{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-14T00:15:30.038183Z","repo":{"ref":{"host":"github.com","owner":"Windy3f3f3f3f","name":"claude-code-from-scratch"},"default_branch":"main","clone_url":"https://github.com/Windy3f3f3f3f/claude-code-from-scratch.git","html_url":"https://github.com/Windy3f3f3f3f/claude-code-from-scratch","description":"Build your own Claude Code from scratch.  🔍 Claude Code 开源了 50 万行代码，读不动？用 ~5000 行 TypeScript / Python 从零复现核心架构，11 章分步教程带你理解 coding agent 精髓","stars":2832,"forks":560,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":2106,"primary_language":"Python","license_spdx":"MIT","created_at":"2026-03-31T12:26:06Z","pushed_at":"2026-11-09T05:43:12Z","security_policy_url":null,"distribution":{"owner_created_at":"2022-03-19T08:56:10Z","owner_type":"User","release_assets":[{"name":"demo.mp4","size":863367,"download_count":23,"release_tag":"v1.0.0","url":"https://github.com/Windy3f3f3f3f/claude-code-from-scratch/releases/download/v1.0.0/demo.mp4"}]}},"commit_sha":"acc4c34f062b9fbc289ef9cc2be339ba4e970347","profile":{"lines_by_language":{"Python":6649,"TypeScript":6498,"JavaScript":2421,"Shell":109},"files_by_category":{"source":62,"docs":56,"config":24,"test":23,"binary":3,"other":2,"generated":1},"source_lines":13707,"test_lines":1970},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.64,"coverage":1.0,"label":"possible","breakdown":{"attributed_share":0.0,"suspected_share":0.4654,"estimated_share":0.0,"ai_artifacts":5.0,"flagged_work_units":3.0,"flagged_releases":null},"summary":"Weak signals consistent with AI-assisted development."},"quality":{"score":51.5,"confidence":0.9,"coverage":1.0,"label":"weak","breakdown":{"complexity":46.7,"duplication":75.6,"lint":66.9,"testing":30.6,"docs":65.0,"type_safety":30.0,"process":null},"summary":"Code quality is weak: test-to-source ratio 0.14, no CI test run detected; 25% of function code in complex or long functions; 5% duplicated lines. Weakest area: type safety."},"security":{"score":62.0,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":96.7,"sast":32.4,"dependencies":79.2,"ci_actions":null,"posture":0.0,"scorecard":null},"summary":"Security posture is weak: 9 known vulnerabilities in 3 dependencies; 11 high-severity SAST findings. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":9.0,"checked":9.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":94.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":23100.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2026-03":{"loc":1386,"attributed_loc":0},"2026-04":{"loc":13621,"attributed_loc":0},"2026-05":{"loc":32,"attributed_loc":0},"2026-07":{"loc":7916,"attributed_loc":0},"2026-10":{"loc":145,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":5.0,"workflow_agents":0.0,"tools_configured":1.0,"earliest_adoption":1775744766.0},"findings":[],"evidence":[{"kind":"ai-artifact","description":".claude/agents/reviewer.md (claude-code configuration)","ref":".claude/agents/reviewer.md","url":"https://github.com/Windy3f3f3f3f/claude-code-from-scratch/blob/acc4c34f062b9fbc289ef9cc2be339ba4e970347/.claude/agents/reviewer.md","weight":0.5},{"kind":"ai-artifact","description":".claude/rules/chinese-greeting.md (claude-code configuration)","ref":".claude/rules/chinese-greeting.md","url":"https://github.com/Windy3f3f3f3f/claude-code-from-scratch/blob/acc4c34f062b9fbc289ef9cc2be339ba4e970347/.claude/rules/chinese-greeting.md","weight":0.5},{"kind":"ai-artifact","description":".claude/skills/commit/SKILL.md (claude-code configuration)","ref":".claude/skills/commit/SKILL.md","url":"https://github.com/Windy3f3f3f3f/claude-code-from-scratch/blob/acc4c34f062b9fbc289ef9cc2be339ba4e970347/.claude/skills/commit/SKILL.md","weight":0.5},{"kind":"ai-artifact","description":".claude/skills/greet/SKILL.md (claude-code configuration)","ref":".claude/skills/greet/SKILL.md","url":"https://github.com/Windy3f3f3f3f/claude-code-from-scratch/blob/acc4c34f062b9fbc289ef9cc2be339ba4e970347/.claude/skills/greet/SKILL.md","weight":0.5},{"kind":"ai-artifact","description":"CLAUDE.md (claude-code configuration)","ref":"CLAUDE.md","url":"https://github.com/Windy3f3f3f3f/claude-code-from-scratch/blob/acc4c34f062b9fbc289ef9cc2be339ba4e970347/CLAUDE.md","weight":0.5}],"data":{"artifacts":[{"tool":"claude-code","path":".claude/agents/reviewer.md","added_at":1775744766},{"tool":"claude-code","path":".claude/rules/chinese-greeting.md","added_at":1775744766},{"tool":"claude-code","path":".claude/skills/commit/SKILL.md","added_at":1775744766},{"tool":"claude-code","path":".claude/skills/greet/SKILL.md","added_at":1775744766},{"tool":"claude-code","path":"CLAUDE.md","added_at":1775744766}],"workflows":[],"tools":["claude-code"]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":20.0,"flagged_units":3.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":23100.0,"flagged_loc":10750.0,"flagged_loc_share":0.4653679653679654,"max_loc_per_hour":1243.9266565168466,"median_loc_per_hour":347.6853583593446,"pr_timed_units":0.0,"excluded_import_loc":0.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"5,220 lines of first-party code in ~4.2h (1,244 lines/hour, 2 commit session)","ref":"a485299eb5c86577eb32c3fa4bbd1b6383233cc9","url":"https://github.com/Windy3f3f3f3f/claude-code-from-scratch/commit/a485299eb5c86577eb32c3fa4bbd1b6383233cc9","weight":0.37317799695505394},{"kind":"velocity-burst","description":"3,363 lines of first-party code in ~4.0h (841 lines/hour, 1 commit session)","ref":"a51d9094301413d87e67afb43e487e152b6a5434","url":"https://github.com/Windy3f3f3f3f/claude-code-from-scratch/commit/a51d9094301413d87e67afb43e487e152b6a5434","weight":0.252225},{"kind":"velocity-burst","description":"2,167 lines of first-party code in ~4.0h (542 lines/hour, 1 commit session)","ref":"3abb945294760ae0dea401f16a8647d3e2d2b713","url":"https://github.com/Windy3f3f3f3f/claude-code-from-scratch/commit/3abb945294760ae0dea401f16a8647d3e2d2b713","weight":0.16252499999999998}],"data":{"flagged_loc_by_commit":{"a51d9094301413d87e67afb43e487e152b6a5434":3363,"f928e925ee0add39dcfd785bd8034979b1bdc72d":2610,"a485299eb5c86577eb32c3fa4bbd1b6383233cc9":2610,"3abb945294760ae0dea401f16a8647d3e2d2b713":2167},"excluded_import_commits":[]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":13707.0,"index":0.875,"count:narrated_steps":4.0,"per_kloc:narrated_steps":0.292,"files:narrated_steps":1.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":16.0,"per_kloc:emoji_in_code":1.167,"files:emoji_in_code":2.