Every API has a secret identity. This finds it, absorbs every feature from every competing tool, then builds the GOAT CLI — designed for AI agents first, with SQLite sync, offline search, and compound insight commands.
This report presents the forensic synthetic code analysis of mvanhorn/cli-printing-press, a Go project with 3,969 GitHub stars. SynthScan v2.0 examined 423,512 lines of code across 1404 source files, recording 990 pattern matches distributed across 15 syntactic categories. The overall adjusted score of 3.4 places this repository in the Likely human-written band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
Longitudinal tracking requires multiple scan runs. Once this repository is re-scanned after new commits land, this chart will visualise how the synthetic code signal evolves over time — enabling you to detect whether AI authorship is growing, stabilising, or being actively corrected by human engineers.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 990 distinct pattern matches across 15 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .mergify.yml | 1 | queue_rules: | COMMENT |
| LOW | .mergify.yml | 61 | # Evaluated against the speculative draft PR. Intentionally omitted: | COMMENT |
| LOW | .mergify.yml | 81 | # 2026-04-21 (removal 2026-07-01); the published migration path is | COMMENT |
| LOW | supported-versions.txt | 1 | # Currency floor for the printing-press generation skills. | COMMENT |
| LOW | cmd/manifest-gen/main.go | 1 | // manifest-gen downloads an OpenAPI/internal spec and generates a tools-manifest.json. | COMMENT |
| LOW | …n-loop-api/learn-loop-example/internal/learn/recall.go | 21 | ) | COMMENT |
| LOW | …n-loop-api/learn-loop-example/internal/learn/recall.go | 41 | // engine rather than read from search_learnings. | COMMENT |
| LOW | …n-loop-api/learn-loop-example/internal/learn/recall.go | 81 | // surfaces Notes). | COMMENT |
| LOW | …n-loop-api/learn-loop-example/internal/learn/recall.go | 101 | Results []Hit `json:"results"` | COMMENT |
| LOW | …n-loop-api/learn-loop-example/internal/learn/recall.go | 121 | // NoLearn short-circuits to an empty envelope. | COMMENT |
| LOW | …n-loop-api/learn-loop-example/internal/learn/recall.go | 141 | // fallback fires. Defaults to 0.3 (defaultCrossAliasJaccardMin) when | COMMENT |
| LOW | …n-loop-api/learn-loop-example/internal/learn/recall.go | 201 | } | COMMENT |
| LOW | …n-loop-api/learn-loop-example/internal/learn/recall.go | 361 | // Two fallback paths when literal non-entity Jaccard misses: | COMMENT |
| LOW | …n-loop-api/learn-loop-example/internal/learn/recall.go | 381 | // promotion to Exact happens downstream. | COMMENT |
| LOW | …n-loop-api/learn-loop-example/internal/learn/recall.go | 581 | for _, e := range unresolvedEntities { | COMMENT |
| LOW | …n-loop-api/learn-loop-example/internal/learn/recall.go | 621 | // Parse errors are logged-by-omission: keep Notes, | COMMENT |
| LOW | …-loop-api/learn-loop-example/internal/learn/journal.go | 61 | ) | COMMENT |
| LOW | …n-loop-api/learn-loop-example/internal/learn/derive.go | 21 | // sequence into an open flag_alias candidate. Derivation is read-only | COMMENT |
| LOW | …n-loop-api/learn-loop-example/internal/learn/derive.go | 61 | Example string `json:"example,omitempty"` | COMMENT |
| LOW | …n-loop-api/learn-loop-example/internal/learn/derive.go | 81 | // - when no suggestion was recorded, the correction is the one new | COMMENT |
| LOW | …op-api/learn-loop-example/internal/learn/synthesize.go | 21 | // playbook_candidate row in learn_candidates. Nothing here writes | COMMENT |
| LOW | …op-api/learn-loop-example/internal/learn/synthesize.go | 101 | notes []string | COMMENT |
| LOW | …op-api/learn-loop-example/internal/learn/synthesize.go | 221 | COMMENT | |
| LOW | …api/learn-loop-example/internal/learn/lookups/seeds.go | 21 | Canonical string | COMMENT |
| LOW | …pi/learn-loop-example/internal/learn/patterns/apply.go | 41 | Source string | COMMENT |
| LOW | …pi/learn-loop-example/internal/learn/patterns/apply.go | 61 | JaccardMin float64 | COMMENT |
| LOW | …/learn-loop-example/internal/learn/entities/extract.go | 1 | // Copyright 2026 printing-press-golden and contributors. Licensed under Apache-2.0. See LICENSE. | COMMENT |
| LOW | …/learn-loop-example/internal/learn/entities/extract.go | 21 | // downstream code can distinguish "user typed the literal id" from | COMMENT |
| LOW | …loop-api/learn-loop-example/internal/cli/learn_init.go | 1 | // Copyright 2026 printing-press-golden and contributors. Licensed under Apache-2.0. See LICENSE. | COMMENT |
| LOW | …earn-loop-api/learn-loop-example/internal/cli/teach.go | 1 | // Copyright 2026 printing-press-golden and contributors. Licensed under Apache-2.0. See LICENSE. | COMMENT |
| LOW | …earn-loop-api/learn-loop-example/internal/cli/teach.go | 301 | writeTeachErrLog(fmt.Sprintf("teach: playbook upsert: %v", pbErr)) | COMMENT |
| LOW | …earn-loop-api/learn-loop-example/internal/cli/teach.go | 361 | } | COMMENT |
| LOW | …earn-loop-example/internal/cli/learnings_candidates.go | 1 | // Copyright 2026 printing-press-golden and contributors. Licensed under Apache-2.0. See LICENSE. | COMMENT |
| LOW | …learn-loop-api/learn-loop-example/internal/cli/root.go | 81 | } | COMMENT |
| LOW | …learn-loop-api/learn-loop-example/internal/cli/root.go | 121 | return err | COMMENT |
| LOW | …learn-loop-api/learn-loop-example/internal/cli/root.go | 321 | // short-circuit for commandPath. | COMMENT |
| LOW | …rn-loop-api/learn-loop-example/internal/store/store.go | 41 | // the parent's typed domain table exists at the moment of the lookup. | COMMENT |
| LOW | …rn-loop-api/learn-loop-example/internal/store/store.go | 81 | } | COMMENT |
| LOW | …rn-loop-api/learn-loop-example/internal/store/store.go | 101 | // those keys silently, so the busy_timeout below is what keeps a read | COMMENT |
| LOW | …rn-loop-api/learn-loop-example/internal/store/store.go | 241 | COMMENT | |
| LOW | …rn-loop-api/learn-loop-example/internal/store/store.go | 301 | // backfillColumns adds columns that newer binaries declare but that | COMMENT |
| LOW | …rn-loop-api/learn-loop-example/internal/store/store.go | 381 | resourcesFTSCreateSQL, | COMMENT |
| LOW | …rn-loop-api/learn-loop-example/internal/store/store.go | 421 | canonical TEXT NOT NULL, | COMMENT |
| LOW | …rn-loop-api/learn-loop-example/internal/store/store.go | 461 | // keyed on the structural query family (all entities stripped; | COMMENT |
| LOW | …rn-loop-api/learn-loop-example/internal/store/store.go | 481 | confidence INTEGER NOT NULL DEFAULT 2, | COMMENT |
| LOW | …rn-loop-api/learn-loop-example/internal/store/store.go | 541 | // Run every migration — including the column backfill and the | COMMENT |
| LOW | …rn-loop-api/learn-loop-example/internal/store/store.go | 1261 | } | COMMENT |
| LOW | …rn-loop-api/learn-loop-example/internal/store/store.go | 1281 | // field and upsert on names — see #1394. | COMMENT |
| LOW | …rn-loop-api/learn-loop-example/internal/store/store.go | 1501 | // and the F4b stored_count_zero_after_extraction probe. | COMMENT |
