The secure, validated skill registry for professional AI coding agents. Extend Antigravity, Claude Code, Cursor, Copilot and more with absolute confidence.
This report summarizes scanner evidence for tech-leads-club/agent-skills, a TypeScript project with 7,046 GitHub stars. SynthScan examined 208,676 lines of code across 1112 source files, recording 368 pattern matches distributed across 20 syntactic categories. The legacy adjusted pattern signal is 4.2 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 211 finding(s).
Are imports declared and package/API names verified? 71 finding(s).
Are wrappers, guards, and repeated structures necessary? 113 finding(s).
Which changes need focused human review? 368 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 368 distinct pattern matches across 20 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | …s/skills-catalog/skills/(cloud)/render-deploy/SKILL.md | 477 | ### Step 1: Analyze Codebase | COMMENT |
| LOW⚡ | …s/skills-catalog/skills/(cloud)/render-deploy/SKILL.md | 481 | ### Step 2: Create Resources via MCP | COMMENT |
| LOW⚡ | …s/skills-catalog/skills/(cloud)/render-deploy/SKILL.md | 487 | ### Step 3: Configure Environment Variables | COMMENT |
| LOW⚡ | …s/skills-catalog/skills/(cloud)/render-deploy/SKILL.md | 493 | ### Step 4: Verify Deployment | COMMENT |
| LOW | …s/skills-catalog/skills/(cloud)/render-deploy/SKILL.md | 268 | ### Step 1: Analyze Codebase | COMMENT |
| LOW | …s/skills-catalog/skills/(cloud)/render-deploy/SKILL.md | 272 | ### Step 2: Generate render.yaml | COMMENT |
| LOW | …s/skills-catalog/skills/(cloud)/render-deploy/SKILL.md | 334 | ### Step 3: Validate Configuration | COMMENT |
| LOW | …s/skills-catalog/skills/(cloud)/render-deploy/SKILL.md | 352 | ### Step 4: Commit and Push | COMMENT |
| LOW | …s/skills-catalog/skills/(cloud)/render-deploy/SKILL.md | 370 | ### Step 5: Generate Deeplink | COMMENT |
| LOW | …s/skills-catalog/skills/(cloud)/render-deploy/SKILL.md | 400 | ### Step 6: Guide User | COMMENT |
| LOW | …s/skills-catalog/skills/(cloud)/render-deploy/SKILL.md | 416 | ### Step 7: Verify Deployment | COMMENT |
| LOW | …ls/(cloud)/render-deploy/references/direct-creation.md | 7 | ### Step 1: Analyze Codebase | COMMENT |
| LOW | …ls/(cloud)/render-deploy/references/direct-creation.md | 11 | ### Step 2: Create Resources via MCP | COMMENT |
| LOW | …ls/(cloud)/render-deploy/references/direct-creation.md | 81 | ### Step 3: Configure Environment Variables | COMMENT |
| LOW | …ls/(cloud)/render-deploy/references/direct-creation.md | 98 | ### Step 4: Verify Deployment | COMMENT |
| LOW | …lls-catalog/skills/(development)/harness-eval/SKILL.md | 95 | ### Step 1: Resolve SKILL_DIR | COMMENT |
| LOW | …lls-catalog/skills/(development)/harness-eval/SKILL.md | 110 | ### Step 2: Inventory + claim deck | COMMENT |
| LOW⚡ | …lls-catalog/skills/(development)/harness-eval/SKILL.md | 136 | ### Step 3: Track A (deterministic) — always run | COMMENT |
| LOW⚡ | …lls-catalog/skills/(development)/harness-eval/SKILL.md | 146 | ### Step 4: Track B — Judge1 | COMMENT |
| LOW⚡ | …lls-catalog/skills/(development)/harness-eval/SKILL.md | 152 | ### Step 5: Track B — Judge2 (blind) | COMMENT |
| LOW⚡ | …lls-catalog/skills/(development)/harness-eval/SKILL.md | 160 | ### Step 6: Merge Track B agreement | COMMENT |
| LOW⚡ | …lls-catalog/skills/(development)/harness-eval/SKILL.md | 168 | ### Step 7: Track C — surface deck | COMMENT |
| LOW⚡ | …lls-catalog/skills/(development)/harness-eval/SKILL.md | 176 | ### Step 8: Track C — Usefulness Judge1 | COMMENT |
| LOW⚡ | …lls-catalog/skills/(development)/harness-eval/SKILL.md | 182 | ### Step 9: Track C — Usefulness Judge2 (blind) | COMMENT |
| LOW⚡ | …lls-catalog/skills/(development)/harness-eval/SKILL.md | 190 | ### Step 10: Merge Track C agreement | COMMENT |
| LOW⚡ | …lls-catalog/skills/(development)/harness-eval/SKILL.md | 198 | ### Step 11: Present results | COMMENT |
| LOW | …/skills-catalog/skills/(development)/codenavi/SKILL.md | 32 | ### Step 1: Briefing | COMMENT |
| LOW | …/skills-catalog/skills/(development)/codenavi/SKILL.md | 46 | ### Step 2: Recon | COMMENT |
| LOW | …/skills-catalog/skills/(development)/codenavi/SKILL.md | 64 | ### Step 3: Plan | COMMENT |
| LOW | …/skills-catalog/skills/(development)/codenavi/SKILL.md | 86 | ### Step 4: Execute | COMMENT |
| LOW | …/skills-catalog/skills/(development)/codenavi/SKILL.md | 117 | ### Step 5: Verify | COMMENT |
| LOW | …/skills-catalog/skills/(development)/codenavi/SKILL.md | 128 | ### Step 6: Debrief | COMMENT |
| LOW⚡ | …ills-catalog/skills/(development)/docs-writer/SKILL.md | 10 | ## Step 1: Understand the goal and create a plan | COMMENT |
| LOW⚡ | …ills-catalog/skills/(development)/docs-writer/SKILL.md | 16 | ## Step 2: Investigate and gather information | COMMENT |
| LOW⚡ | …ills-catalog/skills/(development)/docs-writer/SKILL.md | 22 | ## Step 3: Write or edit the documentation | COMMENT |
