💫 Toolkit to help you get started with SDD or any other process!
This report summarizes scanner evidence for github/spec-kit, a Python project with 140,706 GitHub stars. SynthScan examined 307,794 lines of code across 890 source files, recording 8241 pattern matches distributed across 21 syntactic categories. The legacy adjusted pattern signal is 29.0 (Elevated pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 6771 finding(s).
Are imports declared and package/API names verified? 809 finding(s).
Are wrappers, guards, and repeated structures necessary? 6916 finding(s).
Which changes need focused human review? 8241 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 8241 distinct pattern matches across 21 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/test_shared_infra_integrity.py | 23 | def test_matching_digest_passes(): | CODE |
| LOW | tests/test_shared_infra_integrity.py | 30 | def test_mismatch_raises_error_cls(): | CODE |
| LOW | tests/test_shared_infra_integrity.py | 43 | def test_comparison_is_case_insensitive(): | CODE |
| LOW | tests/test_shared_infra_integrity.py | 50 | def test_malformed_digest_is_rejected(): | CODE |
| LOW | tests/test_shared_infra_integrity.py | 75 | def test_absent_digest_skips_and_logs_debug(caplog): | CODE |
| LOW | tests/test_shared_infra_integrity.py | 90 | def test_blank_declared_digest_is_rejected(): | CODE |
| LOW | tests/test_check_prerequisites_python_parity.py | 142 | def test_all_variants_resolve_requested_template( | CODE |
| LOW | tests/test_check_prerequisites_python_parity.py | 185 | def test_all_variants_validate_requested_template_in_text_mode( | CODE |
| LOW | tests/test_check_prerequisites_python_parity.py | 231 | def test_python_json_output_matches_bash(prereq_repo: Path, args: tuple[str, ...]) -> None: | CODE |
| LOW | tests/test_check_prerequisites_python_parity.py | 251 | def test_python_require_spec_matches_bash(prereq_repo: Path) -> None: | CODE |
| LOW | tests/test_check_prerequisites_python_parity.py | 287 | def test_powershell_require_spec_matches_python(prereq_repo: Path) -> None: | CODE |
| LOW | tests/test_check_prerequisites_python_parity.py | 323 | def test_python_text_output_matches_bash(prereq_repo: Path) -> None: | CODE |
| LOW | tests/test_check_prerequisites_python_parity.py | 338 | def test_python_text_output_survives_a_legacy_stdout_code_page( | CODE |
| LOW | tests/test_check_prerequisites_python_parity.py | 385 | def test_python_help_output_matches_bash(prereq_repo: Path) -> None: | CODE |
| LOW | tests/test_check_prerequisites_python_parity.py | 395 | def test_python_unknown_option_matches_bash_error_shape(prereq_repo: Path) -> None: | CODE |
| LOW | tests/test_check_prerequisites_python_parity.py | 423 | def test_python_json_output_matches_powershell( | CODE |
| LOW | tests/test_check_prerequisites_python_parity.py | 444 | def test_python_repo_copy_script_file_fallback_finds_repo_root(tmp_path: Path) -> None: | CODE |
| LOW | tests/test_check_prerequisites_python_parity.py | 465 | def test_python_paths_only_does_not_persist_feature_json(prereq_repo: Path) -> None: | CODE |
| LOW | tests/test_check_prerequisites_python_parity.py | 481 | def test_python_normal_mode_persists_feature_json(prereq_repo: Path) -> None: | CODE |
| LOW | tests/test_check_prerequisites_python_parity.py | 500 | def test_persisted_feature_json_is_lexical_when_specs_is_symlink( | CODE |
| LOW | tests/test_check_prerequisites_python_parity.py | 541 | def test_python_negative_errors_are_stderr_only( | CODE |
| LOW | tests/test_check_prerequisites_python_parity.py | 565 | def test_python_branch_falls_back_to_feature_dir_basename(prereq_repo: Path) -> None: | CODE |
| LOW | tests/test_check_prerequisites_python_parity.py | 622 | def test_non_mapping_integration_json_falls_back(self, tmp_path: Path, body: str): | CODE |
| LOW | tests/test_check_prerequisites_python_parity.py | 631 | def test_hyphen_separator_is_still_honoured(self, tmp_path: Path): | CODE |
| LOW | tests/test_check_prerequisites_python_parity.py | 644 | def test_powershell_text_output_lists_available_docs(prereq_repo: Path) -> None: | CODE |
| LOW⚡ | tests/test_workflows.py | 120 | def test_get_step_type_missing(self): | CODE |
| LOW⚡ | tests/test_workflows.py | 125 | def test_register_step_duplicate_raises(self): | CODE |
| LOW⚡ | tests/test_workflows.py | 132 | def test_register_step_empty_key_raises(self): | CODE |
| LOW⚡ | tests/test_workflows.py | 214 | def test_step_output_reference(self): | CODE |
| LOW⚡ | tests/test_workflows.py | 223 | def test_string_interpolation(self): | CODE |
| LOW⚡ | tests/test_workflows.py | 231 | def test_multi_expression_no_surrounding_text(self): | CODE |
| LOW⚡ | tests/test_workflows.py | 548 | def test_filter_from_json_parses_object(self): | CODE |
| LOW⚡ | tests/test_workflows.py | 558 | def test_filter_from_json_invalid_json_raises(self): | CODE |
| LOW⚡ | tests/test_workflows.py | 567 | def test_filter_from_json_non_string_raises(self): | CODE |
| LOW⚡ | tests/test_workflows.py | 576 | def test_filter_from_json_rejects_malformed_forms(self): | CODE |
| LOW⚡ | tests/test_workflows.py | 2855 | def test_validate_rejects_non_positive_timeout(self): | CODE |
| LOW⚡ | tests/test_workflows.py | 2863 | def test_validate_rejects_non_numeric_timeout(self): | CODE |
| LOW⚡ | tests/test_workflows.py | 2873 | def test_validate_rejects_non_finite_timeout(self): | CODE |
| LOW⚡ | tests/test_workflows.py | 3303 | def test_validate_rejects_bad_script(self): | CODE |
| LOW⚡ | tests/test_workflows.py | 3310 | def test_validate_accepts_valid(self): | CODE |
| LOW⚡ | tests/test_workflows.py | 3320 | def test_docstring_lists_every_on_reject_behaviour(self): | CODE |
| LOW⚡ | tests/test_workflows.py | 3330 | def _non_tty_stdin_by_default(self, monkeypatch): | CODE |
| LOW⚡ | tests/test_workflows.py | 3337 | def test_execute_returns_paused(self): | CODE |
| LOW⚡ | tests/test_workflows.py | 4572 | def test_validate_rejects_non_string_non_bool_condition(self, bad): | CODE |
| LOW⚡ | tests/test_workflows.py | 4580 | def test_validate_accepts_string_or_bool_condition(self, good): | CODE |
| LOW⚡ | tests/test_workflows.py | 4589 | def test_validate_invalid_max_iterations(self): | CODE |
| LOW⚡ | tests/test_workflows.py | 4723 | def test_validate_rejects_non_string_non_bool_condition(self, bad): | CODE |
| LOW⚡ | tests/test_workflows.py | 4731 | def test_validate_accepts_string_or_bool_condition(self, good): | CODE |
| LOW⚡ | tests/test_workflows.py | 4740 | def test_validate_steps_not_list(self): | CODE |
| LOW⚡ | tests/test_workflows.py | 5008 | def test_validate_empty_wait_for(self): | CODE |
| LOW⚡ | tests/test_workflows.py | 5015 | def test_validate_wait_for_not_list(self): | CODE |
| LOW⚡ | tests/test_workflows.py | 5023 | def test_validate_rejects_non_mapping_output(self, bad_output): | CODE |
| LOW⚡ | tests/test_workflows.py | 5087 | def test_sequential_default_preserves_order(self, tmp_path, monkeypatch): | CODE |
| LOW⚡ | tests/test_workflows.py | 5091 | def test_concurrent_runs_all_items_in_item_order(self, tmp_path, monkeypatch): | CODE |
| LOW⚡ | tests/test_workflows.py | 5095 | def test_sequential_and_concurrent_agree(self, tmp_path, monkeypatch): | CODE |
| LOW⚡ | tests/test_workflows.py | 5101 | def test_shuffled_completion_preserves_item_order(self, tmp_path, monkeypatch): | CODE |
| LOW⚡ | tests/test_workflows.py | 5145 | def test_invalid_max_concurrency_coerces_to_sequential( | CODE |
| LOW⚡ | tests/test_workflows.py | 5154 | def test_string_max_concurrency_is_honored(self, tmp_path, monkeypatch): | CODE |
| LOW⚡ | tests/test_workflows.py | 5158 | def test_context_item_isolation_across_threads(self, tmp_path, monkeypatch): | CODE |
| LOW⚡ | tests/test_workflows.py | 5164 | def test_marks_item_context_as_inside_fan_out( | CODE |
| 6192 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/test_workflows.py | 28 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_workflows.py | 30 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/conftest.py | 138 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/conftest.py | 140 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_setup_tasks.py | 181 | # =========================================================================== | COMMENT |
| MEDIUM⚡ | tests/test_setup_tasks.py | 183 | # =========================================================================== | COMMENT |
| MEDIUM⚡ | tests/test_setup_tasks.py | 703 | # =========================================================================== | COMMENT |
| MEDIUM⚡ | tests/test_setup_tasks.py | 705 | # =========================================================================== | COMMENT |
| MEDIUM | tests/test_setup_tasks.py | 26 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_setup_tasks.py | 28 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_setup_tasks.py | 150 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_setup_tasks.py | 152 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_setup_tasks.py | 994 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_setup_tasks.py | 997 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_live_transient_windows.py | 17 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_live_transient_windows.py | 19 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_live_transient_windows.py | 65 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_live_transient_windows.py | 67 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_setup_plan_no_overwrite.py | 90 | # ── Bash tests ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_setup_plan_no_overwrite.py | 178 | # ── PowerShell tests ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | tests/test_timestamp_branches.py | 445 | # ── check_feature_branch Tests ─────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | tests/test_timestamp_branches.py | 459 | # ── find_feature_dir_by_prefix Tests ───────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | tests/test_timestamp_branches.py | 470 | # ── get_feature_paths + single-prefix integration ─────────────────────────── | COMMENT |
