have name, description, compatibility, metadata. | STRING |
| HIGH | tests/integrations/test_integration_base_skills.py | 0 | skill.md must have name, description, compatibility, metadata. | STRING |
| HIGH | tests/integrations/test_integration_copilot.py | 0 | skill.md must have name, description, compatibility, metadata. | STRING |
| HIGH | tests/integrations/test_integration_cline.py | 0 | test formatting a simple name without 'speckit.' prefix. | STRING |
| HIGH | tests/integrations/test_integration_junie.py | 0 | test formatting a simple name without 'speckit.' prefix. | STRING |
| HIGH | tests/integrations/test_integration_forge.py | 0 | test formatting a simple name without 'speckit.' prefix. | STRING |
| HIGH | tests/integrations/test_integration_cline.py | 0 | test formatting a name that already has 'speckit.' prefix. | STRING |
| HIGH | tests/integrations/test_integration_junie.py | 0 | test formatting a name that already has 'speckit.' prefix. | STRING |
| HIGH | tests/integrations/test_integration_forge.py | 0 | test formatting a name that already has 'speckit.' prefix. | STRING |
| HIGH | tests/integrations/test_integration_cline.py | 0 | test that already-hyphenated names are returned unchanged (idempotent). | STRING |
| HIGH | tests/integrations/test_integration_junie.py | 0 | test that already-hyphenated names are returned unchanged (idempotent). | STRING |
| HIGH | tests/integrations/test_integration_forge.py | 0 | test that already-hyphenated names are returned unchanged (idempotent). | STRING |
| HIGH | tests/integrations/test_integration_claude.py | 0 | test rendering a skill preserves non-ascii characters. | STRING |
| HIGH | tests/integrations/test_integration_vibe.py | 0 | test rendering a skill preserves non-ascii characters. | STRING |
| HIGH | tests/integrations/test_integration_alquimia.py | 0 | test rendering a skill preserves non-ascii characters. | STRING |
| HIGH | tests/integrations/test_integration_claude.py | 0 | the cli no longer manages the agent context file — that is owned by the opt-in agent-context extension. setup must not c | STRING |
| HIGH | tests/integrations/test_integration_vibe.py | 0 | the cli no longer manages the agent context file — that is owned by the opt-in agent-context extension. setup must not c | STRING |
| HIGH | tests/integrations/test_integration_alquimia.py | 0 | the cli no longer manages the agent context file — that is owned by the opt-in agent-context extension. setup must not c | STRING |
| HIGH | tests/integrations/test_integration_claude.py | 0 | a user-authored context file is left intact on teardown. | STRING |
| HIGH | tests/integrations/test_integration_vibe.py | 0 | a user-authored context file is left intact on teardown. | STRING |
| HIGH | tests/integrations/test_integration_alquimia.py | 0 | a user-authored context file is left intact on teardown. | STRING |
| HIGH | tests/integrations/test_integration_claude.py | 0 | skills that have hook sections should get the normalization note. | STRING |
| HIGH | tests/integrations/test_integration_alquimia.py | 0 | skills that have hook sections should get the normalization note. | STRING |
| HIGH | tests/integrations/test_integration_codex.py | 0 | skills that have hook sections should get the normalization note. | STRING |
| HIGH | tests/integrations/test_integration_claude.py | 0 | skills without hook sections should not get the note. | STRING |
| HIGH | tests/integrations/test_integration_agy.py | 0 | skills without hook sections should not get the note. | STRING |
| HIGH | tests/integrations/test_integration_alquimia.py | 0 | skills without hook sections should not get the note. | STRING |
| HIGH | tests/integrations/test_integration_codex.py | 0 | skills without hook sections should not get the note. | STRING |
| HIGH | tests/integrations/test_integration_claude.py | 0 | already-noted hook sections should not suppress later sections. | STRING |
| HIGH | tests/integrations/test_integration_alquimia.py | 0 | already-noted hook sections should not suppress later sections. | STRING |
| HIGH | tests/integrations/test_integration_codex.py | 0 | already-noted hook sections should not suppress later sections. | STRING |
| 20 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/test_workflows.py | 4390 | # block (list/null) is stored raw and would crash _resolve_inputs at | COMMENT |
| HIGH | tests/test_workflows.py | 2671 | ``config.get(k, default)`` does not replace an explicit null). | CODE |
| HIGH | tests/test_workflows.py | 3874 | """An explicit ``output:`` (YAML null) is valid, matching ``validate``.""" | STRING |
| HIGH | tests/test_workflows.py | 8797 | """An empty document, explicit null, or absent/empty ``catalogs:`` stays a | STRING |
| HIGH | tests/test_workflows.py | 16992 | (int/list instead of str-or-null) raises ValueError, which leaked | STRING |
| HIGH | tests/test_resolve_template_python_parity.py | 240 | '"disabled-ext":{"enabled":null,"priority":1},' | CODE |
| HIGH⚡ | tests/test_presets.py | 206 | """Required manifest sections reject null, list, and scalar values.""" | STRING |
| HIGH | tests/test_init_dir.py | 562 | `cd && pwd` never yields one, so the two must agree. | STRING |
| HIGH | tests/test_extension_update_hardening.py | 155 | # Write config with hooks: null; get_project_config() normalizes this to {} | COMMENT |
| HIGH⚡ | tests/test_setup_plan_python_parity.py | 181 | '{"presets": {"alpha": {"priority": 2}, "beta": {"priority": 1}, "gamma": {"priority": null}}}', | CODE |
| HIGH⚡ | tests/test_setup_plan_python_parity.py | 186 | ('{"presets":null}', "# alpha plan\n"), | CODE |
| HIGH | tests/test_extension_registration.py | 303 | """Regression: hooks: {after_tasks: null} must not crash in unregister_hooks().""" | STRING |
| HIGH | tests/test_security_workflow.py | 100 | "${{ github.event.pull_request.base.sha || github.event.before || '' }}" | CODE |