| LOW | …n-loop-api/learn-loop-example/internal/store/events.go | 61 | // learnSurfaceEnvVar is the environment variable the MCP server sets | COMMENT |
| LOW | …n-loop-api/learn-loop-example/internal/store/events.go | 221 | // RecallHitRate = hits / (hits + misses). | COMMENT |
| LOW | …oop-api/learn-loop-example/internal/store/learnings.go | 361 | // Nil slice means "caller has nothing to say"; the column stays | COMMENT |
| LOW | …oop-api/learn-loop-example/internal/store/learnings.go | 681 | } | COMMENT |
| LOW | …oop-api/learn-loop-example/internal/store/learnings.go | 701 | type Applier interface { | COMMENT |
| LOW | …op-api/learn-loop-example/internal/store/candidates.go | 21 | // | COMMENT |
| LOW | …op-api/learn-loop-example/internal/store/candidates.go | 81 | } | COMMENT |
| LOW | …nids/fastapi-operationids-golden/internal/mcp/tools.go | 521 | return out | COMMENT |
| LOW | …api-operationids-golden/internal/cli/promoted_items.go | 41 | prov := attachFreshness(DataProvenance{Source: "live"}, flags) | COMMENT |
| LOW | …onids/fastapi-operationids-golden/internal/cli/root.go | 121 | // missing required, etc.) never flow through usageErr() because | COMMENT |
| LOW | …onids/fastapi-operationids-golden/internal/cli/root.go | 141 | // Patterns covered (Cobra v1.x + pflag v1.x as of 2026-05): | COMMENT |
| 456 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …ed/generate-learn-loop-api/learn-loop-example/SKILL.md | 187 | ### Step 2: decision tree | COMMENT |
| LOW | …ed/generate-learn-loop-api/learn-loop-example/SKILL.md | 238 | ### Step 3: always read `warnings` | COMMENT |
| LOW | …ed/generate-learn-loop-api/learn-loop-example/SKILL.md | 262 | ### Step 5: playbooks - optional flags, automatic synthesis | COMMENT |
| LOW | …ookie-auth/golden-api-cookie-auth/internal/cli/auth.go | 139 | // Step 0: Try press-auth, the dedicated cookie capture companion. | COMMENT |
| LOW | …ookie-auth/golden-api-cookie-auth/internal/cli/auth.go | 177 | // Step 1: Detect cookie extraction tool | COMMENT |
| LOW | …ookie-auth/golden-api-cookie-auth/internal/cli/auth.go | 200 | // Step 2: Resolve which Chrome profile to use when the backend can honor it | COMMENT |
| LOW | …ookie-auth/golden-api-cookie-auth/internal/cli/auth.go | 223 | // Step 3: Extract cookies from the resolved profile | COMMENT |
| LOW | …ookie-auth/golden-api-cookie-auth/internal/cli/auth.go | 256 | // Step 5: Save to config | COMMENT |
| LOW | …routing-api/tier-routing-golden/internal/cli/doctor.go | 259 | // Step 1: Basic reachability via the configured transport. | COMMENT |
| LOW | …routing-api/tier-routing-golden/internal/cli/doctor.go | 290 | // Step 2: Validate credentials with an authenticated probe. | COMMENT |
| LOW | …ted/generate-golden-api/printing-press-golden/SKILL.md | 197 | ### Step 2: decision tree | COMMENT |
| LOW | …ted/generate-golden-api/printing-press-golden/SKILL.md | 248 | ### Step 3: always read `warnings` | COMMENT |
| LOW | …ted/generate-golden-api/printing-press-golden/SKILL.md | 272 | ### Step 5: playbooks - optional flags, automatic synthesis | COMMENT |
| LOW | …olden-api/printing-press-golden/internal/cli/doctor.go | 237 | // Step 1: Basic reachability via the configured transport. | COMMENT |
| LOW | …olden-api/printing-press-golden/internal/cli/doctor.go | 268 | // Step 2: Validate credentials with an authenticated probe. | COMMENT |
| LOW | …golden-api-rich-auth/printing-press-rich-auth/SKILL.md | 171 | ### Step 2: decision tree | COMMENT |
| LOW | …golden-api-rich-auth/printing-press-rich-auth/SKILL.md | 222 | ### Step 3: always read `warnings` | COMMENT |
| LOW | …golden-api-rich-auth/printing-press-rich-auth/SKILL.md | 246 | ### Step 5: playbooks - optional flags, automatic synthesis | COMMENT |
| LOW | …h-auth/printing-press-rich-auth/internal/cli/doctor.go | 289 | // Step 1: Basic reachability via the configured transport. | COMMENT |
| LOW | …h-auth/printing-press-rich-auth/internal/cli/doctor.go | 320 | // Step 2: Validate credentials with an authenticated probe. | COMMENT |
| LOW | …device-code/printing-press-oauth2-device-code/SKILL.md | 173 | ### Step 2: decision tree | COMMENT |
| LOW | …device-code/printing-press-oauth2-device-code/SKILL.md | 224 | ### Step 3: always read `warnings` | COMMENT |
| LOW | …device-code/printing-press-oauth2-device-code/SKILL.md | 248 | ### Step 5: playbooks - optional flags, automatic synthesis | COMMENT |
| LOW | …nerate-public-param-names/public-param-golden/SKILL.md | 163 | ### Step 2: decision tree | COMMENT |
| LOW | …nerate-public-param-names/public-param-golden/SKILL.md | 214 | ### Step 3: always read `warnings` | COMMENT |
| LOW | …nerate-public-param-names/public-param-golden/SKILL.md | 238 | ### Step 5: playbooks - optional flags, automatic synthesis | COMMENT |
| LOW⚡ | internal/pipeline/research.go | 266 | // Step 3: Deduplicate by URL | COMMENT |
| LOW⚡ | internal/pipeline/research.go | 269 | // Step 4: Score novelty and produce recommendation | COMMENT |
| LOW⚡ | internal/pipeline/research.go | 273 | // Step 5: Analyze gaps and patterns | COMMENT |
| LOW | internal/pipeline/research.go | 324 | // Step 6: Write research.json | COMMENT |
| LOW⚡ | internal/pipeline/workflow_manifest_test.go | 57 | // Step 0: stores find_stores | COMMENT |
| LOW⚡ | internal/pipeline/workflow_manifest_test.go | 66 | // Step 1: menu get_menu | COMMENT |
| LOW⚡ | internal/pipeline/workflow_manifest_test.go | 73 | // Step 2: cart new | COMMENT |
| LOW⚡ | internal/pipeline/workflow_manifest_test.go | 80 | // Step 3: cart add ${item_code} | COMMENT |
| LOW⚡ | internal/pipeline/workflow_manifest_test.go | 85 | // Step 4: orders price_order | COMMENT |
| LOW⚡ | internal/pipeline/fullrun.go | 26 | // Step 1: Research | COMMENT |
| LOW⚡ | internal/pipeline/fullrun.go | 30 | // Step 2: Generate | COMMENT |
| LOW⚡ | internal/pipeline/fullrun.go | 38 | // Step 3: Coverage | COMMENT |
| LOW⚡ | internal/pipeline/fullrun.go | 45 | // Step 4: Dogfood | COMMENT |
| LOW⚡ | internal/pipeline/fullrun.go | 58 | // Step 5: Scorecard | COMMENT |
| LOW⚡ | internal/pipeline/fullrun.go | 62 | // Step 6: Learnings | COMMENT |
| LOW⚡ | internal/pipeline/fullrun.go | 138 | // Step 1: Research | COMMENT |
| LOW⚡ | internal/pipeline/fullrun.go | 146 | // Step 2: Generate | COMMENT |
| LOW⚡ | internal/pipeline/fullrun.go | 192 | // Step 3: Count commands and resources | COMMENT |
| LOW⚡ | internal/pipeline/fullrun.go | 197 | // Step 4: API Coverage estimate | COMMENT |
| LOW⚡ | internal/pipeline/fullrun.go | 204 | // Step 5: Dogfood | COMMENT |
| LOW⚡ | internal/pipeline/fullrun.go | 257 | // Step 6: Scorecard | COMMENT |
| LOW⚡ | internal/pipeline/fullrun.go | 265 | // Step 7: Fix Plans | COMMENT |
| LOW | internal/pipeline/contracts_test.go | 904 | step7 := strings.Index(skill, "## Step 7: Collision Detection & Resolution") | CODE |
| LOW⚡ | internal/pipeline/contracts_test.go | 1052 | validateStart := strings.Index(skill, "## Step 4: Validate") | CODE |