| MEDIUM⚡ | tests/test_timestamp_branches.py | 764 | # ── Dry-Run Tests ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | tests/test_timestamp_branches.py | 1210 | # ── Feature Directory Resolution Tests ─────────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_timestamp_branches.py | 179 | # ── Timestamp Branch Tests ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_timestamp_branches.py | 225 | # ── Sequential Branch Tests ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_timestamp_branches.py | 513 | # ── get_current_branch Tests ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_timestamp_branches.py | 524 | # ── No-git Tests ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_timestamp_branches.py | 537 | # ── E2E Flow Tests ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_timestamp_branches.py | 604 | # ── Allow Existing Branch Tests ────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_timestamp_branches.py | 978 | # ── PowerShell Dry-Run Tests ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_timestamp_branches.py | 1062 | # ── Short-Word / Acronym Branch-Name Tests ────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_timestamp_branches.py | 1108 | # ── GIT_BRANCH_NAME Override Tests ────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_timestamp_branches.py | 1366 | # ── Description Quoting Tests (issue #2339) ────────────────────────────────── | COMMENT |
| MEDIUM⚡ | tests/test_init_dir.py | 115 | # ── Bash: positive cases ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | tests/test_init_dir.py | 350 | # ubuntu/windows runners ship pwsh, so these DO run there) ───────────────── | COMMENT |
| MEDIUM | tests/test_init_dir.py | 199 | # ── Bash: negative / contract cases ───────────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_init_dir.py | 292 | # ── Bash: bundled Git extension entrypoint ────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_init_dir.py | 480 | # ── Windows PowerShell 5.1 compatibility (issue #3749) ────────────────────── | COMMENT |
| MEDIUM | tests/test_check_prerequisites_paths_only.py | 76 | # ── Bash tests ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_check_prerequisites_paths_only.py | 265 | # ── PowerShell tests ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_init_dir_cli.py | 52 | # ── chokepoint: _require_specify_project() via `workflow list` ─────────────── | COMMENT |
| MEDIUM | tests/test_init_dir_cli.py | 165 | # ── bypass: `workflow run <file>` ──────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | tests/specify_cli/test_version_detection.py | 600 | # =========================================================================== | COMMENT |
| MEDIUM⚡ | tests/specify_cli/test_version_detection.py | 602 | # =========================================================================== | COMMENT |
| MEDIUM | tests/specify_cli/test_version_execution.py | 18 | # =========================================================================== | COMMENT |
| MEDIUM | tests/specify_cli/test_version_execution.py | 20 | # =========================================================================== | COMMENT |
| MEDIUM⚡ | tests/specify_cli/test_version_verification.py | 23 | # =========================================================================== | COMMENT |
| MEDIUM⚡ | tests/specify_cli/test_version_verification.py | 25 | # =========================================================================== | COMMENT |
| MEDIUM | tests/specify_cli/test_version_guidance.py | 14 | # =========================================================================== | COMMENT |
| MEDIUM | tests/specify_cli/test_version_guidance.py | 16 | # =========================================================================== | COMMENT |
| MEDIUM⚡ | tests/specify_cli/artifacts/test_catalog.py | 36 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/specify_cli/artifacts/test_catalog.py | 38 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/specify_cli/artifacts/test_catalog.py | 659 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/specify_cli/artifacts/test_catalog.py | 661 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/specify_cli/artifacts/test_catalog.py | 751 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/specify_cli/artifacts/test_catalog.py | 753 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/specify_cli/artifacts/test_catalog.py | 893 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/specify_cli/artifacts/test_catalog.py | 895 | # --------------------------------------------------------------------------- | COMMENT |
| 168 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/test_workflows.py | 0 | cli alignment with extension/preset commands (#2342). | STRING |
| HIGH | tests/specify_cli/workflows/test_command_search.py | 0 | cli alignment with extension/preset commands (#2342). | STRING |
| HIGH | tests/specify_cli/workflows/test_command_disable.py | 0 | cli alignment with extension/preset commands (#2342). | STRING |
| HIGH | tests/specify_cli/workflows/test_command_status.py | 0 | cli alignment with extension/preset commands (#2342). | STRING |
| HIGH | tests/specify_cli/workflows/test_command_enable.py | 0 | cli alignment with extension/preset commands (#2342). | STRING |
| HIGH | tests/specify_cli/workflows/test_command_add.py | 0 | cli alignment with extension/preset commands (#2342). | STRING |
| HIGH | tests/specify_cli/workflows/test_command_resume.py | 0 | cli alignment with extension/preset commands (#2342). | STRING |
| HIGH | tests/specify_cli/workflows/test_command_update.py | 0 | cli alignment with extension/preset commands (#2342). | STRING |
| HIGH | tests/specify_cli/workflows/test_command_run.py | 0 | cli alignment with extension/preset commands (#2342). | STRING |
| HIGH | tests/specify_cli/workflows/test_command_remove.py | 0 | cli alignment with extension/preset commands (#2342). | STRING |
| HIGH | tests/specify_cli/workflows/test_command_list.py | 0 | cli alignment with extension/preset commands (#2342). | STRING |
| HIGH | …sts/specify_cli/workflows/catalog/test_command_list.py | 0 | cli alignment with extension/preset commands (#2342). | STRING |
| HIGH | …pecify_cli/workflows/step/catalog/test_command_list.py | 0 | cli alignment with extension/preset commands (#2342). | STRING |
| HIGH | tests/specify_cli/workflows/test_command_disable.py | 0 | schema_version: "1.0" workflow: id: "align-wf" name: "align workflow" version: "{version}" description: "cli alignment t | STRING |
| HIGH | tests/specify_cli/workflows/test_command_enable.py | 0 | schema_version: "1.0" workflow: id: "align-wf" name: "align workflow" version: "{version}" description: "cli alignment t | STRING |
| HIGH | tests/specify_cli/workflows/test_command_add.py | 0 | schema_version: "1.0" workflow: id: "align-wf" name: "align workflow" version: "{version}" description: "cli alignment t | STRING |
| HIGH | tests/specify_cli/workflows/test_command_update.py | 0 | schema_version: "1.0" workflow: id: "align-wf" name: "align workflow" version: "{version}" description: "cli alignment t | STRING |
| HIGH | …ts/specify_cli/workflows/test_command_run_ownership.py | 0 | schema_version: "1.0" workflow: id: "align-wf" name: "align workflow" version: "{version}" description: "cli alignment t | STRING |
| HIGH | tests/specify_cli/workflows/test_command_run.py | 0 | schema_version: "1.0" workflow: id: "align-wf" name: "align workflow" version: "{version}" description: "cli alignment t | STRING |
| HIGH | tests/specify_cli/workflows/test_command_remove.py | 0 | schema_version: "1.0" workflow: id: "align-wf" name: "align workflow" version: "{version}" description: "cli alignment t | STRING |
| HIGH | tests/specify_cli/workflows/test_command_list.py | 0 | schema_version: "1.0" workflow: id: "align-wf" name: "align workflow" version: "{version}" description: "cli alignment t | STRING |
| HIGH | tests/specify_cli/workflows/test_command_status.py | 0 | test the --json machine-readable output for run/resume/status. | STRING |
| HIGH | tests/specify_cli/workflows/test_command_resume.py | 0 | test the --json machine-readable output for run/resume/status. | STRING |
| HIGH | tests/specify_cli/workflows/test_command_run.py | 0 | test the --json machine-readable output for run/resume/status. | STRING |
| HIGH | tests/specify_cli/workflows/test_command_status.py | 0 | schema_version: "1.0" workflow: id: "json-wf" name: "json wf" version: "1.0.0" steps: - id: ask type: gate message: "rev | STRING |
| HIGH | tests/specify_cli/workflows/test_command_resume.py | 0 | schema_version: "1.0" workflow: id: "json-wf" name: "json wf" version: "1.0.0" steps: - id: ask type: gate message: "rev | STRING |
| HIGH | tests/specify_cli/workflows/test_command_run.py | 0 | schema_version: "1.0" workflow: id: "json-wf" name: "json wf" version: "1.0.0" steps: - id: ask type: gate message: "rev | STRING |
| HIGH | tests/specify_cli/workflows/test_command_status.py | 0 | schema_version: "1.0" workflow: id: "gated-wf" name: "gated workflow" version: "1.0.0" steps: - id: ask type: gate messa | STRING |
| HIGH | tests/specify_cli/workflows/test_command_resume.py | 0 | schema_version: "1.0" workflow: id: "gated-wf" name: "gated workflow" version: "1.0.0" steps: - id: ask type: gate messa | STRING |
| HIGH | tests/specify_cli/workflows/test_command_run.py | 0 | schema_version: "1.0" workflow: id: "gated-wf" name: "gated workflow" version: "1.0.0" steps: - id: ask type: gate messa | STRING |
| HIGH | tests/specify_cli/workflows/test_command_add.py | 0 | a malformed ipv6 url must produce a clean error, not a valueerror traceback. | STRING |
| HIGH | tests/specify_cli/extensions/test_command_add.py | 0 | a malformed ipv6 url must produce a clean error, not a valueerror traceback. | STRING |
| HIGH | tests/specify_cli/presets/test_command_add.py | 0 | a malformed ipv6 url must produce a clean error, not a valueerror traceback. | STRING |
| HIGH | tests/specify_cli/workflows/test_command_add.py | 0 | cli-level tests for ``specify workflow overlay *``. | STRING |
