🥷 Engineering habits you already know, turned into skills AI assistants can run.
This report summarizes scanner evidence for tw93/Waza, a Python project with 7,241 GitHub stars. SynthScan examined 42,448 lines of code across 249 source files, recording 519 pattern matches distributed across 13 syntactic categories. The legacy adjusted pattern signal is 13.4 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 394 finding(s).
Are imports declared and package/API names verified? 99 finding(s).
Are wrappers, guards, and repeated structures necessary? 335 finding(s).
Which changes need focused human review? 519 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 519 distinct pattern matches across 13 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …ns/waza/skills/health/scripts/check_maintainability.py | 314 | def collapse_generated_mirrors( | CODE |
| LOW | …ns/waza/skills/health/scripts/check_maintainability.py | 396 | def has_substantive_instruction_evidence(path: Path, root: Path) -> bool: | CODE |
| LOW | …ns/waza/skills/health/scripts/check_maintainability.py | 535 | def shell_script_has_verifier_evidence(path: Path, root: Path) -> bool: | CODE |
| LOW | …ns/waza/skills/health/scripts/check_maintainability.py | 555 | def command_is_verifier_candidate(command: str) -> bool: | CODE |
| LOW | …ns/waza/skills/health/scripts/check_maintainability.py | 568 | def command_has_verifier_evidence( | CODE |
| LOW | …ns/waza/skills/health/scripts/check_maintainability.py | 699 | def strip_markdown_inline_code(line: str) -> str: | CODE |
| LOW | …ns/waza/skills/health/scripts/check_maintainability.py | 722 | def is_rustdoc_generated_link(source: Path, target: str, root: Path) -> bool: | CODE |
| LOW | …ns/waza/skills/health/scripts/check_maintainability.py | 739 | def actionable_inline_command_snippets(line: str) -> list[str]: | CODE |
| LOW | …gins/waza/skills/health/scripts/check_agent_context.py | 282 | def project_instruction_files(root: Path) -> list[Path]: | CODE |
| LOW | …gins/waza/skills/health/scripts/check_agent_context.py | 310 | def project_instructions_mode(settings_path: Path) -> str: | CODE |
| LOW | …gins/waza/skills/health/scripts/check_agent_context.py | 349 | def claude_delegates_to_agents(path: Path) -> bool: | CODE |
| LOW | …gins/waza/skills/health/scripts/check_agent_context.py | 705 | def summarize_skill_duplicates(root: Path, home: Path) -> tuple[str, list[str]]: | CODE |
| LOW | …gins/waza/skills/health/scripts/check_agent_context.py | 1205 | def hook_handler_enforces_pipe_block(path: Path) -> bool: | CODE |
| LOW | …gins/waza/skills/health/scripts/check_agent_context.py | 1310 | def has_task_scoped_env_policy(paths: list[Path]) -> bool: | CODE |
| LOW | …gins/waza/skills/health/scripts/check_agent_context.py | 1325 | def summarize_claude_permissions( | CODE |
| LOW | plugins/waza/skills/check/scripts/audit_signals.py | 345 | def _pyproject_script_entrypoints(root: Path) -> list[str]: | CODE |
| LOW | plugins/waza/skills/check/scripts/audit_signals.py | 404 | def _is_cli_contract_candidate(path: Path, root: Path) -> bool: | CODE |
| LOW | plugins/waza/skills/check/scripts/audit_signals.py | 439 | def block_cli_contract_surface(files: list[Path], root: Path) -> None: | CODE |
| LOW | plugins/waza/skills/check/scripts/release_gate.py | 182 | def latest_stable_reachable_tag(root: Path) -> str | None: | CODE |
