{"data":{"skill":{"slug":"alexmacapple-synthese-multi-llm","name":"synthese-multi-llm","icon":"📩","repo":"https://github.com/Alexmacapple/Synthese-Council/tree/main/skills/synthese-multi-llm","status":"approved","author":"Alexmacapple","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"af87dd7d-e74f-47cb-9a3e-48985d220ba9","skill_id":"bdadc5d1-75ac-4fb5-9cf6-6acadb73456d","version":7,"content_hash":"b54c60c943a049878d8f117c734986d4","risk_level":"high","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"confirmation_required","manual_install_policy":"allowed","summary":"Most weak cryptography, obfuscation, and markdown command findings are false positives caused by French prose, documentation, or sanitizer patterns. Confirmed risks remain: the skill executes local CLIs and wrappers, reads API keys from environment variables, makes outbound network calls, and writes cache or audit files. No prompt injection text was found in the skill files.","remediation":[{"issue":"External command execution through CLIs, wrappers, and custom backend configuration.","severity":"high","suggestion":"Restrict commands to an explicit allowlist, require user confirmation for wrappers, and document exactly which CLIs run."},{"issue":"API key handling appears in code, shell wrappers, and troubleshooting guidance.","severity":"high","suggestion":"Remove guidance that prints API key fragments, avoid displaying masked keys, and prefer environment-only credential storage."},{"issue":"Audit trails and cache files can persist source text and model responses.","severity":"high","suggestion":"Make persistence opt-in for sensitive workflows, add redaction controls, and document retention and deletion steps."},{"issue":"User-supplied URLs are fetched and converted into model prompts.","severity":"medium","suggestion":"Validate URL schemes and hosts, block local network targets by default, and warn about remote prompt injection."},{"issue":"Custom CLI backends inherit the process environment.","severity":"medium","suggestion":"Pass a minimal environment to child processes and require explicit opt-in for each secret needed by a backend."}],"risk_factor_evidence":[{"factor":"env_access","evidence":[{"file":"references/configuration.md","line_end":128,"line_start":128},{"file":"references/troubleshooting.md","line_end":64,"line_start":64},{"file":"references/troubleshooting.md","line_end":69,"line_start":69},{"file":"references/troubleshooting.md","line_end":75,"line_start":75},{"file":"scripts/backends/anthropic_backend.py","line_end":108,"line_start":108},{"file":"scripts/backends/anthropic_backend.py","line_end":314,"line_start":314},{"file":"scripts/backends/anthropic_backend.py","line_end":108,"line_start":108},{"file":"scripts/backends/anthropic_backend.py","line_end":314,"line_start":314},{"file":"scripts/backends/anthropic_backend.py","line_end":9,"line_start":9},{"file":"scripts/backends/anthropic_backend.py","line_end":64,"line_start":64},{"file":"scripts/backends/anthropic_backend.py","line_end":65,"line_start":65},{"file":"scripts/backends/anthropic_backend.py","line_end":77,"line_start":77},{"file":"scripts/backends/anthropic_backend.py","line_end":85,"line_start":85},{"file":"scripts/backends/anthropic_backend.py","line_end":89,"line_start":89},{"file":"scripts/backends/anthropic_backend.py","line_end":106,"line_start":106},{"file":"scripts/backends/anthropic_backend.py","line_end":108,"line_start":108},{"file":"scripts/backends/anthropic_backend.py","line_end":116,"line_start":116},{"file":"scripts/backends/anthropic_backend.py","line_end":121,"line_start":121},{"file":"scripts/backends/anthropic_backend.py","line_end":135,"line_start":135},{"file":"scripts/backends/anthropic_backend.py","line_end":140,"line_start":140},{"file":"scripts/backends/anthropic_backend.py","line_end":170,"line_start":170},{"file":"scripts/backends/anthropic_backend.py","line_end":314,"line_start":314},{"file":"scripts/backends/anthropic_backend.py","line_end":315,"line_start":315},{"file":"scripts/backends/anthropic_backend.py","line_end":316,"line_start":316},{"file":"scripts/backends/anthropic_backend.py","line_end":319,"line_start":319},{"file":"scripts/backends/cli_backend.py","line_end":151,"line_start":151},{"file":"scripts/backends/cli_backend.py","line_end":275,"line_start":275},{"file":"scripts/backends/cli_backend.py","line_end":276,"line_start":276},{"file":"scripts/backends/cli_backend.py","line_end":277,"line_start":277},{"file":"scripts/config.py","line_end":514,"line_start":514},{"file":"scripts/config.py","line_end":533,"line_start":533},{"file":"scripts/convergence.py","line_end":376,"line_start":376},{"file":"scripts/synthese.py","line_end":1692,"line_start":1692},{"file":"scripts/synthese.py","line_end":1711,"line_start":1711},{"file":"scripts/synthese.py","line_end":1713,"line_start":1713},{"file":"scripts/synthese.py","line_end":1714,"line_start":1714},{"file":"scripts/synthese.py","line_end":1715,"line_start":1715},{"file":"scripts/synthese.py","line_end":2115,"line_start":2115},{"file":"scripts/synthese.py","line_end":2616,"line_start":2616},{"file":"scripts/synthese.py","line_end":3128,"line_start":3128},{"file":"scripts/synthese.py","line_end":3449,"line_start":3449},{"file":"scripts/synthese.py","line_end":3491,"line_start":3491},{"file":"scripts/synthese.py","line_end":1159,"line_start":1159},{"file":"scripts/synthese.py","line_end":1765,"line_start":1765},{"file":"wrappers/claude_wrapper.sh","line_end":9,"line_start":9},{"file":"wrappers/claude_wrapper.sh","line_end":23,"line_start":23},{"file":"wrappers/claude_wrapper.sh","line_end":24,"line_start":24},{"file":"wrappers/claude_wrapper.sh","line_end":42,"line_start":42},{"file":"wrappers/README.md","line_end":16,"line_start":16},{"file":"wrappers/README.md","line_end":45,"line_start":45},{"file":"wrappers/README.md","line_end":115,"line_start":115}]},{"factor":"scripts","evidence":[{"file":"scripts/backends/__init__.py","line_end":26,"line_start":22},{"file":"scripts/backends/__init__.py","line_end":35,"line_start":30},{"file":"scripts/backends/__init__.py","line_end":46,"line_start":41},{"file":"scripts/synthese.py","line_end":96,"line_start":93},{"file":"scripts/synthese.py","line_end":118,"line_start":113},{"file":"scripts/synthese.py","line_end":132,"line_start":129},{"file":"scripts/synthese.py","line_end":142,"line_start":139},{"file":"scripts/synthese.py","line_end":152,"line_start":149},{"file":"scripts/synthese.py","line_end":163,"line_start":159}]},{"factor":"external_commands","evidence":[{"file":"scripts/backends/cli_backend.py","line_end":109,"line_start":109},{"file":"scripts/sanitize.py","line_end":42,"line_start":27},{"file":"scripts/sanitize.py","line_end":42,"line_start":42},{"file":"scripts/sanitize.py","line_end":180,"line_start":180},{"file":"scripts/sanitize.py","line_end":41,"line_start":28},{"file":"scripts/sanitize.py","line_end":41,"line_start":41},{"file":"scripts/sanitize.py","line_end":42,"line_start":27},{"file":"scripts/synthese.py","line_end":1229,"line_start":1229},{"file":"scripts/synthese.py","line_end":1317,"line_start":1317},{"file":"scripts/synthese.py","line_end":2851,"line_start":2851},{"file":"scripts/synthese.py","line_end":2890,"line_start":2890},{"file":"SKILL.md","line_end":32,"line_start":20},{"file":"SKILL.md","line_end":36,"line_start":32},{"file":"SKILL.md","line_end":38,"line_start":36},{"file":"SKILL.md","line_end":54,"line_start":38},{"file":"SKILL.md","line_end":70,"line_start":54},{"file":"SKILL.md","line_end":76,"line_start":70},{"file":"SKILL.md","line_end":77,"line_start":76},{"file":"SKILL.md","line_end":78,"line_start":77},{"file":"SKILL.md","line_end":79,"line_start":78},{"file":"SKILL.md","line_end":80,"line_start":79},{"file":"SKILL.md","line_end":81,"line_start":80},{"file":"SKILL.md","line_end":82,"line_start":81},{"file":"SKILL.md","line_end":83,"line_start":82},{"file":"SKILL.md","line_end":84,"line_start":83},{"file":"SKILL.md","line_end":98,"line_start":84},{"file":"SKILL.md","line_end":115,"line_start":98},{"file":"SKILL.md","line_end":146,"line_start":115},{"file":"SKILL.md","line_end":157,"line_start":146},{"file":"SKILL.md","line_end":159,"line_start":157},{"file":"SKILL.md","line_end":175,"line_start":159},{"file":"SKILL.md","line_end":185,"line_start":175},{"file":"SKILL.md","line_end":191,"line_start":185},{"file":"SKILL.md","line_end":195,"line_start":191},{"file":"SKILL.md","line_end":198,"line_start":195},{"file":"SKILL.md","line_end":202,"line_start":198},{"file":"SKILL.md","line_end":205,"line_start":202},{"file":"wrappers/claude_wrapper.sh","line_end":37,"line_start":37},{"file":"wrappers/claude_wrapper.sh","line_end":50,"line_start":40},{"file":"wrappers/claude_wrapper.sh","line_end":1,"line_start":1},{"file":"wrappers/ollama_wrapper.sh","line_end":37,"line_start":37},{"file":"wrappers/ollama_wrapper.sh","line_end":46,"line_start":40},{"file":"wrappers/ollama_wrapper.sh","line_end":1,"line_start":1},{"file":"wrappers/README.md","line_end":57,"line_start":57},{"file":"wrappers/README.md","line_end":142,"line_start":142}]},{"factor":"network","evidence":[{"file":"scripts/config.py","line_end":382,"line_start":382},{"file":"scripts/synthese.py","line_end":836,"line_start":836},{"file":"scripts/synthese.py","line_end":848,"line_start":848},{"file":"scripts/synthese.py","line_end":1162,"line_start":1162},{"file":"SKILL.md","line_end":219,"line_start":219},{"file":"wrappers/claude_wrapper.sh","line_end":20,"line_start":20},{"file":"wrappers/ollama_wrapper.sh","line_end":13,"line_start":13},{"file":"wrappers/ollama_wrapper.sh","line_end":19,"line_start":19},{"file":"wrappers/README.md","line_end":96,"line_start":96},{"file":"wrappers/README.md","line_end":97,"line_start":97}]},{"factor":"filesystem","evidence":[{"file":"scripts/config.py","line_end":7,"line_start":7},{"file":"scripts/config.py","line_end":168,"line_start":168},{"file":"scripts/config.py","line_end":7,"line_start":7},{"file":"scripts/config.py","line_end":168,"line_start":168},{"file":"scripts/synthese.py","line_end":326,"line_start":326},{"file":"scripts/synthese.py","line_end":362,"line_start":362},{"file":"scripts/synthese.py","line_end":374,"line_start":374},{"file":"scripts/synthese.py","line_end":708,"line_start":708},{"file":"scripts/synthese.py","line_end":2680,"line_start":2680},{"file":"scripts/synthese.py","line_end":2716,"line_start":2716},{"file":"wrappers/ollama_wrapper.sh","line_end":30,"line_start":30}]}],"critical_findings":[],"high_findings":[{"title":"Weak cryptographic