| HIGH | tests/specify_cli/workflows/test_command_resolve.py | 0 | cli-level tests for ``specify workflow overlay *``. | STRING |
| HIGH | …ify_cli/workflows/overlay/test_command_set_priority.py | 0 | cli-level tests for ``specify workflow overlay *``. | STRING |
| HIGH | …/specify_cli/workflows/overlay/test_command_disable.py | 0 | cli-level tests for ``specify workflow overlay *``. | STRING |
| HIGH | tests/specify_cli/workflows/overlay/test_command_add.py | 0 | cli-level tests for ``specify workflow overlay *``. | STRING |
| HIGH | …s/specify_cli/workflows/overlay/test_command_remove.py | 0 | cli-level tests for ``specify workflow overlay *``. | STRING |
| HIGH | …sts/specify_cli/workflows/overlay/test_command_list.py | 0 | cli-level tests for ``specify workflow overlay *``. | STRING |
| HIGH | …sts/specify_cli/workflows/catalog/test_command_list.py | 0 | user-editable catalog name/url/description must not be parsed as rich markup. | STRING |
| HIGH | …/specify_cli/integrations/catalog/test_command_list.py | 0 | user-editable catalog name/url/description must not be parsed as rich markup. | STRING |
| HIGH | tests/specify_cli/presets/catalog/test_command_list.py | 0 | user-editable catalog name/url/description must not be parsed as rich markup. | STRING |
| HIGH | tests/specify_cli/workflows/step/test_command_info.py | 0 | step discovery commands render metadata as literal text. | STRING |
| HIGH | tests/specify_cli/workflows/step/test_command_search.py | 0 | step discovery commands render metadata as literal text. | STRING |
| HIGH | tests/specify_cli/workflows/step/test_command_list.py | 0 | step discovery commands render metadata as literal text. | STRING |
| HIGH | …ify_cli/workflows/overlay/test_command_set_priority.py | 0 | overlay identity must come from the manifest ``id`` field, not the filename. this matches the project-wide convention: p | STRING |
| HIGH | …/specify_cli/workflows/overlay/test_command_disable.py | 0 | overlay identity must come from the manifest ``id`` field, not the filename. this matches the project-wide convention: p | STRING |
| HIGH | …s/specify_cli/workflows/overlay/test_command_remove.py | 0 | overlay identity must come from the manifest ``id`` field, not the filename. this matches the project-wide convention: p | STRING |
| HIGH | …sts/specify_cli/workflows/overlay/test_command_list.py | 0 | overlay identity must come from the manifest ``id`` field, not the filename. this matches the project-wide convention: p | STRING |
| HIGH | …ify_cli/workflows/overlay/test_command_set_priority.py | 0 | write an overlay file where filename != manifest id. | STRING |
| HIGH | …/specify_cli/workflows/overlay/test_command_disable.py | 0 | write an overlay file where filename != manifest id. | STRING |
| HIGH | …s/specify_cli/workflows/overlay/test_command_remove.py | 0 | write an overlay file where filename != manifest id. | STRING |
| HIGH | …sts/specify_cli/workflows/overlay/test_command_list.py | 0 | write an overlay file where filename != manifest id. | STRING |
| HIGH | …ify_cli/workflows/overlay/test_command_set_priority.py | 0 | overlay cli must stay inside the overlay directory. | STRING |
| HIGH | …s/specify_cli/workflows/overlay/test_command_enable.py | 0 | overlay cli must stay inside the overlay directory. | STRING |
| HIGH | tests/specify_cli/workflows/overlay/test_command_add.py | 0 | overlay cli must stay inside the overlay directory. | STRING |
| HIGH | …s/specify_cli/workflows/overlay/test_command_remove.py | 0 | overlay cli must stay inside the overlay directory. | STRING |
| HIGH | …sts/specify_cli/workflows/overlay/test_command_list.py | 0 | overlay cli must stay inside the overlay directory. | STRING |
| HIGH | tests/integrations/test_integration_base_markdown.py | 0 | the generated plan skill must not carry a context-file placeholder. agent context files are owned entirely by the opt-in | STRING |
| 99 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/test_shared_infra_integrity.py | 9 | CODE | |
| LOW | tests/test_check_prerequisites_python_parity.py | 3 | CODE | |
| LOW | tests/test_workflows.py | 13 | CODE | |
| LOW | tests/test_utils.py | 3 | CODE | |
| LOW | tests/lock_helpers.py | 3 | CODE | |
| LOW | tests/test_github_workflows.py | 3 | CODE | |
| LOW | tests/test_installed_list_json.py | 3 | CODE | |
| LOW | tests/test_download_security.py | 3 | CODE | |
| LOW | tests/test_post_process.py | 10 | CODE | |
| LOW | tests/test_live_transient_windows.py | 12 | CODE | |
| LOW | tests/test_resolve_template_python_parity.py | 3 | CODE | |
| LOW | tests/test_extensions.py | 26 | CODE | |
| LOW | tests/parity_helpers.py | 3 | CODE | |
| LOW | tests/test_setup_tasks_python_parity.py | 3 | CODE | |
| LOW | tests/test_shared_infra_gitignore.py | 12 | CODE | |
| LOW | tests/test_create_new_feature_python_parity.py | 3 | CODE | |
| LOW | tests/test_setup_plan_python_parity.py | 3 | CODE | |
| LOW | tests/test_security_workflow.py | 3 | CODE | |
| LOW | tests/test_shared_infra_lock.py | 3 | CODE | |
| LOW | tests/test_installed_info_json.py | 3 | CODE | |
| LOW | tests/specify_cli/test_command_init.py | 17 | CODE | |
| LOW | tests/specify_cli/test_version_detection.py | 15 | CODE | |
| LOW | tests/specify_cli/test_version_execution.py | 9 | CODE | |
| LOW | tests/specify_cli/self_upgrade_helpers.py | 13 | CODE | |
| LOW | tests/specify_cli/self_upgrade_helpers.py | 13 | CODE | |
| LOW | tests/specify_cli/self_upgrade_helpers.py | 13 | CODE | |
| LOW | tests/specify_cli/self_upgrade_helpers.py | 13 | CODE | |
| LOW | tests/specify_cli/self_upgrade_helpers.py | 13 | CODE | |
| LOW | tests/specify_cli/self_upgrade_helpers.py | 20 | CODE | |
| LOW | tests/specify_cli/self_upgrade_helpers.py | 21 | CODE | |
| LOW | tests/specify_cli/self_upgrade_helpers.py | 21 | CODE | |
| LOW | tests/specify_cli/test_version_release.py | 22 | CODE | |
| LOW | tests/specify_cli/test_version_verification.py | 10 | CODE | |
| LOW | tests/specify_cli/test_version_guidance.py | 7 | CODE | |
| LOW | tests/specify_cli/artifacts/test_command_info.py | 3 | CODE | |
| LOW | tests/specify_cli/artifacts/conftest.py | 1 | CODE | |
| LOW | tests/specify_cli/artifacts/test_catalog.py | 3 | CODE | |
| LOW | tests/specify_cli/artifacts/test_operation_info.py | 3 | CODE | |
| LOW | tests/specify_cli/artifacts/test_catalog_parity.py | 8 | CODE | |
| LOW | tests/specify_cli/artifacts/test_operation_list.py | 3 | CODE | |
| LOW | tests/specify_cli/artifacts/helpers.py | 1 | CODE | |
| LOW | tests/specify_cli/artifacts/test_command_lookup.py | 3 | CODE | |
| LOW | tests/specify_cli/artifacts/test_command_list.py | 3 | CODE | |
| LOW | tests/specify_cli/selfs/test_command_check.py | 11 | CODE | |
| LOW | tests/specify_cli/workflows/test_command_info.py | 3 | CODE | |
| LOW | tests/specify_cli/workflows/test_command_search.py | 3 | CODE | |
| LOW | tests/specify_cli/workflows/conftest.py | 3 | CODE | |
| LOW | tests/specify_cli/workflows/test_custom_steps.py | 3 | CODE | |
| LOW | tests/specify_cli/workflows/test_command_disable.py | 3 | CODE | |
| LOW | tests/specify_cli/workflows/test_catalog_versions.py | 3 | CODE | |
| LOW | tests/specify_cli/workflows/test_command_status.py | 3 | CODE | |
| LOW | tests/specify_cli/workflows/test_command_enable.py | 3 | CODE | |
| LOW | tests/specify_cli/workflows/test_command_add.py | 3 | CODE | |
| LOW | tests/specify_cli/workflows/test_command_resume.py | 3 | CODE | |
| LOW | tests/specify_cli/workflows/test_command_resolve.py | 3 | CODE | |
| LOW | tests/specify_cli/workflows/test_command_update.py | 3 | CODE | |
| LOW | tests/specify_cli/workflows/test_command_run.py | 3 | CODE | |
| LOW | tests/specify_cli/workflows/helpers.py | 3 | CODE | |
| LOW | tests/specify_cli/workflows/test_command_remove.py | 3 | CODE | |
| LOW | tests/specify_cli/workflows/test_command_list.py | 3 | CODE | |
| 692 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/specify_cli/artifacts/test_catalog.py | 816 | except ArtifactNotFoundError: | CODE |
| HIGH | tests/specify_cli/extensions/test_command_info.py | 231 | except SystemExit: | CODE |
| HIGH | tests/integrations/test_registry.py | 95 | except ValueError: | CODE |
| HIGH | scripts/python/common.py | 298 | except OSError: | CODE |
| HIGH | scripts/python/common.py | 530 | except ImportError: | CODE |
| HIGH | scripts/python/common.py | 237 | except Exception: | CODE |
| HIGH | src/specify_cli/_version.py | 549 | except (subprocess.TimeoutExpired, OSError, ValueError): | CODE |
| HIGH | src/specify_cli/_version.py | 570 | except (subprocess.TimeoutExpired, OSError, ValueError): | CODE |
| HIGH | src/specify_cli/_assets.py | 117 | except Exception: | CODE |
| HIGH | src/specify_cli/__init__.py | 512 | except (AttributeError, ValueError, OSError): | CODE |
| HIGH | src/specify_cli/agents.py | 1457 | except ImportError: | CODE |
| HIGH | src/specify_cli/agents.py | 747 | except (ImportError, ValueError, KeyError): | CODE |
| HIGH | src/specify_cli/agents.py | 92 | except ImportError: | CODE |
| HIGH | src/specify_cli/agents.py | 1437 | except OSError: | CODE |
| HIGH | src/specify_cli/_download_security.py | 183 | except _TAR_DECOMPRESSION_ERRORS: | CODE |
| HIGH | src/specify_cli/command_init.py | 905 | except OSError: | CODE |
| HIGH | src/specify_cli/_utils.py | 230 | except OSError: | CODE |
| HIGH | src/specify_cli/_utils.py | 227 | except PermissionError: | CODE |
| HIGH | src/specify_cli/artifacts/catalog.py | 234 | except IdentifierComponentError: | CODE |
| HIGH | src/specify_cli/artifacts/catalog.py | 547 | except (OSError, ValueError): | CODE |
| HIGH | src/specify_cli/artifacts/_operation_info.py | 462 | except IdentifierComponentError: | CODE |
| HIGH | src/specify_cli/workflows/expressions.py | 930 | except (ValueError, TypeError): | CODE |
| HIGH | src/specify_cli/workflows/expressions.py | 1455 | except Exception: # noqa: BLE001 - probe values, reported by _evaluator_rejects | CODE |
| HIGH | src/specify_cli/workflows/_execution.py | 662 | except Exception: | CODE |
| HIGH | src/specify_cli/workflows/engine.py | 1031 | except FileNotFoundError: | CODE |