| HIGH | tests/test_security_workflow.py | 103 | "${{ github.event.pull_request.head.sha || github.sha }}" | CODE |
| HIGH⚡ | tests/contract/test_catalog_schema.py | 108 | default stack (must not be confused with an explicit top-level null).""" | STRING |
| HIGH | tests/contract/test_catalog_schema.py | 85 | """A top-level non-mapping bundle-catalogs.yml (list/scalar/null) must raise, | STRING |
| HIGH | tests/extensions/test_extension_agent_context.py | 175 | "command -v cygpath >/dev/null 2>&1 && cygpath -u \"$1\"", | CODE |
| HIGH | tests/integrations/test_events.py | 1049 | assert "errors.push(" in content | CODE |
| HIGH | scripts/python/common.py | 525 | # * a non-mapping top level ([], "forge", 42, null) is valid JSON, so | COMMENT |
| HIGH⚡ | src/specify_cli/events.py | 1940 | f" try {{ if ({checks}) {{ runEvent({command_lit}, {ev_lit}, input, output, {timeout_sec}); } | STRING |
| HIGH⚡ | src/specify_cli/events.py | 1944 | f" try {{ runEvent({command_lit}, {ev_lit}, input, output, {timeout_sec}); }} catch (e) {{ er | STRING |
| HIGH⚡ | src/specify_cli/events.py | 1948 | f" try {{ const ctx = runEvent({command_lit}, {ev_lit}, input, output, {timeout_sec}); if (ctx) c | STRING |
| HIGH⚡ | src/specify_cli/events.py | 1952 | f" try {{ runEvent({command_lit}, {ev_lit}, input, output, {timeout_sec}); }} catch (e) {{ errors | STRING |
| HIGH | src/specify_cli/events.py | 1987 | f" if (ctx === undefined) {{\n" | STRING |
| HIGH | src/specify_cli/events.py | 1991 | f" if (ctx) output.system.push(ctx);\n" | STRING |
| HIGH | src/specify_cli/events.py | 2011 | f" output.parts.push({{ id: base + \".speckit\" + Math.random().toString(36).slice(2, 8), sessionID | STRING |
| HIGH | src/specify_cli/workflows/catalog.py | 362 | # raises. An absent key, an explicit ``catalogs:`` null, and an empty | COMMENT |
| HIGH | src/specify_cli/workflows/expressions.py | 617 | In every such case the membership relation is undefined, so treat it as | STRING |
| HIGH⚡ | src/specify_cli/workflows/engine.py | 156 | "'workflow.integration' must be a string or null, got " | CODE |
| HIGH⚡ | src/specify_cli/workflows/engine.py | 166 | "'workflow.model' must be a string or null, got " | CODE |
| HIGH⚡ | src/specify_cli/workflows/engine.py | 173 | "'workflow.options' must be a mapping or null, got " | CODE |
| HIGH | src/specify_cli/workflows/engine.py | 326 | # valid, but any present-but-non-mapping value — ``requires:`` (YAML null), | COMMENT |
| HIGH | src/specify_cli/workflows/engine.py | 626 | f"string or null, got {type(installed_workflow_id).__name__}" | CODE |
| HIGH | src/specify_cli/workflows/engine.py | 637 | f"string or null, got {type(installed_registry_root).__name__}" | CODE |
| HIGH | src/specify_cli/workflows/steps/prompt/__init__.py | 283 | # (an explicit ``integration:``/``model:`` YAML null) means "inherit the | COMMENT |
| HIGH | src/specify_cli/workflows/steps/command/__init__.py | 240 | # a non-string (null, list, int) crashes there with a raw | COMMENT |
| HIGH | src/specify_cli/workflows/steps/command/__init__.py | 264 | # (an explicit ``integration:``/``model:`` YAML null) means "inherit the | COMMENT |
| HIGH | src/specify_cli/workflows/steps/fan_in/__init__.py | 38 | # explicit ``output:`` (YAML null) stays valid, matching validate. | COMMENT |
| HIGH | src/specify_cli/extensions/__init__.py | 3749 | ``{"extensions": []}`` or ``{"extensions": null}`` slip through | STRING |
| HIGH | src/specify_cli/integrations/_migrate_commands.py | 194 | # anything else (e.g. null) leaves ownership undecidable, so fail | COMMENT |
| HIGH | src/specify_cli/presets/__init__.py | 393 | # ``templates: [null]``) raises a clean PresetValidationError the | COMMENT |
| HIGH | src/specify_cli/presets/__init__.py | 4252 | ``{"presets": []}`` or ``{"presets": null}`` slip through here and | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/test_shared_infra_integrity.py | 9 | CODE | |
| LOW | tests/test_check_prerequisites_python_parity.py | 3 | CODE | |
| LOW | tests/test_workflows.py | 13 | CODE | |
| LOW | tests/test_utils.py | 3 | CODE | |
| LOW | tests/test_event_command.py | 16 | CODE | |
| LOW | tests/test_self_upgrade_execution.py | 9 | CODE | |
| LOW | tests/test_github_workflows.py | 3 | CODE | |
| LOW | tests/test_self_upgrade_detection.py | 15 | CODE | |
| LOW | tests/bundler_helpers.py | 8 | CODE | |
| LOW | tests/test_download_security.py | 3 | CODE | |
| LOW | tests/test_post_process.py | 10 | CODE | |
| LOW | tests/self_upgrade_helpers.py | 13 | CODE | |
| LOW | tests/self_upgrade_helpers.py | 13 | CODE | |
| LOW | tests/self_upgrade_helpers.py | 13 | CODE | |
| LOW | tests/self_upgrade_helpers.py | 13 | CODE | |
| LOW | tests/self_upgrade_helpers.py | 13 | CODE | |
| LOW | tests/self_upgrade_helpers.py | 20 | CODE | |
| LOW | tests/self_upgrade_helpers.py | 21 | CODE | |
| LOW | tests/self_upgrade_helpers.py | 21 | CODE | |
| LOW | tests/test_live_transient_windows.py | 12 | CODE | |
| LOW | tests/test_resolve_template_python_parity.py | 3 | CODE | |
| LOW | tests/test_init_output_markup.py | 17 | CODE | |
| LOW | tests/test_extensions.py | 27 | CODE | |
| LOW | tests/test_upgrade.py | 29 | CODE | |
| LOW | tests/parity_helpers.py | 3 | CODE | |
| LOW | tests/test_setup_tasks_python_parity.py | 3 | CODE | |
| LOW | tests/test_shared_infra_gitignore.py | 12 | CODE | |
| LOW | tests/test_create_new_feature_python_parity.py | 3 | CODE | |
| LOW | tests/test_self_upgrade_guidance.py | 7 | CODE | |
| LOW | tests/test_authentication.py | 14 | CODE | |
| LOW | tests/test_setup_plan_python_parity.py | 3 | CODE | |
| LOW | tests/test_extension_add_path_traversal.py | 3 | CODE | |
| LOW | tests/test_security_workflow.py | 3 | CODE | |
| LOW | tests/auth_helpers.py | 3 | CODE | |
| LOW | tests/test_self_upgrade_verification.py | 10 | CODE | |
| LOW | tests/unit/test_bundler_resolver.py | 2 | CODE | |
| LOW | tests/unit/test_bundler_yamlio.py | 2 | CODE | |
| LOW | tests/unit/test_bundler_records.py | 2 | CODE | |