| LOW⚡ | internal/pipeline/contracts_test.go | 1054 | cloneStart := strings.Index(skill, "## Step 5: Managed Clone") | CODE |
| LOW | internal/pipeline/mcpsync/sync_test.go | 370 | // Step 1: generate the CLI with an initial spec (no key_url, not optional). | COMMENT |
| LOW⚡ | internal/pipeline/mcpsync/sync_test.go | 398 | // Step 2: simulate a generate-time provenance write. WriteManifestForGenerate | COMMENT |
| LOW⚡ | internal/pipeline/mcpsync/sync_test.go | 406 | // Step 3: edit spec.yaml with the new auth.key_url + auth.optional that | COMMENT |
| LOW⚡ | internal/pipeline/mcpsync/sync_test.go | 415 | // Step 4: run mcp-sync. It should pick up the new spec values and | COMMENT |
| LOW⚡ | internal/pipeline/mcpsync/sync_test.go | 421 | // Step 5: verify .printing-press.json now reflects the new spec. | COMMENT |
| LOW⚡ | internal/pipeline/mcpsync/sync_test.go | 429 | // Step 6: verify the MCPB manifest also reflects the new spec — this | COMMENT |
| LOW⚡ | internal/crowdsniff/aggregate.go | 183 | // Step 1: Convert :id, {user_id}, <id>, $id → {id} | COMMENT |
| LOW⚡ | internal/crowdsniff/aggregate.go | 184 | // Step 2: Replace UUIDs, numeric IDs, long hashes → {id}/{uuid}/{hash} | COMMENT |
| LOW⚡ | internal/crowdsniff/aggregate.go | 198 | // Step 1: Unify parameter syntax → {id} | COMMENT |
| 62 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | internal/cli/verify_skill_bundled.py | 682 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | internal/cli/verify_skill_bundled.py | 684 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | internal/cli/verify_skill_bundled.py | 129 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | internal/cli/verify_skill_bundled.py | 131 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | internal/cli/verify_skill_bundled.py | 1036 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | internal/cli/verify_skill_bundled.py | 1038 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | internal/cli/verify_skill_bundled.py | 1309 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | internal/cli/verify_skill_bundled.py | 1311 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | scripts/verify-skill/verify_skill.py | 682 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | scripts/verify-skill/verify_skill.py | 684 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/verify-skill/verify_skill.py | 129 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/verify-skill/verify_skill.py | 131 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/verify-skill/verify_skill.py | 1036 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/verify-skill/verify_skill.py | 1038 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/verify-skill/verify_skill.py | 1309 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/verify-skill/verify_skill.py | 1311 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | .github/scripts/verify-supply-chain/signals.py | 344 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | .github/scripts/verify-supply-chain/signals.py | 346 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | .github/scripts/verify-supply-chain/signals.py | 440 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | .github/scripts/verify-supply-chain/signals.py | 442 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/scripts/verify-supply-chain/signals.py | 37 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/scripts/verify-supply-chain/signals.py | 39 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/scripts/verify-supply-chain/signals.py | 63 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/scripts/verify-supply-chain/signals.py | 65 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/scripts/verify-supply-chain/signals.py | 83 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/scripts/verify-supply-chain/signals.py | 85 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/scripts/verify-supply-chain/signals.py | 286 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/scripts/verify-supply-chain/signals.py | 288 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/scripts/verify-supply-chain/signals.py | 390 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/scripts/verify-supply-chain/signals.py | 392 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/scripts/verify-supply-chain/signals.py | 487 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/scripts/verify-supply-chain/signals.py | 489 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/scripts/verify-supply-chain/scan.py | 33 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/scripts/verify-supply-chain/scan.py | 35 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | .github/scripts/verify-supply-chain/scan.py | 112 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | .github/scripts/verify-supply-chain/scan.py | 114 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | .github/scripts/verify-supply-chain/scan.py | 124 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | .github/scripts/verify-supply-chain/scan.py | 126 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/scripts/verify-supply-chain/scan.py | 144 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/scripts/verify-supply-chain/scan.py | 146 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | .github/scripts/verify-supply-chain/scan_test.py | 41 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | .github/scripts/verify-supply-chain/scan_test.py | 43 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/scripts/verify-supply-chain/scan_test.py | 302 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/scripts/verify-supply-chain/scan_test.py | 304 | # --------------------------------------------------------------------------- | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | testdata/golden/cases/generate-mcp-api/artifacts.txt | 3 | # (transport: [stdio, http], orchestration: code, endpoint_tools: hidden). | COMMENT |
| MEDIUM⚡ | testdata/golden/cases/generate-mcp-api/artifacts.txt | 13 | # Code-orchestration mode: tools.go must call RegisterCodeOrchestrationTools | COMMENT |
| MEDIUM⚡ | testdata/golden/cases/generate-mcp-api/artifacts.txt | 18 | # Code-orchestration tool bodies: tools.go calls RegisterCodeOrchestrationTools, | COMMENT |
| MEDIUM | internal/pipeline/dogfood_test.go | 3773 | // agentic review, not a hard gate. | COMMENT |
| MEDIUM | internal/pipeline/dogfood.go | 110 | // warning surfaced to Phase 4.85 (Wave B) for agentic review — trivial | COMMENT |
| MEDIUM | internal/pipeline/dogfood.go | 2848 | // surfaced to Wave B's Phase 4.85 agentic reviewer for deeper judgment. | COMMENT |
| MEDIUM | internal/pipeline/dogfood.go | 2850 | // tests; the agentic review is better at judging coverage quality. | COMMENT |
| MEDIUM | internal/pipeline/naming_rules.go | 23 | // schema-layer guardrails documented in their 2026-04-13 Wrangler CLI post: | COMMENT |
| MEDIUM | internal/pipeline/live_check.go | 95 | // downstream consumers (Phase 4.85's agentic output review in particular) | COMMENT |