| HIGH | src/specify_cli/workflows/engine.py | 807 | except OSError: | CODE |
| HIGH | src/specify_cli/workflows/_commands.py | 405 | except OSError: | CODE |
| HIGH | src/specify_cli/workflows/_commands.py | 447 | except OSError: | CODE |
| HIGH | src/specify_cli/workflows/_commands.py | 452 | except OSError: | CODE |
| HIGH | src/specify_cli/workflows/_commands.py | 522 | except OSError: | CODE |
| HIGH | src/specify_cli/workflows/_commands.py | 542 | except OSError: | CODE |
| HIGH | src/specify_cli/workflows/command_info.py | 53 | except FileNotFoundError: | CODE |
| HIGH | src/specify_cli/workflows/catalog/_domain.py | 628 | except OSError: | CODE |
| HIGH | src/specify_cli/workflows/catalog/_domain.py | 199 | except OSError: | CODE |
| HIGH | src/specify_cli/workflows/catalog/_domain.py | 542 | except (UnicodeDecodeError, json.JSONDecodeError, OSError): | CODE |
| HIGH | src/specify_cli/workflows/catalog/_domain.py | 224 | except OSError: | CODE |
| HIGH | src/specify_cli/workflows/catalog/_domain.py | 220 | except OSError: | CODE |
| HIGH | src/specify_cli/workflows/catalog/_domain.py | 609 | except (json.JSONDecodeError, ValueError, OSError): | CODE |
| HIGH | src/specify_cli/workflows/catalog/_domain.py | 197 | except PermissionError: | CODE |
| HIGH | src/specify_cli/workflows/catalog/_versions.py | 112 | except InvalidVersion: | CODE |
| HIGH | src/specify_cli/workflows/step/installer.py | 448 | except FileNotFoundError: | CODE |
| HIGH | src/specify_cli/workflows/step/installer.py | 657 | except OSError: | CODE |
| HIGH | src/specify_cli/workflows/step/init/__init__.py | 282 | except OSError: | CODE |
| HIGH | src/specify_cli/workflows/step/catalog/_domain.py | 159 | except OSError: | CODE |
| HIGH | src/specify_cli/workflows/step/catalog/_domain.py | 503 | except (UnicodeDecodeError, json.JSONDecodeError, OSError): | CODE |
| HIGH | src/specify_cli/workflows/step/catalog/_domain.py | 593 | except OSError: | CODE |
| HIGH | src/specify_cli/workflows/step/catalog/_domain.py | 183 | except OSError: | CODE |
| HIGH | src/specify_cli/workflows/step/catalog/_domain.py | 188 | except OSError: | CODE |
| HIGH | src/specify_cli/workflows/step/catalog/_domain.py | 574 | except (json.JSONDecodeError, ValueError, OSError): | CODE |
| HIGH | src/specify_cli/workflows/step/catalog/_domain.py | 157 | except PermissionError: | CODE |
| HIGH | src/specify_cli/workflows/step/catalog/_versions.py | 161 | except InvalidVersion: | CODE |
| HIGH | …/specify_cli/extensions/_command_update_transaction.py | 732 | except KeyError: | CODE |
| HIGH | …/specify_cli/extensions/_command_update_transaction.py | 808 | except OSError: | CODE |
| HIGH | src/specify_cli/extensions/__init__.py | 173 | except OSError: | CODE |
| HIGH | src/specify_cli/extensions/__init__.py | 1946 | except (OSError, ValueError): | CODE |
| HIGH | src/specify_cli/extensions/__init__.py | 3248 | except OSError: | CODE |
| HIGH | src/specify_cli/extensions/__init__.py | 4770 | except (json.JSONDecodeError, OSError, UnicodeError, ExtensionError): | CODE |
| HIGH | src/specify_cli/extensions/__init__.py | 4834 | except OSError: | CODE |
| HIGH | src/specify_cli/extensions/__init__.py | 4975 | except (json.JSONDecodeError, OSError, UnicodeError, ExtensionError): | CODE |
| HIGH | src/specify_cli/extensions/__init__.py | 5029 | except OSError: | CODE |
| 50 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/test_workflows.py | 5508 | # block (list/null) is stored raw and would crash _resolve_inputs at | COMMENT |
| HIGH | tests/test_workflows.py | 3563 | ``config.get(k, default)`` does not replace an explicit null). | CODE |
| HIGH | tests/test_workflows.py | 4969 | """An explicit ``output:`` (YAML null) is valid, matching ``validate``.""" | STRING |
| HIGH | tests/test_workflows.py | 10402 | """An empty document, explicit null, or absent/empty ``catalogs:`` stays a | STRING |
| HIGH | tests/test_github_workflows.py | 202 | calls.push({api, args}); | CODE |
| HIGH | tests/test_github_workflows.py | 216 | let error = null; | CODE |
| HIGH | tests/test_github_workflows.py | 1645 | const activated = pre && evaluate(input.activated); | CODE |
| HIGH | tests/test_github_workflows.py | 1683 | "pr-assess-${{ github.event.issue.number || github.event.pull_request.number }}" | STRING |
| HIGH | tests/test_resolve_template_python_parity.py | 280 | '"disabled-ext":{"enabled":null,"priority":1},' | CODE |
| HIGH | tests/parity_helpers.py | 141 | 'command -v cygpath >/dev/null 2>&1 && cygpath -u "$1"', | CODE |
| HIGH⚡ | tests/test_workflow_step_submission.py | 918 | path.write_text(original.replace(token, token + " null, " + token, 1)) | STRING |
| HIGH | tests/test_workflow_step_submission.py | 898 | text = text.replace(token, token + " null, " + token, 1) | STRING |
| HIGH | tests/test_init_dir.py | 562 | `cd && pwd` never yields one, so the two must agree. | STRING |
| HIGH⚡ | tests/test_setup_plan_python_parity.py | 183 | '{"presets": {"alpha": {"priority": 2}, "beta": {"priority": 1}, "gamma": {"priority": null}}}', | CODE |
| HIGH⚡ | tests/test_setup_plan_python_parity.py | 188 | ('{"presets":null}', "# alpha plan\n"), | CODE |
| HIGH | tests/test_extension_registration.py | 303 | """Regression: hooks: {after_tasks: null} must not crash in unregister_hooks().""" | STRING |
| HIGH | tests/test_security_workflow.py | 100 | "${{ github.event.pull_request.base.sha || github.event.before || '' }}" | CODE |
| HIGH | tests/test_security_workflow.py | 103 | "${{ github.event.pull_request.head.sha || github.sha }}" | CODE |
| HIGH | tests/specify_cli/workflows/test_command_status.py | 343 | (int/list instead of str-or-null) raises ValueError, which leaked | CODE |
| HIGH | …cify_cli/extensions/test_command_update_transaction.py | 160 | # Write config with hooks: null; get_project_config() normalizes this to {} | COMMENT |
| HIGH⚡ | tests/specify_cli/presets/test_manifest.py | 77 | """Required manifest sections reject null, list, and scalar values.""" | STRING |
| HIGH | tests/specify_cli/events/test_events.py | 1217 | assert "errors.push(" in content | CODE |
| HIGH⚡ | tests/contract/test_catalog_schema.py | 108 | default stack (must not be confused with an explicit top-level null).""" | STRING |
| HIGH | tests/contract/test_catalog_schema.py | 85 | """A top-level non-mapping bundle-catalogs.yml (list/scalar/null) must raise, | STRING |
| HIGH | tests/extensions/test_extension_agent_context.py | 175 | "command -v cygpath >/dev/null 2>&1 && cygpath -u \"$1\"", | CODE |
| HIGH | scripts/python/common.py | 692 | # * a non-mapping top level ([], "forge", 42, null) is valid JSON, so | COMMENT |
| HIGH | src/specify_cli/workflows/expressions.py | 983 | In every such case the membership relation is undefined, so treat it as | STRING |
| HIGH⚡ | src/specify_cli/workflows/engine.py | 171 | "'workflow.integration' must be a string or null, got " | CODE |
| HIGH⚡ | src/specify_cli/workflows/engine.py | 181 | "'workflow.model' must be a string or null, got " | CODE |
| HIGH⚡ | src/specify_cli/workflows/engine.py | 188 | "'workflow.options' must be a mapping or null, got " | CODE |
| HIGH | src/specify_cli/workflows/engine.py | 343 | # valid, but any present-but-non-mapping value — ``requires:`` (YAML null), | COMMENT |
| HIGH | src/specify_cli/workflows/engine.py | 650 | f"string or null, got {type(installed_workflow_id).__name__}" | CODE |
| HIGH | src/specify_cli/workflows/engine.py | 661 | f"string or null, got {type(installed_registry_root).__name__}" | CODE |
| HIGH | src/specify_cli/workflows/catalog/_domain.py | 384 | # raises. An absent key, an explicit ``catalogs:`` null, and an empty | COMMENT |
| HIGH | src/specify_cli/workflows/step/prompt/__init__.py | 294 | # (an explicit ``integration:``/``model:`` YAML null) means "inherit the | COMMENT |
| HIGH | src/specify_cli/workflows/step/command/__init__.py | 322 | # a non-string (null, list, int) crashes there with a raw | COMMENT |
| HIGH | src/specify_cli/workflows/step/command/__init__.py | 374 | # (an explicit ``integration:``/``model:`` YAML null) means "inherit the | COMMENT |
| HIGH | src/specify_cli/workflows/step/fan_in/__init__.py | 38 | # explicit ``output:`` (YAML null) stays valid, matching validate. | COMMENT |
| HIGH | src/specify_cli/extensions/__init__.py | 4588 | ``{"extensions": []}`` or ``{"extensions": null}`` slip through | STRING |
| HIGH | src/specify_cli/integrations/_command_upgrade_layout.py | 154 | # anything else (e.g. null) leaves ownership undecidable, so fail | COMMENT |
| HIGH | src/specify_cli/presets/_manifest.py | 173 | # ``templates: [null]``) raises a clean PresetValidationError the | COMMENT |
| HIGH | src/specify_cli/presets/_catalog.py | 209 | ``{"presets": []}`` or ``{"presets": null}`` slip through here and | STRING |
| HIGH⚡ | src/specify_cli/events/__init__.py | 2022 | f" try {{ if ({checks}) {{ runEvent({command_lit}, {ev_lit}, input, output, {timeout_sec}); } | STRING |
| HIGH⚡ | src/specify_cli/events/__init__.py | 2026 | f" try {{ runEvent({command_lit}, {ev_lit}, input, output, {timeout_sec}); }} catch (e) {{ er | STRING |
| HIGH⚡ | src/specify_cli/events/__init__.py | 2030 | f" try {{ const ctx = runEvent({command_lit}, {ev_lit}, input, output, {timeout_sec}); if (ctx) c | STRING |
| HIGH⚡ | src/specify_cli/events/__init__.py | 2034 | f" try {{ runEvent({command_lit}, {ev_lit}, input, output, {timeout_sec}); }} catch (e) {{ errors | STRING |
| HIGH | src/specify_cli/events/__init__.py | 2069 | f" if (ctx === undefined) {{\n" | STRING |
| HIGH | src/specify_cli/events/__init__.py | 2073 | f" if (ctx) output.system.push(ctx);\n" | STRING |
| HIGH | src/specify_cli/events/__init__.py | 2093 | f" output.parts.push({{ id: base + \".speckit\" + Math.random().toString(36).slice(2, 8), sessionID | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/test_github_workflows.py | 1593 | CODE | |
| LOW | tests/test_extensions.py | 1673 | CODE | |
| LOW | tests/test_extensions.py | 2816 | CODE | |
| LOW | tests/test_workflow_step_submission.py | 743 | CODE | |