| LOW | tests/unit/test_bundler_adapters.py | 2 | CODE | |
| LOW | tests/unit/test_bundler_versioning.py | 2 | CODE | |
| LOW | tests/unit/test_bundler_validator.py | 2 | CODE | |
| LOW | tests/unit/test_bundle_download_url.py | 2 | CODE | |
| LOW | tests/unit/test_bundler_primitives.py | 7 | CODE | |
| LOW | tests/unit/test_bundler_references.py | 6 | CODE | |
| LOW | tests/unit/test_bundler_catalog_config.py | 2 | CODE | |
| LOW | tests/unit/test_bundler_conflict.py | 2 | CODE | |
| LOW | tests/unit/test_bundler_packager.py | 2 | CODE | |
| LOW | tests/contract/test_bundle_cli.py | 7 | CODE | |
| LOW | tests/contract/test_wheel_core_pack_scripts.py | 9 | CODE | |
| LOW | tests/contract/test_manifest_schema.py | 6 | CODE | |
| LOW | tests/contract/test_catalog_schema.py | 6 | CODE | |
| LOW | tests/contract/test_wheel_bundled_presets.py | 12 | CODE | |
| LOW | tests/integration/test_bundler_offline.py | 7 | CODE | |
| LOW | tests/integration/test_bundler_catalog_stack.py | 2 | CODE | |
| LOW | tests/integration/test_bundler_init_install.py | 8 | CODE | |
| LOW | tests/integration/test_bundler_local_install.py | 7 | CODE | |
| LOW | tests/integration/test_bundler_install_flow.py | 6 | CODE | |
| LOW | tests/integration/test_bundler_security_paths.py | 6 | CODE | |
| LOW | tests/workflows/conftest.py | 3 | CODE | |
| LOW | tests/workflows/test_resolver_integration.py | 3 | CODE | |
| 171 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/test_workflows.py | 12269 | CODE | |
| LOW | tests/test_extensions.py | 1657 | CODE | |
| LOW | tests/test_extensions.py | 2799 | CODE | |
| LOW | …s/agent-context/scripts/python/update_agent_context.py | 45 | CODE | |
| LOW | …s/agent-context/scripts/python/update_agent_context.py | 141 | CODE | |
| LOW | …s/agent-context/scripts/python/update_agent_context.py | 259 | CODE | |
| LOW | …nsions/git/scripts/python/create_new_feature_branch.py | 90 | CODE | |
| LOW | …nsions/git/scripts/python/create_new_feature_branch.py | 420 | CODE | |
| LOW | extensions/git/scripts/python/auto_commit.py | 49 | CODE | |
| LOW | scripts/python/check_prerequisites.py | 68 | CODE | |
| LOW | scripts/python/common.py | 383 | CODE | |
| LOW | scripts/python/common.py | 445 | CODE | |
| LOW | scripts/python/common.py | 452 | CODE | |
| LOW | scripts/python/create_new_feature.py | 110 | CODE | |
| LOW | scripts/python/create_new_feature.py | 253 | CODE | |
| LOW | src/specify_cli/_console.py | 150 | CODE | |
| LOW | src/specify_cli/_console.py | 93 | CODE | |
| LOW | src/specify_cli/_console.py | 220 | CODE | |
| LOW | src/specify_cli/_toml_string.py | 36 | CODE | |
| LOW | src/specify_cli/_version.py | 481 | CODE | |
| LOW | src/specify_cli/events.py | 493 | CODE | |
| LOW | src/specify_cli/events.py | 879 | CODE | |
| LOW | src/specify_cli/events.py | 1299 | CODE | |
| LOW | src/specify_cli/events.py | 1601 | CODE | |
| LOW | src/specify_cli/events.py | 1826 | CODE | |
| LOW | src/specify_cli/events.py | 1880 | CODE | |
| LOW | src/specify_cli/_assets.py | 104 | CODE | |
| LOW | src/specify_cli/__init__.py | 217 | CODE | |
| LOW | src/specify_cli/agents.py | 610 | CODE | |
| LOW | src/specify_cli/agents.py | 1052 | CODE | |
| LOW | src/specify_cli/agents.py | 1203 | CODE | |
| LOW | src/specify_cli/agents.py | 1282 | CODE | |
| LOW | src/specify_cli/integration_scaffold.py | 203 | CODE | |
| LOW | src/specify_cli/shared_infra.py | 403 | CODE | |
| LOW | src/specify_cli/_download_security.py | 125 | CODE | |
| LOW | src/specify_cli/_download_security.py | 905 | CODE | |
| LOW | src/specify_cli/_download_security.py | 1070 | CODE | |
| LOW | src/specify_cli/integration_status.py | 130 | CODE | |
| LOW | src/specify_cli/_utils.py | 153 | CODE | |
| LOW | src/specify_cli/_utils.py | 163 | CODE | |
| LOW | src/specify_cli/workflows/catalog.py | 140 | CODE | |
| LOW | src/specify_cli/workflows/catalog.py | 505 | CODE | |
| LOW | src/specify_cli/workflows/catalog.py | 608 | CODE | |
| LOW | src/specify_cli/workflows/catalog.py | 1200 | CODE | |
| LOW | src/specify_cli/workflows/catalog.py | 1302 | CODE | |
| LOW | src/specify_cli/workflows/expressions.py | 56 | CODE | |
| LOW | src/specify_cli/workflows/expressions.py | 190 | CODE | |
| LOW | src/specify_cli/workflows/expressions.py | 227 | CODE | |
| LOW | src/specify_cli/workflows/expressions.py | 346 | CODE | |
| LOW | src/specify_cli/workflows/expressions.py | 380 | CODE | |
| LOW | src/specify_cli/workflows/expressions.py | 916 | CODE | |
| LOW | src/specify_cli/workflows/__init__.py | 83 | CODE | |
| LOW | src/specify_cli/workflows/engine.py | 181 | CODE | |
| LOW | src/specify_cli/workflows/engine.py | 368 | CODE | |
| LOW | src/specify_cli/workflows/engine.py | 1170 | CODE | |
| LOW | src/specify_cli/workflows/engine.py | 1408 | CODE | |
| LOW | src/specify_cli/workflows/engine.py | 1597 | CODE | |
| LOW | src/specify_cli/workflows/engine.py | 1691 | CODE | |
| LOW | src/specify_cli/workflows/engine.py | 1764 | CODE | |
| LOW | src/specify_cli/workflows/_commands.py | 674 | CODE | |
| 90 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/test_workflows.py | 9507 | # Create an orphaned step directory (no registry entry) | COMMENT |
| MEDIUM | tests/test_setup_tasks.py | 221 | # Create the override | COMMENT |
| MEDIUM | tests/test_extensions.py | 1812 | # Create a config file in the installed extension directory | COMMENT |
| MEDIUM | tests/test_extensions.py | 2809 | # Create a ZIP of the extension in a temp directory (not NamedTemporaryFile, | COMMENT |
| MEDIUM | tests/test_extensions.py | 3151 | # Create a config file | COMMENT |
| MEDIUM | tests/test_presets.py | 10608 | # Create a template in the preset directory | COMMENT |
| MEDIUM | tests/test_presets.py | 11470 | # Create a preset command dir with a wrap-strategy command | COMMENT |
| MEDIUM | tests/test_presets.py | 13109 | # Create a gemini commands dir so reconciliation writes there | COMMENT |