algorithm","locations":[{"file":"references/cadrage.md","line_end":7,"line_start":7}],"confidence":1,"description":"Une synthĂšse sans cadrage est un rĂ©sumĂ© hors contexte. Le mĂȘme texte peut donner des synthĂšses radic","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"references/cadrage.md","line_end":59,"line_start":59}],"confidence":1,"description":"**Attention** : Une longueur trop courte force Ă  des choix qui peuvent crĂ©er des glissements.","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"references/cadrage.md","line_end":71,"line_start":71}],"confidence":1,"description":"| Neutre | Équilibre des positions | MĂ©diation |","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"references/configuration.md","line_end":65,"line_start":65}],"confidence":1,"description":"| `cache.ttl` | 3600 | DurĂ©e de vie des entrĂ©es (secondes) |","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"references/configuration.md","line_end":89,"line_start":89}],"confidence":1,"description":"## RĂŽles des experts","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"references/configuration.md","line_end":131,"line_start":131}],"confidence":1,"description":"| `SYNTHESE_TRAIL_DIR` | Override du rĂ©pertoire des trails |","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"references/configuration.md","line_end":135,"line_start":135}],"confidence":1,"description":"- [troubleshooting.md](troubleshooting.md) - RĂ©solution des problĂšmes","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"references/glissements.md","line_end":1,"line_start":1}],"confidence":1,"description":"# Catalogue des glissements sĂ©mantiques","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"references/glissements.md","line_end":12,"line_start":12}],"confidence":1,"description":"- Source : \"simplification des procĂ©dures\"","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"references/glissements.md","line_end":39,"line_start":39}],"confidence":1,"description":"**DĂ©finition** : Effacer des nuances ou des rĂ©serves.","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"references/glissements.md","line_end":52,"line_start":52}],"confidence":1,"description":"- Source : \"malgrĂ© les progrĂšs, des dĂ©fis persistent\"","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"references/metrics.md","line_end":5,"line_start":5}],"confidence":1,"description":"Le skill expose des mĂ©triques pour le monitoring opĂ©rationnel et l'optimisation des performances.","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"references/metrics.md","line_end":26,"line_start":26}],"confidence":1,"description":"| Warning | `0.1 <= hit_rate < 0.3` | VĂ©rifier la diversitĂ© des prompts |","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"references/metrics.md","line_end":60,"line_start":60}],"confidence":1,"description":"| `reasons` | list[str] | Raisons des retries |","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"references/metrics.md","line_end":115,"line_start":115}],"confidence":1,"description":"## Export des mĂ©triques","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"references/metrics.md","line_end":146,"line_start":146}],"confidence":1,"description":"2. **Suivi des retries** : Des retries frĂ©quents sur un modĂšle suggĂšrent un problĂšme","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Generic API/secret keys","locations":[{"file":"references/troubleshooting.md","line_end":75,"line_start":75}],"confidence":0.86,"description":"1. VĂ©rifier la clĂ© : `echo $ANTHROPIC_API_KEY | head -c 20`","review_kind":"capability","source_category":"env_access","source_severity":"high","confidence_reasoning":"The troubleshooting guide tells users to print the first part of ANTHROPIC_API_KEY. Even partial credential disclosure can leak through logs, history, or screenshots."},{"title":"Weak cryptographic algorithm","locations":[{"file":"references/troubleshooting.md","line_end":3,"line_start":3}],"confidence":1,"description":"Guide de rĂ©solution des problĂšmes courants.","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"references/troubleshooting.md","line_end":106,"line_start":106}],"confidence":1,"description":"**SymptĂŽme** : Les modĂšles produisent des analyses trĂšs divergentes.","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"references/troubleshooting.md","line_end":116,"line_start":116}],"confidence":1,"description":"3. Utiliser `--mode critique` pour analyse dĂ©taillĂ©e des divergences","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"references/troubleshooting.md","line_end":136,"line_start":136}],"confidence":1,"description":"**SymptĂŽme** : Le Gardien signale des glissements sĂ©mantiques.","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"references/troubleshooting.md","line_end":138,"line_start":138}],"confidence":1,"description":"**Explication** : Des termes ont Ă©tĂ© substituĂ©s ou le sens a Ă©tĂ© altĂ©rĂ©.","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"references/troubleshooting.md","line_end":220,"line_start":220}],"confidence":1,"description":"- [modes.md](modes.md) - DĂ©tail des modes de synthĂšse","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Generic API/secret keys","locations":[{"file":"scripts/backends/anthropic_backend.py","line_end":108,"line_start":108}],"confidence":0.9,"description":"return self._api_key or os.getenv(\"ANTHROPIC_API_KEY\")","review_kind":"capability","source_category":"env_access","source_severity":"high","confidence_reasoning":"The backend reads ANTHROPIC_API_KEY from the process environment. This is expected for API use, but it confirms secret-bearing environment access."},{"title":"Generic API/secret keys","locations":[{"file":"scripts/backends/anthropic_backend.py","line_end":121,"line_start":121}],"confidence":0.78,"description":"if not self.api_key:","review_kind":"capability","source_category":"env_access","source_severity":"high","confidence_reasoning":"The availability check calls the api_key property and depends on a secret being present. This is legitimate credential handling, but still a security-sensitive path."},{"title":"Generic API/secret keys","locations":[{"file":"scripts/backends/anthropic_backend.py","line_end":140,"line_start":140}],"confidence":0.68,"description":"api_key: \"sk-ant-...\"","review_kind":"capability","source_category":"env_access","source_severity":"high","confidence_reasoning":"The configuration help suggests placing an API key in YAML. That can persist credentials in files that may be copied or committed."},{"title":"Generic API/secret keys","locations":[{"file":"scripts/backends/anthropic_backend.py","line_end":170,"line_start":170}],"confidence":0.9,"description":"self._client = anthropic.Anthropic(api_key=self.api_key)","review_kind":"capability","source_category":"env_access","source_severity":"high","confidence_reasoning":"The Anthropic client is created with the API key and can send source content to the external provider. Credential use is confirmed and should be documented."},{"title":"Generic API/secret keys","locations":[{"file":"scripts/backends/anthropic_backend.py","line_end":314,"line_start":314}],"confidence":0.9,"description":"api_key = os.getenv(\"ANTHROPIC_API_KEY\")","review_kind":"capability","source_category":"env_access","source_severity":"high","confidence_reasoning":"The backend reads ANTHROPIC_API_KEY from the process environment. This is expected for API use, but it confirms secret-bearing environment access."},{"title":"Generic API/secret keys","locations":[{"file":"scripts/backends/anthropic_backend.py","line_end":319,"line_start":319}],"confidence":0.82,"description":"masked_key = api_key[:10] + \"...\" + api_key[-4:] if len(api_key) > 14 else \"***\"","review_kind":"capability","source_category":"env_access","source_severity":"high","confidence_reasoning":"The code constructs a masked API key string for display. Partial key display reduces exposure, but still leaks credential fragments into output."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/backends/base.py","line_end":94,"line_start":94}],"confidence":1,"description":"- PrĂ©sence des dĂ©pendances (packages)","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/backends/base.py","line_end":150,"line_start":150}],"confidence":1,"description":"Registre des backends disponibles.","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/backends/base.py","line_end":206,"line_start":206}],"confidence":1,"description":"Liste des backends dont is_available() == True","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/backends/base.py","line_end":221,"line_start":221}],"confidence":1,"description":"Liste les noms des backends enregistrĂ©s.","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/backends/base.py","line_end":224,"line_start":224}],"confidence":1,"description":"Liste des noms","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Configuration library","locations":[{"file":"scripts/backends/cli_backend.py","line_end":275,"line_start":275}],"confidence":0.86,"description":"command=config.get(\"command\", cli_name),","review_kind":"capability","source_category":"env_access","source_severity":"low","confidence_reasoning":"The CLI backend accepts command, args, and env values from configuration. A malicious or mistaken config can execute local programs with chosen environment variables."},{"title":"Configuration library","locations":[{"file":"scripts/backends/cli_backend.py","line_end":276,"line_start":276}],"confidence":0.86,"description":"args=config.get(\"args\", []),","review_kind":"capability","source_category":"env_access","source_severity":"low","confidence_reasoning":"The CLI backend accepts command, args, and env values from configuration. A malicious or mistaken config can execute local programs with chosen environment variables."},{"title":"Configuration library","locations":[{"file":"scripts/backends/cli_backend.py","line_end":277,"line_start":277}],"confidence":0.86,"description":"env=config.get(\"env\", {})","review_kind":"capability","source_category":"env_access","source_severity":"low","confidence_reasoning":"The CLI backend accepts command, args, and env values from configuration. A malicious or mistaken config can execute local programs with chosen environment variables."