| LOW⚡ | tests/python/test_write_release_notes_contract.py | 13 | def test_release_note_mode_is_artifact_bounded_and_outcome_sized() -> None: | CODE |
| LOW⚡ | tests/python/test_write_release_notes_contract.py | 23 | def test_release_note_mode_keeps_only_audience_useful_technical_terms() -> None: | CODE |
| LOW⚡ | tests/python/test_write_release_notes_contract.py | 31 | def test_release_guidance_does_not_turn_previous_item_count_into_a_quota() -> None: | CODE |
| LOW | tests/python/test_agent_context_effective.py | 44 | def test_disabled_plugins_are_not_reported_enabled(tmp_path: Path): | CODE |
| LOW | tests/python/test_agent_context_effective.py | 60 | def test_global_runtime_inventory_and_instruction_limit(tmp_path: Path): | CODE |
| LOW | tests/python/test_agent_context_effective.py | 84 | def test_runtime_plugin_sources_and_disabled_executables(tmp_path: Path): | CODE |
| LOW | tests/python/test_agent_context_effective.py | 99 | def test_runtime_inventory_tolerates_malformed_collections(tmp_path: Path): | CODE |
| LOW | tests/python/test_agent_context_effective.py | 108 | def test_codex_budget_charges_only_the_project_doc(tmp_path: Path): | CODE |
| LOW | tests/python/test_agent_context_effective.py | 120 | def test_codex_budget_is_absent_without_codex_home(tmp_path: Path): | CODE |
| LOW | tests/python/test_agent_context_effective.py | 130 | def test_codex_budget_uses_default_limit_without_config_toml(tmp_path: Path): | CODE |
| LOW | tests/python/test_agent_context_effective.py | 141 | def test_claude_project_mcp_disables_are_applied(tmp_path: Path): | CODE |
| LOW | tests/python/test_agent_context_effective.py | 158 | def test_claude_local_mcp_entry_outranks_project_and_user(tmp_path: Path): | CODE |
| LOW | tests/python/test_agent_context_effective.py | 199 | def test_hook_executable_skips_assignments_and_shell_builtins( | CODE |
| LOW | tests/python/test_agent_context_effective.py | 215 | def test_settings_mcpjson_rejects_apply_and_keep_user_server(tmp_path: Path): | CODE |
| LOW | tests/python/test_agent_context_effective.py | 230 | def test_mcpjson_reject_leaves_same_name_local_server_enabled(tmp_path: Path): | CODE |
| LOW | tests/python/test_agent_context_effective.py | 242 | def test_unapproved_mcpjson_server_is_pending(tmp_path: Path): | CODE |
| LOW | tests/python/test_agent_context_effective.py | 262 | def test_enable_all_project_mcp_servers_approves_mcpjson(tmp_path: Path): | CODE |
| LOW | tests/python/test_agent_context_effective.py | 271 | def test_plugin_mcp_server_honors_disabled_runtime_name(tmp_path: Path): | CODE |
| LOW | tests/python/test_agent_context_effective.py | 287 | def test_settings_mcp_servers_are_not_claude_sources(tmp_path: Path): | CODE |
| LOW | tests/python/test_agent_context_effective.py | 300 | def test_mcpjson_reject_does_not_disable_same_name_user_server(tmp_path: Path): | CODE |
| LOW | tests/python/test_agent_context_effective.py | 329 | def test_pipe_hook_floor_rejects_python_env_overrides(tmp_path: Path, prefix: str, credited: str): | CODE |
| LOW | tests/python/test_agent_context_effective.py | 378 | def test_effective_permissions_aliases_and_path_context_are_reported(tmp_path: Path): | CODE |
| LOW | tests/python/test_agent_context_effective.py | 427 | def test_same_runtime_skill_name_collision_remains_a_warning(tmp_path: Path): | CODE |
| LOW | tests/python/test_agent_context_effective.py | 443 | def test_divergent_cross_runtime_skill_requires_review(tmp_path: Path): | CODE |