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 1: Deny rules always win — even bypassPermissions (--yolo) is","ref":"src/tools.ts:647","url":"https://github.com/Windy3f3f3f3f/claude-code-from-scratch/blob/acc4c34f062b9fbc289ef9cc2be339ba4e970347/src/tools.ts#L647","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 2: Plan mode's read-only contract beats allow rules and bypass:","ref":"src/tools.ts:655","url":"https://github.com/Windy3f3f3f3f/claude-code-from-scratch/blob/acc4c34f062b9fbc289ef9cc2be339ba4e970347/src/tools.ts#L655","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 3: Mode-specific logic","ref":"src/tools.ts:677","url":"https://github.com/Windy3f3f3f3f/claude-code-from-scratch/blob/acc4c34f062b9fbc289ef9cc2be339ba4e970347/src/tools.ts#L677","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 3: Built-in dangerous pattern checks","ref":"src/tools.ts:691","url":"https://github.com/Windy3f3f3f3f/claude-code-from-scratch/blob/acc4c34f062b9fbc289ef9cc2be339ba4e970347/src/tools.ts#L691","weight":0.0}],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":1.0,"secrets_low_confidence":0.0},"findings":[{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"en/docs/14-testing.md","line":51,"fingerprint":"en/docs/14-testing.md:generic-api-key:51"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":146.0,"findings_high":11.0,"findings_medium":135.0,"findings_low":0.0,"weighted_findings":44.1,"scanned_lines":13707.0,"parse_errors":1.0},"findings":[{"rule_id":"opengrep/python.lang.security.audit.dangerous-asyncio-create-exec-audit","severity":"high","message":"Detected 'create_subprocess_exec' function without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"python/mini_claude/mcp_client.py","line":41,"fingerprint":"python.lang.security.audit.dangerous-asyncio-create-exec-audit:python/mini_claude/mcp_client.py:41"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-asyncio-create-exec-tainted-env-args","severity":"high","message":"Detected 'create_subprocess_exec' function with user controlled data. You may consider using 'shlex.escape()'. [confidence low]","path":"python/mini_claude/mcp_client.py","line":41,"fingerprint":"python.lang.security.audit.dangerous-asyncio-create-exec-tainted-env-args:python/mini_claude/mcp_client.py:41"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"python/mini_claude/tools.py","line":356,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:python/mini_claude/tools.py:356"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"python/mini_claude/tools.py","line":428,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:python/mini_claude/tools.py:428"},{"rule_id":"opengrep/python.lang.security.audit.subprocess-shell-true","severity":"high","message":"Found 'subprocess' function 'run' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead. [confidence medium]","path":"python/mini_claude/tools.py","line":430,"fingerprint":"python.lang.security.audit.subprocess-shell-true:python/mini_claude/tools.py:430"},{"rule_id":"opengrep/javascript.lang.security.detect-child-process","severity":"high","message":"Detected calls to child_process from a function argument `input`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low]","path":"src/tools.ts","line":500,"fingerprint":"javascript.lang.security.detect-child-process:src/tools.ts:500"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"steps/canonical/py/mcp_client.py","line":15,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:steps/canonical/py/mcp_client.py:15"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"steps/canonical/py/tools.py","line":209,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:steps/canonical/py/tools.py:209"},{"rule_id":"opengrep/python.lang.security.audit.subprocess-shell-true","severity":"high","message":"Found 'subprocess' function 'run' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead. [confidence medium]","path":"steps/canonical/py/tools.py","line":209,"fingerprint":"python.lang.security.audit.subprocess-shell-true:steps/canonical/py/tools.py:209"},{"rule_id":"opengrep/javascript.lang.security.detect-child-process","severity":"high","message":"Detected calls to child_process from a function argument `command`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low]","path":"steps/canonical/ts/mcp.ts","line":14,"fingerprint":"javascript.lang.security.detect-child-process:steps/canonical/ts/mcp.ts:14"},{"rule_id":"opengrep/javascript.lang.security.detect-child-process","severity":"high","message":"Detected calls to child_process from a function argument `input`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low]","path":"steps/canonical/ts/tools.ts","line":209,"fingerprint":"javascript.lang.security.detect-child-process:steps/canonical/ts/tools.ts:209"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"python/mini_claude/tools.py","line":460,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:python/mini_claude/tools.py:460"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"src/agent.ts","line":1324,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:src/agent.ts:1324"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `toolName` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/agent.ts","line":1325,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/agent.ts:1325"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/autonomy.ts","line":461,"fingerprint":"javascript.lang.security.html-in-template-string:src/autonomy.ts:461"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/mcp.ts","line":260,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/mcp.ts:260"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/mcp.ts","line":262,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/mcp.ts:262"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `a` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/memory.ts","line":83,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/memory.ts:83"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"src/memory.ts","line":83,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:src/memory.ts:83"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `b` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/memory.ts","line":84,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/memory.ts:84"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"src/memory.ts","line":84,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:src/memory.ts:84"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `entry` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