| MEDIUM | internal/pipeline/live_check.go | 128 | // readable and agentic reviewers don't blow through their context window on | COMMENT |
| MEDIUM | internal/pipeline/live_check_test.go | 1232 | // Phase 4.85's agentic reviewer needs the captured stdout to judge | COMMENT |
| MEDIUM | internal/pipeline/live_check_test.go | 1277 | // scorecard JSON or overwhelm an agentic reviewer's context window. | COMMENT |
| MEDIUM | internal/pipeline/regenmerge/merge_into_fresh_test.go | 719 | // Novel command scaffold tests. Keep the wiring smoke test and add behavior cases as needed. | COMMENT |
| MEDIUM⚡ | internal/pipeline/regenmerge/merge_into_fresh_test.go | 734 | // cli-printing-press: novel-scaffold-test | COMMENT |
| MEDIUM⚡ | internal/pipeline/regenmerge/merge_into_fresh_test.go | 735 | // Novel command scaffold tests. Keep the wiring smoke test and add behavior cases as needed. | COMMENT |
| MEDIUM⚡ | internal/pipeline/regenmerge/merge_into_fresh_test.go | 745 | // scaffold with operator-authored tests, while the fresh file is the new | COMMENT |
| MEDIUM⚡ | internal/pipeline/regenmerge/merge_into_fresh_test.go | 746 | // marker-based editable scaffold. Once both sides are markerless novel files, | COMMENT |
| MEDIUM | internal/pipeline/regenmerge/merge_into_fresh_test.go | 767 | // Novel command scaffold. Implement the RunE body; generate --force preserves this file. | COMMENT |
| MEDIUM | internal/pipeline/regenmerge/merge_into_fresh_test.go | 791 | // Novel command scaffold. Implement the RunE body; generate --force preserves this file. | COMMENT |
| MEDIUM | internal/pipeline/regenmerge/merge_into_fresh_test.go | 837 | // Novel command scaffold. Implement the RunE body; generate --force preserves this file. | COMMENT |
| MEDIUM | internal/pipeline/regenmerge/merge_into_fresh_test.go | 859 | // Novel command scaffold. Implement the RunE body; generate --force preserves this file. | COMMENT |
| MEDIUM | internal/spec/spec.go | 1565 | // validateAuthCompanion enforces the small set of guardrails on the | COMMENT |
| MEDIUM | internal/spec/spec.go | 328 | Streaming StreamingConfig `yaml:"streaming,omitempty" json:"streaming"` // streaming-pri | CODE |
| MEDIUM | internal/generator/plan_generate.go | 84 | // will emit for user-declared plan commands after scaffold-owned names are | COMMENT |
| MEDIUM | internal/generator/plan_generate.go | 96 | // GenerateFromPlan creates a CLI scaffold from a parsed plan spec. | COMMENT |
| MEDIUM | internal/generator/plan_generate.go | 105 | // owner stays the slug for module path / Homebrew tap. The plan scaffold has | COMMENT |
| MEDIUM | internal/generator/plan_generate.go | 656 | // plan-scaffold func maps. | COMMENT |
| MEDIUM | internal/generator/learn_emission_test.go | 74 | // U9: internal/cli/playbooks/ ships the embed.FS scaffold for | COMMENT |
| MEDIUM | internal/generator/learn_emission_test.go | 122 | // U9: cli/playbooks/ embed.FS scaffold is gated off too. | COMMENT |
| MEDIUM | internal/generator/generator.go | 2709 | // internal/cli/playbooks/ ships the embed.FS scaffold for hand- | COMMENT |
| MEDIUM | internal/generator/generator.go | 2711 | // scaffold only — the auto-install path that walks this FS lives | COMMENT |
| MEDIUM | docs/PIPELINE.md | 93 | ### 3. scaffold | COMMENT |
| MEDIUM | …ors/auth-none-dead-code-in-config-client-2026-05-08.md | 26 | # No-auth specs emitted dead token scaffolding in config.go and client.go | COMMENT |
| MEDIUM | …ors/auth-none-dead-code-in-config-client-2026-05-08.md | 50 | The predicate's doc comment names the central auth-emission gate. Before PR #704, `auth.go`, `root.go`, and `scoreAuth` | CODE |
| MEDIUM | …delity-flag-decl-regex-and-mark-required-2026-05-22.md | 67 | - Related to #1561 — same pattern of scorer substring greps drifting from the SKILL's sanctioned scaffolding (different | CODE |
| MEDIUM | docs/retros/2026-04-08-linear-retro.md | 47 | ### 3. GraphQL sync command must be hand-written (Missing scaffolding) | COMMENT |
| MEDIUM | docs/retros/2026-04-11-movie-goat-retro.md | 103 | ### F8. No multi-API enrichment scaffolding (missing scaffolding) | COMMENT |
| MEDIUM | docs/retros/2026-04-05-cal-com-retro.md | 79 | ### 6. Verify Cannot Test Data-Layer-Dependent Commands (Missing scaffolding) | COMMENT |
| MEDIUM | docs/retros/2026-03-30-postman-explore-retro.md | 66 | ### 5. Entity-Specific Store Methods Not Generated (missing scaffolding) | COMMENT |
| MEDIUM | docs/retros/2026-04-03-postman-explore-run2-retro.md | 115 | ### 8. Store migration doesn't create entity-specific tables for sniffed specs (Missing scaffolding) | COMMENT |
| MEDIUM | docs/retros/2026-04-23-producthunt-retro.md | 55 | **Root cause #3:** Phase 4.8's agentic SKILL review has a prompt contract that covers **trigger phrases, novel-feature d | CODE |
| MEDIUM | docs/retros/2026-03-30-steam-retro.md | 29 | ### 2. Crowd-sniff doesn't detect auth patterns from SDK code (missing scaffolding) | COMMENT |
| MEDIUM | docs/retros/2026-03-30-steam-retro.md | 72 | ### 5. Crowd-sniff misses params for endpoints not in popular SDKs (missing scaffolding) | COMMENT |
| MEDIUM | skills/printing-press/SKILL.md | 228 | # (go mod tidy, go vet, etc.) after writing thousands of lines of scaffolding, | COMMENT |
| MEDIUM | skills/printing-press/SKILL.md | 4057 | ### Why agentic vs template-only | COMMENT |
| MEDIUM | skills/printing-press/SKILL.md | 4540 | **Pick the promote path by whether the library already holds hand-authored content.** `lock promote --dir` performs an * | CODE |
| MEDIUM | skills/printing-press-output-review/SKILL.md | 136 | ## Why agentic vs template-only | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …d/generate-learn-loop-api/learn-loop-example/README.md | 135 | learn-loop-example-pp-cli auth set-token YOUR_TOKEN_HERE | CODE |
| HIGH | …ed/generate-learn-loop-api/learn-loop-example/SKILL.md | 75 | learn-loop-example-pp-cli auth set-token YOUR_TOKEN_HERE | CODE |
| HIGH | …-cc/printing-press-oauth2-cc/internal/client/client.go | 857 | if !strings.Contains(header, "<") && !strings.Contains(header, "YOUR_TOKEN_HERE") && !strings.Contains(header, "your-to | CODE |
| HIGH | …-cc/printing-press-oauth2-cc/internal/client/client.go | 880 | case "<your-token>", "<your-key>", "<paste-your-key>", "YOUR_TOKEN_HERE", "your-token-here": | CODE |
| HIGH | …inting-press-oauth2-authcode/internal/client/client.go | 829 | if !strings.Contains(header, "<") && !strings.Contains(header, "YOUR_TOKEN_HERE") && !strings.Contains(header, "your-to | CODE |
| HIGH | …inting-press-oauth2-authcode/internal/client/client.go | 852 | case "<your-token>", "<your-key>", "<paste-your-key>", "YOUR_TOKEN_HERE", "your-token-here": | CODE |
| HIGH | …te-learn-disabled-api/learn-disabled-example/README.md | 132 | learn-disabled-example-pp-cli auth set-token YOUR_TOKEN_HERE | CODE |
| HIGH | …ate-learn-disabled-api/learn-disabled-example/SKILL.md | 68 | learn-disabled-example-pp-cli auth set-token YOUR_TOKEN_HERE | CODE |