| LOW | tests/python/test_agent_context_effective.py | 458 | def test_source_skills_are_inventory_not_active_claude_skills(tmp_path: Path): | CODE |
| LOW | tests/python/test_agent_context_effective.py | 472 | def test_task_scoped_env_instruction_can_replace_a_global_env_deny(tmp_path: Path): | CODE |
| LOW | tests/python/test_agent_context_effective.py | 497 | def test_oversized_path_rule_context_is_actionable(tmp_path: Path): | CODE |
| LOW | tests/python/test_agent_context_effective.py | 518 | def test_cjk_rule_size_is_not_hidden_by_whitespace_word_count(tmp_path: Path): | CODE |
| LOW | tests/python/test_agent_context_effective.py | 537 | def test_double_star_directory_prefix_matches_root_files(tmp_path: Path): | CODE |
| LOW | tests/python/test_agent_context_effective.py | 556 | def test_global_and_project_path_rules_share_the_effective_budget(tmp_path: Path): | CODE |
| LOW | tests/python/test_agent_context_effective.py | 579 | def test_effective_path_context_combines_overlapping_distinct_selectors( | CODE |
| LOW | tests/python/test_agent_context_effective.py | 608 | def test_missing_global_deny_categories_remain_visible(tmp_path: Path): | CODE |
| LOW | tests/python/test_agent_context_effective.py | 623 | def test_shared_and_local_project_settings_are_merged_into_effective_permissions( | CODE |
| LOW | tests/python/test_agent_context_effective.py | 647 | def test_absent_claude_settings_make_deny_floor_not_applicable(tmp_path: Path): | CODE |
| LOW | tests/python/test_agent_context_effective.py | 660 | def test_malformed_shared_settings_are_reported(tmp_path: Path): | CODE |
| LOW | tests/python/test_agent_context_effective.py | 675 | def test_substring_lookalikes_and_missing_hook_handler_do_not_false_pass( | CODE |
| LOW | tests/python/test_agent_context_effective.py | 720 | def test_existing_but_noop_pipe_hook_does_not_false_pass(tmp_path: Path): | CODE |
| LOW | tests/python/test_agent_context_effective.py | 739 | def test_misleading_hook_comments_and_disconnected_exit_do_not_false_pass( | CODE |
| LOW | tests/python/test_agent_context_effective.py | 762 | def test_unreachable_canonical_words_do_not_false_pass(tmp_path: Path): | CODE |
| LOW | tests/python/test_agent_context_effective.py | 784 | def test_wrong_matcher_does_not_enable_real_pipe_hook(tmp_path: Path): | CODE |
| LOW | tests/python/test_agent_context_effective.py | 799 | def test_absolute_shell_interpreter_executes_real_pipe_hook(tmp_path: Path): | CODE |
| 249 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | plugins/waza/skills/write/scripts/check_punctuation.py | 23 | CODE | |
| LOW | …ns/waza/skills/health/scripts/check_verifier_output.py | 11 | CODE | |
| LOW | …ugins/waza/skills/health/scripts/conversation_audit.py | 12 | CODE | |
| LOW | plugins/waza/skills/health/scripts/check_doc_refs.py | 11 | CODE | |
| LOW | …s/waza/skills/health/scripts/read_skill_description.py | 4 | CODE | |
| LOW | …ns/waza/skills/health/scripts/check_maintainability.py | 8 | CODE | |
| LOW | …gins/waza/skills/health/scripts/block-pipe-to-shell.py | 4 | CODE | |
| LOW | …gins/waza/skills/health/scripts/check_agent_context.py | 11 | CODE | |
| LOW | …gins/waza/skills/health/scripts/scan_skill_security.py | 4 | CODE | |
| LOW | plugins/waza/skills/read/scripts/fetch_local.py | 24 | CODE | |