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/backends/cli_backend.py","line_end":3,"line_start":3}],"confidence":1,"description":"PRD-008 Story 8.3: Support des CLI wrappers personnalisĂ©s.","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Hidden file in home directory","locations":[{"file":"scripts/config.py","line_end":7,"line_start":7}],"confidence":0.82,"description":"2. ~/.synthese-council/config.yaml (global utilisateur)","review_kind":"capability","source_category":"filesystem","source_severity":"high","confidence_reasoning":"The configuration design loads a hidden file under the user home directory. This is legitimate configuration behavior, but it accesses user-home filesystem state."},{"title":"Hidden file in home directory","locations":[{"file":"scripts/config.py","line_end":168,"line_start":168}],"confidence":0.82,"description":"2. ~/.synthese-council/config.yaml - global utilisateur","review_kind":"capability","source_category":"filesystem","source_severity":"high","confidence_reasoning":"The configuration design loads a hidden file under the user home directory. This is legitimate configuration behavior, but it accesses user-home filesystem state."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/config.py","line_end":103,"line_start":103}],"confidence":1,"description":"\"description\": \"Activer la sauvegarde des trails\"","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/config.py","line_end":113,"line_start":113}],"confidence":1,"description":"\"description\": \"Liste des modĂšles Ă  utiliser\"","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/config.py","line_end":127,"line_start":127}],"confidence":1,"description":"\"description\": \"Configuration des rĂŽles experts\"","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/config.py","line_end":183,"line_start":183}],"confidence":1,"description":"\"\"\"Retourne une copie des valeurs par dĂ©faut.\"\"\"","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/config.py","line_end":318,"line_start":318}],"confidence":1,"description":"# VĂ©rification des Ă©lĂ©ments de liste","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/config.py","line_end":435,"line_start":435}],"confidence":1,"description":"lines.append(\"# RĂŽles des experts (personnalisable)\")","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/convergence.py","line_end":30,"line_start":30}],"confidence":1,"description":"\"le\", \"la\", \"les\", \"l\", \"un\", \"une\", \"des\", \"du\", \"de\", \"d\",","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/convergence.py","line_end":32,"line_start":32}],"confidence":1,"description":"\"Ă \", \"au\", \"aux\", \"de\", \"du\", \"des\", \"en\", \"dans\", \"sur\", \"sous\",","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/convergence.py","line_end":68,"line_start":68}],"confidence":1,"description":"2. Remplacement des apostrophes par des espaces","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/convergence.py","line_end":71,"line_start":71}],"confidence":1,"description":"5. Filtrage des stop words et tokens courts","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/convergence.py","line_end":119,"line_start":119}],"confidence":1,"description":"n: Taille des n-grams (1=unigrams, 2=bigrams, etc.)","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/convergence.py","line_end":185,"line_start":185}],"confidence":1,"description":"n: Taille des n-grams","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/convergence.py","line_end":284,"line_start":284}],"confidence":1,"description":"weights: Poids des mĂ©triques (optionnel)","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/convergence.py","line_end":359,"line_start":359}],"confidence":1,"description":"contents: Liste des contenus Ă  comparer","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/convergence.py","line_end":360,"line_start":360}],"confidence":1,"description":"weights: Poids des mĂ©triques (optionnel)","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/convergence.py","line_end":442,"line_start":442}],"confidence":1,"description":"Liste des mots-clĂ©s les plus frĂ©quents","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/convergence.py","line_end":502,"line_start":502}],"confidence":1,"description":"\"On observe des changements technologiques\"","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/pedagogy.py","line_end":50,"line_start":50}],"confidence":1,"description":"║ 4. La SYNTHÈSE finale (convergence des perspectives) ║","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/pedagogy.py","line_end":63,"line_start":63}],"confidence":1,"description":"│ Le mĂȘme texte donne des synthĂšses diffĂ©rentes selon : │","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/pedagogy.py","line_end":91,"line_start":91}],"confidence":1,"description":"│ Les 3 experts ont des FOCUS diffĂ©rents : │","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/pedagogy.py","line_end":133,"line_start":133}],"confidence":1,"description":"│ Un seul point de vue peut manquer des nuances ou │","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/pedagogy.py","line_end":134,"line_start":134}],"confidence":1,"description":"│ introduire des biais involontaires. │","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/pedagogy.py","line_end":141,"line_start":141}],"confidence":1,"description":"│ Chaque expert Ă©value les analyses des autres : │","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/pedagogy.py","line_end":153,"line_start":153}],"confidence":1,"description":"│ ⚠ CONTRÔLE DES GLISSEMENTS │","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/pedagogy.py","line_end":161,"line_start":161}],"confidence":1,"description":"│ Confondre des termes proches mais distincts │","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/pedagogy.py","line_end":188,"line_start":188}],"confidence":1,"description":"│ ‱ La similitude des analyses produites │","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/pedagogy.py","line_end":190,"line_start":190}],"confidence":1,"description":"│ ‱ La cohĂ©rence des structures proposĂ©es │","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/pedagogy.py","line_end":217,"line_start":217}],"confidence":1,"description":"│ ✓ IntĂšgre les CONVERGENCES des 3 experts │","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/pedagogy.py","line_end":255,"line_start":255}],"confidence":1,"description":"# EXPLICATIONS DES EXPERTS","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/pedagogy.py","line_end":310,"line_start":310}],"confidence":1,"description":"# EXPLICATIONS DES COUCHES","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/pedagogy.py","line_end":353,"line_start":353}],"confidence":1,"description":"Affiche des explications contextuelles Ă  chaque Ă©tape","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/retry.py","line_end":8,"line_start":8}],"confidence":1,"description":"- Classification automatique des erreurs retryables","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/retry.py","line_end":41,"line_start":41}],"confidence":1,"description":"# CLASSIFICATION DES ERREURS (Story 4.3)","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/retry.py","line_end":259,"line_start":259}],"confidence":1,"description":"\"\"\"RĂ©sumĂ© textuel des mĂ©triques.\"\"\"","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/sanitize.py","line_end":2,"line_start":2}],"confidence":1,"description":"Module de sanitisation des entrĂ©es pour SynthĂšse Council.","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/sanitize.py","line_end":3,"line_start":3}],"confidence":1,"description":"PRD-008 Story 8.4: Validation et nettoyage des entrĂ©es utilisateur.","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/sanitize.py","line_end":5,"line_start":5}],"confidence":1,"description":"Ce module fournit des fonctions pour valider et nettoyer les entrĂ©es","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/sanitize.py","line_end":54,"line_start":54}],"confidence":1,"description":"\"\"\"Erreur de validation des entrĂ©es.\"\"\"","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/sanitize.py","line_end":144,"line_start":144}],"confidence":1,"description":"# VĂ©rifier la longueur des champs","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/sanitize.py","line_end":147,"line_start":147}],"confidence":1,"description":"return False, f\"Les clĂ©s du cadrage doivent ĂȘtre des chaĂźnes\"","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/sanitize.py","line_end":150,"line_start":150}],"confidence":1,"description":"return False, f\"Les valeurs du cadrage doivent ĂȘtre des chaĂźnes (champ: {key})\"","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/sanitize.py","line_end":296,"line_start":296}],"confidence":1,"description":"Liste des patterns dĂ©tectĂ©s","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Python subprocess.run","locations":[{"file":"scripts/synthese.py","line_end":1229,"line_start":1229}],"confidence":0.87,"description":"result = subprocess.run(","review_kind":"capability","source_category":"external_commands","source_severity":"high","confidence_reasoning":"The code runs installed model CLIs with --version to detect availability. Arguments are fixed, but local external command execution is confirmed."},{"title":"Python subprocess.run","locations":[{"file":"scripts/synthese.py","line_end":1317,"line_start":1317}],"confidence":0.91,"description":"result = subprocess.run(","review_kind":"capability","source_category":"external_commands","source_severity":"high","confidence_reasoning":"The code runs Claude, Gemini, or Codex CLIs and passes the prompt as an argument. There is no shell injection, but external tool execution and data disclosure are real."},{"title":"Python file write/append","locations":[{"file":"scripts/synthese.py","line_end":2680,"line_start":2680}],"confidence":0.92,"description":"with open(trail_file, \"w\", encoding=\"utf-8\") as f:","review_kind":"capability","source_category":"filesystem","source_severity":"medium","confidence_reasoning":"The audit trail writes the full session object to a local JSON file. This can persist source text, model responses, and metadata."