| LOW | tests/test_community_preset_validation.py | 651 | CODE | |
| LOW | tests/specify_cli/workflows/test_command_add.py | 818 | CODE | |
| LOW | tests/specify_cli/workflows/step/test_command_add.py | 1662 | CODE | |
| LOW | tests/specify_cli/integrations/test_lifecycle.py | 63 | CODE | |
| LOW | …ts/specify_cli/integrations/test_installed_adapters.py | 1350 | CODE | |
| LOW | …ts/specify_cli/integrations/test_installed_adapters.py | 2180 | CODE | |
| LOW | …ts/specify_cli/integrations/test_installed_adapters.py | 2412 | CODE | |
| LOW | tests/specify_cli/presets/test_catalog.py | 973 | CODE | |
| LOW | tests/specify_cli/bundles/test_references.py | 447 | CODE | |
| LOW | tests/integrations/test_integration_generic.py | 229 | CODE | |
| LOW | tests/integrations/test_integration_generic.py | 1534 | CODE | |
| LOW | …s/agent-context/scripts/python/update_agent_context.py | 45 | CODE | |
| LOW | …s/agent-context/scripts/python/update_agent_context.py | 141 | CODE | |
| LOW | …s/agent-context/scripts/python/update_agent_context.py | 259 | CODE | |
| LOW | …nsions/git/scripts/python/create_new_feature_branch.py | 90 | CODE | |
| LOW | …nsions/git/scripts/python/create_new_feature_branch.py | 427 | CODE | |
| LOW | extensions/git/scripts/python/auto_commit.py | 49 | CODE | |
| LOW | scripts/python/check_prerequisites.py | 70 | CODE | |
| LOW | scripts/python/common.py | 612 | CODE | |
| LOW | scripts/python/common.py | 619 | CODE | |
| LOW | scripts/python/create_new_feature.py | 114 | CODE | |
| LOW | scripts/python/create_new_feature.py | 266 | CODE | |
| LOW | .github/scripts/validate_community_workflow_step.py | 274 | CODE | |
| LOW | .github/scripts/validate_community_workflow_step.py | 346 | CODE | |
| LOW | .github/scripts/validate_community_workflow_step.py | 491 | CODE | |
| LOW | .github/scripts/validate_community_preset.py | 113 | CODE | |
| LOW | .github/scripts/validate_community_preset.py | 165 | CODE | |
| LOW | .github/scripts/validate_community_preset.py | 184 | CODE | |
| LOW | .github/scripts/validate_community_preset.py | 382 | CODE | |
| LOW | src/specify_cli/_console.py | 150 | CODE | |
| LOW | src/specify_cli/_console.py | 93 | CODE | |
| LOW | src/specify_cli/_console.py | 220 | CODE | |
| LOW | src/specify_cli/_toml_string.py | 36 | CODE | |
| LOW | src/specify_cli/_version.py | 480 | CODE | |
| LOW | src/specify_cli/_assets.py | 104 | CODE | |
| LOW | src/specify_cli/__init__.py | 216 | CODE | |
| LOW | src/specify_cli/agents.py | 669 | CODE | |
| LOW | src/specify_cli/agents.py | 1139 | CODE | |
| LOW | src/specify_cli/agents.py | 1293 | CODE | |
| LOW | src/specify_cli/agents.py | 1372 | CODE | |
| LOW | src/specify_cli/shared_infra.py | 243 | CODE | |
| LOW | src/specify_cli/shared_infra.py | 467 | CODE | |
| LOW | src/specify_cli/_download_security.py | 125 | CODE | |
| LOW | src/specify_cli/_download_security.py | 905 | CODE | |
| LOW | src/specify_cli/_download_security.py | 1070 | CODE | |
| LOW | src/specify_cli/command_init.py | 264 | CODE | |
| LOW | src/specify_cli/command_init.py | 269 | CODE | |
| LOW | src/specify_cli/integration_status.py | 130 | CODE | |
| LOW | src/specify_cli/_utils.py | 194 | CODE | |
| LOW | src/specify_cli/_utils.py | 204 | CODE | |
| LOW | src/specify_cli/artifacts/catalog.py | 475 | CODE | |
| LOW | src/specify_cli/artifacts/catalog.py | 580 | CODE | |
| LOW | src/specify_cli/artifacts/catalog.py | 844 | CODE | |
| LOW | src/specify_cli/artifacts/catalog.py | 1032 | CODE | |
| LOW | src/specify_cli/artifacts/resolution.py | 189 | CODE | |
| LOW | src/specify_cli/artifacts/resolution.py | 293 | CODE | |
| 155 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/test_check_prerequisites_python_parity.py | 605 | except Exception: # pragma: no cover - defensive cleanup | CODE |
| MEDIUM | tests/specify_cli/workflows/step/test_installer.py | 1045 | def _install(label, pkg, force): | CODE |
| LOW | tests/specify_cli/workflows/step/test_installer.py | 1050 | except Exception as exc: # noqa: BLE001 - recorded for assertions | CODE |
| MEDIUM | …ts/specify_cli/integrations/test_installed_adapters.py | 3569 | def load_second(): | CODE |
| LOW | …ts/specify_cli/integrations/test_installed_adapters.py | 3572 | except Exception as exc: | STRING |
| LOW | tests/unit/test_condition_expression_block.py | 774 | except Exception: | CODE |
| LOW | tests/integrations/test_integration_base_toml.py | 316 | except Exception as exc: | CODE |
| LOW | tests/integrations/test_integration_base_yaml.py | 152 | except Exception as exc: | CODE |
| LOW | …s/agent-context/scripts/python/update_agent_context.py | 83 | except Exception: | CODE |
| LOW | …s/agent-context/scripts/python/update_agent_context.py | 96 | except Exception: | CODE |
| LOW | …s/agent-context/scripts/python/update_agent_context.py | 152 | except Exception: | CODE |
| LOW | …s/agent-context/scripts/python/update_agent_context.py | 325 | except Exception as exc: | CODE |
| LOW | …ons/agent-context/scripts/bash/update-agent-context.sh | 86 | except Exception as exc: | CODE |
| LOW | …ons/agent-context/scripts/bash/update-agent-context.sh | 138 | except Exception: | CODE |
| LOW | …ons/agent-context/scripts/bash/update-agent-context.sh | 151 | except Exception: | CODE |
| LOW | …ons/agent-context/scripts/bash/update-agent-context.sh | 197 | except Exception: | CODE |
| LOW | …ons/agent-context/scripts/bash/update-agent-context.sh | 270 | except Exception: | CODE |
| LOW | scripts/python/common.py | 237 | except Exception: | CODE |
| MEDIUM | scripts/python/setup_plan.py | 70 | print(f"Error: {exc}", file=sys.stderr) | STRING |
| MEDIUM | scripts/python/create_new_feature.py | 134 | print(f"Error: {arg} requires a value", file=sys.stderr) | STRING |
| MEDIUM | scripts/python/create_new_feature.py | 364 | print("Error: feature number is too long for a branch name", file=sys.stderr) | CODE |
| MEDIUM | scripts/python/create_new_feature.py | 415 | print(f"Error: {exc}", file=sys.stderr) | CODE |
| LOW | scripts/bash/common.sh | 291 | except Exception: | CODE |
| LOW | scripts/bash/common.sh | 453 | except Exception as exc: | CODE |
| LOW | scripts/bash/common.sh | 559 | except Exception: | CODE |
| LOW | scripts/bash/common.sh | 678 | except Exception: | CODE |
| LOW | scripts/bash/common.sh | 760 | except Exception as exc: | CODE |
| LOW | src/specify_cli/_console.py | 90 | except Exception: | STRING |
| LOW | src/specify_cli/mcp_version.py | 130 | except Exception: | CODE |
| LOW | src/specify_cli/command_version.py | 84 | except Exception: # noqa: BLE001 | CODE |
| LOW | src/specify_cli/_assets.py | 108 | except Exception: | CODE |
| LOW | src/specify_cli/_assets.py | 117 | except Exception: | CODE |
| LOW | src/specify_cli/__init__.py | 237 | except Exception: | CODE |
| LOW | src/specify_cli/__init__.py | 254 | except Exception as e: | CODE |
| LOW | src/specify_cli/_download_security.py | 520 | except Exception as exc: | CODE |
| LOW | src/specify_cli/_download_security.py | 900 | except Exception as exc: | CODE |
| LOW | src/specify_cli/_download_security.py | 1060 | except Exception as exc: | CODE |
| LOW | src/specify_cli/_download_security.py | 1235 | except Exception as exc: | CODE |
| LOW | src/specify_cli/command_init.py | 254 | except Exception as e: | CODE |
| LOW | src/specify_cli/command_init.py | 822 | except Exception as wf_err: | CODE |
| LOW | src/specify_cli/command_init.py | 907 | except Exception as preset_err: | CODE |
| LOW | src/specify_cli/command_init.py | 943 | except Exception as ext_err: | CODE |
| LOW | src/specify_cli/command_init.py | 966 | except Exception as e: | CODE |
| LOW | src/specify_cli/_utils.py | 235 | except Exception: | CODE |
| LOW | src/specify_cli/artifacts/mcp_list.py | 330 | except Exception: | CODE |
| LOW | src/specify_cli/artifacts/mcp_list.py | 349 | except Exception as exc: | CODE |
| LOW | src/specify_cli/artifacts/mcp_list.py | 366 | except Exception as exc: | CODE |
| LOW | src/specify_cli/artifacts/mcp_info.py | 308 | except Exception: | CODE |
| LOW | src/specify_cli/artifacts/mcp_info.py | 326 | except Exception as exc: | CODE |
| LOW | src/specify_cli/artifacts/mcp_info.py | 343 | except Exception as exc: | CODE |
| LOW | src/specify_cli/workflows/command_resume.py | 115 | except Exception as exc: | CODE |
| LOW | src/specify_cli/workflows/expressions.py | 876 | except Exception: # noqa: BLE001 - probe values, not the author's text | CODE |
| LOW | src/specify_cli/workflows/expressions.py | 1428 | except Exception: # noqa: BLE001 - probe values, not the author's text | CODE |
| LOW | src/specify_cli/workflows/expressions.py | 1455 | except Exception: # noqa: BLE001 - probe values, reported by _evaluator_rejects | CODE |
| LOW | src/specify_cli/workflows/__init__.py | 229 | except Exception: # noqa: BLE001, S112 | CODE |
| LOW | src/specify_cli/workflows/_execution.py | 662 | except Exception: | CODE |
| LOW | src/specify_cli/workflows/engine.py | 778 | except Exception as exc: | CODE |
| LOW | src/specify_cli/workflows/engine.py | 1146 | except Exception as exc: | CODE |
| LOW | src/specify_cli/workflows/engine.py | 1260 | except Exception as exc: | CODE |
| LOW | src/specify_cli/workflows/command_add.py | 429 | except Exception as exc: | CODE |
| 84 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | spec-driven.md | 121 | COMMENT | |
| LOW | tests/test_workflows.py | 7981 | engine = WorkflowEngine(project_dir) | COMMENT |
| LOW | tests/integrations/test_extra_args.py | 481 | # SPECKIT_INTEGRATION_<KEY>_EXECUTABLE tests | COMMENT |
| LOW | extensions/template/extension.yml | 81 | description: "Demonstrates hook functionality" | COMMENT |
| LOW | extensions/template/config-template.yml | 61 | COMMENT | |
| LOW | extensions/github/scripts/bash/resolve-tasks.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | extensions/agent-context/agent-context-config.yml | 1 | # Coding Agent Context Extension Configuration | COMMENT |
| LOW | …ons/agent-context/scripts/bash/update-agent-context.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | extensions/git/git-config.yml | 1 | # Git Branching Workflow Extension Configuration | COMMENT |