| LOW | …ills-catalog/skills/(development)/docs-writer/SKILL.md | 35 | ## Step 4: Verify and finalize | COMMENT |
| LOW | …s/skills-catalog/skills/(creation)/create-rfc/SKILL.md | 52 | ### Step 1: Gather Context (if not provided) | COMMENT |
| LOW | …s/skills-catalog/skills/(creation)/create-rfc/SKILL.md | 98 | ### Step 2: Validate Mandatory Fields | COMMENT |
| LOW⚡ | …s/skills-catalog/skills/(creation)/create-rfc/SKILL.md | 114 | ### Step 3: Detect RFC Type and Tailor Sections | COMMENT |
| LOW⚡ | …s/skills-catalog/skills/(creation)/create-rfc/SKILL.md | 124 | ### Step 4: Generate RFC Document | COMMENT |
| LOW⚡ | …s/skills-catalog/skills/(creation)/create-rfc/SKILL.md | 128 | ### Step 5: Offer Next Steps | COMMENT |
| LOW | …skills/(creation)/create-technical-design-doc/SKILL.md | 227 | ### Step 1: Initial Gathering | COMMENT |
| LOW | …skills/(creation)/create-technical-design-doc/SKILL.md | 276 | ### Step 2: Validate Mandatory Information | COMMENT |
| LOW | …skills/(creation)/create-technical-design-doc/SKILL.md | 337 | ### Step 3: Check for Critical Sections | COMMENT |
| LOW | …skills/(creation)/create-technical-design-doc/SKILL.md | 381 | ### Step 4: Offer Suggested Sections | COMMENT |
| LOW | …skills/(creation)/create-technical-design-doc/SKILL.md | 415 | ### Step 5: Generate Document | COMMENT |
| LOW | …skills/(creation)/create-technical-design-doc/SKILL.md | 419 | ### Step 6: Offer Confluence Integration | COMMENT |
| LOW | …s/skills-catalog/skills/(creation)/create-adr/SKILL.md | 69 | ### Step 1: Gather Context (if not provided) | COMMENT |
| LOW | …s/skills-catalog/skills/(creation)/create-adr/SKILL.md | 115 | ### Step 2: Validate Mandatory Fields | COMMENT |
| LOW⚡ | …s/skills-catalog/skills/(creation)/create-adr/SKILL.md | 135 | ### Step 3: Assign ADR Number | COMMENT |
| LOW⚡ | …s/skills-catalog/skills/(creation)/create-adr/SKILL.md | 144 | ### Step 4: Generate the ADR | COMMENT |
| LOW⚡ | …s/skills-catalog/skills/(creation)/create-adr/SKILL.md | 148 | ### Step 5: Offer File Placement | COMMENT |
| LOW⚡ | …r-decomposition/references/domain-analysis-examples.md | 400 | ### Step 1: Concepts Extracted | COMMENT |
| LOW⚡ | …r-decomposition/references/domain-analysis-examples.md | 406 | ### Step 2: Language Groups | COMMENT |
| LOW⚡ | …r-decomposition/references/domain-analysis-examples.md | 410 | ### Step 3: Subdomains Identified | COMMENT |
| LOW⚡ | …r-decomposition/references/domain-analysis-examples.md | 417 | ### Step 4: Cohesion Matrix | COMMENT |
| LOW⚡ | …r-decomposition/references/domain-analysis-examples.md | 422 | ### Step 5: Issues Found | COMMENT |
| LOW⚡ | …r-decomposition/references/domain-analysis-examples.md | 427 | ### Step 6: Recommendations | COMMENT |
| LOW⚡ | …alog/skills/(architecture)/domain-analysis/EXAMPLES.md | 400 | ### Step 1: Concepts Extracted | COMMENT |
| LOW⚡ | …alog/skills/(architecture)/domain-analysis/EXAMPLES.md | 406 | ### Step 2: Language Groups | COMMENT |
| 63 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | packages/skills-catalog/security-scan-allowlist.yaml | 8 | # ============================================================================ | COMMENT |
| MEDIUM⚡ | packages/skills-catalog/security-scan-allowlist.yaml | 11 | # ============================================================================ | COMMENT |
| MEDIUM⚡ | packages/skills-catalog/security-scan-allowlist.yaml | 66 | # ============================================================================ | COMMENT |
| MEDIUM⚡ | packages/skills-catalog/security-scan-allowlist.yaml | 69 | # ============================================================================ | COMMENT |
| MEDIUM⚡ | packages/skills-catalog/security-scan-allowlist.yaml | 79 | # ============================================================================ | COMMENT |
| MEDIUM⚡ | packages/skills-catalog/security-scan-allowlist.yaml | 82 | # ============================================================================ | COMMENT |
| MEDIUM⚡ | packages/skills-catalog/security-scan-allowlist.yaml | 256 | # ============================================================================ | COMMENT |
| MEDIUM⚡ | packages/skills-catalog/security-scan-allowlist.yaml | 259 | # ============================================================================ | COMMENT |
| MEDIUM⚡ | packages/skills-catalog/security-scan-allowlist.yaml | 269 | # ============================================================================ | COMMENT |
| MEDIUM⚡ | packages/skills-catalog/security-scan-allowlist.yaml | 272 | # ============================================================================ | COMMENT |
| MEDIUM | packages/skills-catalog/security-scan-allowlist.yaml | 52 | # ============================================================================ | COMMENT |
| MEDIUM | packages/skills-catalog/security-scan-allowlist.yaml | 55 | # ============================================================================ | COMMENT |