| MEDIUM | tests/test_extension_skills.py | 3060 | # Create the skill directory without the SKILL.md file | COMMENT |
| MEDIUM | tests/test_extension_registration.py | 69 | # Create a mock manifest | COMMENT |
| MEDIUM | tests/test_extension_registration.py | 117 | # Create a manifest with hooks | COMMENT |
| MEDIUM | tests/test_extension_registration.py | 175 | # Create a corrupted config (root is a list) | COMMENT |
| MEDIUM | tests/test_extension_registration.py | 330 | # Create a manifest with a hook for the same event | COMMENT |
| MEDIUM | tests/test_workflow_run_without_project.py | 19 | # Create a minimal workflow YAML with a shell step | COMMENT |
| MEDIUM | tests/workflows/test_resolver_integration.py | 382 | # Create a real overlay directory outside the project with a malicious overlay. | COMMENT |
| MEDIUM | tests/workflows/test_overlay_security.py | 118 | # Create a base workflow file that would be the traversal target. | COMMENT |
| MEDIUM⚡ | tests/workflows/test_overlay_security.py | 257 | # Create a symlinked overlays directory pointing outside the project | COMMENT |
| MEDIUM⚡ | tests/workflows/test_overlay_security.py | 271 | # Create a real overlay directory outside the project. | COMMENT |
| MEDIUM | tests/extensions/git/test_git_extension.py | 1050 | # Create a file to commit | COMMENT |
| MEDIUM | tests/integrations/test_integration_bob.py | 654 | # Create a real legacy Bob project (renders shared templates). | COMMENT |
| MEDIUM | tests/integrations/test_integration_hermes.py | 179 | # Create a foreign skill in the global dir first | COMMENT |
| MEDIUM⚡ | tests/integrations/test_integration_forge.py | 292 | # Create a mock extension command file | COMMENT |
| MEDIUM⚡ | tests/integrations/test_integration_forge.py | 298 | # Create a test command with dot notation name | COMMENT |
| MEDIUM | tests/integrations/test_integration_forge.py | 343 | # Create a mock extension command file | COMMENT |
| MEDIUM | tests/integrations/test_integration_forge.py | 391 | # Create a mock extension command file | COMMENT |
| MEDIUM | tests/integrations/test_events.py | 1004 | # Create a project venv so the plugin's runtime resolver prefers it. | COMMENT |
| MEDIUM | tests/integrations/test_events.py | 1188 | # Create a mock core command md file | COMMENT |
| MEDIUM | tests/integrations/test_events.py | 1421 | # Create a core command template whose script writes its payload. | COMMENT |
| MEDIUM | tests/integrations/test_events.py | 2064 | # Create a symlinked .claude directory pointing outside the project. | COMMENT |
| MEDIUM⚡ | tests/integrations/test_integration_opencode.py | 75 | # Create a source command file for the registrar | COMMENT |
| MEDIUM | tests/integrations/test_integration_opencode.py | 162 | # Create a source command file for the registrar | COMMENT |
| MEDIUM | src/specify_cli/extensions/__init__.py | 2417 | # Create the staging file with mode 0600 before writing so | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/test_check_prerequisites_python_parity.py | 533 | except Exception: # pragma: no cover - defensive cleanup | CODE |
| LOW | tests/unit/test_condition_expression_block.py | 664 | except Exception: | CODE |
| LOW | tests/integrations/test_integration_base_toml.py | 316 | except Exception as exc: | CODE |
| LOW | tests/integrations/test_integration_base_yaml.py | 152 | except Exception as exc: | CODE |
| LOW | …s/agent-context/scripts/python/update_agent_context.py | 83 | except Exception: | CODE |
| LOW | …s/agent-context/scripts/python/update_agent_context.py | 96 | except Exception: | CODE |
| LOW | …s/agent-context/scripts/python/update_agent_context.py | 152 | except Exception: | CODE |
| LOW | …s/agent-context/scripts/python/update_agent_context.py | 325 | except Exception as exc: | CODE |
| LOW | …ons/agent-context/scripts/bash/update-agent-context.sh | 86 | except Exception as exc: | CODE |
| LOW | …ons/agent-context/scripts/bash/update-agent-context.sh | 138 | except Exception: | CODE |
| LOW | …ons/agent-context/scripts/bash/update-agent-context.sh | 151 | except Exception: | CODE |
| LOW | …ons/agent-context/scripts/bash/update-agent-context.sh | 197 | except Exception: | CODE |
| LOW | …ons/agent-context/scripts/bash/update-agent-context.sh | 270 | except Exception: | CODE |
| LOW | scripts/python/common.py | 230 | except Exception: | CODE |
| MEDIUM | scripts/python/setup_plan.py | 68 | print(f"Error: {exc}", file=sys.stderr) | STRING |
| MEDIUM | scripts/python/create_new_feature.py | 130 | print(f"Error: {arg} requires a value", file=sys.stderr) | STRING |
| MEDIUM | scripts/python/create_new_feature.py | 344 | print("Error: feature number is too long for a branch name", file=sys.stderr) | CODE |
| MEDIUM | scripts/python/create_new_feature.py | 394 | print(f"Error: {exc}", file=sys.stderr) | CODE |
| LOW | scripts/bash/common.sh | 284 | except Exception: | CODE |
| LOW | scripts/bash/common.sh | 437 | except Exception as exc: | CODE |
| LOW | scripts/bash/common.sh | 543 | except Exception: | CODE |
| LOW | scripts/bash/common.sh | 662 | except Exception: | CODE |
| LOW | scripts/bash/common.sh | 744 | except Exception as exc: | CODE |
| LOW | src/specify_cli/_console.py | 90 | except Exception: | STRING |
| LOW | src/specify_cli/events.py | 120 | except Exception: | CODE |
| LOW | src/specify_cli/events.py | 162 | except Exception: | CODE |
| LOW | src/specify_cli/events.py | 194 | except Exception: | CODE |
| LOW | src/specify_cli/events.py | 203 | except Exception: | CODE |
| LOW | src/specify_cli/events.py | 301 | except Exception as e: | CODE |
| LOW | src/specify_cli/events.py | 523 | except Exception: | STRING |
| LOW | src/specify_cli/events.py | 625 | except Exception: | STRING |
| LOW | src/specify_cli/events.py | 709 | except Exception: | STRING |
| LOW | src/specify_cli/events.py | 771 | except Exception as e: | STRING |
| LOW | src/specify_cli/events.py | 979 | except Exception as exc: | STRING |