| LOW | plugins/waza/skills/check/scripts/audit_signals.py | 14 | CODE | |
| LOW | plugins/waza/skills/check/scripts/release_gate.py | 15 | CODE | |
| LOW | tests/python/test_safe_install_docs.py | 3 | CODE | |
| LOW | tests/python/test_health_windows_launcher.py | 3 | CODE | |
| LOW | scripts/skill_checks.py | 14 | CODE | |
| LOW | scripts/skill_checks.py | 16 | CODE | |
| LOW | scripts/skill_checks.py | 16 | CODE | |
| LOW | scripts/skill_checks.py | 16 | CODE | |
| LOW | scripts/skill_checks.py | 16 | CODE | |
| LOW | scripts/skill_checks.py | 16 | CODE | |
| LOW | scripts/skill_checks.py | 16 | CODE | |
| LOW | scripts/skill_checks.py | 16 | CODE | |
| LOW | scripts/skill_checks.py | 16 | CODE | |
| LOW | scripts/skill_checks.py | 16 | CODE | |
| LOW | scripts/skill_checks.py | 16 | CODE | |
| LOW | scripts/skill_checks.py | 16 | CODE | |
| LOW | scripts/skill_checks.py | 16 | CODE | |
| LOW | scripts/skill_checks.py | 16 | CODE | |
| LOW | scripts/skill_checks.py | 16 | CODE | |
| LOW | scripts/skill_checks.py | 16 | CODE | |
| LOW | scripts/skill_checks.py | 16 | CODE | |
| LOW | scripts/skill_checks.py | 16 | CODE | |
| LOW | scripts/skill_checks.py | 16 | CODE | |
| LOW | scripts/skill_checks.py | 16 | CODE | |
| LOW | scripts/skill_checks.py | 16 | CODE | |
| LOW | scripts/skill_checks.py | 16 | CODE | |
| LOW | scripts/skill_checks.py | 16 | CODE | |
| LOW | scripts/skill_checks.py | 16 | CODE | |
| LOW | scripts/skill_checks.py | 16 | CODE | |
| LOW | scripts/skill_checks.py | 16 | CODE | |
| LOW | scripts/skill_checks.py | 16 | CODE | |
| LOW | scripts/skill_checks.py | 16 | CODE | |
| LOW | scripts/skill_checks.py | 16 | CODE | |
| LOW | scripts/skill_checks.py | 16 | CODE | |
| LOW | scripts/skill_checks.py | 16 | CODE | |
| LOW | scripts/skill_checks.py | 16 | CODE | |
| LOW | scripts/skill_checks.py | 16 | CODE | |
| LOW | scripts/skill_checks.py | 16 | CODE | |
| LOW | scripts/skill_checks.py | 16 | CODE | |
| LOW | scripts/skill_checks.py | 52 | CODE | |
| LOW | scripts/skill_checks.py | 52 | CODE | |
| LOW | scripts/skill_checks.py | 52 | CODE | |
| LOW | scripts/skill_checks.py | 52 | CODE | |
| LOW | scripts/skill_checks.py | 52 | CODE | |
| LOW | scripts/skill_checks.py | 52 | CODE | |
| LOW | scripts/skill_checks.py | 52 | CODE | |
| LOW | scripts/skill_checks.py | 52 | CODE | |
| LOW | scripts/skill_checks.py | 52 | CODE | |
| LOW | scripts/skill_checks.py | 52 | CODE | |
| LOW | scripts/skill_checks.py | 64 | CODE | |
| 25 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | plugins/waza/skills/write/scripts/check_punctuation.py | 63 | CODE | |
| LOW | plugins/waza/skills/write/scripts/check_punctuation.py | 305 | CODE | |
| LOW | …ugins/waza/skills/health/scripts/conversation_audit.py | 202 | CODE | |
| LOW | …ugins/waza/skills/health/scripts/conversation_audit.py | 296 | CODE | |
| LOW | …ugins/waza/skills/health/scripts/conversation_audit.py | 396 | CODE | |
| LOW | …ugins/waza/skills/health/scripts/conversation_audit.py | 504 | CODE | |
| LOW | …ugins/waza/skills/health/scripts/conversation_audit.py | 705 | CODE | |
| LOW | plugins/waza/skills/health/scripts/check_doc_refs.py | 163 | CODE | |
| LOW | …ns/waza/skills/health/scripts/check_maintainability.py | 267 | CODE | |
| LOW | …ns/waza/skills/health/scripts/check_maintainability.py | 314 | CODE | |
| LOW | …ns/waza/skills/health/scripts/check_maintainability.py | 488 | CODE | |