/memory.ts","line":98,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/memory.ts:98"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"src/memory.ts","line":98,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:src/memory.ts:98"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"src/memory.ts","line":104,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:src/memory.ts:104"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filename` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/memory.ts","line":105,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/memory.ts:105"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filename` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/memory.ts","line":106,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/memory.ts:106"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `h` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/memory.ts","line":263,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/memory.ts:263"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/memory.ts","line":346,"fingerprint":"javascript.lang.security.html-in-template-string:src/memory.ts:346"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `basePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/prompt.ts","line":38,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/prompt.ts:38"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `rawPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/prompt.ts","line":38,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/prompt.ts:38"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `basePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/prompt.ts","line":41,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/prompt.ts:41"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `rawPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/prompt.ts","line":41,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/prompt.ts:41"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"src/prompt.ts","line":52,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:src/prompt.ts:52"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `dir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/prompt.ts","line":53,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/prompt.ts:53"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `dir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/prompt.ts","line":55,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/prompt.ts:55"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `dir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/prompt.ts","line":62,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/prompt.ts:62"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"src/prompt.ts","line":62,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:src/prompt.ts:62"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"src/prompt.ts","line":62,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:src/prompt.ts:62"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/prompt.ts","line":237,"fingerprint":"javascript.lang.security.html-in-template-string:src/prompt.ts:237"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `id` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/session.ts","line":30,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/session.ts:30"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"src/session.ts","line":30,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:src/session.ts:30"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"src/session.ts","line":34,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:src/session.ts:34"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `id` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/session.ts","line":35,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/session.ts:35"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `id` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/session.ts","line":37,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/session.ts:37"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `f` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/session.ts","line":49,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/session.ts:49"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"src/session.ts","line":49,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:src/session.ts:49"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `baseDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/skills.ts","line":49,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/skills.ts:49"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `baseDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/skills.ts","line":52,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/skills.ts:52"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"src/skills.ts","line":56,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:src/skills.ts:56"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"src/skills.ts","line":56,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:src/skills.ts:56"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `baseDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/skills.ts","line":58,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/skills.ts:58"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"src/skills.ts","line":60,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:src/skills.ts:60"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `baseDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/skills.ts","line":61,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/skills.ts:61"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/skills.ts","line":74,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/skills.ts:74"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `dir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/subagent.ts","line":117,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/subagent.ts:117"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `dir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/subagent.ts","line":119,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/subagent.ts:119"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"src/subagent.ts","line":123,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:src/subagent.ts:123"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"src/subagent.ts","line":123,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