| HIGH | …-auth/golden-api-cookie-auth/internal/client/client.go | 816 | if !strings.Contains(header, "<") && !strings.Contains(header, "YOUR_TOKEN_HERE") && !strings.Contains(header, "your-to | CODE |
| HIGH | …-auth/golden-api-cookie-auth/internal/client/client.go | 839 | case "<your-token>", "<your-key>", "<paste-your-key>", "YOUR_TOKEN_HERE", "your-token-here": | CODE |
| HIGH | …ting-api/tier-routing-golden/internal/client/client.go | 922 | if !strings.Contains(header, "<") && !strings.Contains(header, "YOUR_TOKEN_HERE") && !strings.Contains(header, "your-to | CODE |
| HIGH | …ting-api/tier-routing-golden/internal/client/client.go | 945 | case "<your-token>", "<your-key>", "<paste-your-key>", "YOUR_TOKEN_HERE", "your-token-here": | CODE |
| HIGH | …-golden-api/printing-press-golden/internal/cli/auth.go | 110 | Example: " printing-press-golden-pp-cli auth set-token YOUR_TOKEN_HERE", | CODE |
| HIGH | …en-api/printing-press-golden/internal/client/client.go | 903 | if !strings.Contains(header, "<") && !strings.Contains(header, "YOUR_TOKEN_HERE") && !strings.Contains(header, "your-to | CODE |
| HIGH | …en-api/printing-press-golden/internal/client/client.go | 926 | case "<your-token>", "<your-key>", "<paste-your-key>", "YOUR_TOKEN_HERE", "your-token-here": | CODE |
| HIGH | …ich-auth/printing-press-rich-auth/internal/cli/auth.go | 120 | Example: " printing-press-rich-pp-cli auth set-token YOUR_TOKEN_HERE", | CODE |
| HIGH | …ing-press-oauth2-device-code/internal/client/client.go | 829 | if !strings.Contains(header, "<") && !strings.Contains(header, "YOUR_TOKEN_HERE") && !strings.Contains(header, "your-to | CODE |
| HIGH | …ing-press-oauth2-device-code/internal/client/client.go | 852 | case "<your-token>", "<your-key>", "<paste-your-key>", "YOUR_TOKEN_HERE", "your-token-here": | CODE |
| HIGH | internal/narrativecheck/narrativecheck_test.go | 540 | "stub auth set-token YOUR_TOKEN_HERE", | CODE |
| HIGH | internal/narrativecheck/narrativecheck_test.go | 542 | Result{Section: SectionQuickstart, Command: "stub auth set-token YOUR_TOKEN_HERE", Words: "auth set-token YOUR_TOKEN_H | CODE |
| HIGH | internal/generator/placeholder_auth_test.go | 44 | for _, token := range []string{"<PAT>", "<your-token>", "YOUR_TOKEN_HERE"} { | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …ookie-auth/golden-api-cookie-auth/internal/cli/auth.go | 139 | // Step 0: Try press-auth, the dedicated cookie capture companion. | COMMENT |
| LOW | …ookie-auth/golden-api-cookie-auth/internal/cli/auth.go | 177 | // Step 1: Detect cookie extraction tool | COMMENT |
| LOW | …ookie-auth/golden-api-cookie-auth/internal/cli/auth.go | 200 | // Step 2: Resolve which Chrome profile to use when the backend can honor it | COMMENT |
| LOW | …ookie-auth/golden-api-cookie-auth/internal/cli/auth.go | 223 | // Step 3: Extract cookies from the resolved profile | COMMENT |
| LOW | …ookie-auth/golden-api-cookie-auth/internal/cli/auth.go | 256 | // Step 5: Save to config | COMMENT |
| LOW | …routing-api/tier-routing-golden/internal/cli/doctor.go | 259 | // Step 1: Basic reachability via the configured transport. | COMMENT |
| LOW | …routing-api/tier-routing-golden/internal/cli/doctor.go | 290 | // Step 2: Validate credentials with an authenticated probe. | COMMENT |
| LOW | …olden-api/printing-press-golden/internal/cli/doctor.go | 237 | // Step 1: Basic reachability via the configured transport. | COMMENT |
| LOW | …olden-api/printing-press-golden/internal/cli/doctor.go | 268 | // Step 2: Validate credentials with an authenticated probe. | COMMENT |
| LOW | …h-auth/printing-press-rich-auth/internal/cli/doctor.go | 289 | // Step 1: Basic reachability via the configured transport. | COMMENT |
| LOW | …h-auth/printing-press-rich-auth/internal/cli/doctor.go | 320 | // Step 2: Validate credentials with an authenticated probe. | COMMENT |
| LOW⚡ | internal/pipeline/research.go | 266 | // Step 3: Deduplicate by URL | COMMENT |
| LOW⚡ | internal/pipeline/research.go | 269 | // Step 4: Score novelty and produce recommendation | COMMENT |
| LOW⚡ | internal/pipeline/research.go | 273 | // Step 5: Analyze gaps and patterns | COMMENT |
| LOW | internal/pipeline/research.go | 324 | // Step 6: Write research.json | COMMENT |
| LOW⚡ | internal/pipeline/workflow_manifest_test.go | 57 | // Step 0: stores find_stores | COMMENT |
| LOW⚡ | internal/pipeline/workflow_manifest_test.go | 66 | // Step 1: menu get_menu | COMMENT |
| LOW⚡ | internal/pipeline/workflow_manifest_test.go | 73 | // Step 2: cart new | COMMENT |
| LOW⚡ | internal/pipeline/workflow_manifest_test.go | 80 | // Step 3: cart add ${item_code} | COMMENT |
| LOW⚡ | internal/pipeline/workflow_manifest_test.go | 85 | // Step 4: orders price_order | COMMENT |
| LOW⚡ | internal/pipeline/fullrun.go | 26 | // Step 1: Research | COMMENT |
| LOW⚡ | internal/pipeline/fullrun.go | 30 | // Step 2: Generate | COMMENT |
| LOW⚡ | internal/pipeline/fullrun.go | 38 | // Step 3: Coverage | COMMENT |
| LOW⚡ | internal/pipeline/fullrun.go | 45 | // Step 4: Dogfood | COMMENT |
| LOW⚡ | internal/pipeline/fullrun.go | 58 | // Step 5: Scorecard | COMMENT |
| LOW⚡ | internal/pipeline/fullrun.go | 62 | // Step 6: Learnings | COMMENT |
| LOW⚡ | internal/pipeline/fullrun.go | 138 | // Step 1: Research | COMMENT |
| LOW⚡ | internal/pipeline/fullrun.go | 146 | // Step 2: Generate | COMMENT |
| LOW⚡ | internal/pipeline/fullrun.go | 192 | // Step 3: Count commands and resources | COMMENT |
| LOW⚡ | internal/pipeline/fullrun.go | 197 | // Step 4: API Coverage estimate | COMMENT |
| LOW⚡ | internal/pipeline/fullrun.go | 204 | // Step 5: Dogfood | COMMENT |
| LOW⚡ | internal/pipeline/fullrun.go | 257 | // Step 6: Scorecard | COMMENT |
| LOW⚡ | internal/pipeline/fullrun.go | 265 | // Step 7: Fix Plans | COMMENT |
| LOW | internal/pipeline/contracts_test.go | 904 | step7 := strings.Index(skill, "## Step 7: Collision Detection & Resolution") | CODE |
| LOW⚡ | internal/pipeline/contracts_test.go | 1052 | validateStart := strings.Index(skill, "## Step 4: Validate") | CODE |
| LOW⚡ | internal/pipeline/contracts_test.go | 1054 | cloneStart := strings.Index(skill, "## Step 5: Managed Clone") | CODE |
| LOW | internal/pipeline/mcpsync/sync_test.go | 370 | // Step 1: generate the CLI with an initial spec (no key_url, not optional). | COMMENT |
| LOW⚡ | internal/pipeline/mcpsync/sync_test.go | 398 | // Step 2: simulate a generate-time provenance write. WriteManifestForGenerate | COMMENT |
| LOW⚡ | internal/pipeline/mcpsync/sync_test.go | 406 | // Step 3: edit spec.yaml with the new auth.key_url + auth.optional that | COMMENT |
| LOW⚡ | internal/pipeline/mcpsync/sync_test.go | 415 | // Step 4: run mcp-sync. It should pick up the new spec values and | COMMENT |
| LOW⚡ | internal/pipeline/mcpsync/sync_test.go | 421 | // Step 5: verify .printing-press.json now reflects the new spec. | COMMENT |
| LOW⚡ | internal/pipeline/mcpsync/sync_test.go | 429 | // Step 6: verify the MCPB manifest also reflects the new spec — this | COMMENT |