| MEDIUM | packages/skills-catalog/security-scan-allowlist.yaml | 100 | # ============================================================================ | COMMENT |
| MEDIUM | packages/skills-catalog/security-scan-allowlist.yaml | 103 | # ============================================================================ | COMMENT |
| MEDIUM | packages/skills-catalog/security-scan-allowlist.yaml | 122 | # ============================================================================ | COMMENT |
| MEDIUM | packages/skills-catalog/security-scan-allowlist.yaml | 125 | # ============================================================================ | COMMENT |
| MEDIUM | packages/skills-catalog/security-scan-allowlist.yaml | 136 | # ============================================================================ | COMMENT |
| MEDIUM | packages/skills-catalog/security-scan-allowlist.yaml | 139 | # ============================================================================ | COMMENT |
| MEDIUM | packages/skills-catalog/security-scan-allowlist.yaml | 176 | # ============================================================================ | COMMENT |
| MEDIUM | packages/skills-catalog/security-scan-allowlist.yaml | 179 | # ============================================================================ | COMMENT |
| MEDIUM | packages/skills-catalog/security-scan-allowlist.yaml | 197 | # ============================================================================ | COMMENT |
| MEDIUM | packages/skills-catalog/security-scan-allowlist.yaml | 200 | # ============================================================================ | COMMENT |
| MEDIUM | packages/skills-catalog/security-scan-allowlist.yaml | 345 | # ============================================================================ | COMMENT |
| MEDIUM | packages/skills-catalog/security-scan-allowlist.yaml | 348 | # ============================================================================ | COMMENT |
| MEDIUM | …/nestjs-modular-monolith/references/state-isolation.md | 83 | // ═══════════════════════════════════════════ | COMMENT |
| MEDIUM | …/nestjs-modular-monolith/references/state-isolation.md | 85 | // ═══════════════════════════════════════════ | COMMENT |
| MEDIUM | …/nestjs-modular-monolith/references/state-isolation.md | 96 | // ═══════════════════════════════════════════ | COMMENT |
| MEDIUM | …/nestjs-modular-monolith/references/state-isolation.md | 98 | // ═══════════════════════════════════════════ | COMMENT |
| MEDIUM | …/nestjs-modular-monolith/references/state-isolation.md | 130 | // ═══════════════════════════════════════════ | COMMENT |
| MEDIUM | …/nestjs-modular-monolith/references/state-isolation.md | 132 | // ═══════════════════════════════════════════ | COMMENT |
| MEDIUM | …/nestjs-modular-monolith/scripts/validate-isolation.sh | 52 | # ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | …/nestjs-modular-monolith/scripts/validate-isolation.sh | 54 | # ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | …/nestjs-modular-monolith/scripts/validate-isolation.sh | 71 | # ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | …/nestjs-modular-monolith/scripts/validate-isolation.sh | 73 | # ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | …/nestjs-modular-monolith/scripts/validate-isolation.sh | 89 | # ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | …/nestjs-modular-monolith/scripts/validate-isolation.sh | 91 | # ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | …/nestjs-modular-monolith/scripts/validate-isolation.sh | 109 | # ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | …/nestjs-modular-monolith/scripts/validate-isolation.sh | 111 | # ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | …/nestjs-modular-monolith/scripts/validate-isolation.sh | 128 | # ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | …/nestjs-modular-monolith/scripts/validate-isolation.sh | 130 | # ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | …/nestjs-modular-monolith/scripts/validate-isolation.sh | 147 | # ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | …/nestjs-modular-monolith/scripts/validate-isolation.sh | 149 | # ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | …/nestjs-modular-monolith/scripts/validate-isolation.sh | 167 | # ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | …/nestjs-modular-monolith/scripts/validate-isolation.sh | 169 | # ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | …/nestjs-modular-monolith/scripts/validate-isolation.sh | 188 | # ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | …/nestjs-modular-monolith/scripts/validate-isolation.sh | 190 | # ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/cli/src/components/Header.tsx | 74 | <Text color="#334155">────── </Text> | CODE |
| MEDIUM | packages/cli/src/components/Header.tsx | 78 | <Text color="#334155"> ──────</Text> | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | …kills/(cloud)/cloudflare-deploy/references/ddos/api.md | 41 | const entrypointRuleset = await client.zones.rulesets.phases.entrypoint.get('ddos_l7', { | CODE |