:src/subagent.ts:123"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `dir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/subagent.ts","line":125,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/subagent.ts:125"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `input` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/tools.ts","line":277,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/tools.ts:277"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `input` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/tools.ts","line":291,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/tools.ts:291"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `input` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/tools.ts","line":291,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/tools.ts:291"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `input` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/tools.ts","line":292,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/tools.ts:292"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `input` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/tools.ts","line":379,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/tools.ts:379"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `input` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/tools.ts","line":393,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/tools.ts:393"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `pattern` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-control [confidence low]","path":"src/tools.ts","line":459,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:src/tools.ts:459"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `include` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-control [confidence low]","path":"src/tools.ts","line":465,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:src/tools.ts:465"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `d` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/tools.ts","line":470,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/tools.ts:470"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"src/tools.ts","line":473,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:src/tools.ts:473"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"src/tools.ts","line":473,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:src/tools.ts:473"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `d` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/tools.ts","line":475,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/tools.ts:475"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `d` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/tools.ts","line":479,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/tools.ts:479"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/tools.ts","line":569,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/tools.ts:569"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/tools.ts","line":571,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/tools.ts:571"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `input` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/tools.ts","line":698,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/tools.ts:698"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `input` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/tools.ts","line":701,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/tools.ts:701"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `input` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/tools.ts","line":754,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/tools.ts:754"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"src/tools.ts","line":757,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:src/tools.ts:757"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `input` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/tools.ts","line":758,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/tools.ts:758"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"src/tools.ts","line":762,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:src/tools.ts:762"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `input` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/tools.ts","line":764,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/tools.ts:764"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `input` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/tools.ts","line":768,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/tools.ts:768"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `input` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/tools.ts","line":774,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/tools.ts:774"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `input` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/tools.ts","line":776,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/tools.ts:776"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"src/tools.ts","line":781,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:src/tools.ts:781"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `input` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/tools.ts","line":782,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/tools.ts:782"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `input` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/tools.ts","line":786,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/tools.ts:786"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `input` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/tools.ts","line":795,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/tools.ts:795"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `input` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/tools.ts","line":796,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/tools.ts:796"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"steps/canonical/ts/skills.ts","line":13,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:steps/canonical/ts/skills.ts:13"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `input` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"steps/canonical/ts/skills.ts","line":14,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:steps/canonical/ts/skills.ts:14"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `input` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"steps/canonical/ts/skills.ts","line":15,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:steps/canonical/ts/skills.ts:15"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `input` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"steps/canonical/ts/tools.ts","line":97,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:steps/canonical/ts/tools.ts:97"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `input` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"steps/canonical/ts/tools.ts","line":99,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:steps/canonical/ts/tools.ts:99"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `input` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"steps/canonical/ts/tools.ts","line":113,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:steps/canonical/ts/tools.ts:113"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `input` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"steps/canonical/ts/tools.ts","line":125,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:steps/canonical/ts/tools.ts:125"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `input` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"steps/canonical/ts/tools.ts","line":125,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:steps/canonical/ts/tools.ts:125"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `input` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"steps/canonical/ts/tools.ts","line":126,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:steps/canonical/ts/tools.ts:126"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `input` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"steps/canonical/ts/tools.ts","line":139,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:steps/canonical/ts/tools.ts:139"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `input` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"steps/canonical/ts/tools.ts","line":149,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:steps/canonical/ts/tools.ts:149"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `pattern` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-control [confidence low]","path":"steps/canonical/ts/tools.ts","line":186,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:steps/canonical/ts/tools.ts:186"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `d` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"steps/canonical/ts/tools.ts","line":190,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:steps/canonical/ts/tools.ts:190"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"steps/canonical/ts/tools.ts","line":193,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:steps/canonical/ts/tools.ts:193"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"steps/canonical/ts/tools.ts","line":193,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:steps/canonical/ts/tools.ts:193"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `d` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"steps/canonical/ts/tools.ts","line":194,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:steps/canonical/ts/tools.ts:194"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `d` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"steps/canonical/ts/tools.ts","line":197,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:steps/canonical/ts/tools.ts:197"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"steps/docs-sync.mjs","line":43,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:steps/docs-sync.mjs:43"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"steps/docs-sync.mjs","line":43,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:steps/docs-sync.mjs:43"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"steps/docs-sync.mjs","line":43,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:steps/docs-sync.mjs:43"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `file` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"steps/docs-sync.mjs","line":44,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:steps/docs-sync.mjs:44"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `lang` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"steps/docs-sync.mjs","line":44,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:steps/docs-sync.mjs:44"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `step` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"steps/docs-sync.mjs","line":44,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:steps/docs-sync.mjs:44"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `file` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"steps/docs-sync.mjs","line":45,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:steps/docs-sync.mjs:45"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `lang` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"steps/docs-sync.mjs","line":45,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:steps/docs-sync.mjs:45"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `step` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"steps/docs-sync.mjs","line":45,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:steps/docs-sync.mjs:45"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"steps/docs-sync.mjs","line":71,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:steps/docs-sync.mjs:71"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"steps/docs-sync.mjs","line":71,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:steps/docs-sync.mjs:71"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"steps/docs-sync.mjs","line":71,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:steps/docs-sync.mjs:71"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"steps/docs-sync.mjs","line":71,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:steps/docs-sync.mjs:71"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"steps/docs-sync.mjs","line":71,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:steps/docs-sync.mjs:71"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"steps/docs-sync.mjs","line":71,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:steps/docs-sync.mjs:71"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `path` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"steps/docs-sync.mjs","line":115,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:steps/docs-sync.mjs:115"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `path` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"steps/docs-sync.mjs","line":131,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:steps/docs-sync.mjs:131"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `{ scenario, logPath } = {}` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"steps/mock-anthropic.mjs","line":100,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:steps/mock-anthropic.mjs:100"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `{ scenario, logPath } = {}` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"steps/mock-anthropic.mjs","line":116,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:steps/mock-anthropic.mjs:116"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `{ scenario, logPath } = {}` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"steps/mock-anthropic.mjs","line":133,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:steps/mock-anthropic.mjs:133"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `{ scenario, logPath } = {}` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"steps/mock-anthropic.mjs","line":139,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:steps/mock-anthropic.mjs:139"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `dir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"steps/run.mjs","line":84,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:steps/run.mjs:84"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `p` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"steps/test.mjs","line":37,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:steps/test.mjs:37"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `p` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"steps/test.mjs","line":37,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:steps/test.mjs:37"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"steps/test.mjs","line":42,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:steps/test.mjs:42"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `workdir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"steps/test.mjs","line":42,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:steps/test.mjs:42"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `workdir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"steps/test.mjs","line":42,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:steps/test.mjs:42"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"steps/test.mjs","line":47,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:steps/test.mjs:47"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"steps/test.mjs","line":51,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:steps/test.mjs:51"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"steps/test.mjs","line":62,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:steps/test.mjs:62"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"steps/test.mjs","line":65,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:steps/test.mjs:65"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"steps/test.mjs","line":77,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:steps/test.mjs:77"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"steps/test.mjs","line":112,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:steps/test.mjs:112"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `conf` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"steps/test.mjs","line":113,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:steps/test.mjs:113"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `conf` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"steps/test.mjs","line":167,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:steps/test.mjs:167"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"steps/test.mjs","line":167,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:steps/test.mjs:167"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `conf` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"steps/test.mjs","line":171,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:steps/test.mjs:171"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"steps/test.mjs","line":171,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:steps/test.mjs:171"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `[f]` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"steps/test.selfcheck.mjs","line":46,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:steps/test.selfcheck.mjs:46"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"steps/test.selfcheck.mjs","line":46,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:steps/test.selfcheck.mjs:46"}],"evidence":[],"data":{"rulesets":["python","typescript","javascript"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":3.0,"vulnerabilities":9.0,"vulns_critical":0.0,"vulns_high":5.0,"vulns_medium":4.0,"vulns_low":0.0,"vulns_unknown":0.0,"penalty":14.0},"findings":[{"rule_id":"osv/GHSA-3jxr-9vmj-r5cp","severity":"high","message":"brace-expansion@5.0.5 (npm) is affected by GHSA-3jxr-9vmj-r5cp","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@5.0.5 (npm):GHSA-3jxr-9vmj-r5cp"},{"rule_id":"osv/GHSA-6j4f-fj2g-mc7p","severity":"high","message":"brace-expansion@5.0.5 (npm) is affected by GHSA-6j4f-fj2g-mc7p","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@5.0.5 (npm):GHSA-6j4f-fj2g-mc7p"},{"rule_id":"osv/GHSA-mh99-v99m-4gvg","severity":"high","message":"brace-expansion@5.0.5 (npm) is affected by GHSA-mh99-v99m-4gvg","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@5.0.5 (npm):GHSA-mh99-v99m-4gvg"},{"rule_id":"osv/GHSA-qhr7-859c-m2p7","severity":"high","message":"brace-expansion@5.0.5 (npm) is affected by GHSA-qhr7-859c-m2p7","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@5.0.5 (npm):GHSA-qhr7-859c-m2p7"},{"rule_id":"osv/GHSA-rgw5-rvv9-x895","severity":"high","message":"brace-expansion@5.0.5 (npm) is affected by GHSA-rgw5-rvv9-x895","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@5.0.5 (npm):GHSA-rgw5-rvv9-x895"},{"rule_id":"osv/GHSA-jxxr-4gwj-5jf2","severity":"medium","message":"brace-expansion@5.0.5 (npm) is affected by GHSA-jxxr-4gwj-5jf2","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@5.0.5 (npm):GHSA-jxxr-4gwj-5jf2"},{"rule_id":"osv/GHSA-q2hr-2g5m-vwhr","severity":"medium","message":"brace-expansion@5.0.5 (npm) is affected by GHSA-q2hr-2g5m-vwhr","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@5.0.5 (npm):GHSA-q2hr-2g5m-vwhr"},{"rule_id":"osv/GHSA-3g3m-2fjr-6pw4","severity":"medium","message":"glob@11.1.0 (npm) is affected by GHSA-3g3m-2fjr-6pw4","path":"package-lock.json","line":null,"fingerprint":"glob@11.1.0 (npm):GHSA-3g3m-2fjr-6pw4"},{"rule_id":"osv/GHSA-g3hv-75wg-m249","severity":"medium","message":"minimatch@10.2.5 (npm) is affected by GHSA-g3hv-75wg-m249","path":"package-lock.json","line":null,"fingerprint":"minimatch@10.2.5 (npm):GHSA-g3hv-75wg-m249"}],"evidence":[],"data":{"ecosystems":["npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.0851,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":749.0,"function_nloc":8172.0,"mean_ccn":4.17,"p90_ccn":10.0,"complex_functions":30.0,"long_functions":6.0,"many_param_functions":1.0,"risky_nloc_share":0.2537},"findings":[],"evidence":[{"kind":"complex-function","description":"runScenario in steps/test.mjs: complexity 44, 55 lines","ref":"steps/test.mjs","url":"https://github.com/Windy3f3f3f3f/claude-code-from-scratch/blob/acc4c34f062b9fbc289ef9cc2be339ba4e970347/steps/test.mjs#L111","weight":0.7333333333333333},{"kind":"complex-function","description":"(anonymous) in src/cli.ts: complexity 41, 126 lines","ref":"src/cli.ts","url":"https://github.com/Windy3f3f3f3f/claude-code-from-scratch/blob/acc4c34f062b9fbc289ef9cc2be339ba4e970347/src/cli.ts#L193","weight":0.6833333333333333},{"kind":"complex-function","description":"_chat_openai in python/mini_claude/agent.py: complexity 40, 104 lines","ref":"python/mini_claude/agent.py","url":"https://github.com/Windy3f3f3f3f/claude-code-from-scratch/blob/acc4c34f062b9fbc289ef9cc2be339ba4e970347/python/mini_claude/agent.py#L1711","weight":0.6666666666666666},{"kind":"complex-function","description":"chatOpenAI in src/agent.ts: complexity 40, 117 lines","ref":"src/agent.ts","url":"https://github.com/Windy3f3f3f3f/claude-code-from-scratch/blob/acc4c34f062b9fbc289ef9cc2be339ba4e970347/src/agent.ts#L1898","weight":0.6666666666666666},{"kind":"complex-function","description":"run_repl in python/mini_claude/__main__.py: complexity 38, 102 lines","ref":"python/mini_claude/__main__.py","url":"https://github.com/Windy3f3f3f3f/claude-code-from-scratch/blob/acc4c34f062b9fbc289ef9cc2be339ba4e970347/python/mini_claude/__main__.py#L54","weight":0.6333333333333333},{"kind":"complex-function","description":"executeTool in src/tools.ts: complexity 38, 123 lines","ref":"src/tools.ts","url":"https://github.com/Windy3f3f3f3f/claude-code-from-scratch/blob/acc4c34f062b9fbc289ef9cc2be339ba4e970347/src/tools.ts#L746","weight":0.6333333333333333},{"kind":"complex-function","description":"_chat_anthropic in python/mini_claude/agent.py: complexity 31, 90 lines","ref":"python/mini_claude/agent.py","url":"https://github.com/Windy3f3f3f3f/claude-code-from-scratch/blob/acc4c34f062b9fbc289ef9cc2be339ba4e970347/python/mini_claude/agent.py#L1474","weight":0.5166666666666667},{"kind":"complex-function","description":"chatAnthropic in src/agent.ts: complexity 29, 99 lines","ref":"src/agent.ts","url":"https://github.com/Windy3f3f3f3f/claude-code-from-scratch/blob/acc4c34f062b9fbc289ef9cc2be339ba4e970347/src/agent.ts#L1638","weight":0.48333333333333334},{"kind":"complex-function","description":"execute_tool in python/mini_claude/tools.py: complexity 28, 55 lines","ref":"python/mini_claude/tools.py","url":"https://github.com/Windy3f3f3f3f/claude-code-from-scratch/blob/acc4c34f062b9fbc289ef9cc2be339ba4e970347/python/mini_claude/tools.py#L670","weight":0.4666666666666667},{"kind":"complex-function","description":"start_mock.do_POST in steps/mock_anthropic.py: complexity 26, 54 lines","ref":"steps/mock_anthropic.py","url":"https://github.com/Windy3f3f3f3f/claude-code-from-scratch/blob/acc4c34f062b9fbc289ef9cc2be339ba4e970347/steps/mock_anthropic.py#L70","weight":0.43333333333333335}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":10522.0,"duplicated_lines":490.0,"duplicated_share":0.0466,"files":62.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: python/mini_claude/__main__.py:230 and src/cli.ts:60","ref":"python/mini_claude/__main__.py","url":"https://github.com/Windy3f3f3f3f/claude-code-from-scratch/blob/acc4c34f062b9fbc289ef9cc2be339ba4e970347/python/mini_claude/__main__.py#L230","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: python/mini_claude/agent.py:105 and src/agent.ts:75","ref":"python/mini_claude/agent.py","url":"https://github.com/Windy3f3f3f3f/claude-code-from-scratch/blob/acc4c34f062b9fbc289ef9cc2be339ba4e970347/python/mini_claude/agent.py#L105","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: python/mini_claude/agent.py:416 and python/mini_claude/agent.py:1352","ref":"python/mini_claude/agent.py","url":"https://github.com/Windy3f3f3f3f/claude-code-from-scratch/blob/acc4c34f062b9fbc289ef9cc2be339ba4e970347/python/mini_claude/agent.py#L416","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: python/mini_claude/memory.py:351 and src/memory.ts:360","ref":"python/mini_claude/memory.py","url":"https://github.com/Windy3f3f3f3f/claude-code-from-scratch/blob/acc4c34f062b9fbc289ef9cc2be339ba4e970347/python/mini_claude/memory.py#L351","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: python/mini_claude/prompt.py:20 and src/prompt.ts:119","ref":"python/mini_claude/prompt.py","url":"https://github.com/Windy3f3f3f3f/claude-code-from-scratch/blob/acc4c34f062b9fbc289ef9cc2be339ba4e970347/python/mini_claude/prompt.py#L20","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: python/mini_claude/subagent.py:18 and src/subagent.ts:40","ref":"python/mini_claude/subagent.py","url":"https://github.com/Windy3f3f3f3f/claude-code-from-scratch/blob/acc4c34f062b9fbc289ef9cc2be339ba4e970347/python/mini_claude/subagent.py#L18","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/agent.ts:432 and src/agent.ts:1550","ref":"src/agent.ts","url":"https://github.com/Windy3f3f3f3f/claude-code-from-scratch/blob/acc4c34f062b9fbc289ef9cc2be339ba4e970347/src/agent.ts#L432","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/tools.ts:408 and steps/canonical/ts/tools.ts:158","ref":"src/tools.ts","url":"https://github.com/Windy3f3f3f3f/claude-code-from-scratch/blob/acc4c34f062b9fbc289ef9cc2be339ba4e970347/src/tools.ts#L408","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: steps/canonical/py/prompt.py:10 and steps/canonical/ts/prompt.ts:9","ref":"steps/canonical/py/prompt.py","url":"https://github.com/Windy3f3f3f3f/claude-code-from-scratch/blob/acc4c34f062b9fbc289ef9cc2be339ba4e970347/steps/canonical/py/prompt.py#L10","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":21.0,"weighted_findings":22.0,"scanned_lines":13707.0,"category:best-practice":5.0,"category:correctness":5.0,"category:maintainability":11.0},"findings":[{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"python/mini_claude/ui.py","line":123,"fingerprint":"python.lang.best-practice.arbitrary-sleep:python/mini_claude/ui.py:123"},{"rule_id":"opengrep/typescript.lang.correctness.useless-ternary","severity":"high","message":"It