| LOW | …ns/waza/skills/health/scripts/check_maintainability.py | 662 | CODE | |
| LOW | …ns/waza/skills/health/scripts/check_maintainability.py | 747 | CODE | |
| LOW | …gins/waza/skills/health/scripts/block-pipe-to-shell.py | 86 | CODE | |
| LOW | …gins/waza/skills/health/scripts/block-pipe-to-shell.py | 240 | CODE | |
| LOW | …gins/waza/skills/health/scripts/block-pipe-to-shell.py | 261 | CODE | |
| LOW | …gins/waza/skills/health/scripts/check_agent_context.py | 398 | CODE | |
| LOW | …gins/waza/skills/health/scripts/check_agent_context.py | 458 | CODE | |
| LOW | …gins/waza/skills/health/scripts/check_agent_context.py | 705 | CODE | |
| LOW | …gins/waza/skills/health/scripts/check_agent_context.py | 841 | CODE | |
| LOW | …gins/waza/skills/health/scripts/check_agent_context.py | 910 | CODE | |
| LOW | …gins/waza/skills/health/scripts/check_agent_context.py | 1159 | CODE | |
| LOW | …gins/waza/skills/health/scripts/check_agent_context.py | 1173 | CODE | |
| LOW | …gins/waza/skills/health/scripts/scan_skill_security.py | 230 | CODE | |
| LOW | …gins/waza/skills/health/scripts/scan_skill_security.py | 446 | CODE | |
| LOW | plugins/waza/skills/read/scripts/fetch_feishu.py | 117 | CODE | |
| LOW | plugins/waza/skills/read/scripts/fetch_feishu.py | 147 | CODE | |
| LOW | plugins/waza/skills/check/scripts/audit_signals.py | 144 | CODE | |
| LOW | plugins/waza/skills/check/scripts/release_gate.py | 224 | CODE | |
| LOW | plugins/waza/skills/check/scripts/release_gate.py | 278 | CODE | |
| LOW | scripts/build_metadata.py | 417 | CODE | |
| LOW | scripts/markdown_fragments.py | 40 | CODE | |
| LOW | scripts/checks_content.py | 205 | CODE | |
| LOW | scripts/checks_content.py | 365 | CODE | |
| LOW | scripts/checks_content.py | 395 | CODE | |
| LOW | scripts/checks_content.py | 446 | CODE | |
| LOW | scripts/checks_content.py | 547 | CODE | |
| LOW | scripts/checks_routing.py | 87 | CODE | |
| LOW | scripts/validate_package.py | 266 | CODE | |
| LOW | skills/write/scripts/check_punctuation.py | 63 | CODE | |
| LOW | skills/write/scripts/check_punctuation.py | 305 | CODE | |
| LOW | skills/health/scripts/conversation_audit.py | 202 | CODE | |
| LOW | skills/health/scripts/conversation_audit.py | 296 | CODE | |
| LOW | skills/health/scripts/conversation_audit.py | 396 | CODE | |
| LOW | skills/health/scripts/conversation_audit.py | 504 | CODE | |
| LOW | skills/health/scripts/conversation_audit.py | 705 | CODE | |
| LOW | skills/health/scripts/check_doc_refs.py | 163 | CODE | |
| LOW | skills/health/scripts/check_maintainability.py | 267 | CODE | |
| LOW | skills/health/scripts/check_maintainability.py | 314 | CODE | |
| LOW | skills/health/scripts/check_maintainability.py | 488 | CODE | |
| LOW | skills/health/scripts/check_maintainability.py | 662 | CODE | |
| LOW | skills/health/scripts/check_maintainability.py | 747 | CODE | |
| LOW | skills/health/scripts/block-pipe-to-shell.py | 86 | CODE | |
| LOW | skills/health/scripts/block-pipe-to-shell.py | 240 | CODE | |
| LOW | skills/health/scripts/block-pipe-to-shell.py | 261 | CODE | |
| LOW | skills/health/scripts/check_agent_context.py | 398 | CODE | |
| LOW | skills/health/scripts/check_agent_context.py | 458 | CODE | |
| LOW | skills/health/scripts/check_agent_context.py | 705 | CODE | |
| LOW | skills/health/scripts/check_agent_context.py | 841 | CODE | |
| LOW | skills/health/scripts/check_agent_context.py | 910 | CODE | |