| LOW | src/specify_cli/events.py | 1015 | except Exception: | STRING |
| LOW | src/specify_cli/events.py | 1060 | except Exception: | STRING |
| LOW | src/specify_cli/events.py | 1075 | except Exception: | STRING |
| LOW | src/specify_cli/events.py | 1661 | except Exception: | STRING |
| LOW | src/specify_cli/events.py | 1791 | except Exception as exc: | STRING |
| LOW | src/specify_cli/events.py | 1816 | except Exception as exc: | STRING |
| LOW | src/specify_cli/_assets.py | 108 | except Exception: | CODE |
| LOW | src/specify_cli/_assets.py | 117 | except Exception: | CODE |
| LOW | src/specify_cli/__init__.py | 238 | except Exception: | CODE |
| LOW | src/specify_cli/__init__.py | 255 | except Exception as e: | CODE |
| LOW | src/specify_cli/_download_security.py | 520 | except Exception as exc: | CODE |
| LOW | src/specify_cli/_download_security.py | 900 | except Exception as exc: | CODE |
| LOW | src/specify_cli/_download_security.py | 1060 | except Exception as exc: | CODE |
| LOW | src/specify_cli/_download_security.py | 1235 | except Exception as exc: | CODE |
| LOW | src/specify_cli/_utils.py | 194 | except Exception: | CODE |
| LOW | src/specify_cli/workflows/catalog.py | 576 | except Exception as exc: | CODE |
| LOW | src/specify_cli/workflows/catalog.py | 1271 | except Exception as exc: | CODE |
| LOW | src/specify_cli/workflows/expressions.py | 1025 | except Exception: # noqa: BLE001 - probe values, not the author's text | CODE |
| LOW | src/specify_cli/workflows/__init__.py | 207 | except Exception: # noqa: BLE001 | CODE |
| LOW | src/specify_cli/workflows/engine.py | 1057 | except Exception as exc: | CODE |
| LOW | src/specify_cli/workflows/engine.py | 1141 | except Exception as exc: | CODE |
| LOW | src/specify_cli/workflows/engine.py | 1558 | except Exception: | CODE |
| LOW | src/specify_cli/workflows/_commands.py | 439 | except Exception: | CODE |
| LOW | src/specify_cli/workflows/_commands.py | 1429 | except Exception as exc: | CODE |
| LOW | src/specify_cli/workflows/_commands.py | 1544 | except Exception as exc: | CODE |
| LOW | src/specify_cli/workflows/_commands.py | 2060 | except Exception as exc: | CODE |
| 57 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | src/specify_cli/extensions/__init__.py | 1077 | Collect command and alias names declared by a manifest. Performs install-time validation for extension-specific | STRING |
| HIGH | src/specify_cli/extensions/__init__.py | 2007 | Check if extension is compatible with current spec-kit version. Args: manifest: Extension manifest | STRING |
| HIGH | src/specify_cli/extensions/__init__.py | 2056 | Install extension from a local directory. Args: source_dir: Path to extension directory | STRING |
| HIGH | src/specify_cli/extensions/__init__.py | 2677 | Install an extension from a supported archive. Args: archive_path: Path to a .zip, .tar.gz, or .tgz | STRING |
| HIGH | src/specify_cli/extensions/__init__.py | 3864 | Fetch a single catalog with per-URL caching. For the DEFAULT_CATALOG_URL, uses legacy cache files (self.cache_f | STRING |
| HIGH | src/specify_cli/extensions/__init__.py | 4008 | Fetch and merge extensions from all active catalogs. Higher-priority (lower priority number) catalogs win on co | STRING |
| HIGH | src/specify_cli/extensions/__init__.py | 4107 | Fetch extension catalog from URL or cache. Args: force_refresh: If True, bypass cache and fetch fro | STRING |
| HIGH | src/specify_cli/extensions/__init__.py | 4289 | Download an extension archive from a catalog. Args: extension_id: ID of the extension to download | STRING |
| HIGH | src/specify_cli/extensions/_commands.py | 295 | Resolve an extension argument (ID or display name) to an installed extension. Args: argument: Extension ID | STRING |
| HIGH | src/specify_cli/integrations/cline/__init__.py | 23 | Convert command name to Cline-compatible hyphenated format. Cline handles slash-commands optimally when they use hy | STRING |
| HIGH | src/specify_cli/integrations/forge/__init__.py | 20 | Convert command name to Forge-compatible hyphenated format. Forge requires command names to use hyphens instead of | STRING |
| HIGH | src/specify_cli/integrations/junie/__init__.py | 21 | Convert command name to Junie-compatible hyphenated format. Junie does not allow dots inside of slash-commands. | STRING |
| HIGH | src/specify_cli/presets/__init__.py | 805 | Check if preset is compatible with current spec-kit version. Args: manifest: Preset manifest | STRING |
| HIGH | src/specify_cli/presets/__init__.py | 3559 | Install preset from a local directory. Args: source_dir: Path to preset directory speck | STRING |
| HIGH | src/specify_cli/presets/__init__.py | 3741 | Install a preset from a supported archive. Args: archive_path: Path to a .zip, .tar.gz, or .tgz arc | STRING |
| HIGH | src/specify_cli/presets/__init__.py | 4286 | Load catalog stack configuration from a YAML file. Args: config_path: Path to preset-catalogs.yml | STRING |
| HIGH | src/specify_cli/presets/__init__.py | 4477 | Fetch a single catalog with per-URL caching. Args: entry: PresetCatalogEntry describing the catalog | STRING |
| HIGH | src/specify_cli/presets/__init__.py | 4647 | Fetch preset catalog from URL or cache. Args: force_refresh: If True, bypass cache and fetch from n | STRING |
| HIGH | src/specify_cli/presets/__init__.py | 4832 | Download a preset archive from a catalog. Args: pack_id: ID of the preset to download t | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | spec-driven.md | 121 | COMMENT | |
| LOW | tests/integrations/test_manifest.py | 461 | def test_is_recovered_absolute_path_returns_false(self, tmp_path): | COMMENT |
| LOW | tests/integrations/test_extra_args.py | 481 | # SPECKIT_INTEGRATION_<KEY>_EXECUTABLE tests | COMMENT |
| LOW | extensions/template/extension.yml | 81 | description: "Demonstrates hook functionality" | COMMENT |
| LOW | extensions/template/config-template.yml | 61 | COMMENT | |