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":168,"line_start":168}],"confidence":1,"description":"# PRD-018: Import des extracteurs optionnels","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":205,"line_start":205}],"confidence":1,"description":"PRD-019: Permet de crĂ©er des rĂ©fĂ©rences vĂ©rifiables vers le texte source.","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":390,"line_start":390}],"confidence":1,"description":"valid_refs: Liste des rĂ©fĂ©rences valides","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":392,"line_start":392}],"confidence":1,"description":"max_excerpt_len: Longueur max des extraits","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":437,"line_start":437}],"confidence":1,"description":"PRD-020: Support des templates de cadrage.","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":631,"line_start":631}],"confidence":1,"description":"# CACHE DES RÉPONSES (PRD-024)","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":759,"line_start":759}],"confidence":1,"description":"PRD-018: Support des fichiers PDF via pdfplumber.","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":794,"line_start":794}],"confidence":1,"description":"PRD-018: Support des fichiers Word via python-docx.","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":825,"line_start":825}],"confidence":1,"description":"PRD-018: Support des URLs via requests + BeautifulSoup.","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":959,"line_start":959}],"confidence":1,"description":"sources: Liste des sources chargĂ©es","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":1153,"line_start":1153}],"confidence":1,"description":"PRD-008 Story 8.1: Gestion gracieuse des erreurs de configuration.","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":1206,"line_start":1206}],"confidence":1,"description":"# Destination des logs (stdout par dĂ©faut, stderr si sortie structurĂ©e)","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":1268,"line_start":1268}],"confidence":1,"description":"PRD-008: Support des backends natifs (Anthropic, etc.)","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":1272,"line_start":1272}],"confidence":1,"description":"Liste des backends disponibles","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":1730,"line_start":1730}],"confidence":1,"description":"log(\"║ VÉRIFICATION DES MODÈLES ║\")","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":1830,"line_start":1830}],"confidence":1,"description":"GĂ©nĂšre des personas experts adaptĂ©s au document (PRD-017).","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":1850,"line_start":1850}],"confidence":1,"description":"2. GĂ©nĂšre 3 personas d'experts avec des angles complĂ©mentaires","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":1868,"line_start":1868}],"confidence":1,"description":"log(f\"⚠ GĂ©nĂ©ration personas Ă©chouĂ©e, utilisation des dĂ©fauts\")","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":1903,"line_start":1903}],"confidence":1,"description":"log(\"\\n─── GÉNÉRATION DES PERSONAS ───\")","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":2077,"line_start":2077}],"confidence":1,"description":"Voici les analyses et critiques des experts:","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":2147,"line_start":2147}],"confidence":1,"description":"# EXECUTION PARALLÈLE DES ROUNDS (Story 2.2)","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":2256,"line_start":2256}],"confidence":1,"description":"with_refs: Inclure des rĂ©fĂ©rences [§N] aux passages sources","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":2481,"line_start":2481}],"confidence":1,"description":"# Afficher rĂ©sumĂ© des retries si pertinent","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":2946,"line_start":2946}],"confidence":1,"description":"# PRD-018: RĂ©cupĂ©ration des sources (fichiers, URLs, texte)","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":2999,"line_start":2999}],"confidence":1,"description":"# Construction des overrides CLI (PRD-003)","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":3152,"line_start":3152}],"confidence":1,"description":"# PRD-026: Affichage des mĂ©triques dĂ©taillĂ©es","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":3238,"line_start":3238}],"confidence":1,"description":"help=\"Inclure des rĂ©fĂ©rences [§N] aux passages sources (PRD-019)\"","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":3269,"line_start":3269}],"confidence":1,"description":"help=\"DĂ©sactiver le cache des rĂ©ponses (PRD-024)\"","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":3274,"line_start":3274}],"confidence":1,"description":"help=\"Vider le cache des rĂ©ponses\"","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":3515,"line_start":3515}],"confidence":1,"description":"print(\"║ VÉRIFICATION DES CLI ║\")","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"SKILL.md","line_end":3,"line_start":3}],"confidence":1,"description":"description: SynthĂšse co-fabriquĂ©e par un conseil de 3 LLMs (Claude, Gemini, Codex). Ce skill devrai","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"SKILL.md","line_end":14,"line_start":14}],"confidence":1,"description":"Ce skill orchestre trois modĂšles IA avec des rĂŽles experts distincts pour produire une synthĂšse robu","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"SKILL.md","line_end":18,"line_start":18}],"confidence":1,"description":"### Installation des CLI","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"SKILL.md","line_end":106,"line_start":106}],"confidence":1,"description":"├─ DĂ©tection des divergences","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"SKILL.md","line_end":111,"line_start":111}],"confidence":1,"description":"├─ Consolidation des analyses","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"SKILL.md","line_end":112,"line_start":112}],"confidence":1,"description":"├─ RĂ©solution des divergences","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"SKILL.md","line_end":114,"line_start":114}],"confidence":1,"description":"└─ Mention des points de dissensus","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"SKILL.md","line_end":138,"line_start":138}],"confidence":1,"description":"Focus sur la dĂ©tection des glissements. Utile pour vĂ©rifier une synthĂšse existante.","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"SKILL.md","line_end":212,"line_start":212}],"confidence":1,"description":"| [troubleshooting.md](references/troubleshooting.md) | Guide de rĂ©solution des problĂšmes |","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"SKILL.md","line_end":214,"line_start":214}],"confidence":1,"description":"| [couches-semiotiques.md](references/couches-semiotiques.md) | DĂ©tail des 4 couches d'analyse |","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"SKILL.md","line_end":215,"line_start":215}],"confidence":1,"description":"| [glissements.md](references/glissements.md) | Catalogue des glissements sĂ©mantiques courants |","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"synthese.config.yaml","line_end":19,"line_start":19}],"confidence":1,"description":"# Activer la sauvegarde des trails","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"synthese.config.yaml","line_end":22,"line_start":22}],"confidence":1,"description":"# RĂ©pertoire de sauvegarde des trails","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"synthese.config.yaml","line_end":28,"line_start":28}],"confidence":1,"description":"# RĂŽles des experts (personnalisable)","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Shell command substitution","locations":[{"file":"wrappers/claude_wrapper.sh","line_end":50,"line_start":40}],"confidence":0.93,"description":"RESPONSE=$(curl -s -X POST \"$API_URL\" \\","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The wrapper executes curl to send the prompt and API key to Anthropic. This is intentional but confirms networked external command execution."},{"title":"Hardcoded URL","locations":[{"file":"wrappers/claude_wrapper.sh","line_end":20,"line_start":20}],"confidence":0.91,"description":"API_URL=\"https://api.anthropic.com/v1/messages\"","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The Claude wrapper targets the Anthropic messages API. This confirms outbound network calls to an external model provider."},{"title":"Generic API/secret keys","locations":[{"file":"wrappers/claude_wrapper.sh","line_end":23,"line_start":23}],"confidence":0.82,"description":"if [ -z \"$ANTHROPIC_API_KEY\" ]; then","review_kind":"capability","source_category":"env_access","source_severity":"high","confidence_reasoning":"The wrapper reads ANTHROPIC_API_KEY from the shell environment. This is intended, but it confirms credential-dependent execution."},{"title":"Generic API/secret keys","locations":[{"file":"wrappers/claude_wrapper.sh","line_end":42,"line_start":42}],"confidence":0.93,"description":"-H \"x-api-key: $ANTHROPIC_API_KEY\" \\","review_kind":"capability","source_category":"env_access","source_severity":"high","confidence_reasoning":"The wrapper sends ANTHROPIC_API_KEY in an HTTP header to the Anthropic API. This is legitimate API use but a real credential handling risk."},{"title":"Weak cryptographic algorithm","locations":[{"file":"wrappers/README.md","line_end":3,"line_start":3}],"confidence":1,"description":"Ce dossier contient des exemples de scripts wrapper pour intĂ©grer diffĂ©rents LLMs avec SynthĂšse Coun","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Persistent Audit Trails Store Source Text and Model Outputs","locations":[{"file":"SKILL.md","line_end":153,"line_start":146},{"file":"scripts/synthese.py","line_end":2682,"line_start":2677}],"confidence":0.93,"description":"The skill documents local audit trails that include source text, framing, model responses, convergence data, and final summaries. The implementation writes the session object to disk, which can persist confidential user content beyond the chat session.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"Documentation lists the data stored in each trail, and the code writes the serialized session to a local JSON file."},{"title":"Custom CLI Backend Executes Configured Commands With Inherited Environment","locations":[{"file":"scripts/backends/cli_backend.py","line_end":64,"line_start":45},{"file":"scripts/backends/cli_backend.py","line_end":160,"line_start":147},{"file":"scripts/backends/cli_backend.py","line_end":278,"line_start":271}],"confidence":0.91,"description":"The CLI backend accepts command, args, and env values from configuration, then executes the command with a copied process environment. A malicious configuration can run arbitrary local programs and receive inherited secrets.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"The code builds commands from configuration and passes os.environ.copy() plus configured environment values to create_subprocess_exec."}],"medium_findings":[{"title":"Python getenv function","locations":[{"file":"scripts/backends/anthropic_backend.py","line_end":108,"line_start":108}],"confidence":0.9,"description":"return self._api_key or os.getenv(\"ANTHROPIC_API_KEY\")","review_kind":"capability","source_category":"env_access","source_severity":"low","confidence_reasoning":"The backend reads ANTHROPIC_API_KEY from the process environment. This is expected for API use, but it confirms secret-bearing environment access."