| CRITICAL | …kills/(cloud)/cloudflare-deploy/references/ddos/api.md | 46 | await client.zones.rulesets.phases.entrypoint.update('ddos_l7', { | CODE |
| CRITICAL | …kills/(cloud)/cloudflare-deploy/references/ddos/api.md | 66 | const l4Ruleset = await client.accounts.rulesets.phases.entrypoint.get('ddos_l4', { | CODE |
| CRITICAL | …/(cloud)/cloudflare-deploy/references/ddos/patterns.md | 20 | await client.accounts.rulesets.phases.entrypoint.update('ddos_l7', { | CODE |
| CRITICAL | …/(cloud)/cloudflare-deploy/references/ddos/patterns.md | 71 | return client.zones.rulesets.phases.entrypoint.update('ddos_l7', { | CODE |
| CRITICAL | …/(cloud)/cloudflare-deploy/references/ddos/patterns.md | 151 | await client.zones.rulesets.phases.entrypoint.update('ddos_l7', { | CODE |
| CRITICAL | …/(cloud)/cloudflare-deploy/references/ddos/patterns.md | 163 | await client.zones.rulesets.phases.entrypoint.update('http_request_firewall_managed', { | CODE |
| CRITICAL | …/(cloud)/cloudflare-deploy/references/ddos/patterns.md | 169 | await client.zones.rulesets.phases.entrypoint.update('http_ratelimit', { | CODE |
| CRITICAL | …/(cloud)/cloudflare-deploy/references/ddos/patterns.md | 181 | await client.zones.rulesets.phases.entrypoint.update('http_request_sbfm', { | CODE |
| CRITICAL | …/(cloud)/cloudflare-deploy/references/ddos/patterns.md | 201 | await client.zones.rulesets.phases.entrypoint.update('http_request_cache_settings', { | CODE |
| CRITICAL | …udflare-deploy/references/workers-for-platforms/api.md | 24 | await client.workersForPlatforms.dispatch.namespaces.scripts.update(namespace, scriptName, { | CODE |
| CRITICAL | …re-deploy/references/workers-for-platforms/patterns.md | 153 | await client.workersForPlatforms.dispatch.namespaces.scripts.update('production', name, { | CODE |
| CRITICAL | …ills/(cloud)/cloudflare-deploy/references/pages/api.md | 189 | const data = await event.locals.runtime.env.DB.prepare('SELECT * FROM users').all() | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH⚡ | …s/skills-catalog/skills/(cloud)/render-deploy/SKILL.md | 175 | 2. Add this to `~/.cursor/mcp.json` (replace `<YOUR_API_KEY>`): | CODE |
| HIGH⚡ | …s/skills-catalog/skills/(cloud)/render-deploy/SKILL.md | 175 | 2. Add this to `~/.cursor/mcp.json` (replace `<YOUR_API_KEY>`): | CODE |
| HIGH⚡ | …s/skills-catalog/skills/(cloud)/render-deploy/SKILL.md | 183 | "Authorization": "Bearer <YOUR_API_KEY>" | CODE |
| HIGH⚡ | …s/skills-catalog/skills/(cloud)/render-deploy/SKILL.md | 183 | "Authorization": "Bearer <YOUR_API_KEY>" | CODE |
| HIGH⚡ | …s/skills-catalog/skills/(cloud)/render-deploy/SKILL.md | 202 | 2. Add the MCP server with Claude Code (replace `<YOUR_API_KEY>`): | CODE |
| HIGH⚡ | …s/skills-catalog/skills/(cloud)/render-deploy/SKILL.md | 202 | 2. Add the MCP server with Claude Code (replace `<YOUR_API_KEY>`): | CODE |
| HIGH⚡ | …s/skills-catalog/skills/(cloud)/render-deploy/SKILL.md | 205 | claude mcp add --transport http render https://mcp.render.com/mcp --header "Authorization: Bearer <YOUR_API_KEY>" | CODE |
| HIGH⚡ | …s/skills-catalog/skills/(cloud)/render-deploy/SKILL.md | 205 | claude mcp add --transport http render https://mcp.render.com/mcp --header "Authorization: Bearer <YOUR_API_KEY>" | CODE |
| HIGH | …s/skills-catalog/skills/(cloud)/render-deploy/SKILL.md | 42 | 2. **NEVER include actual API keys in examples** - Always use placeholders like `<YOUR_API_KEY>` or `rnd_xxxxx` | CODE |
| HIGH | …s/skills-catalog/skills/(cloud)/render-deploy/SKILL.md | 42 | 2. **NEVER include actual API keys in examples** - Always use placeholders like `<YOUR_API_KEY>` or `rnd_xxxxx` | CODE |
| HIGH | …s/skills-catalog/skills/(cloud)/render-deploy/SKILL.md | 55 | - Replace `<YOUR_API_KEY>` with their actual key | CODE |
| HIGH | …s/skills-catalog/skills/(cloud)/render-deploy/SKILL.md | 55 | - Replace `<YOUR_API_KEY>` with their actual key | CODE |
| HIGH | …pment)/shopify-developer/references/app-development.md | 102 | SHOPIFY_API_KEY=your_api_key | CODE |
| HIGH | …pment)/shopify-developer/references/app-development.md | 723 | SHOPIFY_API_KEY = "your_api_key" | CODE |
| HIGH | …e)/frontend-blueprint/references/stitch-integration.md | 112 | Header: X-Goog-Api-Key: <YOUR-API-KEY> | CODE |
| HIGH | …e)/frontend-blueprint/references/stitch-integration.md | 112 | Header: X-Goog-Api-Key: <YOUR-API-KEY> | CODE |
| HIGH | …e)/frontend-blueprint/references/stitch-integration.md | 130 | "X-Goog-Api-Key": "YOUR-API-KEY" | CODE |
| HIGH | …e)/frontend-blueprint/references/stitch-integration.md | 138 | <tool> mcp add stitch --transport http https://stitch.googleapis.com/mcp --header "X-Goog-Api-Key: YOUR-API-KEY" | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …cloudflare-deploy/references/argo-smart-routing/api.md | 219 | except Exception as e: | CODE |
| LOW | …/skills/(development)/tlc-spec-lean/scripts/lessons.py | 60 | except Exception: | CODE |