looks like no matter how this.anthropicClient is evaluated, this expression returns undefined. This is probably a copy-paste error.","path":"src/agent.ts","line":1584,"fingerprint":"typescript.lang.correctness.useless-ternary:src/agent.ts:1584"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_processing\" a function or an attribute? If it is a function, you may have meant agent.is_processing() because agent.is_processing is always true.","path":"python/mini_claude/__main__.py","line":103,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:python/mini_claude/__main__.py:103"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_sub_agent\" a function or an attribute? If it is a function, you may have meant self.is_sub_agent() because self.is_sub_agent is always true.","path":"python/mini_claude/agent.py","line":201,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:python/mini_claude/agent.py:201"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_sub_agent\" a function or an attribute? If it is a function, you may have meant self.is_sub_agent() because self.is_sub_agent is always true.","path":"python/mini_claude/agent.py","line":441,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:python/mini_claude/agent.py:441"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_sub_agent\" a function or an attribute? If it is a function, you may have meant self.is_sub_agent() because self.is_sub_agent is always true.","path":"python/mini_claude/agent.py","line":460,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:python/mini_claude/agent.py:460"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_sub_agent\" a function or an attribute? If it is a function, you may have meant self.is_sub_agent() because self.is_sub_agent is always true.","path":"python/mini_claude/agent.py","line":1438,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:python/mini_claude/agent.py:1438"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_sub_agent\" a function or an attribute? If it is a function, you may have meant self.is_sub_agent() because self.is_sub_agent is always true.","path":"python/mini_claude/agent.py","line":1493,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:python/mini_claude/agent.py:1493"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_sub_agent\" a function or an attribute? If it is a function, you may have meant self.is_sub_agent() because self.is_sub_agent is always true.","path":"python/mini_claude/agent.py","line":1516,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:python/mini_claude/agent.py:1516"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_sub_agent\" a function or an attribute? If it is a function, you may have meant self.is_sub_agent() because self.is_sub_agent is always true.","path":"python/mini_claude/agent.py","line":1544,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:python/mini_claude/agent.py:1544"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_sub_agent\" a function or an attribute? If it is a function, you may have meant self.is_sub_agent() because self.is_sub_agent is always true.","path":"python/mini_claude/agent.py","line":1730,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:python/mini_claude/agent.py:1730"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_sub_agent\" a function or an attribute? If it is a function, you may have meant self.is_sub_agent() because self.is_sub_agent is always true.","path":"python/mini_claude/agent.py","line":1735,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:python/mini_claude/agent.py:1735"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_sub_agent\" a function or an attribute? If it is a function, you may have meant self.is_sub_agent() because self.is_sub_agent is always true.","path":"python/mini_claude/agent.py","line":1765,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:python/mini_claude/agent.py:1765"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"steps/_pydriver.py","line":25,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:steps/_pydriver.py:25"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"steps/_pydriver.py","line":31,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:steps/_pydriver.py:31"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"steps/mock_anthropic.py","line":66,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:steps/mock_anthropic.py:66"},{"rule_id":"opengrep/python.lang.best-practice.pass-body-range","severity":"medium","message":"`pass` is the body of for _ in s.text_stream. Consider removing this or raise NotImplementedError() if this is a TODO","path":"steps/mock_anthropic.selftest.py","line":57,"fingerprint":"python.lang.best-practice.pass-body-range:steps/mock_anthropic.selftest.py:57"},{"rule_id":"opengrep/python.lang.correctness.useless-eqeq","severity":"low","message":"This expression is always True: `s == s` or `s != s`. If testing for floating point NaN, use `math.isnan(s)`, or `cmath.isnan(s)` if the number is complex.","path":"python/mini_claude/autonomy.py","line":232,"fingerprint":"python.lang.correctness.useless-eqeq:python/mini_claude/autonomy.py:232"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/autonomy.ts","line":37,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/autonomy.ts:37"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/autonomy.ts","line":37,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/autonomy.ts:37"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/memory.ts","line":378,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/memory.ts:378"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.2874,"check:ci_present":0.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.3404,"test_lines":1970.0,"source_lines":13707.0,"test_ratio":0.1437,"ci_files":0.0,"cochange_share":0.0851,"cochange_commits":47.0},"findings":[],"evidence":[],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":245.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.4998,"check:low_escape_density":0.0,"escapes":118.0,"escapes_per_kloc":9.279},"findings":[],"evidence":[{"kind":"typing","description":"TypeScript strict type checking: tsconfig.json","ref":"tsconfig.json","url":null,"weight":0.0}],"data":{},"error":null}],"flags":[]}