},{"title":"Python getenv function","locations":[{"file":"scripts/backends/anthropic_backend.py","line_end":314,"line_start":314}],"confidence":0.9,"description":"api_key = os.getenv(\"ANTHROPIC_API_KEY\")","review_kind":"capability","source_category":"env_access","source_severity":"low","confidence_reasoning":"The backend reads ANTHROPIC_API_KEY from the process environment. This is expected for API use, but it confirms secret-bearing environment access."},{"title":"getenv function call","locations":[{"file":"scripts/backends/anthropic_backend.py","line_end":108,"line_start":108}],"confidence":0.9,"description":"return self._api_key or os.getenv(\"ANTHROPIC_API_KEY\")","review_kind":"capability","source_category":"env_access","source_severity":"low","confidence_reasoning":"The backend reads ANTHROPIC_API_KEY from the process environment. This is expected for API use, but it confirms secret-bearing environment access."},{"title":"getenv function call","locations":[{"file":"scripts/backends/anthropic_backend.py","line_end":314,"line_start":314}],"confidence":0.9,"description":"api_key = os.getenv(\"ANTHROPIC_API_KEY\")","review_kind":"capability","source_category":"env_access","source_severity":"low","confidence_reasoning":"The backend reads ANTHROPIC_API_KEY from the process environment. This is expected for API use, but it confirms secret-bearing environment access."},{"title":"Python environment access","locations":[{"file":"scripts/backends/cli_backend.py","line_end":151,"line_start":151}],"confidence":0.9,"description":"env = os.environ.copy()","review_kind":"capability","source_category":"env_access","source_severity":"low","confidence_reasoning":"The CLI backend copies the full process environment before launching a child process. This can propagate unrelated secrets to custom LLM wrappers."},{"title":"Hidden file access","locations":[{"file":"scripts/config.py","line_end":7,"line_start":7}],"confidence":0.82,"description":"2. ~/.synthese-council/config.yaml (global utilisateur)","review_kind":"capability","source_category":"filesystem","source_severity":"medium","confidence_reasoning":"The configuration design loads a hidden file under the user home directory. This is legitimate configuration behavior, but it accesses user-home filesystem state."},{"title":"Hidden file access","locations":[{"file":"scripts/config.py","line_end":168,"line_start":168}],"confidence":0.82,"description":"2. ~/.synthese-council/config.yaml - global utilisateur","review_kind":"capability","source_category":"filesystem","source_severity":"medium","confidence_reasoning":"The configuration design loads a hidden file under the user home directory. This is legitimate configuration behavior, but it accesses user-home filesystem state."},{"title":"Python HTTP libraries","locations":[{"file":"scripts/synthese.py","line_end":848,"line_start":848}],"confidence":0.9,"description":"response = requests.get(url, headers=headers, timeout=timeout)","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The URL loader fetches arbitrary user-supplied URLs with requests. This enables outbound network access and can ingest untrusted remote prompt content."},{"title":"Python file write/append","locations":[{"file":"scripts/synthese.py","line_end":708,"line_start":708}],"confidence":0.87,"description":"with open(cache_path, \"w\", encoding=\"utf-8\") as f:","review_kind":"capability","source_category":"filesystem","source_severity":"medium","confidence_reasoning":"The response cache writes model output to local JSON files. This can persist source-derived content on disk."},{"title":"Python file write/append","locations":[{"file":"scripts/synthese.py","line_end":2716,"line_start":2716}],"confidence":0.88,"description":"with open(md_file, \"w\", encoding=\"utf-8\") as f:","review_kind":"capability","source_category":"filesystem","source_severity":"medium","confidence_reasoning":"The skill writes final summaries to Markdown files under an output directory. This is intended but can persist sensitive summaries locally."},{"title":"Shell command substitution","locations":[{"file":"wrappers/claude_wrapper.sh","line_end":37,"line_start":37}],"confidence":0.78,"description":"ESCAPED_PROMPT=$(echo \"$PROMPT\" | python3 -c 'import json,sys; print(json.dumps(sys.stdin.read().str","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The shell wrapper invokes python3 in command substitution to JSON-escape the prompt. Quoting reduces injection risk, but external command execution is present."},{"title":"Unix shell invocation","locations":[{"file":"wrappers/claude_wrapper.sh","line_end":1,"line_start":1}],"confidence":0.83,"description":"#!/bin/bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"This file is an executable shell wrapper for model calls. Shell script execution is an intended feature and should require user trust."},{"title":"Shell command substitution","locations":[{"file":"wrappers/ollama_wrapper.sh","line_end":37,"line_start":37}],"confidence":0.78,"description":"ESCAPED_PROMPT=$(echo \"$PROMPT\" | python3 -c 'import json,sys; print(json.dumps(sys.stdin.read().str","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The shell wrapper invokes python3 in command substitution to JSON-escape the prompt. Quoting reduces injection risk, but external command execution is present."},{"title":"Shell command substitution","locations":[{"file":"wrappers/ollama_wrapper.sh","line_end":46,"line_start":40}],"confidence":0.9,"description":"RESPONSE=$(curl -s -X POST \"$HOST/api/generate\" \\","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The wrapper executes curl against the configured Ollama endpoint. It is local by default, but it is still external command and network execution."},{"title":"Unix shell invocation","locations":[{"file":"wrappers/ollama_wrapper.sh","line_end":1,"line_start":1}],"confidence":0.83,"description":"#!/bin/bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"This file is an executable shell wrapper for a local Ollama backend. Shell script execution is an intended feature and should require user trust."},{"title":"Untrusted URL Content Is Sent Into LLM Prompts","locations":[{"file":"scripts/synthese.py","line_end":848,"line_start":821},{"file":"scripts/synthese.py","line_end":933,"line_start":923}],"confidence":0.86,"description":"The URL loader fetches arbitrary pages and extracts text for synthesis. Remote page content can contain prompt-injection text that influences downstream Claude, Gemini, or Codex calls.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The code accepts URL input, fetches it with requests, and appends the extracted text as source material for model prompts."}],"low_findings":[{"title":"Hardcoded URL","locations":[{"file":"wrappers/ollama_wrapper.sh","line_end":19,"line_start":19}],"confidence":0.86,"description":"HOST=\"${OLLAMA_HOST:-http://localhost:11434}\"","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The Ollama wrapper defaults to a localhost HTTP endpoint. It is low risk by default, but confirms network access through a configurable host."}],"dangerous_patterns":[{"title":"Weak cryptographic algorithm","locations":[{"file":"references/cadrage.md","line_end":7,"line_start":7}],"confidence":1,"description":"Une synthĂšse sans cadrage est un rĂ©sumĂ© hors contexte. Le mĂȘme texte peut donner des synthĂšses radic","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"references/cadrage.md","line_end":59,"line_start":59}],"confidence":1,"description":"**Attention** : Une longueur trop courte force Ă  des choix qui peuvent crĂ©er des glissements.","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"references/cadrage.md","line_end":71,"line_start":71}],"confidence":1,"description":"| Neutre | Équilibre des positions | MĂ©diation |","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"references/configuration.md","line_end":65,"line_start":65}],"confidence":1,"description":"| `cache.ttl` | 3600 | DurĂ©e de vie des entrĂ©es (secondes) |","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"references/configuration.md","line_end":89,"line_start":89}],"confidence":1,"description":"## RĂŽles des experts","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"references/configuration.md","line_end":131,"line_start":131}],"confidence":1,"description":"| `SYNTHESE_TRAIL_DIR` | Override du rĂ©pertoire des trails |","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"references/configuration.md","line_end":135,"line_start":135}],"confidence":1,"description":"- [troubleshooting.md](troubleshooting.md) - RĂ©solution des problĂšmes","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"references/glissements.md","line_end":1,"line_start":1}],"confidence":1,"description":"# Catalogue des glissements sĂ©mantiques","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"references/glissements.md","line_end":12,"line_start":12}],"confidence":1,"description":"- Source : \"simplification des procĂ©dures\"","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"references/glissements.md","line_end":39,"line_start":39}],"confidence":1,"description":"**DĂ©finition** : Effacer des nuances ou des rĂ©serves.","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"references/glissements.md","line_end":52,"line_start":52}],"confidence":1,"description":"- Source : \"malgrĂ© les progrĂšs, des dĂ©fis persistent\"","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"references/metrics.md","line_end":5,"line_start":5}],"confidence":1,"description":"Le skill expose des mĂ©triques pour le monitoring opĂ©rationnel et l'optimisation des performances.","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"references/metrics.md","line_end":26,"line_start":26}],"confidence":1,"description":"| Warning | `0.1 <= hit_rate < 0.3` | VĂ©rifier la diversitĂ© des prompts |","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"references/metrics.md","line_end":60,"line_start":60}],"confidence":1,"description":"| `reasons` | list[str] | Raisons des retries |","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"references/metrics.md","line_end":115,"line_start":115}],"confidence":1,"description":"## Export des mĂ©triques","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"references/metrics.md","line_end":146,"line_start":146}],"confidence":1,"description":"2. **Suivi