| 9 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | plugins/waza/skills/health/scripts/check_doc_refs.py | 0 | return true only for a regular file reached without any symlink hop. | STRING |
| HIGH | …ns/waza/skills/health/scripts/check_maintainability.py | 0 | return true only for a regular file reached without any symlink hop. | STRING |
| HIGH | plugins/waza/skills/check/scripts/audit_signals.py | 0 | return true only for a regular file reached without any symlink hop. | STRING |
| HIGH | skills/health/scripts/check_doc_refs.py | 0 | return true only for a regular file reached without any symlink hop. | STRING |
| HIGH | skills/health/scripts/check_maintainability.py | 0 | return true only for a regular file reached without any symlink hop. | STRING |
| HIGH | skills/check/scripts/audit_signals.py | 0 | return true only for a regular file reached without any symlink hop. | STRING |
| HIGH | plugins/waza/skills/health/scripts/check_doc_refs.py | 0 | return true only for a directory reached without any symlink hop. | STRING |
| HIGH | …ns/waza/skills/health/scripts/check_maintainability.py | 0 | return true only for a directory reached without any symlink hop. | STRING |
| HIGH | plugins/waza/skills/check/scripts/audit_signals.py | 0 | return true only for a directory reached without any symlink hop. | STRING |
| HIGH | skills/health/scripts/check_doc_refs.py | 0 | return true only for a directory reached without any symlink hop. | STRING |
| HIGH | skills/health/scripts/check_maintainability.py | 0 | return true only for a directory reached without any symlink hop. | STRING |
| HIGH | skills/check/scripts/audit_signals.py | 0 | return true only for a directory reached without any symlink hop. | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | plugins/waza/skills/read/scripts/fetch_weixin.py | 31 | return {"error": str(e) + "\nRun: pip install playwright beautifulsoup4 lxml && playwright install chromium"} | CODE |
| HIGH | plugins/waza/skills/read/scripts/fetch_feishu.py | 41 | "(npm install -g @larksuite/cli && lark-cli auth login), then run " | CODE |
| HIGH | tests/python/test_agent_context_effective.py | 184 | ("FOO=1 && true", None, "hook_executable="), | CODE |
| HIGH | tests/python/test_agent_context_effective.py | 770 | "if false && test -n 'tool_input command curl wget [|] bash'; then\n" | CODE |
| HIGH | tests/python/test_health_maintainability_regressions.py | 132 | default: "npm run lint && npm run typecheck", | CODE |
| HIGH | skills/read/scripts/fetch_weixin.py | 31 | return {"error": str(e) + "\nRun: pip install playwright beautifulsoup4 lxml && playwright install chromium"} | CODE |
| HIGH | skills/read/scripts/fetch_feishu.py | 41 | "(npm install -g @larksuite/cli && lark-cli auth login), then run " | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …ns/waza/skills/health/scripts/check_maintainability.py | 295 | except OSError: | CODE |
| HIGH | …gins/waza/skills/health/scripts/scan_skill_security.py | 122 | except OSError: | CODE |
| HIGH | plugins/waza/skills/check/scripts/audit_signals.py | 161 | except OSError: | CODE |
| HIGH | skills/health/scripts/check_maintainability.py | 295 | except OSError: | CODE |
| HIGH | skills/health/scripts/scan_skill_security.py | 122 | except OSError: | CODE |