| MEDIUM | …/skills/(development)/tlc-spec-lean/scripts/lessons.py | 57 | def _parse_date(s): | CODE |
| LOW | …kills/(development)/tlc-spec-driven/scripts/lessons.py | 60 | except Exception: | CODE |
| MEDIUM | …kills/(development)/tlc-spec-driven/scripts/lessons.py | 57 | def _parse_date(s): | CODE |
| LOW | …s/(creation)/skill-architect/scripts/validate_skill.py | 313 | except Exception as e: | CODE |
| MEDIUM | …/excalidraw-studio/scripts/split-excalidraw-library.py | 67 | print(f"Error: No .excalidrawlib file found in {directory}") | CODE |
| MEDIUM | …/excalidraw-studio/scripts/split-excalidraw-library.py | 72 | print(f"Error: Multiple .excalidrawlib files found in {directory}") | CODE |
| MEDIUM | …/excalidraw-studio/scripts/split-excalidraw-library.py | 89 | print(f"Error: Directory not found: {library_dir}") | CODE |
| MEDIUM | …/excalidraw-studio/scripts/split-excalidraw-library.py | 93 | print(f"Error: Path is not a directory: {library_dir}") | CODE |
| MEDIUM | …/excalidraw-studio/scripts/split-excalidraw-library.py | 107 | print("Error: Invalid library file format (missing 'libraryItems')") | CODE |
| MEDIUM⚡ | …ling)/excalidraw-studio/scripts/add-icon-to-diagram.py | 365 | print("Error: --library-path requires a path argument") | CODE |
| MEDIUM⚡ | …ling)/excalidraw-studio/scripts/add-icon-to-diagram.py | 372 | print("Error: --label requires a text argument") | CODE |
| MEDIUM⚡ | …ling)/excalidraw-studio/scripts/add-icon-to-diagram.py | 381 | print(f"Error: Unknown option: {sys.argv[i]}") | CODE |
| MEDIUM⚡ | …ling)/excalidraw-studio/scripts/add-icon-to-diagram.py | 386 | print(f"Error: Diagram file not found: {diagram_path}") | CODE |
| MEDIUM⚡ | …ling)/excalidraw-studio/scripts/add-icon-to-diagram.py | 390 | print(f"Error: Library path not found: {library_path}") | CODE |
| LOW⚡ | …ling)/excalidraw-studio/scripts/add-icon-to-diagram.py | 397 | except Exception as e: | CODE |
| MEDIUM⚡ | …ling)/excalidraw-studio/scripts/add-icon-to-diagram.py | 398 | print(f"Error: {e}") | CODE |
| MEDIUM⚡ | …kills/(tooling)/excalidraw-studio/scripts/add-arrow.py | 267 | print(f"Error: Invalid style '{style}'. Must be: solid, dashed, or dotted") | CODE |
| MEDIUM⚡ | …kills/(tooling)/excalidraw-studio/scripts/add-arrow.py | 271 | print("Error: --style requires an argument") | CODE |
| MEDIUM⚡ | …kills/(tooling)/excalidraw-studio/scripts/add-arrow.py | 278 | print("Error: --color requires an argument") | CODE |
| MEDIUM⚡ | …kills/(tooling)/excalidraw-studio/scripts/add-arrow.py | 285 | print("Error: --label requires a text argument") | CODE |
| MEDIUM⚡ | …kills/(tooling)/excalidraw-studio/scripts/add-arrow.py | 294 | print(f"Error: Unknown option: {sys.argv[i]}") | CODE |
| MEDIUM⚡ | …kills/(tooling)/excalidraw-studio/scripts/add-arrow.py | 299 | print(f"Error: Diagram file not found: {diagram_path}") | CODE |
| LOW⚡ | …kills/(tooling)/excalidraw-studio/scripts/add-arrow.py | 306 | except Exception as e: | CODE |
| MEDIUM⚡ | …kills/(tooling)/excalidraw-studio/scripts/add-arrow.py | 307 | print(f"Error: {e}") | CODE |
| MEDIUM | …kills/(tooling)/gh-fix-ci/scripts/inspect_pr_checks.py | 100 | print("Error: not inside a Git repository.", file=sys.stderr) | CODE |
| MEDIUM | …kills/(tooling)/gh-fix-ci/scripts/inspect_pr_checks.py | 152 | print("Error: gh is not installed or not on PATH.", file=sys.stderr) | CODE |
| MEDIUM | …kills/(tooling)/gh-fix-ci/scripts/inspect_pr_checks.py | 173 | print("Error: unable to parse PR JSON.", file=sys.stderr) | CODE |
| MEDIUM | …kills/(tooling)/gh-fix-ci/scripts/inspect_pr_checks.py | 177 | print("Error: no PR number found.", file=sys.stderr) | CODE |
| MEDIUM | …kills/(tooling)/gh-fix-ci/scripts/inspect_pr_checks.py | 203 | print("Error: no usable fields available for gh pr checks.", file=sys.stderr) | CODE |
| MEDIUM | …kills/(tooling)/gh-fix-ci/scripts/inspect_pr_checks.py | 219 | print("Error: unable to parse checks JSON.", file=sys.stderr) | CODE |
| MEDIUM | …kills/(tooling)/gh-fix-ci/scripts/inspect_pr_checks.py | 222 | print("Error: unexpected checks JSON shape.", file=sys.stderr) | CODE |
| MEDIUM | …kills/(tooling)/gh-fix-ci/scripts/inspect_pr_checks.py | 492 | print(f"Error fetching logs: {result['error']}") | CODE |
| MEDIUM | …talog/skills/(monitoring)/sentry/scripts/sentry_api.py | 237 | print(f"Error: {exc}", file=sys.stderr) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …oud)/cloudflare-deploy/references/workers-ai/README.md | 59 | ### Embeddings (Semantic Search/RAG) | COMMENT |
| MEDIUM | …oud)/cloudflare-deploy/references/workers-ai/README.md | 118 | ## RAG vs Direct Generation | COMMENT |
| MEDIUM | …oud)/cloudflare-deploy/references/workers-ai/README.md | 120 | ### Use RAG (Vectorize + Workers AI) When: | COMMENT |
| MEDIUM | …d)/cloudflare-deploy/references/workers-ai/patterns.md | 3 | ## RAG (Retrieval-Augmented Generation) | COMMENT |
| MEDIUM | …oudflare-deploy/references/workers-ai/configuration.md | 80 | ## RAG Setup (with Vectorize) | COMMENT |