des retries** : Des retries frĂ©quents sur un modĂšle suggĂšrent un problĂšme","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"references/troubleshooting.md","line_end":3,"line_start":3}],"confidence":1,"description":"Guide de rĂ©solution des problĂšmes courants.","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"references/troubleshooting.md","line_end":106,"line_start":106}],"confidence":1,"description":"**SymptĂŽme** : Les modĂšles produisent des analyses trĂšs divergentes.","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"references/troubleshooting.md","line_end":116,"line_start":116}],"confidence":1,"description":"3. Utiliser `--mode critique` pour analyse dĂ©taillĂ©e des divergences","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"references/troubleshooting.md","line_end":136,"line_start":136}],"confidence":1,"description":"**SymptĂŽme** : Le Gardien signale des glissements sĂ©mantiques.","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"references/troubleshooting.md","line_end":138,"line_start":138}],"confidence":1,"description":"**Explication** : Des termes ont Ă©tĂ© substituĂ©s ou le sens a Ă©tĂ© altĂ©rĂ©.","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"references/troubleshooting.md","line_end":220,"line_start":220}],"confidence":1,"description":"- [modes.md](modes.md) - DĂ©tail des modes de synthĂšse","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/backends/base.py","line_end":94,"line_start":94}],"confidence":1,"description":"- PrĂ©sence des dĂ©pendances (packages)","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/backends/base.py","line_end":150,"line_start":150}],"confidence":1,"description":"Registre des backends disponibles.","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/backends/base.py","line_end":206,"line_start":206}],"confidence":1,"description":"Liste des backends dont is_available() == True","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/backends/base.py","line_end":221,"line_start":221}],"confidence":1,"description":"Liste les noms des backends enregistrĂ©s.","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/backends/base.py","line_end":224,"line_start":224}],"confidence":1,"description":"Liste des noms","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/backends/cli_backend.py","line_end":3,"line_start":3}],"confidence":1,"description":"PRD-008 Story 8.3: Support des CLI wrappers personnalisĂ©s.","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/config.py","line_end":103,"line_start":103}],"confidence":1,"description":"\"description\": \"Activer la sauvegarde des trails\"","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/config.py","line_end":113,"line_start":113}],"confidence":1,"description":"\"description\": \"Liste des modĂšles Ă  utiliser\"","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/config.py","line_end":127,"line_start":127}],"confidence":1,"description":"\"description\": \"Configuration des rĂŽles experts\"","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/config.py","line_end":183,"line_start":183}],"confidence":1,"description":"\"\"\"Retourne une copie des valeurs par dĂ©faut.\"\"\"","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/config.py","line_end":318,"line_start":318}],"confidence":1,"description":"# VĂ©rification des Ă©lĂ©ments de liste","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/config.py","line_end":435,"line_start":435}],"confidence":1,"description":"lines.append(\"# RĂŽles des experts (personnalisable)\")","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/convergence.py","line_end":30,"line_start":30}],"confidence":1,"description":"\"le\", \"la\", \"les\", \"l\", \"un\", \"une\", \"des\", \"du\", \"de\", \"d\",","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/convergence.py","line_end":32,"line_start":32}],"confidence":1,"description":"\"Ă \", \"au\", \"aux\", \"de\", \"du\", \"des\", \"en\", \"dans\", \"sur\", \"sous\",","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/convergence.py","line_end":68,"line_start":68}],"confidence":1,"description":"2. Remplacement des apostrophes par des espaces","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/convergence.py","line_end":71,"line_start":71}],"confidence":1,"description":"5. Filtrage des stop words et tokens courts","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/convergence.py","line_end":119,"line_start":119}],"confidence":1,"description":"n: Taille des n-grams (1=unigrams, 2=bigrams, etc.)","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/convergence.py","line_end":185,"line_start":185}],"confidence":1,"description":"n: Taille des n-grams","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/convergence.py","line_end":284,"line_start":284}],"confidence":1,"description":"weights: Poids des mĂ©triques (optionnel)","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/convergence.py","line_end":359,"line_start":359}],"confidence":1,"description":"contents: Liste des contenus Ă  comparer","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/convergence.py","line_end":360,"line_start":360}],"confidence":1,"description":"weights: Poids des mĂ©triques (optionnel)","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/convergence.py","line_end":442,"line_start":442}],"confidence":1,"description":"Liste des mots-clĂ©s les plus frĂ©quents","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/convergence.py","line_end":502,"line_start":502}],"confidence":1,"description":"\"On observe des changements technologiques\"","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/pedagogy.py","line_end":50,"line_start":50}],"confidence":1,"description":"║ 4. La SYNTHÈSE finale (convergence des perspectives) ║","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/pedagogy.py","line_end":63,"line_start":63}],"confidence":1,"description":"│ Le mĂȘme texte donne des synthĂšses diffĂ©rentes selon : │","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/pedagogy.py","line_end":91,"line_start":91}],"confidence":1,"description":"│ Les 3 experts ont des FOCUS diffĂ©rents : │","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/pedagogy.py","line_end":133,"line_start":133}],"confidence":1,"description":"│ Un seul point de vue peut manquer des nuances ou │","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/pedagogy.py","line_end":134,"line_start":134}],"confidence":1,"description":"│ introduire des biais involontaires. │","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/pedagogy.py","line_end":141,"line_start":141}],"confidence":1,"description":"│ Chaque expert Ă©value les analyses des autres : │","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/pedagogy.py","line_end":153,"line_start":153}],"confidence":1,"description":"│ ⚠ CONTRÔLE DES GLISSEMENTS │","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/pedagogy.py","line_end":161,"line_start":161}],"confidence":1,"description":"│ Confondre des termes proches mais distincts │","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/pedagogy.py","line_end":188,"line_start":188}],"confidence":1,"description":"│ ‱ La similitude des analyses produites │","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/pedagogy.py","line_end":190,"line_start":190}],"confidence":1,"description":"│ ‱ La cohĂ©rence des structures proposĂ©es │","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/pedagogy.py","line_end":217,"line_start":217}],"confidence":1,"description":"│ ✓ IntĂšgre les CONVERGENCES des 3 experts │","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/pedagogy.py","line_end":255,"line_start":255}],"confidence":1,"description":"# EXPLICATIONS DES EXPERTS","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/pedagogy.py","line_end":310,"line_start":310}],"confidence":1,"description":"# EXPLICATIONS DES COUCHES","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/pedagogy.py","line_end":353,"line_start":353}],"confidence":1,"description":"Affiche des explications contextuelles Ă  chaque Ă©tape","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/retry.py","line_end":8,"line_start":8}],"confidence":1,"description":"- Classification automatique des erreurs retryables","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/retry.py","line_end":41,"line_start":41}],"confidence":1,"description":"# CLASSIFICATION DES ERREURS (Story 4.3)","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/retry.py","line_end":259,"line_start":259}],"confidence":1,"description":"\"\"\"RĂ©sumĂ© textuel des mĂ©triques.\"\"\"","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/sanitize.py","line_end":2,"line_start":2}],"confidence":1,"description":"Module de sanitisation des entrĂ©es pour SynthĂšse Council.","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/sanitize.py","line_end":3,"line_start":3}],"confidence":1,"description":"PRD-008 Story 8.4: Validation et nettoyage des entrĂ©es utilisateur.","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/sanitize.py","line_end":5,"line_start":5}],"confidence":1,"description":"Ce module fournit des fonctions pour valider et nettoyer les entrĂ©es","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/sanitize.py","line_end":54,"line_start":54}],"confidence":1,"description":"\"\"\"Erreur de validation des entrĂ©es.