| LOW⚡ | internal/crowdsniff/aggregate.go | 183 | // Step 1: Convert :id, {user_id}, <id>, $id → {id} | COMMENT |
| LOW⚡ | internal/crowdsniff/aggregate.go | 184 | // Step 2: Replace UUIDs, numeric IDs, long hashes → {id}/{uuid}/{hash} | COMMENT |
| LOW⚡ | internal/crowdsniff/aggregate.go | 198 | // Step 1: Unify parameter syntax → {id} | COMMENT |
| LOW⚡ | internal/crowdsniff/aggregate.go | 208 | // Step 2: Replace concrete values | COMMENT |
| LOW⚡ | internal/crowdsniff/npm.go | 119 | // Step 1: Search the registry. | COMMENT |
| LOW⚡ | internal/crowdsniff/npm.go | 129 | // Step 2: Filter by recency. | COMMENT |
| LOW⚡ | internal/crowdsniff/npm.go | 141 | // Step 3: Take top N packages. | COMMENT |
| LOW⚡ | internal/crowdsniff/npm.go | 146 | // Step 4: Fetch download counts (non-fatal). | COMMENT |
| LOW⚡ | internal/crowdsniff/npm.go | 149 | // Step 5: Process each package. | COMMENT |
| LOW | internal/cli/emboss.go | 137 | // Step 1: AUDIT - baseline | COMMENT |
| LOW | internal/llmpolish/polish.go | 46 | // Step 1: Improve help texts | COMMENT |
| LOW | internal/llmpolish/polish.go | 66 | // Step 2: Add examples | COMMENT |
| LOW | internal/llmpolish/polish.go | 86 | // Step 3: Rewrite README | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | internal/cli/verify_skill_bundled.py | 687 | def _cli_invocation_from_tokens( | CODE |
| LOW | internal/cli/verify_skill_bundled.py | 242 | def collect_command_constructors(cli_dir: Path) -> dict[str, CommandConstructor]: | CODE |
| LOW | internal/cli/verify_skill_bundled.py | 402 | def _legacy_find_command_source(cli_dir: Path, cmd_path: list[str]): | CODE |
| LOW | internal/cli/verify_skill_bundled.py | 768 | def _split_before_shell_operator(line: str) -> str: | CODE |
| LOW | internal/cli/verify_skill_bundled.py | 816 | def _strip_trailing_shell_comment(line: str) -> str: | CODE |
| LOW | internal/cli/verify_skill_bundled.py | 858 | def _shell_operator_cut_index(line: str, operator_index: int) -> int: | CODE |
| LOW | internal/cli/verify_skill_bundled.py | 869 | def _extract_prose_invocations( | CODE |
| LOW | internal/cli/verify_skill_bundled.py | 992 | def _bash_blocks_with_line_numbers(text: str) -> Iterable[tuple[int, str]]: | CODE |
| LOW | internal/cli/verify_skill_bundled.py | 998 | def _unquoted_shell_variables(line: str) -> list[str]: | CODE |
| LOW⚡ | scripts/verify-skill/test_resolve_command_path.py | 49 | def test_braces_inside_string(self): | CODE |
| LOW⚡ | scripts/verify-skill/test_resolve_command_path.py | 54 | def test_braces_inside_raw_string(self): | CODE |
| LOW⚡ | scripts/verify-skill/test_resolve_command_path.py | 59 | def test_braces_inside_line_comment(self): | CODE |
| LOW⚡ | scripts/verify-skill/test_resolve_command_path.py | 64 | def test_braces_inside_block_comment(self): | CODE |
| LOW⚡ | scripts/verify-skill/test_resolve_command_path.py | 69 | def test_unclosed_returns_none(self): | CODE |
| LOW⚡ | scripts/verify-skill/test_resolve_command_path.py | 76 | def test_resolves_top_level_when_leaf_collides_with_subcommand(self): | CODE |
| LOW | scripts/verify-skill/test_resolve_command_path.py | 119 | def test_constructor_collection(self): | STRING |
| LOW | scripts/verify-skill/test_resolve_command_path.py | 144 | def test_root_children_discovery(self): | STRING |
| LOW | scripts/verify-skill/test_resolve_command_path.py | 167 | def test_unresolvable_path_returns_none(self): | STRING |
| LOW | scripts/verify-skill/test_resolve_command_path.py | 187 | def test_constructor_with_func_typed_param(self): | STRING |
| LOW | scripts/verify-skill/test_resolve_command_path.py | 209 | def test_collect_command_constructors_is_cached(self): | STRING |
| LOW | scripts/verify-skill/test_resolve_command_path.py | 227 | def test_legacy_fallback_when_no_root_addcommand(self): | STRING |
| LOW | scripts/verify-skill/test_resolve_command_path.py | 248 | def test_alias_receiver_flags_are_recognized(self): | STRING |
| LOW | scripts/verify-skill/test_resolve_command_path.py | 285 | def test_missing_limit_flag_is_reported(self): | STRING |
| LOW | scripts/verify-skill/test_resolve_command_path.py | 339 | def test_optional_positionals_are_bound_before_sibling_resolution(self): | STRING |
| LOW | scripts/verify-skill/test_resolve_command_path.py | 385 | def test_trailing_quote_is_stripped_from_flag_token(self): | STRING |
| LOW | scripts/verify-skill/test_resolve_command_path.py | 400 | def test_space_separated_long_flag_value_is_not_positional(self): | STRING |
| LOW | scripts/verify-skill/test_resolve_command_path.py | 410 | def test_boolean_long_flag_does_not_swallow_following_positional(self): | STRING |
| LOW | scripts/verify-skill/test_resolve_command_path.py | 500 | def test_single_quoted_command_strips_trailing_quote(self): | STRING |
| LOW | scripts/verify-skill/test_resolve_command_path.py | 513 | def test_double_quoted_command_strips_trailing_quote(self): | STRING |
| LOW | scripts/verify-skill/test_resolve_command_path.py | 530 | def test_undeclared_flag_in_prose_still_extracted(self): | STRING |
| LOW⚡ | scripts/verify-skill/verify_skill.py | 687 | def _cli_invocation_from_tokens( | CODE |
| LOW | scripts/verify-skill/verify_skill.py | 242 | def collect_command_constructors(cli_dir: Path) -> dict[str, CommandConstructor]: | CODE |
| LOW | scripts/verify-skill/verify_skill.py | 402 | def _legacy_find_command_source(cli_dir: Path, cmd_path: list[str]): | CODE |
| LOW | scripts/verify-skill/verify_skill.py | 768 | def _split_before_shell_operator(line: str) -> str: | CODE |
| LOW | scripts/verify-skill/verify_skill.py | 816 | def _strip_trailing_shell_comment(line: str) -> str: | CODE |
| LOW | scripts/verify-skill/verify_skill.py | 858 | def _shell_operator_cut_index(line: str, operator_index: int) -> int: | CODE |
| LOW | scripts/verify-skill/verify_skill.py | 869 | def _extract_prose_invocations( | CODE |
| LOW | scripts/verify-skill/verify_skill.py | 992 | def _bash_blocks_with_line_numbers(text: str) -> Iterable[tuple[int, str]]: | CODE |
| LOW | scripts/verify-skill/verify_skill.py | 998 | def _unquoted_shell_variables(line: str) -> list[str]: | CODE |
| LOW⚡ | .github/scripts/verify-supply-chain/signals.py | 349 | def signal_id_token_outside_allowlist(change: FileChange) -> list[Finding]: | CODE |
| LOW⚡ | .github/scripts/verify-supply-chain/signals.py | 445 | def signal_setup_go_uses_go_version_file(change: FileChange) -> list[Finding]: | CODE |
| LOW | .github/scripts/verify-supply-chain/signals.py | 203 | def _permissions_grant_id_token(perm: Any) -> bool: | CODE |
| LOW | .github/scripts/verify-supply-chain/signals.py | 237 | def _walk_setup_go_version_literals(parsed: Any) -> list[str]: | CODE |
| LOW⚡ | .github/scripts/verify-supply-chain/scan_test.py | 47 | def test_pull_request_target_with_head_sha_ref_blocks(self) -> None: | CODE |
| LOW⚡ | .github/scripts/verify-supply-chain/scan_test.py | 91 | def test_plain_pull_request_with_head_ref_does_not_block(self) -> None: | CODE |
| LOW⚡ | .github/scripts/verify-supply-chain/scan_test.py | 96 | def test_flow_sequence_trigger_blocks(self) -> None: | CODE |