| LOW | extensions/agent-context/agent-context-config.yml | 1 | # Coding Agent Context Extension Configuration | COMMENT |
| LOW | …ons/agent-context/scripts/bash/update-agent-context.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | extensions/git/git-config.yml | 1 | # Git Branching Workflow Extension Configuration | COMMENT |
| LOW | extensions/git/config-template.yml | 1 | # Git Branching Workflow Extension Configuration | COMMENT |
| LOW | extensions/git/scripts/bash/auto-commit.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | scripts/bash/common.sh | 21 | prev_dir="$dir" | COMMENT |
| LOW | scripts/bash/check-prerequisites.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | .github/workflows/add-community-extension.lock.yml | 1 | # gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"f9532e77722bfd32e8f626cbfbf6c5372ddcd9997963d965d53e8531b3e | COMMENT |
| LOW | .github/workflows/add-community-extension.lock.yml | 21 | # gh aw compile | COMMENT |
| LOW | .github/workflows/add-community-extension.lock.yml | 41 | # - github/gh-aw-actions/setup@c0338fef4749d08c21f8f975fb0e37efa17dda47 # v0.79.8 | COMMENT |
| LOW | .github/workflows/add-community-extension.lock.yml | 841 | # --allow-tool shell(cat) | COMMENT |
| LOW | .github/workflows/feature-assess.lock.yml | 1 | # gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"669e5f4d2956792cf5b7a2dfbbda10e7ef26f25fc8283f5b3db1cc838f0 | COMMENT |
| LOW | .github/workflows/feature-assess.lock.yml | 21 | # gh aw compile | COMMENT |
| LOW | .github/workflows/feature-assess.lock.yml | 41 | # - astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 | COMMENT |
| LOW | .github/workflows/feature-assess.lock.yml | 841 | # --allow-tool shell(date) | COMMENT |
| LOW | .github/workflows/add-community-bundle.lock.yml | 1 | # gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"c64e3dc29aca89e48108bb6d4eb877f6264b4cec9cd56dcd36827893802 | COMMENT |
| LOW | .github/workflows/add-community-bundle.lock.yml | 21 | # gh aw compile | COMMENT |
| LOW | .github/workflows/add-community-bundle.lock.yml | 41 | # - github/gh-aw-actions/setup@c0338fef4749d08c21f8f975fb0e37efa17dda47 # v0.79.8 | COMMENT |
| LOW | .github/workflows/add-community-bundle.lock.yml | 861 | # --allow-tool shell(cat) | COMMENT |
| LOW | .github/workflows/bug-test.lock.yml | 1 | # gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"ec50d44af032f2f0c04073858a24d73cb1fa9036515b3bc7ee4dcfe0213 | COMMENT |
| LOW | .github/workflows/bug-test.lock.yml | 21 | # gh aw compile | COMMENT |
| LOW | .github/workflows/bug-test.lock.yml | 41 | # - astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 | COMMENT |
| LOW | .github/workflows/bug-test.lock.yml | 801 | run: bash "${RUNNER_TEMP}/gh-aw/actions/audit_pre_agent_workspace.sh" | COMMENT |
| LOW | .github/workflows/bug-test.lock.yml | 821 | # --allow-tool shell(make) | COMMENT |
| LOW | .github/workflows/add-community-preset.lock.yml | 1 | # gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"09fb89e95c57c7beeaa0c823fb35f38d5f9db898a419e59dd0a323e7a92 | COMMENT |
| LOW | .github/workflows/add-community-preset.lock.yml | 21 | # gh aw compile | COMMENT |
| LOW | .github/workflows/add-community-preset.lock.yml | 41 | # - github/gh-aw-actions/setup@c0338fef4749d08c21f8f975fb0e37efa17dda47 # v0.79.8 | COMMENT |
| LOW | .github/workflows/add-community-preset.lock.yml | 841 | # --allow-tool shell(cat) | COMMENT |
| LOW | .github/workflows/bug-fix.lock.yml | 1 | # gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"aafdb01f262d603577971994522575829802b93d9042d62446313955485 | COMMENT |
| LOW | .github/workflows/bug-fix.lock.yml | 21 | # gh aw compile | COMMENT |
| LOW | .github/workflows/bug-fix.lock.yml | 41 | # - github/gh-aw-actions/setup@c0338fef4749d08c21f8f975fb0e37efa17dda47 # v0.79.8 | COMMENT |
| LOW | .github/workflows/bug-fix.lock.yml | 841 | # --allow-tool shell(cargo:*) | COMMENT |
| LOW | .github/workflows/bug-fix.lock.yml | 861 | # --allow-tool shell(printf) | COMMENT |
| LOW | .github/workflows/bug-assess.lock.yml | 1 | # gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"00c226f69fb7ec2b63755304328cee6ecddbcedbe4a9840310e5f430bd3 | COMMENT |
| LOW | .github/workflows/bug-assess.lock.yml | 21 | # gh aw compile | COMMENT |
| LOW | .github/workflows/bug-assess.lock.yml | 41 | # | COMMENT |
| LOW | .github/workflows/bug-assess.lock.yml | 801 | # --allow-tool shell(jq) | COMMENT |
| LOW | presets/scaffold/preset.yml | 21 | COMMENT | |
| LOW | presets/scaffold/preset.yml | 41 | # $CORE_SCRIPT placeholder (scripts), replaced with lower-priority content | COMMENT |
| LOW | presets/scaffold/preset.yml | 61 | # | COMMENT |
| LOW | src/specify_cli/events.py | 41 | # are always stored in POSIX form (record_file/record_existing normalize via | COMMENT |
| LOW | src/specify_cli/events.py | 1261 | # Always emit the timeout (4th positional arg) so the dispatcher's argv | COMMENT |
| LOW | src/specify_cli/events.py | 1521 | cursor_hooks[native] = entries | COMMENT |
| LOW | src/specify_cli/__init__.py | 1 | #!/usr/bin/env python3 | COMMENT |
| LOW | src/specify_cli/agents.py | 661 | # is about to write. The separator must match the *output layout* the | COMMENT |
| LOW | src/specify_cli/shared_infra.py | 21 | # templates, scripts, extension config) tracked. Patterns are relative to the | COMMENT |
| LOW | src/specify_cli/workflows/catalog.py | 341 | f"Failed to read catalog config {config_path}: {exc}" | COMMENT |
| LOW | src/specify_cli/workflows/expressions.py | 421 | # `from_json` is strict: it takes no arguments and tolerates no trailing | COMMENT |
| LOW | src/specify_cli/workflows/expressions.py | 681 | string for multi-expression or mixed templates). | COMMENT |
| LOW | src/specify_cli/workflows/expressions.py | 721 | # Strip before matching: the string a condition resolves to is most often | COMMENT |