| MEDIUM | …loud)/cloudflare-deploy/references/vectorize/README.md | 98 | ### RAG Pattern | COMMENT |
| MEDIUM | …ud)/cloudflare-deploy/references/vectorize/patterns.md | 24 | ## RAG Pattern | COMMENT |
| MEDIUM | …log/skills/(development)/rails-dev/references/model.md | 75 | # Don't: service object orchestrating a record | COMMENT |
| MEDIUM | packages/marketplace/public/llms.txt | 28 | - [Antigravity](https://agent-skills.techleads.club/agents/antigravity/): Google's agentic coding (VS Code). Installs to | CODE |
| MEDIUM | packages/marketplace/public/llms.txt | 30 | - [Claude Code](https://agent-skills.techleads.club/agents/claude-code/): Anthropic's agentic coding tool. Installs to . | CODE |
| MEDIUM | packages/marketplace/public/llms.txt | 110 | - [Run Nx Generator](https://agent-skills.techleads.club/skills/nx-generate/): Generate code using Nx generators — scaff | CODE |
| MEDIUM | packages/marketplace/public/llms.txt | 145 | - [TLC AI Dev Flow](https://agent-skills.techleads.club/tlc-ai-dev-flow/): v1 skills for agentic software factories: dis | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …/(cloud)/aws-advisor/scripts/architecture_validator.py | 192 | CODE | |
| LOW | …(development)/harness-eval/scripts/merge_usefulness.py | 184 | CODE | |
| LOW | …velopment)/harness-eval/scripts/track_a_correctness.py | 292 | CODE | |
| LOW | …velopment)/harness-eval/scripts/track_a_correctness.py | 445 | CODE | |
| LOW | …velopment)/harness-eval/scripts/track_a_correctness.py | 496 | CODE | |
| LOW | …velopment)/harness-eval/scripts/track_a_correctness.py | 650 | CODE | |
| LOW | …development)/harness-eval/scripts/inventory_extract.py | 250 | CODE | |
| LOW | …development)/harness-eval/scripts/inventory_extract.py | 311 | CODE | |
| LOW | …development)/harness-eval/scripts/inventory_extract.py | 403 | CODE | |
| LOW | …development)/harness-eval/scripts/inventory_extract.py | 506 | CODE | |
| LOW | …development)/harness-eval/scripts/inventory_extract.py | 541 | CODE | |
| LOW | …kills/(development)/harness-eval/scripts/slim_fanin.py | 65 | CODE | |
| LOW | …kills/(development)/harness-eval/scripts/slim_fanin.py | 135 | CODE | |
| LOW | …s/(development)/tlc-spec-lean/scripts/validate_plan.py | 191 | CODE | |
| LOW | …s/(development)/tlc-spec-lean/scripts/validate_plan.py | 276 | CODE | |
| LOW | …s/(development)/tlc-spec-lean/scripts/validate_plan.py | 331 | CODE | |
| LOW | …skills/(development)/tlc-spec-lean/scripts/selftest.py | 252 | CODE | |
| LOW | …opment)/tlc-spec-lean/scripts/validate_verification.py | 150 | CODE | |
| LOW | …(development)/tlc-spec-lean/scripts/validate_checks.py | 158 | CODE | |
| LOW | …(development)/tlc-spec-lean/scripts/validate_checks.py | 238 | CODE | |
| LOW | …development)/tlc-spec-driven/scripts/validate_tasks.py | 80 | CODE | |
| LOW | …(development)/tlc-spec-driven/scripts/validate_spec.py | 145 | CODE | |
| LOW | …ling)/excalidraw-studio/scripts/add-icon-to-diagram.py | 61 | CODE | |
| LOW | …ling)/excalidraw-studio/scripts/add-icon-to-diagram.py | 330 | CODE | |
| LOW | …kills/(tooling)/excalidraw-studio/scripts/add-arrow.py | 234 | CODE | |
| LOW | …talog/skills/(monitoring)/sentry/scripts/sentry_api.py | 206 | CODE | |
| LOW | …alog/skills/(quality)/the-judge/scripts/review_gate.py | 84 | CODE | |
| LOW | …og/skills/(quality)/the-judge/scripts/scan_bypasses.py | 33 | CODE | |
| LOW | …ity)/security-ownership-map/scripts/query_ownership.py | 447 | CODE | |
| LOW | …/security-ownership-map/scripts/build_ownership_map.py | 421 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | libs/core/src/lib/services/skills-provider.service.ts | 186 | function loadLocalCategoryMetadata( | CODE |
| LOW | libs/core/src/lib/services/registry.service.ts | 214 | function pruneOrphanedSkillCacheFiles( | CODE |
| LOW | …cloudflare-deploy/references/argo-smart-routing/api.md | 171 | async function enableArgoWithErrorHandling(client: Cloudflare, zoneId: string) { | CODE |
| LOW | …cloudflare-deploy/references/argo-smart-routing/api.md | 205 | def enable_argo_with_error_handling(client: Cloudflare, zone_id: str): | CODE |
| LOW | …/(cloud)/cloudflare-deploy/references/turn/patterns.md | 61 | function filterICEServersForBrowser(urls: string[]): string[] { | CODE |
| LOW | …velopment)/harness-eval/scripts/track_a_correctness.py | 251 | def is_concrete_checkable_cite(cite: str) -> bool: | CODE |
| LOW | …skills/(development)/harness-eval/scripts/doc_scope.py | 45 | def is_excluded_decision_record(rel_path: str) -> bool: | CODE |
| LOW | …kills/(development)/harness-eval/scripts/slim_fanin.py | 65 | def discover_harness_markdown(root: Path) -> list[Path]: | CODE |
| LOW | …s/(creation)/skill-architect/scripts/validate_skill.py | 98 | def _parse_frontmatter_stdlib(frontmatter_raw: str) -> dict[str, Any]: | CODE |
| LOW | …ular-decomposition/references/pattern-03-flattening.md | 490 | function findRootNamespacesWithCode(namespaces, sourceFiles) { | CODE |