| LOW | extensions/git/config-template.yml | 1 | # Git Branching Workflow Extension Configuration | COMMENT |
| LOW | extensions/git/scripts/bash/auto-commit.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | scripts/bash/common.sh | 21 | prev_dir="$dir" | COMMENT |
| LOW | scripts/bash/check-prerequisites.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | .github/security-audit-requirements.txt | 801 | # sse-starlette | COMMENT |
| LOW | .github/workflows/add-community-workflow-step.lock.yml | 1 | # gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"8afebb8429e0d385eb72f85e4ad601a08d7af8f6a1265c79a02d66f6cca | COMMENT |
| LOW | .github/workflows/add-community-workflow-step.lock.yml | 21 | # gh aw compile | COMMENT |
| LOW | .github/workflows/add-community-workflow-step.lock.yml | 41 | # - actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 | COMMENT |
| LOW | .github/workflows/add-community-workflow-step.lock.yml | 961 | run: bash "${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh" | COMMENT |
| LOW | .github/workflows/add-community-workflow-step.lock.yml | 981 | # --allow-tool shell(git status) | COMMENT |
| LOW | .github/workflows/add-community-extension.lock.yml | 1 | # gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"09fd527390aa8e7828202739810588856a8edfbca24ee945e387134bf1f | COMMENT |
| LOW | .github/workflows/add-community-extension.lock.yml | 21 | # gh aw compile | COMMENT |
| LOW | .github/workflows/add-community-extension.lock.yml | 41 | # - actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 | COMMENT |
| LOW | .github/workflows/add-community-extension.lock.yml | 961 | # --allow-tool safeoutputs | COMMENT |
| LOW | .github/workflows/feature-assess.lock.yml | 1 | # gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"6df6db7c7d409c16fdef601eba29916205c00c3d33284dd517c9e0367f9 | COMMENT |
| LOW | .github/workflows/feature-assess.lock.yml | 21 | # gh aw compile | COMMENT |
| LOW | .github/workflows/feature-assess.lock.yml | 41 | # - actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9) | COMMENT |
| LOW | .github/workflows/feature-assess.lock.yml | 921 | continue-on-error: true | COMMENT |
| LOW | .github/workflows/feature-assess.lock.yml | 941 | # --allow-tool shell(mkdir) | COMMENT |
| LOW | .github/workflows/add-community-bundle.lock.yml | 1 | # gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"8f2183d49bd078f40c1d155c981ab0d24de6fd6f594982ef9c34e29d3bf | COMMENT |
| LOW | .github/workflows/add-community-bundle.lock.yml | 21 | # gh aw compile | COMMENT |
| LOW | .github/workflows/add-community-bundle.lock.yml | 41 | # - actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 | COMMENT |
| LOW | .github/workflows/add-community-bundle.lock.yml | 961 | # --allow-tool safeoutputs | COMMENT |
| LOW | .github/workflows/bug-test.lock.yml | 1 | # gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"59e49bd028e10b6702fa004ac998eec66641a031cc6c633da41d5206593 | COMMENT |
| LOW | .github/workflows/bug-test.lock.yml | 21 | # gh aw compile | COMMENT |
| LOW | .github/workflows/bug-test.lock.yml | 41 | # - actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9) | COMMENT |
| LOW | .github/workflows/bug-test.lock.yml | 901 | # --allow-tool shell(awk) | COMMENT |
| LOW | .github/workflows/bug-test.lock.yml | 921 | # --allow-tool shell(pnpm:*) | COMMENT |
| LOW | .github/workflows/add-community-preset.lock.yml | 1 | # gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"b4af3f68becf88fb1763c4da846706cbedde768068083c3ad5b8dc5b7b1 | COMMENT |
| LOW | .github/workflows/add-community-preset.lock.yml | 21 | # gh aw compile | COMMENT |
| LOW | .github/workflows/add-community-preset.lock.yml | 41 | # - actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 | COMMENT |
| LOW | .github/workflows/add-community-preset.lock.yml | 961 | continue-on-error: true | COMMENT |
| LOW | .github/workflows/add-community-preset.lock.yml | 981 | # --allow-tool shell(git rm:*) | COMMENT |
| LOW | .github/workflows/bug-fix.lock.yml | 1 | # gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"f405777e1e6006722af689eeaa5be716ec394f77dcde4f00c403c316c5f | COMMENT |
| LOW | .github/workflows/bug-fix.lock.yml | 21 | # gh aw compile | COMMENT |
| LOW | .github/workflows/bug-fix.lock.yml | 41 | # - actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 | COMMENT |
| LOW | .github/workflows/bug-fix.lock.yml | 941 | id: agentic_execution | COMMENT |
| LOW | .github/workflows/bug-fix.lock.yml | 961 | # --allow-tool shell(grep) | COMMENT |
| LOW | .github/workflows/pr-assess.lock.yml | 1 | # gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"9027e52e8e4ccbef860ca13c6cdf97cf11ce578cb62084e39a7c42d3807 | COMMENT |
| LOW | .github/workflows/pr-assess.lock.yml | 21 | # gh aw compile | COMMENT |
| LOW | .github/workflows/pr-assess.lock.yml | 41 | # - actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | COMMENT |
| LOW | .github/workflows/bug-assess.lock.yml | 1 | # gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"a82cb49e1928917832e31a5d10f4db984d1be1a9006bd20dc7d4dfc45a4 | COMMENT |
| LOW | .github/workflows/bug-assess.lock.yml | 21 | # gh aw compile | COMMENT |
| LOW | .github/workflows/bug-assess.lock.yml | 41 | # - actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9) | COMMENT |
| LOW | .github/workflows/bug-assess.lock.yml | 881 | # Copilot CLI tool arguments (sorted): | COMMENT |
| LOW | .github/workflows/extension-version-guard.yml | 1 | name: Extension Version Guard | COMMENT |
| LOW | presets/scaffold/preset.yml | 21 | COMMENT | |
| LOW | presets/scaffold/preset.yml | 41 | # $CORE_SCRIPT placeholder (scripts), replaced with lower-priority content | COMMENT |
| LOW | presets/scaffold/preset.yml | 61 | # | COMMENT |
| LOW | src/specify_cli/__init__.py | 1 | #!/usr/bin/env python3 | COMMENT |
| LOW | src/specify_cli/agents.py | 721 | # Resolve the command-reference separator for the file THIS registrar | COMMENT |
| 78 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | README.md | 95 | [Command reference](https://github.github.io/spec-kit/reference/agentic-sdd.html) | CODE |
| MEDIUM | README.md | 123 | [Command reference](https://github.github.io/spec-kit/reference/agentic-bugfix.html) | CODE |
| MEDIUM | README.md | 156 | [Command reference](https://github.github.io/spec-kit/reference/agentic-assessment.html) | CODE |
| MEDIUM | README.md | 182 | - [CLI reference](https://github.github.io/spec-kit/reference/overview.html) and [process commands](https://github.githu | CODE |
| MEDIUM | README.ja.md | 77 | [コマンドリファレンス](https://github.github.io/spec-kit/reference/agentic-sdd.html) | CODE |
| MEDIUM | README.ja.md | 104 | [コマンドリファレンス](https://github.github.io/spec-kit/reference/agentic-bugfix.html) | CODE |
| MEDIUM | README.ja.md | 133 | [コマンドリファレンス](https://github.github.io/spec-kit/reference/agentic-assessment.html) | CODE |
| MEDIUM | README.ja.md | 157 | - [CLIリファレンス](https://github.github.io/spec-kit/reference/overview.html) と [プロセスコマンド](https://github.github.io/spec-kit/ | CODE |
| MEDIUM | CONTRIBUTING.md | 247 | 1. **Run focused automated checks first** — use the quick verification commands [below](#automated-checks) to catch scaf | CODE |
| MEDIUM | README.zh-CN.md | 96 | [命令参考](https://github.github.io/spec-kit/reference/agentic-sdd.html) | CODE |
| MEDIUM | README.zh-CN.md | 121 | [命令参考](https://github.github.io/spec-kit/reference/agentic-bugfix.html) | CODE |
| MEDIUM | README.zh-CN.md | 151 | [命令参考](https://github.github.io/spec-kit/reference/agentic-assessment.html) | CODE |
| MEDIUM | README.zh-CN.md | 177 | - [CLI 参考](https://github.github.io/spec-kit/reference/overview.html)与[流程命令](https://github.github.io/spec-kit/reference | CODE |
| MEDIUM | newsletters/2026-March.md | 75 | - **End-to-end workflow automation** -- an open issue (#1966) proposes a built-in pipeline command. The community-built | CODE |
| MEDIUM | newsletters/2026-May.md | 135 | - **Multi-agent workflows** — multi-install support (#2389) was the most-requested feature. The next frontier is orchest | CODE |
| MEDIUM | newsletters/2026-September.md | 58 | September's documentation leaned toward simplification and localization. The **README was simplified around the three co | CODE |
| MEDIUM | newsletters/2026-September.md | 83 | Additional coverage appeared on DEV Community (Ayush Bisht, Rost Glukhov's gstack, Dmitry Amelchenko, Manjush, Abhishek | CODE |
| MEDIUM | newsletters/2026-August.md | 17 | **v0.15.2–v0.16.5** (August 3–19) ran the month's patch cadence before the milestone. Feature work concentrated on **ins | CODE |
| MEDIUM | newsletters/2026-August.md | 90 | - **New2026** (Medium, August 19) — *"AI Coding Frameworks Explained,"* a five-layer "stack" mental model positioning Sp | CODE |
| MEDIUM | newsletters/2026-June.md | 21 | **v0.11.0–v0.11.10** (June 16–29) was the largest release cluster of the month and centered on **workflows** and the new | CODE |
| MEDIUM | newsletters/2026-June.md | 47 | Beyond converge and bundles, June was the month the **workflow engine grew up**. The **step catalog** (#2394) made steps | CODE |
| MEDIUM | newsletters/2026-July.md | 17 | **v0.12.3–v0.12.18** (July 1–17) was the month's longest patch run and carried two features amid heavy hardening. The ** | CODE |
| MEDIUM | newsletters/2026-July.md | 29 | The pipeline runs a staged flow — **capture → evidence → refine → design → decision** — that takes a raw idea, gathers s | CODE |
| MEDIUM | tests/test_extensions.py | 8992 | # .specify/extensions/<id>/<name>, so that is where scaffolding must | COMMENT |
| MEDIUM | tests/specify_cli/presets/test_manager_commands.py | 116 | # it must scaffold (as a native-skill SKILL.md for claude) and be | COMMENT |
| MEDIUM | tests/extensions/git/test_git_extension.py | 1283 | # Baseline-commit the scaffolding (and config) so the tree is | COMMENT |
| MEDIUM | tests/extensions/git/test_git_extension.py | 1285 | # the untracked scaffold files would mask whether the message file | COMMENT |