| LOW⚡ | .github/scripts/verify-supply-chain/scan_test.py | 103 | def test_preexisting_dangerous_ref_unchanged_does_not_fire(self) -> None: | CODE |
| LOW⚡ | .github/scripts/verify-supply-chain/scan_test.py | 110 | def test_block_scalar_folded_ref_blocks(self) -> None: | CODE |
| LOW⚡ | .github/scripts/verify-supply-chain/scan_test.py | 168 | def test_id_token_in_any_workflow_blocks(self) -> None: | CODE |
| LOW⚡ | .github/scripts/verify-supply-chain/scan_test.py | 178 | def test_no_id_token_does_not_block(self) -> None: | CODE |
| LOW⚡ | .github/scripts/verify-supply-chain/scan_test.py | 185 | def test_preexisting_id_token_unchanged_does_not_fire(self) -> None: | CODE |
| LOW⚡ | .github/scripts/verify-supply-chain/scan_test.py | 193 | def test_id_token_with_trailing_comment_blocks(self) -> None: | CODE |
| LOW⚡ | .github/scripts/verify-supply-chain/scan_test.py | 219 | def test_unrelated_env_does_not_fire(self) -> None: | CODE |
| LOW⚡ | .github/scripts/verify-supply-chain/scan_test.py | 224 | def test_preexisting_goproxy_unchanged_does_not_fire(self) -> None: | CODE |
| LOW⚡ | .github/scripts/verify-supply-chain/scan_test.py | 233 | def test_new_hardcoded_setup_go_version_blocks(self) -> None: | CODE |
| LOW | .github/scripts/verify-supply-chain/scan_test.py | 66 | def test_pull_request_target_with_refs_pull_merge_blocks(self) -> None: | CODE |
| LOW | .github/scripts/verify-supply-chain/scan_test.py | 71 | def test_safe_pull_request_target_no_checkout_does_not_block(self) -> None: | CODE |
| LOW | .github/scripts/verify-supply-chain/scan_test.py | 126 | def test_block_scalar_literal_ref_blocks(self) -> None: | CODE |
| LOW | .github/scripts/verify-supply-chain/scan_test.py | 139 | def test_github_head_ref_shorthand_blocks(self) -> None: | CODE |
| LOW | .github/scripts/verify-supply-chain/scan_test.py | 153 | def test_merge_commit_sha_blocks(self) -> None: | CODE |
| 11 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | internal/pipeline/live_dogfood_test.go | 1387 | require.NotContains(t, result.OutputSample, "Jane Doe") | CODE |
| LOW | internal/pipeline/manifest_attribution_write_test.go | 33 | Contributors: []spec.Person{{Handle: "jane-doe", Name: "Jane Doe"}}, | CODE |
| LOW | internal/pipeline/manifest_attribution_write_test.go | 63 | first.Contributors = []spec.Person{{Handle: "jane-doe", Name: "Jane Doe"}} | CODE |
| LOW | internal/pipeline/manifest_attribution_write_test.go | 118 | first.Contributors = []spec.Person{{Handle: "jane-doe", Name: "Jane Doe"}} | CODE |
| LOW | internal/pipeline/lock_test.go | 443 | Contributors: []spec.Person{{Handle: "jane-doe", Name: "Jane Doe"}}, | CODE |
| LOW | internal/pipeline/append_contributor_test.go | 24 | added, err := AppendContributor(dir, spec.Person{Handle: "jane-doe", Name: "Jane Doe"}, false) | CODE |
| LOW⚡ | internal/pipeline/append_contributor_test.go | 45 | writeManifestJSON(t, dir, `{"cli_name":"acme-pp-cli","creator":{"handle":"trevin-chow","name":"Trevin Chow"},"contribu | CODE |
| LOW⚡ | internal/pipeline/append_contributor_test.go | 47 | added, err := AppendContributor(dir, spec.Person{Handle: "JANE-DOE", Name: "Jane Doe"}, false) | CODE |
| LOW⚡ | internal/pipeline/append_contributor_test.go | 55 | writeManifestJSON(t, dir, `{"cli_name":"acme-pp-cli","creator":{"handle":"trevin-chow","name":"Trevin Chow"},"contribu | CODE |
| LOW | internal/pipeline/append_contributor_test.go | 71 | _, err := AppendContributor(dir, spec.Person{Handle: "jane-doe", Name: "Jane Doe"}, false) | CODE |
| LOW | internal/pipeline/append_contributor_test.go | 90 | added, err := AppendContributor(dir, spec.Person{Name: "Jane Doe"}, false) | CODE |
| LOW | internal/pipeline/attribution_model_test.go | 20 | {Handle: "jane-doe", Name: "Jane Doe"}, | CODE |
| LOW | internal/pipeline/attribution_model_test.go | 60 | "contributors": [{"handle": "jane-doe", "name": "Jane Doe"}], | CODE |
| LOW⚡ | internal/pipeline/live_check_test.go | 631 | got := sampleOutput(`{"name":"Jane Doe","email":"jane@gmail.com","address":"123 Main Street","id":42,"status":"active"} | CODE |
| LOW⚡ | internal/pipeline/live_check_test.go | 631 | got := sampleOutput(`{"name":"Jane Doe","email":"jane@gmail.com","address":"123 Main Street","id":42,"status":"active"} | CODE |
| LOW⚡ | internal/pipeline/live_check_test.go | 633 | require.NotContains(t, got, "Jane Doe") | CODE |
| LOW⚡ | internal/pipeline/live_check_test.go | 635 | require.NotContains(t, got, "123 Main Street") | CODE |
| LOW⚡ | internal/pipeline/live_check_test.go | 651 | got := sampleOutput(fmt.Sprintf(`{"name":"Jane Doe","email":"jane@gmail.com","note":%q}`, longNote)) | CODE |
| LOW⚡ | internal/pipeline/live_check_test.go | 654 | require.NotContains(t, got, "Jane Doe") | CODE |
| LOW⚡ | internal/pipeline/live_check_test.go | 663 | require.NotContains(t, got, "Jane Doe") | CODE |
| LOW | internal/pipeline/live_check_test.go | 1250 | printf '{"name":"Jane Doe","email":"jane@gmail.com"}' >&2 | CODE |
| LOW | internal/pipeline/live_check_test.go | 1261 | require.NotContains(t, result.Reason, "Jane Doe") | CODE |
| LOW⚡ | internal/artifacts/pii_test.go | 20 | got := RedactPIIText(`{"name":"Jane Doe","email":"jane@example.com","address":"123 Main Street","id":42,"status":"activ | CODE |
| LOW⚡ | internal/artifacts/pii_test.go | 20 | got := RedactPIIText(`{"name":"Jane Doe","email":"jane@example.com","address":"123 Main Street","id":42,"status":"activ | CODE |
| LOW⚡ | internal/artifacts/pii_test.go | 22 | require.NotContains(t, got, "Jane Doe") | CODE |
| LOW⚡ | internal/artifacts/pii_test.go | 24 | require.NotContains(t, got, "123 Main Street") | CODE |
| LOW | internal/artifacts/pii_test.go | 69 | got, changed := RedactPIIJSONKeys(`{"name":"Jane Doe","note":"contact jane@example.com","id":42}`) | CODE |
| LOW | internal/artifacts/pii_test.go | 72 | require.NotContains(t, got, "Jane Doe") | CODE |
| LOW | internal/artifacts/pii_test.go | 131 | require.NotContains(t, got, "Jane Doe") | CODE |
| LOW | internal/artifacts/pii_test.go | 150 | require.NotContains(t, got, "123 Main Street") | CODE |
| LOW | internal/artifacts/pii_test.go | 157 | require.Contains(t, got, "user@example.com", "reserved example.com email must not be redacted") | CODE |
| LOW | internal/artifacts/pii_test.go | 282 | {name: "reserved-example-org", line: `"email": "anything@example.org"`, expectKinds: nil}, | CODE |
| LOW | internal/artifacts/secrets.go | 388 | for _, token := range []string{"<redacted", "redacted", "example", "placeholder", "your-", "your_", "insert-", "changem | CODE |
| LOW⚡ | internal/spec/person_test.go | 39 | contributors := []Person{{Handle: "jane-doe", Name: "Jane Doe"}} | CODE |
| LOW⚡ | internal/spec/person_test.go | 44 | {Handle: "jane-doe", Name: "Jane Doe"}, | CODE |
| LOW⚡ | internal/spec/person_test.go | 46 | assert.Equal(t, []Person{{Handle: "jane-doe", Name: "Jane Doe"}}, contributors, "input slice is copied") | CODE |
| LOW⚡ | internal/spec/person_test.go | 51 | {Handle: "jane-doe", Name: "Jane Doe"}, | CODE |