| LOW | …ular-decomposition/references/pattern-03-flattening.md | 562 | function validateComponentStructure(namespaces, sourceFiles) { | CODE |
| LOW | …(architecture)/component-flattening-analysis/README.md | 483 | function validateComponentStructure(namespaces, sourceFiles) { | CODE |
| LOW | …/(architecture)/component-flattening-analysis/SKILL.md | 495 | function findRootNamespacesWithCode(namespaces, sourceFiles) { | CODE |
| LOW | …/(architecture)/component-flattening-analysis/SKILL.md | 567 | function validateComponentStructure(namespaces, sourceFiles) { | CODE |
| LOW | …atalog/skills/(web-automation)/playwright-skill/run.js | 134 | function getContextOptionsWithHeaders(options = {}) { | CODE |
| LOW | packages/skills-catalog/src/scan-skills.ts | 100 | function isOnlyInfrastructureFailures(issues: ScanIssue[]): boolean { | CODE |
| LOW | packages/marketplace/src/lib/markdown-code-fences.ts | 39 | export function mapLinesOutsideCodeFences(markdown: string, transform: (line: string) => string): string { | CODE |
| LOW | packages/marketplace/src/lib/markdown-code-fences.ts | 48 | export function findLineOutsideCodeFences(markdown: string, predicate: (line: string) => boolean): string | undefined { | CODE |
| LOW | packages/marketplace/src/lib/safe-markdown-href.ts | 25 | export function resolveMarkdownLinkPresentation(href: string | undefined): MarkdownLinkPresentation { | CODE |
| LOW | packages/marketplace/src/lib/skills-filter.ts | 32 | export function filterAndSortSkillsWithMeta({ | CODE |
| LOW | packages/mcp/src/prompts.ts | 28 | function registerDiscoveryAliasPrompt(server: FastMCP): void { | CODE |
| LOW | packages/mcp/src/prompts.ts | 98 | export function buildCatalogPromptMessages( | CODE |
| LOW | packages/mcp/src/prompts.ts | 130 | export function buildUsePromptNotFoundMessages( | CODE |
| LOW | packages/mcp/src/tools/core/fetcher.ts | 24 | export function buildReferenceFilesOutput( | CODE |
| LOW | packages/mcp/src/tools/core/search.ts | 19 | export function buildSearchSkillsResponse(results: Array<FuseResult<IndexSkill>>): SearchResponse { | CODE |
| LOW | packages/cli/src/services/config.ts | 77 | export async function hasShortcutsBeenDismissed(): Promise<boolean> { | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …loudflare-deploy/references/terraform/configuration.md | 184 | include { email = ["admin@example.com"] } | CODE |
| LOW | …/(cloud)/cloudflare-deploy/references/workflows/api.md | 182 | params: { userId: 'user123', email: 'user@example.com' }, | CODE |
| LOW | …dflare-deploy/references/browser-rendering/patterns.md | 61 | await page.getByLabel('Email').fill('user@example.com') | CODE |
| LOW | …oud)/cloudflare-deploy/references/email-routing/api.md | 135 | from: { name: 'Acme Corp', email: 'noreply@yourdomain.com' }, | CODE |
| LOW | …cloudflare-deploy/references/email-routing/patterns.md | 7 | const allowed = ['user@example.com', 'trusted@corp.com'] | CODE |
| LOW | …oud)/cloudflare-deploy/references/email-workers/api.md | 175 | msg.setSender({ name: 'John Doe', addr: 'john@example.com' }) | CODE |
| LOW | …opment)/shopify-developer/references/liquid-filters.md | 227 | {{ "foo@bar.com" | url_encode }} | CODE |
| LOW | …ent)/shopify-developer/references/theme-development.md | 393 | {{ 'product-1' | placeholder_svg_tag: 'placeholder' }} | CODE |
| LOW | …ent)/shopify-developer/references/theme-development.md | 645 | "placeholder": "Enter store name", | CODE |
| LOW | …ent)/shopify-developer/references/theme-development.md | 660 | "placeholder": "Enter footer text" | CODE |
| LOW | …ent)/shopify-developer/references/theme-development.md | 899 | "placeholder": "https://www.youtube.com/watch?v=...", | CODE |
| LOW | …ent)/shopify-developer/references/theme-development.md | 1097 | "placeholder": "https://twitter.com/username", | CODE |
| LOW | …lls/(web-automation)/playwright-skill/API_REFERENCE.md | 144 | await page.getByRole('textbox', { name: 'Email' }).fill('user@example.com'); | CODE |
| LOW | …lls/(web-automation)/playwright-skill/API_REFERENCE.md | 153 | await page.locator('input[name="email"]').fill('test@test.com'); | CODE |
| LOW | …lls/(web-automation)/playwright-skill/API_REFERENCE.md | 167 | const row = page.locator('tr').filter({ hasText: 'John Doe' }); | CODE |
| LOW | …lls/(web-automation)/playwright-skill/API_REFERENCE.md | 188 | await page.getByLabel('Email').fill('user@example.com'); | CODE |
| LOW | …lls/(web-automation)/playwright-skill/API_REFERENCE.md | 189 | await page.getByPlaceholder('Enter your name').fill('John Doe'); | CODE |
| LOW | …lls/(web-automation)/playwright-skill/API_REFERENCE.md | 376 | await loginPage.login('user@example.com', 'password123'); | CODE |
| LOW | …alog/skills/(web-automation)/playwright-skill/SKILL.md | 164 | await page.fill('input[name="name"]', 'John Doe') | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …skills/(cloud)/aws-advisor/scripts/generate_diagram.py | 15 | CODE | |
| LOW | …(development)/harness-eval/scripts/surfaces_extract.py | 4 | CODE | |