| LOW | src/specify_cli/workflows/engine.py | 61 | self.schema_version: str = data.get("schema_version", "1.0") | COMMENT |
| LOW | src/specify_cli/workflows/engine.py | 261 | # strips ``enum`` before coercing; a scalar/string ``enum`` on an | COMMENT |
| LOW | src/specify_cli/workflows/engine.py | 281 | if "default" in input_def: | COMMENT |
| LOW | src/specify_cli/workflows/engine.py | 1261 | "step_id": step_id, | COMMENT |
| LOW | src/specify_cli/workflows/engine.py | 1601 | ) -> dict[str, Any]: | COMMENT |
| 45 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | CONTRIBUTING.md | 87 | 1. **Run focused automated checks first** — use the quick verification commands [below](#automated-checks) to catch scaf | CODE |
| MEDIUM | newsletters/2026-March.md | 75 | - **End-to-end workflow automation** -- an open issue (#1966) proposes a built-in pipeline command. The community-built | CODE |
| MEDIUM | newsletters/2026-May.md | 135 | - **Multi-agent workflows** — multi-install support (#2389) was the most-requested feature. The next frontier is orchest | CODE |
| MEDIUM | newsletters/2026-June.md | 21 | **v0.11.0–v0.11.10** (June 16–29) was the largest release cluster of the month and centered on **workflows** and the new | CODE |
| MEDIUM | newsletters/2026-June.md | 47 | Beyond converge and bundles, June was the month the **workflow engine grew up**. The **step catalog** (#2394) made steps | CODE |
| MEDIUM | newsletters/2026-July.md | 17 | **v0.12.3–v0.12.18** (July 1–17) was the month's longest patch run and carried two features amid heavy hardening. The ** | CODE |
| MEDIUM | newsletters/2026-July.md | 29 | The pipeline runs a staged flow — **capture → evidence → refine → design → decision** — that takes a raw idea, gathers s | CODE |
| MEDIUM | tests/test_extensions.py | 11393 | # .specify/extensions/<id>/<name>, so that is where scaffolding must | COMMENT |
| MEDIUM | tests/test_presets.py | 4396 | # it must scaffold (as a native-skill SKILL.md for claude) and be | COMMENT |
| MEDIUM | tests/extensions/git/test_git_extension.py | 1283 | # Baseline-commit the scaffolding (and config) so the tree is | COMMENT |
| MEDIUM | tests/extensions/git/test_git_extension.py | 1285 | # the untracked scaffold files would mask whether the message file | COMMENT |
| MEDIUM | tests/extensions/git/test_git_extension.py | 1629 | # Baseline-commit the scaffolding (and config) so the tree is | COMMENT |
| MEDIUM | tests/extensions/git/test_git_extension.py | 1631 | # the untracked scaffold files would mask whether the message file | COMMENT |
| MEDIUM | tests/integrations/test_cli.py | 338 | # Aborted before scaffolding: the pre-existing file is untouched. | COMMENT |
| MEDIUM | docs/reference/integrations.md | 28 | | [IBM Bob](https://www.ibm.com/products/bob) | `bob` | Skills-based | CODE |
| MEDIUM | presets/ARCHITECTURE.md | 158 | │ ├── README.md # Guide for customizing the scaffold | CODE |
| MEDIUM | src/specify_cli/events.py | 634 | # uses for command scaffolding. | STRING |
| MEDIUM | src/specify_cli/agents.py | 664 | # skill scaffold ("/SKILL.md") uses the skills separator; any | COMMENT |
| MEDIUM | src/specify_cli/agents.py | 782 | # layout* this registrar writes — a "/SKILL.md" scaffold uses the skills | COMMENT |
| MEDIUM | src/specify_cli/extensions/__init__.py | 2831 | # Only scaffold what removal actually preserves. remove(keep_config) | COMMENT |
| MEDIUM | src/specify_cli/extensions/__init__.py | 2862 | # file or cannot be created, not raise out of scaffolding after | COMMENT |
| MEDIUM | src/specify_cli/integrations/_scaffold_commands.py | 35 | # scaffold targets the Spec Kit *source* repo layout (_is_spec_kit_repo_root), | COMMENT |
| MEDIUM | src/specify_cli/integrations/copilot/__init__.py | 164 | # Mutable flag set by setup() — indicates the active scaffolding mode. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | spec-driven.md | 123 | # Step 1: Create the feature specification (5 minutes) | COMMENT |
| LOW⚡ | spec-driven.md | 131 | # Step 2: Generate implementation plan (5 minutes) | COMMENT |
| LOW⚡ | spec-driven.md | 134 | # Step 3: Generate executable tasks (5 minutes) | COMMENT |
| LOW | docs/install/air-gapped.md | 5 | ## Step 1: Build the wheel on a connected machine | COMMENT |
| LOW⚡ | docs/install/air-gapped.md | 22 | ## Step 2: Transfer the `dist/` directory | COMMENT |
| LOW⚡ | docs/install/air-gapped.md | 26 | ## Step 3: Install on the air-gapped machine | COMMENT |
| LOW⚡ | docs/install/air-gapped.md | 32 | ## Step 4: Initialize a project | COMMENT |
| LOW | extensions/EXTENSION-API-REFERENCE.md | 487 | ### Step 1: Description | COMMENT |
| LOW | extensions/EXTENSION-API-REFERENCE.md | 495 | ### Step 2: Another Step | COMMENT |
| LOW | extensions/selftest/commands/selftest.md | 16 | ### Step 1: Catalog Discovery Validation | COMMENT |
| LOW | extensions/selftest/commands/selftest.md | 25 | ### Step 2: Simulate Installation | COMMENT |
| LOW | extensions/selftest/commands/selftest.md | 40 | ### Step 3: Registration Verification | COMMENT |
| LOW | extensions/selftest/commands/selftest.md | 49 | ### Step 4: Verification Report | COMMENT |
| LOW⚡ | extensions/template/EXAMPLE-README.md | 116 | # Step 1: Create specification | COMMENT |
| LOW⚡ | extensions/template/EXAMPLE-README.md | 119 | # Step 2: Generate tasks | COMMENT |
| LOW⚡ | extensions/template/EXAMPLE-README.md | 122 | # Step 3: Use extension | COMMENT |
| LOW | extensions/template/commands/example.md | 32 | ### Step 1: Load Configuration | COMMENT |
| LOW | extensions/template/commands/example.md | 66 | ### Step 2: Perform Main Action | COMMENT |
| LOW | extensions/template/commands/example.md | 81 | ### Step 3: Process Results | COMMENT |
| LOW | extensions/template/commands/example.md | 97 | ### Step 4: Save Output (Optional) | COMMENT |
| LOW | .github/workflows/add-community-bundle.md | 67 | ## Step 1 - Read and Parse the Issue | COMMENT |
| LOW | .github/workflows/add-community-bundle.md | 95 | ## Step 2 - Validate the Submission | COMMENT |