| MEDIUM | tests/extensions/git/test_git_extension.py | 1629 | # Baseline-commit the scaffolding (and config) so the tree is | COMMENT |
| MEDIUM | tests/extensions/git/test_git_extension.py | 1631 | # the untracked scaffold files would mask whether the message file | COMMENT |
| MEDIUM | tests/integrations/test_cli.py | 339 | # Aborted before scaffolding: the pre-existing file is untouched. | COMMENT |
| MEDIUM | docs/guides/agentic-sdlc.md | 46 | A star (★) marks agentic work: before prose paragraphs and after | CODE |
| MEDIUM | docs/guides/agentic-sdlc.md | 239 | ★ Beyond core feature delivery, agentic community-submission workflows for | CODE |
| MEDIUM | docs/guides/agentic-sdlc.md | 250 | ## How we went from SDLC to an agentic SDLC | COMMENT |
| MEDIUM | docs/guides/agentic-sdlc.md | 265 | | June 2026 | <ul><li>An <a href="https://github.com/github/spec-kit/pull/3023">agentic bug-assess workflow</a> was adde | CODE |
| MEDIUM | docs/guides/agentic-sdlc.md | 266 | | July 2026 | <ul><li><a href="https://github.com/github/spec-kit/pull/3258">Bug-fix</a> extended the agentic issue work | CODE |
| MEDIUM | docs/reference/integrations.md | 30 | | [IBM Bob](https://www.ibm.com/products/bob) | `bob` | Skills-based | CODE |
| MEDIUM | docs/reference/agentic-assessment.md | 92 | ## Handoff and guardrails | COMMENT |
| MEDIUM | scripts/python/common.py | 144 | # letting an orchestrator (multi-agent runner, CI matrix) guarantee that no | COMMENT |
| MEDIUM | scripts/bash/common.sh | 173 | # letting an orchestrator (multi-agent runner, CI matrix) guarantee that no | COMMENT |
| MEDIUM | presets/ARCHITECTURE.md | 160 | │ ├── README.md # Guide for customizing the scaffold | CODE |
| MEDIUM | src/specify_cli/agents.py | 725 | # skill scaffold ("/SKILL.md") uses the skills separator; any | COMMENT |
| MEDIUM | src/specify_cli/agents.py | 843 | # layout* this registrar writes — a "/SKILL.md" scaffold uses the skills | COMMENT |
| MEDIUM | src/specify_cli/extensions/__init__.py | 3463 | # Only scaffold what removal actually preserves. remove(keep_config) | COMMENT |
| MEDIUM | src/specify_cli/extensions/__init__.py | 3494 | # file or cannot be created, not raise out of scaffolding after | COMMENT |
| MEDIUM | src/specify_cli/integrations/command_scaffold.py | 36 | # scaffold targets the Spec Kit *source* repo layout (_is_spec_kit_repo_root), | COMMENT |
| MEDIUM | src/specify_cli/integrations/copilot/__init__.py | 177 | # Mutable flag set by setup() — indicates the active scaffolding mode. | COMMENT |
| MEDIUM | src/specify_cli/events/__init__.py | 670 | # uses for command scaffolding. | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/test_setup_tasks.py | 221 | # Create the override | COMMENT |
| MEDIUM | tests/test_extensions.py | 1829 | # Create a config file in the installed extension directory | COMMENT |
| MEDIUM | tests/test_extensions.py | 2826 | # Create a ZIP of the extension in a temp directory (not NamedTemporaryFile, | COMMENT |
| MEDIUM | tests/test_extensions.py | 3266 | # Create a config file | COMMENT |
| MEDIUM | tests/test_extension_skills.py | 3152 | # Create the skill directory without the SKILL.md file | COMMENT |
| MEDIUM | tests/test_extension_registration.py | 69 | # Create a mock manifest | COMMENT |
| MEDIUM | tests/test_extension_registration.py | 117 | # Create a manifest with hooks | COMMENT |
| MEDIUM | tests/test_extension_registration.py | 175 | # Create a corrupted config (root is a list) | COMMENT |
| MEDIUM | tests/test_extension_registration.py | 330 | # Create a manifest with a hook for the same event | COMMENT |
| MEDIUM | tests/specify_cli/workflows/test_command_run.py | 1004 | # Create a minimal workflow YAML with a shell step | COMMENT |
| MEDIUM | tests/specify_cli/workflows/step/test_command_remove.py | 265 | # Create an orphaned step directory (no registry entry) | COMMENT |
| MEDIUM | …s/specify_cli/workflows/overlay/test_command_remove.py | 124 | # Create a base workflow file that would be the traversal target. | COMMENT |
| MEDIUM⚡ | …sts/specify_cli/workflows/overlay/test_command_list.py | 175 | # Create a symlinked overlays directory pointing outside the project | COMMENT |
| MEDIUM⚡ | …sts/specify_cli/workflows/overlay/test_command_list.py | 189 | # Create a real overlay directory outside the project. | COMMENT |
| MEDIUM | tests/specify_cli/presets/test_manager_commands.py | 2731 | # Create a preset command dir with a wrap-strategy command | COMMENT |
| MEDIUM | tests/specify_cli/presets/test_manager.py | 1540 | # Create a gemini commands dir so reconciliation writes there | COMMENT |
| MEDIUM | tests/specify_cli/presets/test_resolver.py | 815 | # Create a template in the preset directory | COMMENT |
| MEDIUM | tests/specify_cli/events/test_events.py | 1172 | # Create a project venv so the plugin's runtime resolver prefers it. | COMMENT |
| MEDIUM | tests/specify_cli/events/test_events.py | 1376 | # Create a mock core command md file | COMMENT |
| MEDIUM | tests/specify_cli/events/test_events.py | 1648 | # Create a core command template whose script writes its payload. | COMMENT |
| MEDIUM | tests/specify_cli/events/test_events.py | 2483 | # Create a symlinked .claude directory pointing outside the project. | COMMENT |
| MEDIUM | tests/workflows/test_resolver_integration.py | 382 | # Create a real overlay directory outside the project with a malicious overlay. | COMMENT |
| MEDIUM | tests/extensions/git/test_git_extension.py | 1050 | # Create a file to commit | COMMENT |
| MEDIUM | tests/integrations/test_integration_bob.py | 661 | # Create a real legacy Bob project (renders shared templates). | COMMENT |
| MEDIUM | tests/integrations/test_integration_hermes.py | 179 | # Create a foreign skill in the global dir first | COMMENT |
| MEDIUM⚡ | tests/integrations/test_integration_forge.py | 405 | # Create a mock extension command file | COMMENT |
| MEDIUM⚡ | tests/integrations/test_integration_forge.py | 411 | # Create a test command with dot notation name | COMMENT |
| MEDIUM | tests/integrations/test_integration_forge.py | 456 | # Create a mock extension command file | COMMENT |
| MEDIUM | tests/integrations/test_integration_forge.py | 504 | # Create a mock extension command file | COMMENT |
| MEDIUM⚡ | tests/integrations/test_integration_opencode.py | 78 | # Create a source command file for the registrar | COMMENT |
| MEDIUM | tests/integrations/test_integration_opencode.py | 165 | # Create a source command file for the registrar | COMMENT |
| MEDIUM | src/specify_cli/extensions/__init__.py | 2898 | # Create the staging file with mode 0600 before writing so | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | src/specify_cli/extensions/__init__.py | 1092 | Collect command and alias names declared by a manifest. Performs install-time validation for extension-specific | STRING |
| HIGH | src/specify_cli/extensions/__init__.py | 2387 | Check if extension is compatible with current spec-kit version. Args: manifest: Extension manifest | STRING |
| HIGH | src/specify_cli/extensions/__init__.py | 2438 | Install extension from a local directory. Args: source_dir: Path to extension directory | STRING |
| HIGH | src/specify_cli/extensions/__init__.py | 3285 | Install an extension from a supported archive. Args: archive_path: Path to a .zip, .tar.gz, or .tgz | STRING |
| HIGH | src/specify_cli/extensions/__init__.py | 4703 | Fetch a single catalog with per-URL caching. For the DEFAULT_CATALOG_URL, uses legacy cache files (self.cache_f | STRING |
| HIGH | src/specify_cli/extensions/__init__.py | 4847 | Fetch and merge extensions from all active catalogs. Higher-priority (lower priority number) catalogs win on co | STRING |
| HIGH | src/specify_cli/extensions/__init__.py | 4946 | Fetch extension catalog from URL or cache. Args: force_refresh: If True, bypass cache and fetch fro | STRING |
| HIGH | src/specify_cli/extensions/__init__.py | 5142 | Download an extension archive from a catalog. Args: extension_id: ID of the extension to download | STRING |
| HIGH | src/specify_cli/extensions/_commands.py | 265 | Resolve an extension argument (ID or display name) to an installed extension. Args: argument: Extension ID | STRING |
| HIGH | src/specify_cli/integrations/cline/__init__.py | 23 | Convert command name to Cline-compatible hyphenated format. Cline handles slash-commands optimally when they use hy | STRING |
| HIGH | src/specify_cli/integrations/forge/__init__.py | 21 | Convert command name to Forge-compatible hyphenated format. Forge requires command names to use hyphens instead of | STRING |
| HIGH | src/specify_cli/integrations/junie/__init__.py | 21 | Convert command name to Junie-compatible hyphenated format. Junie does not allow dots inside of slash-commands. | STRING |
| HIGH | src/specify_cli/presets/_catalog.py | 243 | Load catalog stack configuration from a YAML file. Args: config_path: Path to preset-catalogs.yml | STRING |
| HIGH | src/specify_cli/presets/_catalog.py | 454 | Fetch a single catalog with per-URL caching. Args: entry: PresetCatalogEntry describing the catalog | STRING |
| HIGH | src/specify_cli/presets/_catalog.py | 647 | Fetch preset catalog from URL or cache. Args: force_refresh: If True, bypass cache and fetch from n | STRING |
| HIGH | src/specify_cli/presets/_catalog.py | 849 | Download an already-selected release without resolving its ID again. Args: pack_info: Metadata retu | STRING |
| HIGH | src/specify_cli/presets/_manager.py | 175 | Check if preset is compatible with current spec-kit version. Args: manifest: Preset manifest | STRING |
| HIGH | src/specify_cli/presets/_manager.py | 372 | Install preset from a local directory. Args: source_dir: Path to preset directory speck | STRING |
| HIGH | src/specify_cli/presets/_manager.py | 575 | Install a preset from a supported archive. Args: archive_path: Path to a .zip, .tar.gz, or .tgz arc | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | spec-driven.md | 123 | # Step 1: Create the feature specification (5 minutes) | COMMENT |
| LOW⚡ | spec-driven.md | 131 | # Step 2: Generate implementation plan (5 minutes) | COMMENT |