| HIGH | skills/check/scripts/audit_signals.py | 161 | except OSError: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | plugins/waza/skills/health/SKILL.md | 47 | ## Step 0: Establish the evidence basis | COMMENT |
| LOW | plugins/waza/skills/health/SKILL.md | 60 | ## Step 1: Collect data | COMMENT |
| LOW | plugins/waza/skills/health/SKILL.md | 137 | ## Step 2: Analyze | COMMENT |
| LOW | skills/health/SKILL.md | 47 | ## Step 0: Establish the evidence basis | COMMENT |
| LOW | skills/health/SKILL.md | 60 | ## Step 1: Collect data | COMMENT |
| LOW | skills/health/SKILL.md | 137 | ## Step 2: Analyze | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | plugins/waza/skills/write/SKILL.md | 71 | - **Rendering check**: Placeholder text remaining (`Lorem ipsum`, `TODO`, `[TBD]`), broken image links. | CODE |
| LOW | plugins/waza/skills/ui/references/design-reference.md | 42 | - No Lorem Ipsum. Write short real copy that matches the layout's reading level. | CODE |
| LOW⚡ | tests/test_maintainability.sh | 518 | fake_token="ghp_$(printf 'A%.0s' {1..16})" | CODE |
| LOW⚡ | tests/test_maintainability.sh | 526 | " - run: TOKEN=$fake_token /Users/example/private/check.sh" \ | CODE |
| LOW⚡ | tests/test_maintainability.sh | 531 | if grep -qE "$fake_token|/Users/example" "$tmpdir/redacted-ci.out"; then | CODE |
| LOW | skills/write/SKILL.md | 71 | - **Rendering check**: Placeholder text remaining (`Lorem ipsum`, `TODO`, `[TBD]`), broken image links. | CODE |
| LOW | skills/ui/references/design-reference.md | 42 | - No Lorem Ipsum. Write short real copy that matches the layout's reading level. | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | plugins/waza/skills/health/scripts/collect-data.sh | 900 | except Exception: | CODE |
| LOW | plugins/waza/skills/read/scripts/fetch_weixin.py | 42 | except Exception as e: | CODE |
| LOW | scripts/setup-statusline.sh | 83 | except Exception as exc: | CODE |
| MEDIUM | scripts/setup-statusline.sh | 84 | print(f"Error: {path} is not valid JSON. Refusing to modify it.", file=sys.stderr) | CODE |
| LOW | skills/health/scripts/collect-data.sh | 900 | except Exception: | CODE |
| LOW | skills/read/scripts/fetch_weixin.py | 42 | except Exception as e: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | plugins/waza/skills/health/scripts/collect-data.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | plugins/waza/skills/read/scripts/fetch.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tests/test_helpers.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | scripts/setup-rule.sh | 1 | #!/bin/bash | COMMENT |
| LOW | skills/health/scripts/collect-data.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | skills/read/scripts/fetch.sh | 1 | #!/usr/bin/env bash | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | plugins/waza/skills/read/scripts/fetch.sh | 22 | # Usage: | COMMENT |
| LOW | scripts/setup-rule.sh | 5 | # Usage: | COMMENT |
| LOW | skills/read/scripts/fetch.sh | 22 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | README.md | 123 | # Anti-patterns: always-on cross-skill guardrails (read before acting, no scope creep, no unsolicited summaries) | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …ugins/waza/skills/health/scripts/conversation_audit.py | 296 | def update_tool_receipts(record: dict[str, object], stats: ScanStats) -> None: | CODE |
| LOW | skills/health/scripts/conversation_audit.py | 296 | def update_tool_receipts(record: dict[str, object], stats: ScanStats) -> None: | CODE |