| LOW | .github/workflows/add-community-bundle.md | 186 | ## Step 3 - Determine Add or Update | COMMENT |
| LOW | .github/workflows/add-community-bundle.md | 197 | ## Step 4 - Update the Community Catalog | COMMENT |
| LOW | .github/workflows/add-community-bundle.md | 239 | ## Step 5 - Update Community Documentation | COMMENT |
| LOW | .github/workflows/add-community-bundle.md | 258 | ## Step 6 - Create a Draft Pull Request | COMMENT |
| LOW⚡ | src/specify_cli/extensions/__init__.py | 526 | # Step 1: apply any rename from the auto-correction pass. | COMMENT |
| LOW⚡ | src/specify_cli/extensions/__init__.py | 528 | # Step 2: lift alias-form '{ext_id}.cmd' to canonical 'speckit.{ext_id}.cmd'. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/test_extensions.py | 594 | # Set ext_id to match the legacy namespace so correction is valid | COMMENT |
| LOW | extensions/git/scripts/python/auto_commit.py | 152 | # Check if there are changes to commit | COMMENT |
| LOW | …tensions/git/scripts/bash/create-new-feature-branch.sh | 278 | # Check if git is available at this repo root | COMMENT |
| LOW | extensions/git/scripts/bash/git-common.sh | 6 | # Check if we have git available at the repo root | COMMENT |
| LOW | extensions/git/scripts/bash/auto-commit.sh | 75 | # Check if git is available | COMMENT |
| LOW | extensions/git/scripts/bash/auto-commit.sh | 166 | # Check if event section existed at all | COMMENT |
| LOW | extensions/git/scripts/bash/auto-commit.sh | 180 | # Check if there are changes to commit | COMMENT |
| LOW | extensions/git/scripts/bash/initialize-repo.sh | 37 | # Check if git is available | COMMENT |
| LOW | extensions/git/scripts/bash/initialize-repo.sh | 43 | # Check if already a git repo | COMMENT |
| LOW | scripts/bash/common.sh | 233 | # Check if jq is available for safe JSON construction | COMMENT |
| LOW | scripts/bash/common.sh | 831 | # Check if any layer uses a non-replace strategy | COMMENT |
| LOW | scripts/bash/setup-plan.sh | 67 | # Output results | COMMENT |
| LOW | scripts/bash/setup-tasks.sh | 62 | # Output results | COMMENT |
| LOW | scripts/bash/check-prerequisites.sh | 181 | # Output results | COMMENT |
| LOW | scripts/bash/create-new-feature.sh | 33 | # Check if the next argument is another option (starts with --) | COMMENT |
| LOW | src/specify_cli/workflows/_commands.py | 3655 | # Check if it's a built-in | COMMENT |
| LOW | src/specify_cli/workflows/steps/prompt/__init__.py | 205 | # Check if the CLI tool is actually installed. | COMMENT |
| LOW | src/specify_cli/workflows/steps/command/__init__.py | 211 | # Check if the CLI tool is actually installed. | COMMENT |
| LOW | src/specify_cli/extensions/__init__.py | 1625 | # Check if skill already exists before creating the directory | COMMENT |
| LOW | src/specify_cli/extensions/__init__.py | 2086 | # Check if already installed | COMMENT |
| LOW | src/specify_cli/extensions/__init__.py | 2715 | # Check if manifest is in a subdirectory | COMMENT |
| LOW | src/specify_cli/extensions/_commands.py | 1020 | # Check if extension exists in catalog (supports both ID and display name) | COMMENT |
| LOW | src/specify_cli/extensions/_commands.py | 1647 | # Check if installation is allowed from this catalog | COMMENT |
| LOW | src/specify_cli/presets/_commands.py | 472 | # Check if installed locally first | COMMENT |
| LOW | src/specify_cli/presets/_commands.py | 569 | # Check if preset is installed | COMMENT |
| LOW | src/specify_cli/presets/_commands.py | 618 | # Check if preset is installed | COMMENT |
| LOW | src/specify_cli/presets/_commands.py | 655 | # Check if preset is installed | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/test_workflows.py | 12745 | # assertion is robust to Rich line-wrapping at narrow terminal widths. | COMMENT |
| MEDIUM | src/specify_cli/workflows/engine.py | 1467 | # not the outer closure — clearer and robust if StepContext copying | COMMENT |
| MEDIUM | src/specify_cli/workflows/_commands.py | 3432 | # ensuring the traversal check is robust even on non-canonical paths. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …s/extensions/test_update_agent_context_feature_json.py | 21 | def _setup_project(root: Path, context_file: str = "CLAUDE.md") -> None: | CODE |
| LOW | src/specify_cli/_console.py | 25 | logger = logging.getLogger(__name__) | CODE |
| LOW | src/specify_cli/events.py | 29 | logger = logging.getLogger(__name__) | CODE |
| LOW | src/specify_cli/shared_infra.py | 17 | logger = logging.getLogger(__name__) | CODE |
| LOW | src/specify_cli/workflows/engine.py | 721 | def set_step_output(self, step_id: str, output: Any) -> None: | CODE |
| LOW | src/specify_cli/workflows/_commands.py | 601 | def set_mode(self, mode: int) -> None: | CODE |
| LOW | src/specify_cli/workflows/_commands.py | 2788 | def _set_workflow_enabled(workflow_id: str, enabled: bool) -> None: | CODE |
| LOW⚡ | src/specify_cli/integrations/_helpers.py | 354 | def _set_default_integration_or_exit(*args: Any, **kwargs: Any) -> None: | CODE |
| LOW | src/specify_cli/bundler/__init__.py | 10 | __all__ = ["BundlerError"] | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | extensions/template/EXAMPLE-README.md | 52 | api_key: "your-api-key" | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | .github/PULL_REQUEST_TEMPLATE.md | 21 | <!-- If you used AI, briefly describe how (e.g., "Code generated by Copilot", "Consulted ChatGPT for approach"): --> | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | src/specify_cli/extensions/__init__.py | 526 | # Step 1: apply any rename from the auto-correction pass. | COMMENT |
| LOW⚡ | src/specify_cli/extensions/__init__.py | 528 | # Step 2: lift alias-form '{ext_id}.cmd' to canonical 'speckit.{ext_id}.cmd'. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/test_github_http.py | 151 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/specify_cli/commands/init.py | 257 | CODE |