| LOW | …(development)/harness-eval/scripts/merge_usefulness.py | 11 | CODE | |
| LOW | …velopment)/harness-eval/scripts/track_a_correctness.py | 4 | CODE | |
| LOW | …skills/(development)/harness-eval/scripts/doc_scope.py | 7 | CODE | |
| LOW | …development)/harness-eval/scripts/inventory_extract.py | 4 | CODE | |
| LOW | …/(development)/harness-eval/scripts/merge_agreement.py | 4 | CODE | |
| LOW | …kills/(development)/harness-eval/scripts/slim_fanin.py | 8 | CODE | |
| LOW | …lopment)/gh-address-comments/scripts/fetch_comments.py | 16 | CODE | |
| LOW | …/excalidraw-studio/scripts/split-excalidraw-library.py | 20 | CODE | |
| LOW | …kills/(tooling)/excalidraw-studio/scripts/add-arrow.py | 25 | CODE | |
| LOW | …kills/(tooling)/excalidraw-studio/scripts/add-arrow.py | 25 | CODE | |
| LOW | …kills/(tooling)/gh-fix-ci/scripts/inspect_pr_checks.py | 2 | CODE | |
| LOW | …ecurity-ownership-map/scripts/community_maintainers.py | 4 | CODE | |
| LOW | …y)/security-ownership-map/scripts/run_ownership_map.py | 4 | CODE | |
| LOW | …y)/security-ownership-map/scripts/run_ownership_map.py | 137 | CODE | |
| LOW | …ity)/security-ownership-map/scripts/query_ownership.py | 4 | CODE | |
| LOW | …/security-ownership-map/scripts/build_ownership_map.py | 4 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …/(cloud)/aws-advisor/scripts/architecture_validator.py | 223 | except re.error: | CODE |
| HIGH | …velopment)/harness-eval/scripts/track_a_correctness.py | 305 | except ValueError: | CODE |
| HIGH | …/security-ownership-map/scripts/build_ownership_map.py | 920 | except ImportError: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …/(cloud)/cloudflare-deploy/references/ai-search/api.md | 33 | response: string // AI-generated answer | CODE |
| HIGH | packages/marketplace/public/llms.txt | 101 | - [Paid Creative AI](https://agent-skills.techleads.club/skills/paid-creative-ai/): When the user wants to create AI-gen | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …velopment)/harness-eval/scripts/track_a_correctness.py | 550 | lines += ["", "### T2", "", "Cited harness refs.", ""] | CODE |
| MEDIUM | …skills/(development)/harness-eval/scripts/doc_scope.py | 13 | # why: skill trees are agent harness regardless of host product folder name | COMMENT |
| MEDIUM | …kills/(development)/harness-eval/scripts/slim_fanin.py | 180 | # invariant: run dirs live at <repo>/.harness-eval/runs/<id> | COMMENT |
| MEDIUM | packages/marketplace/src/app/about/page.tsx | 115 | │ ├── react-patterns/ # → Skill: React best practices | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …ls/(development)/tlc-spec-lean/scripts/check_commit.py | 14 | ln -s <skill-dir>/scripts/check_commit.py .git/hooks/commit-msg && chmod +x .git/hooks/commit-msg | STRING |
| HIGH | …skills/(development)/tlc-spec-lean/scripts/selftest.py | 102 | lambda s: s.replace("| enum value, not null, existing rows backfilled to `active` |", "| |"), | CODE |
| HIGH | …/(development)/tlc-spec-driven/scripts/check_commit.py | 14 | ln -s <skill-dir>/scripts/check_commit.py .git/hooks/commit-msg && chmod +x .git/hooks/commit-msg | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | packages/skills-catalog/skills/deprecated.yaml | 1 | # Deprecated skills | COMMENT |
| LOW | …(cloud)/cloudflare-deploy/references/images/gotchas.md | 101 | // Test with curl | COMMENT |
| LOW | …/nestjs-modular-monolith/scripts/validate-isolation.sh | 1 | #!/bin/bash | COMMENT |
| LOW | …e-engine-optimization/templates/robots-ai-crawlers.txt | 1 | # robots.txt — AI crawler controls template | COMMENT |
| LOW | …e-engine-optimization/templates/robots-ai-crawlers.txt | 21 | # User-agent: OAI-SearchBot | COMMENT |
| LOW | …e-engine-optimization/templates/robots-ai-crawlers.txt | 41 | # Disallow: / | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …catalog/skills/(cloud)/vercel-deploy/scripts/deploy.sh | 182 | # Check if input is a .tgz file or a directory | COMMENT |
| LOW | …catalog/skills/(cloud)/vercel-deploy/scripts/deploy.sh | 208 | # Check if this is a static HTML project (no package.json) | COMMENT |
| LOW | …s/(creation)/skill-architect/scripts/validate_skill.py | 433 | # Check if references are mentioned in body | COMMENT |
| LOW | …/skills/(quality)/web-quality-audit/scripts/analyze.sh | 73 | # Output results as JSON | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …/excalidraw-studio/scripts/split-excalidraw-library.py | 52 | Find the .excalidrawlib file in the given directory. Args: directory: Directory to search Returns | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | packages/skills-catalog/security-scan-allowlist.yaml | 2 | # This file contains approved exceptions for security warnings in skills. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …/nestjs-modular-monolith/scripts/validate-isolation.sh | 8 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …talog/skills/(monitoring)/sentry/scripts/sentry_api.py | 24 | CODE |