| LOW⚡ | spec-driven.md | 134 | # Step 3: Generate executable tasks (5 minutes) | COMMENT |
| LOW⚡ | tests/test_github_workflows.py | 1899 | source_text.split("## Step 3 - Compare Claims and Material Changes", 1)[1] | STRING |
| LOW⚡ | tests/test_github_workflows.py | 1904 | source_text.split("## Step 4 - Report and Apply the Outcome", 1)[1] | STRING |
| LOW | tests/test_github_workflows.py | 1994 | source_text.split("## Step 4 - Report and Apply the Outcome", 1)[1] | STRING |
| LOW | docs/install/air-gapped.md | 5 | ## Step 1: Build the wheel on a connected machine | COMMENT |
| LOW⚡ | docs/install/air-gapped.md | 22 | ## Step 2: Transfer the `dist/` directory | COMMENT |
| LOW⚡ | docs/install/air-gapped.md | 26 | ## Step 3: Install on the air-gapped machine | COMMENT |
| LOW⚡ | docs/install/air-gapped.md | 32 | ## Step 4: Initialize a project | COMMENT |
| LOW | extensions/EXTENSION-API-REFERENCE.md | 487 | ### Step 1: Description | COMMENT |
| LOW | extensions/EXTENSION-API-REFERENCE.md | 495 | ### Step 2: Another Step | COMMENT |
| LOW | extensions/selftest/commands/selftest.md | 16 | ### Step 1: Catalog Discovery Validation | COMMENT |
| LOW | extensions/selftest/commands/selftest.md | 25 | ### Step 2: Simulate Installation | COMMENT |
| LOW | extensions/selftest/commands/selftest.md | 40 | ### Step 3: Registration Verification | COMMENT |
| LOW | extensions/selftest/commands/selftest.md | 49 | ### Step 4: Verification Report | COMMENT |
| LOW⚡ | extensions/template/EXAMPLE-README.md | 116 | # Step 1: Create specification | COMMENT |
| LOW⚡ | extensions/template/EXAMPLE-README.md | 119 | # Step 2: Generate tasks | COMMENT |
| LOW⚡ | extensions/template/EXAMPLE-README.md | 122 | # Step 3: Use extension | COMMENT |
| LOW | extensions/template/commands/example.md | 32 | ### Step 1: Load Configuration | COMMENT |
| LOW | extensions/template/commands/example.md | 66 | ### Step 2: Perform Main Action | COMMENT |
| LOW | extensions/template/commands/example.md | 81 | ### Step 3: Process Results | COMMENT |
| LOW | extensions/template/commands/example.md | 97 | ### Step 4: Save Output (Optional) | COMMENT |
| LOW | .github/workflows/pr-assess.md | 66 | ## Step 1 - Handle the Item Type and State | COMMENT |
| LOW | .github/workflows/pr-assess.md | 89 | ## Step 2 - Read the Description and Complete PR Changes | COMMENT |
| LOW | .github/workflows/pr-assess.md | 118 | ## Step 3 - Compare Claims and Material Changes | COMMENT |
| LOW | .github/workflows/pr-assess.md | 156 | ## Step 4 - Report and Apply the Outcome | COMMENT |
| LOW | .github/workflows/add-community-bundle.md | 114 | ## Step 1 - Read and Parse the Issue | COMMENT |
| LOW | .github/workflows/add-community-bundle.md | 151 | ## Step 2 - Validate the Submission | COMMENT |
| LOW | .github/workflows/add-community-bundle.md | 326 | ## Step 3 - Determine Add or Update | COMMENT |
| LOW | .github/workflows/add-community-bundle.md | 337 | ## Step 4 - Update the Community Catalog | COMMENT |
| LOW | .github/workflows/add-community-bundle.md | 388 | ## Step 5 - Update Community Documentation | COMMENT |
| LOW | .github/workflows/add-community-bundle.md | 407 | ## Step 6 - Create a Draft Pull Request | COMMENT |
| LOW⚡ | src/specify_cli/extensions/__init__.py | 537 | # Step 1: apply any rename from the auto-correction pass. | COMMENT |
| LOW⚡ | src/specify_cli/extensions/__init__.py | 539 | # Step 2: lift alias-form '{ext_id}.cmd' to canonical 'speckit.{ext_id}.cmd'. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/test_extensions.py | 593 | # Set ext_id to match the legacy namespace so correction is valid | COMMENT |
| LOW | extensions/git/scripts/python/auto_commit.py | 152 | # Check if there are changes to commit | COMMENT |
| LOW | …tensions/git/scripts/bash/create-new-feature-branch.sh | 287 | # Check if git is available at this repo root | COMMENT |
| LOW | extensions/git/scripts/bash/git-common.sh | 6 | # Check if we have git available at the repo root | COMMENT |
| LOW | extensions/git/scripts/bash/auto-commit.sh | 75 | # Check if git is available | COMMENT |
| LOW | extensions/git/scripts/bash/auto-commit.sh | 166 | # Check if event section existed at all | COMMENT |
| LOW | extensions/git/scripts/bash/auto-commit.sh | 180 | # Check if there are changes to commit | COMMENT |
| LOW | extensions/git/scripts/bash/initialize-repo.sh | 37 | # Check if git is available | COMMENT |
| LOW | extensions/git/scripts/bash/initialize-repo.sh | 43 | # Check if already a git repo | COMMENT |
| LOW | scripts/bash/common.sh | 240 | # Check if jq is available for safe JSON construction | COMMENT |
| LOW | scripts/bash/common.sh | 847 | # Check if any layer uses a non-replace strategy | COMMENT |
| LOW | scripts/bash/setup-plan.sh | 67 | # Output results | COMMENT |
| LOW | scripts/bash/setup-tasks.sh | 62 | # Output results | COMMENT |
| LOW | scripts/bash/check-prerequisites.sh | 194 | # Output results | COMMENT |
| LOW | scripts/bash/create-new-feature.sh | 33 | # Check if the next argument is another option (starts with --) | COMMENT |
| LOW | src/specify_cli/workflows/step/command_info.py | 46 | # Check if it's a built-in | COMMENT |
| LOW | src/specify_cli/workflows/step/prompt/__init__.py | 220 | # Check if the CLI tool is actually installed. | COMMENT |
| LOW | src/specify_cli/workflows/step/command/__init__.py | 252 | # Check if the CLI tool is actually installed. | COMMENT |
| LOW | src/specify_cli/extensions/__init__.py | 1678 | # Check if skill already exists before creating the directory | COMMENT |
| LOW | src/specify_cli/extensions/__init__.py | 2468 | # Check if already installed | COMMENT |
| LOW | src/specify_cli/extensions/__init__.py | 3323 | # Check if manifest is in a subdirectory | COMMENT |
| LOW | src/specify_cli/extensions/command_add.py | 158 | # Check if extension exists in catalog (supports both ID and display name) | COMMENT |
| LOW | src/specify_cli/presets/command_disable.py | 22 | # Check if preset is installed | COMMENT |
| LOW | src/specify_cli/presets/command_set_priority.py | 26 | # Check if preset is installed | COMMENT |
| LOW | src/specify_cli/presets/command_enable.py | 22 | # Check if preset is installed | COMMENT |
| LOW | src/specify_cli/presets/command_info.py | 65 | # Check if installed locally first | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …s/extensions/test_update_agent_context_feature_json.py | 21 | def _setup_project(root: Path, context_file: str = "CLAUDE.md") -> None: | CODE |
| LOW | src/specify_cli/_console.py | 25 | logger = logging.getLogger(__name__) | CODE |
| LOW | src/specify_cli/bundler.py | 5 | __all__ = ["BundlerError"] | CODE |
| LOW | src/specify_cli/mcp_version.py | 15 | logger = logging.getLogger(__name__) | CODE |
| LOW | src/specify_cli/shared_infra.py | 18 | logger = logging.getLogger(__name__) | CODE |
| LOW | src/specify_cli/artifacts/models.py | 169 | __all__ = [ | CODE |
| LOW | src/specify_cli/artifacts/__init__.py | 21 | __all__ = [ | CODE |
| LOW | src/specify_cli/artifacts/mcp_list.py | 23 | logger = logging.getLogger(__name__) | CODE |
| LOW | src/specify_cli/artifacts/mcp_info.py | 29 | logger = logging.getLogger(__name__) | CODE |
| LOW | src/specify_cli/workflows/_commands.py | 395 | def set_mode(self, mode: int) -> None: | CODE |
| LOW | src/specify_cli/workflows/_commands.py | 1486 | def _set_workflow_enabled(workflow_id: str, enabled: bool) -> None: | CODE |
| LOW | src/specify_cli/workflows/step/_helpers.py | 21 | __all__ = [ | CODE |
| LOW | src/specify_cli/workflows/overlay/__init__.py | 39 | __all__ = ["WorkflowResolver"] | CODE |
| LOW | src/specify_cli/integrations/manifest.py | 303 | def set_ownership(self, rel_path: str | Path, mode: str) -> None: | CODE |
| LOW⚡ | src/specify_cli/integrations/_helpers.py | 358 | def _set_default_integration_or_exit(*args: Any, **kwargs: Any) -> None: | CODE |
| LOW | src/specify_cli/integrations/catalog/__init__.py | 22 | __all__ = [ | CODE |
| LOW | src/specify_cli/events/__init__.py | 38 | logger = logging.getLogger(__name__) | CODE |
| LOW | src/specify_cli/mcp_server/__init__.py | 5 | __all__ = ["create_server", "run_stdio_server"] | CODE |
| LOW | src/specify_cli/bundles/__init__.py | 11 | __all__ = ["BundlerError"] | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/specify_cli/workflows/test_command_add.py | 1290 | # assertion is robust to Rich line-wrapping at narrow terminal widths. | COMMENT |
| MEDIUM | tests/extensions/github/test_github_extension.py | 982 | # Read the raw value from a file so the harness itself needs no quoting. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | tests/specify_cli/bundles/test_primitives.py | 542 | archive.write_bytes(b"placeholder") | CODE |
| LOW⚡ | tests/specify_cli/bundles/test_primitives.py | 559 | archive.write_bytes(b"placeholder") | CODE |
| LOW | tests/specify_cli/bundles/test_primitives.py | 521 | archive.write_bytes(b"placeholder") | CODE |
| LOW | tests/specify_cli/bundles/test_primitives.py | 587 | archive.write_bytes(b"placeholder") | CODE |
| LOW | tests/specify_cli/bundles/test_primitives.py | 1036 | archive.write_bytes(b"placeholder") | CODE |
| LOW | tests/specify_cli/bundles/test_primitives.py | 1065 | archive.write_bytes(b"placeholder") | CODE |
| LOW | tests/specify_cli/bundles/test_primitives.py | 1113 | archive.write_bytes(b"placeholder") | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | extensions/template/EXAMPLE-README.md | 52 | api_key: "your-api-key" | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | src/specify_cli/extensions/__init__.py | 537 | # Step 1: apply any rename from the auto-correction pass. | COMMENT |
| LOW⚡ | src/specify_cli/extensions/__init__.py | 539 | # Step 2: lift alias-form '{ext_id}.cmd' to canonical 'speckit.{ext_id}.cmd'. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/specify_cli/authentication/test_github_http.py | 226 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/specify_cli/command_init.py | 269 | CODE | |
| LOW | src/specify_cli/extensions/__init__.py | 3271 | CODE | |
| LOW | src/specify_cli/extensions/__init__.py | 3505 | CODE |