| LOW | internal/spec/person_test.go | 81 | {Handle: "jane-doe", Name: "Jane Doe"}, | CODE |
| LOW | internal/spec/spec_test.go | 6060 | wantErr: "placeholder", | CODE |
| LOW | internal/cli/publish_attribution_test.go | 44 | Creator: &spec.Person{Handle: "jane-doe", Name: "Jane Doe"}, | CODE |
| LOW | internal/cli/generate_test.go | 204 | Contributors: []spec.Person{{Handle: "jane-doe", Name: "Jane Doe"}}, | CODE |
| LOW | internal/cli/contributors.go | 40 | cli-printing-press contributors add --handle jane-doe --name "Jane Doe" --dir .`, | CODE |
| LOW | internal/generator/learn_incident_replay_test.go | 146 | "MYAPI_TOKEN=dummy-token-for-harness", | CODE |
| LOW | internal/generator/doctor_health_path_test.go | 90 | Name: "placeholder", | CODE |
| LOW | internal/generator/creator_resolve_test.go | 106 | writeManifest(t, dir, `{"api_name":"old-api","contributors":[{"handle":"jane-doe","name":"Jane Doe"}]}`) | CODE |
| LOW | internal/generator/creator_resolve_test.go | 115 | writeManifest(t, dir, `{"contributors": [{"handle": "jane-doe", "name": "Jane Doe"}, {"handle": "mvanhorn", "name": "M | CODE |
| LOW | internal/generator/generator.go | 7589 | return "user@example.com" | CODE |
| LOW | internal/generator/creator_render_test.go | 23 | {Handle: "jane-doe", Name: "Jane Doe"}, | CODE |
| LOW | internal/generator/creator_render_test.go | 83 | {Handle: "jane-doe", Name: "Jane Doe"}, | CODE |
| LOW | internal/browsersniff/redact_test.go | 126 | body := `{"token_field":"eyJhbGc.eyJzdWI.sig","contact":"user@example.com","line":"+14155551212"}` | CODE |
| LOW | internal/browsersniff/redact_test.go | 181 | assert.NotContains(t, redacted, "user@example.com") | CODE |
| LOW | skills/printing-press-amend/references/pii-scrubbing.md | 42 | # - "Acme Corp" | COMMENT |
| LOW | skills/printing-press-publish/SKILL.md | 1522 | are OK but org names (e.g., "Acme Corp") are not. See `references/secret-protection.md` | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | internal/cli/verify_skill_bundled.py | 674 | except Exception: | CODE |
| LOW | internal/cli/verify_skill_bundled.py | 265 | except Exception: | CODE |
| LOW | internal/cli/verify_skill_bundled.py | 307 | except Exception: | CODE |
| LOW | internal/cli/verify_skill_bundled.py | 419 | except Exception: | CODE |
| LOW | internal/cli/verify_skill_bundled.py | 512 | except Exception: | CODE |
| LOW | internal/cli/verify_skill_bundled.py | 522 | except Exception: | CODE |
| LOW | internal/cli/verify_skill_bundled.py | 634 | except Exception: | CODE |
| LOW | internal/cli/verify_skill_bundled.py | 657 | except Exception: | CODE |
| LOW | internal/cli/verify_skill_bundled.py | 1322 | except Exception: | CODE |
| LOW⚡ | scripts/verify-skill/verify_skill.py | 674 | except Exception: | CODE |
| LOW | scripts/verify-skill/verify_skill.py | 265 | except Exception: | CODE |
| LOW | scripts/verify-skill/verify_skill.py | 307 | except Exception: | CODE |
| LOW | scripts/verify-skill/verify_skill.py | 419 | except Exception: | CODE |
| LOW | scripts/verify-skill/verify_skill.py | 512 | except Exception: | CODE |
| LOW | scripts/verify-skill/verify_skill.py | 522 | except Exception: | CODE |
| LOW | scripts/verify-skill/verify_skill.py | 634 | except Exception: | CODE |
| LOW | scripts/verify-skill/verify_skill.py | 657 | except Exception: | CODE |
| LOW | scripts/verify-skill/verify_skill.py | 1322 | except Exception: | CODE |
| LOW | .github/workflows/main-ci.yml | 257 | except Exception: | CODE |
| LOW | .github/workflows/lint.yml | 201 | except Exception: | CODE |
| LOW | .github/workflows/lint.yml | 334 | except Exception: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | internal/pipeline/dogfood.go | 2509 | // line. Matching the open-brace through the literal "}" keeps the check robust | COMMENT |
| MEDIUM | internal/cli/browser_sniff_test.go | 424 | // Normalize to make the NotContains assertion robust across cobra versions. | COMMENT |
| MEDIUM | internal/cli/verify_skill_sync_test.go | 112 | // This is more robust than relying on PWD or runtime.Caller alone, because | COMMENT |
| MEDIUM | internal/generator/generator_test.go | 14940 | // We assert a robust shape: no occurrence of "ticker" inside the fallback | COMMENT |
| MEDIUM | internal/profiler/profiler_test.go | 3762 | // lookup is robust to the sharded Name. | COMMENT |
| MEDIUM | scripts/golden.sh | 66 | # one (the standalone `generate` path the golden harness exercises). | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | internal/cli/verify_skill_bundled.py | 134 | CODE | |
| LOW | internal/cli/verify_skill_bundled.py | 543 | CODE | |
| LOW | internal/cli/verify_skill_bundled.py | 626 | CODE | |
| LOW | internal/cli/verify_skill_bundled.py | 687 | CODE | |
| LOW | internal/cli/verify_skill_bundled.py | 1041 | CODE | |
| LOW | internal/cli/verify_skill_bundled.py | 1064 | CODE | |
| LOW | internal/cli/verify_skill_bundled.py | 1098 | CODE | |
| LOW | internal/cli/verify_skill_bundled.py | 1140 | CODE | |
| LOW | scripts/verify-go-floor.py | 93 | CODE | |
| LOW | scripts/verify-skill/verify_skill.py | 134 | CODE | |
| LOW | scripts/verify-skill/verify_skill.py | 543 | CODE | |
| LOW | scripts/verify-skill/verify_skill.py | 626 | CODE | |
| LOW | scripts/verify-skill/verify_skill.py | 687 | CODE | |
| LOW | scripts/verify-skill/verify_skill.py | 1041 | CODE | |
| LOW | scripts/verify-skill/verify_skill.py | 1064 | CODE | |
| LOW | scripts/verify-skill/verify_skill.py | 1098 | CODE | |
| LOW | scripts/verify-skill/verify_skill.py | 1140 | CODE | |
| LOW | .github/scripts/verify-supply-chain/signals.py | 216 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | internal/generator/textfilter.go | 17 | // aiSlopPatterns are regex patterns that detect common AI-generated text patterns. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | skills/printing-press-import/references/import-fetch.sh | 5 | # Usage: | COMMENT |
| LOW | skills/printing-press-import/references/import-place.sh | 16 | # Usage: | COMMENT |
| LOW | …ills/printing-press-import/references/import-backup.sh | 5 | # Usage: | COMMENT |
| LOW | …lls/printing-press-import/references/import-rewrite.sh | 20 | # Usage: | COMMENT |
| LOW | skills/printing-press/references/fetch-docs.sh | 4 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | internal/cli/verify_skill_bundled.py | 51 | CODE | |
| LOW | scripts/verify-go-floor.py | 4 | CODE | |
| LOW | scripts/golden_normalize_windows.py | 32 | CODE | |
| LOW | scripts/verify-skill/test_resolve_command_path.py | 9 | CODE | |
| LOW | scripts/verify-skill/verify_skill.py | 51 | CODE | |
| LOW | .github/scripts/verify-supply-chain/signals.py | 27 | CODE | |
| LOW | .github/scripts/verify-supply-chain/scan.py | 20 | CODE | |
| LOW | .github/scripts/verify-supply-chain/scan_test.py | 13 | CODE | |
| LOW | .github/scripts/pr-review-state/greptile_feedback.py | 8 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | internal/llm/llm_test.go | 42 | path=${prompt#Read the file at } | CODE |