\"\"\"","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/sanitize.py","line_end":144,"line_start":144}],"confidence":1,"description":"# VĂ©rifier la longueur des champs","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/sanitize.py","line_end":147,"line_start":147}],"confidence":1,"description":"return False, f\"Les clĂ©s du cadrage doivent ĂȘtre des chaĂźnes\"","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/sanitize.py","line_end":150,"line_start":150}],"confidence":1,"description":"return False, f\"Les valeurs du cadrage doivent ĂȘtre des chaĂźnes (champ: {key})\"","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/sanitize.py","line_end":296,"line_start":296}],"confidence":1,"description":"Liste des patterns dĂ©tectĂ©s","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":168,"line_start":168}],"confidence":1,"description":"# PRD-018: Import des extracteurs optionnels","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":205,"line_start":205}],"confidence":1,"description":"PRD-019: Permet de crĂ©er des rĂ©fĂ©rences vĂ©rifiables vers le texte source.","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":390,"line_start":390}],"confidence":1,"description":"valid_refs: Liste des rĂ©fĂ©rences valides","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":392,"line_start":392}],"confidence":1,"description":"max_excerpt_len: Longueur max des extraits","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":437,"line_start":437}],"confidence":1,"description":"PRD-020: Support des templates de cadrage.","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":631,"line_start":631}],"confidence":1,"description":"# CACHE DES RÉPONSES (PRD-024)","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":759,"line_start":759}],"confidence":1,"description":"PRD-018: Support des fichiers PDF via pdfplumber.","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":794,"line_start":794}],"confidence":1,"description":"PRD-018: Support des fichiers Word via python-docx.","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":825,"line_start":825}],"confidence":1,"description":"PRD-018: Support des URLs via requests + BeautifulSoup.","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":959,"line_start":959}],"confidence":1,"description":"sources: Liste des sources chargĂ©es","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":1153,"line_start":1153}],"confidence":1,"description":"PRD-008 Story 8.1: Gestion gracieuse des erreurs de configuration.","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":1206,"line_start":1206}],"confidence":1,"description":"# Destination des logs (stdout par dĂ©faut, stderr si sortie structurĂ©e)","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":1268,"line_start":1268}],"confidence":1,"description":"PRD-008: Support des backends natifs (Anthropic, etc.)","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":1272,"line_start":1272}],"confidence":1,"description":"Liste des backends disponibles","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":1730,"line_start":1730}],"confidence":1,"description":"log(\"║ VÉRIFICATION DES MODÈLES ║\")","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":1830,"line_start":1830}],"confidence":1,"description":"GĂ©nĂšre des personas experts adaptĂ©s au document (PRD-017).","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":1850,"line_start":1850}],"confidence":1,"description":"2. GĂ©nĂšre 3 personas d'experts avec des angles complĂ©mentaires","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":1868,"line_start":1868}],"confidence":1,"description":"log(f\"⚠ GĂ©nĂ©ration personas Ă©chouĂ©e, utilisation des dĂ©fauts\")","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":1903,"line_start":1903}],"confidence":1,"description":"log(\"\\n─── GÉNÉRATION DES PERSONAS ───\")","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":2077,"line_start":2077}],"confidence":1,"description":"Voici les analyses et critiques des experts:","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":2147,"line_start":2147}],"confidence":1,"description":"# EXECUTION PARALLÈLE DES ROUNDS (Story 2.2)","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":2256,"line_start":2256}],"confidence":1,"description":"with_refs: Inclure des rĂ©fĂ©rences [§N] aux passages sources","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":2481,"line_start":2481}],"confidence":1,"description":"# Afficher rĂ©sumĂ© des retries si pertinent","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":2946,"line_start":2946}],"confidence":1,"description":"# PRD-018: RĂ©cupĂ©ration des sources (fichiers, URLs, texte)","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":2999,"line_start":2999}],"confidence":1,"description":"# Construction des overrides CLI (PRD-003)","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":3152,"line_start":3152}],"confidence":1,"description":"# PRD-026: Affichage des mĂ©triques dĂ©taillĂ©es","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":3238,"line_start":3238}],"confidence":1,"description":"help=\"Inclure des rĂ©fĂ©rences [§N] aux passages sources (PRD-019)\"","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":3269,"line_start":3269}],"confidence":1,"description":"help=\"DĂ©sactiver le cache des rĂ©ponses (PRD-024)\"","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":3274,"line_start":3274}],"confidence":1,"description":"help=\"Vider le cache des rĂ©ponses\"","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"scripts/synthese.py","line_end":3515,"line_start":3515}],"confidence":1,"description":"print(\"║ VÉRIFICATION DES CLI ║\")","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"SKILL.md","line_end":3,"line_start":3}],"confidence":1,"description":"description: SynthĂšse co-fabriquĂ©e par un conseil de 3 LLMs (Claude, Gemini, Codex). Ce skill devrai","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"SKILL.md","line_end":14,"line_start":14}],"confidence":1,"description":"Ce skill orchestre trois modĂšles IA avec des rĂŽles experts distincts pour produire une synthĂšse robu","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"SKILL.md","line_end":18,"line_start":18}],"confidence":1,"description":"### Installation des CLI","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"SKILL.md","line_end":106,"line_start":106}],"confidence":1,"description":"├─ DĂ©tection des divergences","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"SKILL.md","line_end":111,"line_start":111}],"confidence":1,"description":"├─ Consolidation des analyses","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"SKILL.md","line_end":112,"line_start":112}],"confidence":1,"description":"├─ RĂ©solution des divergences","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"SKILL.md","line_end":114,"line_start":114}],"confidence":1,"description":"└─ Mention des points de dissensus","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"SKILL.md","line_end":138,"line_start":138}],"confidence":1,"description":"Focus sur la dĂ©tection des glissements. Utile pour vĂ©rifier une synthĂšse existante.","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"SKILL.md","line_end":212,"line_start":212}],"confidence":1,"description":"| [troubleshooting.md](references/troubleshooting.md) | Guide de rĂ©solution des problĂšmes |","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"SKILL.md","line_end":214,"line_start":214}],"confidence":1,"description":"| [couches-semiotiques.md](references/couches-semiotiques.md) | DĂ©tail des 4 couches d'analyse |","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"SKILL.md","line_end":215,"line_start":215}],"confidence":1,"description":"| [glissements.md](references/glissements.md) | Catalogue des glissements sĂ©mantiques courants |","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"synthese.config.yaml","line_end":19,"line_start":19}],"confidence":1,"description":"# Activer la sauvegarde des trails","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"synthese.config.yaml","line_end":22,"line_start":22}],"confidence":1,"description":"# RĂ©pertoire de sauvegarde des trails","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"synthese.config.yaml","line_end":28,"line_start":28}],"confidence":1,"description":"# RĂŽles des experts (personnalisable)","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Weak cryptographic algorithm","locations":[{"file":"wrappers/README.md","line_end":3,"line_start":3}],"confidence":1,"description":"Ce dossier contient des exemples de scripts wrapper pour intĂ©grer diffĂ©rents LLMs avec SynthĂšse Coun","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."}],"files_scanned":21,"total_lines":8591,"audit_model":"codex","audited_at":"2026-07-05T02:37:52.817+00:00","created_at":"2026-07-05T03:33:21.884715+00:00","static_findings":[{"id":"blocker:references/cadrage.md:7:weak-cryptographic-algorithm","file":"references/cadrage.md","pattern":"Weak cryptographic algorithm","snippet":"Une synthĂšse sans cadrage est un rĂ©sumĂ© hors contexte. Le mĂȘme texte peut donner des synthĂšses radic","category":"blocker","line_end":7,"severity":"high","line_start":7},{"id":"blocker:references/cadrage.md:59:weak-cryptographic-algorithm","file":"references/cadrage.md","pattern":"Weak cryptographic algorithm","snippet":"**Attention** : Une longueur trop courte force Ă  des choix qui peuvent crĂ©er des glissements.","category":"blocker","line_end":59,"severity":"high","line_start":59},{"id":"blocker:references/cadrage.md:71:weak-cryptographic-algorithm","file":"references/cadrage.md","pattern":"Weak cryptographic algorithm","snippet":"| Neutre | Équilibre des positions | MĂ©diation |","category":"blocker","line_end":71,"severity":"high","line_start":71},{"id":"env_access:references/configuration.md:128:generic-api-secret-keys","file":"references/configuration.md","pattern":"Generic API/secret keys","snippet":"| `ANTHROPIC_API_KEY` | ClĂ© API pour backend Anthropic direct |","category":"env_access","line_end":128,"severity":"high","line_start":128},{"id":"blocker:references/configuration.md:65:weak-cryptographic-algorithm","file":"references/configuration.md","pattern":"Weak cryptographic algorithm","snippet":"| `cache.ttl` | 3600 | DurĂ©e de vie des entrĂ©es (secondes) |","category":"blocker","line_end":65,"severity":"high","line_start":65},{"id":"blocker:references/configuration.md:89:weak-cryptographic-algorithm","file":"references/configuration.md","pattern":"Weak cryptographic algorithm","snippet":"## RĂŽles des experts","category":"blocker","line_end":89,"severity":"high","line_start":89},{"id":"blocker:references/configuration.md:131:weak-cryptographic-algorithm","file":"references/configuration.md","pattern":"Weak cryptographic algorithm","snippet":"| `SYNTHESE_TRAIL_DIR` | Override du rĂ©pertoire des trails |","category":"blocker","line_end":131,"severity":"high","line_start":131},{"id":"blocker:references/configuration.md:135:weak-cryptographic-algorithm","file":"references/configuration.md","pattern":"Weak cryptographic algorithm","snippet":"- [troubleshooting.md](troubleshooting.md) - RĂ©solution des problĂšmes","category":"blocker","line_end":135,"severity":"high","line_start":135},{"id":"blocker:references/configuration.md:36:system-reconnaissance","file":"references/configuration.md","pattern":"System reconnaissance","snippet":"| `convergence.semantic_weight` | 0.7 | Poids du score sĂ©mantique en mode hybrid |","category":"blocker","line_end":36,"severity":"low","line_start":36},{"id":"blocker:references/configuration.md:37:system-reconnaissance","file":"references/configuration.md","pattern":"System reconnaissance","snippet":"| `convergence.lexical_weight` | 0.3 | Poids du score lexical en mode hybrid |","category":"blocker","line_end":37,"severity":"low","line_start":37},{"id":"blocker:references/glissements.md:1:weak-cryptographic-algorithm","file":"references/glissements.md","pattern":"Weak cryptographic algorithm","snippet":"# Catalogue des glissements sĂ©mantiques","category":"blocker","line_end":1,"severity":"high","line_start":1},{"id":"blocker:references/glissements.md:12:weak-cryptographic-algorithm","file":"references/glissements.md","pattern":"Weak cryptographic algorithm","snippet":"- Source : \"simplification des procĂ©dures\"","category":"blocker","line_end":12,"severity":"high","line_start":12},{"id":"blocker:references/glissements.md:39:weak-cryptographic-algorithm","file":"references/glissements.md","pattern":"Weak cryptographic algorithm","snippet":"**DĂ©finition** : Effacer des nuances ou des rĂ©serves.","category":"blocker","line_end":39,"severity":"high","line_start":39},{"id":"blocker:references/glissements.md:52:weak-cryptographic-algorithm","file":"references/glissements.md","pattern":"Weak cryptographic algorithm","snippet":"- Source : \"malgrĂ© les progrĂšs, des dĂ©fis persistent\"","category":"blocker","line_end":52,"severity":"high","line_start":52},{"id":"blocker:references/metrics.md:5:weak-cryptographic-algorithm","file":"references/metrics.md","pattern":"Weak cryptographic algorithm","snippet":"Le skill expose des mĂ©triques pour le monitoring opĂ©rationnel et l'optimisation des performances.","category":"blocker","line_end":5,"severity":"high","line_start":5},{"id":"blocker:references/metrics.md:26:weak-cryptographic-algorithm","file":"references/metrics.md","pattern":"Weak cryptographic algorithm","snippet":"| Warning | `0.1 <= hit_rate < 0.3` | VĂ©rifier la diversitĂ© des prompts |","category":"blocker","line_end":26,"severity":"high","line_start":26},{"id":"blocker:references/metrics.md:60:weak-cryptographic-algorithm","file":"references/metrics.md","pattern":"Weak cryptographic algorithm","snippet":"| `reasons` | list[str] | Raisons des retries |","category":"blocker","line_end":60,"severity":"high","line_start":60},{"id":"blocker:references/metrics.md:115:weak-cryptographic-algorithm","file":"references/metrics.md","pattern":"Weak cryptographic algorithm","snippet":"## Export des mĂ©triques","category":"blocker","line_end":115,"severity":"high","line_start":115},{"id":"blocker:references/metrics.md:146:weak-cryptographic-algorithm","file":"references/metrics.md","pattern":"Weak cryptographic algorithm","snippet":"2. **Suivi des retries** : Des retries frĂ©quents sur un modĂšle suggĂšrent un problĂšme","category":"blocker","line_end":146,"severity":"high","line_start":146},{"id":"env_access:references/troubleshooting.md:64:generic-api-secret-keys","file":"references/troubleshooting.md","pattern":"Generic API/secret keys","snippet":"### \"ANTHROPIC_API_KEY non dĂ©fini\"","category":"env_access","line_end":64,"severity":"high","line_start":64},{"id":"env_access:references/troubleshooting.md:69:generic-api-secret-keys","file":"references/troubleshooting.md","pattern":"Generic API/secret keys","snippet":"1. Exporter la variable : `export ANTHROPIC_API_KEY=\"sk-ant-...\"`","category":"env_access","line_end":69,"severity":"high","line_start":69},{"id":"env_access:references/troubleshooting.md:75:generic-api-secret-keys","file":"references/troubleshooting.md","pattern":"Generic API/secret keys","snippet":"1. VĂ©rifier la clĂ© : `echo $ANTHROPIC_API_KEY | head -c 20`","category":"env_access","line_end":75,"severity":"high","line_start":75},{"id":"blocker:references/troubleshooting.md:3:weak-cryptographic-algorithm","file":"references/troubleshooting.md","pattern":"Weak cryptographic algorithm","snippet":"Guide de rĂ©solution des problĂšmes courants.","category":"blocker","line_end":3,"severity":"high","line_start":3},{"id":"blocker:references/troubleshooting.md:106:weak-cryptographic-algorithm","file":"references/troubleshooting.md","pattern":"Weak cryptographic algorithm","snippet":"**SymptĂŽme** : Les modĂšles produisent des analyses trĂšs divergentes.","category":"blocker","line_end":106,"severity":"high","line_start":106},{"id":"blocker:references/troubleshooting.md:116:weak-cryptographic-algorithm","file":"references/troubleshooting.md","pattern":"Weak cryptographic algorithm","snippet":"3. Utiliser `--mode critique` pour analyse dĂ©taillĂ©e des divergences","category":"blocker","line_end":116,"severity":"high","line_start":116},{"id":"blocker:references/troubleshooting.md:136:weak-cryptographic-algorithm","file":"references/troubleshooting.md","pattern":"Weak cryptographic algorithm","snippet":"**SymptĂŽme** : Le Gardien signale des glissements sĂ©mantiques.","category":"blocker","line_end":136,"severity":"high","line_start":136},{"id":"blocker:references/troubleshooting.md:138:weak-cryptographic-algorithm","file":"references/troubleshooting.md","pattern":"Weak cryptographic algorithm","snippet":"**Explication** : Des termes ont Ă©tĂ© substituĂ©s ou le sens a Ă©tĂ© altĂ©rĂ©.","category":"blocker","line_end":138,"severity":"high","line_start":138},{"id":"blocker:references/troubleshooting.md:220:weak-cryptographic-algorithm","file":"references/troubleshooting.md","pattern":"Weak cryptographic algorithm","snippet":"- [modes.md](modes.md) - DĂ©tail des modes de synthĂšse","category":"blocker","line_end":220,"severity":"high","line_start":220},{"id":"blocker:references/troubleshooting.md:72:system-reconnaissance","file":"references/troubleshooting.md","pattern":"System reconnaissance","snippet":"### \"Authentication failed\" / \"Invalid API key\"","category":"blocker","line_end":72,"severity":"low","line_start":72},{"id":"scripts:scripts/backends/__init__.py:22:dynamic-import-expression","file":"scripts/backends/__init__.py","pattern":"Dynamic import() expression","snippet":"from .base import (","category":"scripts","line_end":26,"severity":"medium","line_start":22},{"id":"scripts:scripts/backends/__init__.py:30:dynamic-import-expression","file":"scripts/backends/__init__.py","pattern":"Dynamic import() expression","snippet":"from .anthropic_backend import (","category":"scripts","line_end":35,"severity":"medium","line_start":30},{"id":"scripts:scripts/backends/__init__.py:41:dynamic-import-expression","file":"scripts/backends/__init__.py","pattern":"Dynamic import() expression","snippet":"from .cli_backend import (","category":"scripts","line_end":46,"severity":"medium","line_start":41},{"id":"env_access:scripts/backends/anthropic_backend.py:108:python-getenv-function","file":"scripts/backends/anthropic_backend.py","pattern":"Python getenv function","snippet":"return self._api_key or os.getenv(\"ANTHROPIC_API_KEY\")","category":"env_access","line_end":108,"severity":"low","line_start":108},{"id":"env_access:scripts/backends/anthropic_backend.py:314:python-getenv-function","file":"scripts/backends/anthropic_backend.py","pattern":"Python getenv function","snippet":"api_key = os.getenv(\"ANTHROPIC_API_KEY\")","category":"env_access","line_end":314,"severity":"low","line_start":314},{"id":"env_access:scripts/backends/anthropic_backend.py:108:getenv-function-call","file":"scripts/backends/anthropic_backend.py","pattern":"getenv function call","snippet":"return self._api_key or os.getenv(\"ANTHROPIC_API_KEY\")","category":"env_access","line_end":108,"severity":"low","line_start":108},{"id":"env_access:scripts/backends/anthropic_backend.py:314:getenv-function-call","file":"scripts/backends/anthropic_backend.py","pattern":"getenv function call","snippet":"api_key = os.getenv(\"ANTHROPIC_API_KEY\")","category":"env_access","line_end":314,"severity":"low","line_start":314},{"id":"env_access:scripts/backends/anthropic_backend.py:9:generic-api-secret-keys","file":"scripts/backends/anthropic_backend.py","pattern":"Generic API/secret keys","snippet":"- ANTHROPIC_API_KEY: ClĂ© API (env var ou config)","category":"env_access","line_end":9,"severity":"high","line_start":9},{"id":"env_access:scripts/backends/anthropic_backend.py:64:generic-api-secret-keys","file":"scripts/backends/anthropic_backend.py","pattern":"Generic API/secret keys","snippet":"- ANTHROPIC_API_KEY env var","category":"env_access","line_end":64,"severity":"high","line_start":64},{"id":"env_access:scripts/backends/anthropic_backend.py:65:generic-api-secret-keys","file":"scripts/backends/anthropic_backend.py","pattern":"Generic API/secret keys","snippet":"- ou api_key dans le constructeur","category":"env_access","line_end":65,"severity":"high","line_start":65},{"id":"env_access:scripts/backends/anthropic_backend.py:77:generic-api-secret-keys","file":"scripts/backends/anthropic_backend.py","pattern":"Generic API/secret keys","snippet":"api_key: Optional[str] = None,","category":"env_access","line_end":77,"severity":"high","line_start":77},{"id":"env_access:scripts/backends/anthropic_backend.py:85:generic-api-secret-keys","file":"scripts/backends/anthropic_backend.py","pattern":"Generic API/secret keys","snippet":"api_key: ClĂ© API (ou ANTHROPIC_API_KEY env var)","category":"env_access","line_end":85,"severity":"high","line_start":85},{"id":"env_access:scripts/backends/anthropic_backend.py:89:generic-api-secret-keys","file":"scripts/backends/anthropic_backend.py","pattern":"Generic API/secret keys","snippet":"self._api_key = api_key","category":"env_access","line_end":89,"severity":"high","line_start":89},{"id":"env_access:scripts/backends/anthropic_backend.py:106:generic-api-secret-keys","file":"scripts/backends/anthropic_backend.py","pattern":"Generic API/secret keys","snippet":"def api_key(self) -> Optional[str]:","category":"env_access","line_end":106,"severity":"high","line_start":106},{"id":"env_access:scripts/backends/anthropic_backend.py:108:generic-api-secret-keys","file":"scripts/backends/anthropic_backend.py","pattern":"Generic API/secret keys","snippet":"return self._api_key or os.getenv(\"ANTHROPIC_API_KEY\")","category":"env_access","line_end":108,"severity":"high","line_start":108},{"id":"env_access:scripts/backends/anthropic_backend.py:116:generic-api-secret-keys","file":"scripts/backends/anthropic_backend.py","pattern":"Generic API/secret keys","snippet":"- ANTHROPIC_API_KEY dĂ©fini","category":"env_access","line_end":116,"severity":"high","line_start":116},{"id":"env_access:scripts/backends/anthropic_backend.py:121:generic-api-secret-keys","file":"scripts/backends/anthropic_backend.py","pattern":"Generic API/secret keys","snippet":"if not self.api_key:","category":"env_access","line_end":121,"severity":"high","line_start":121},{"id":"env_access:scripts/backends/anthropic_backend.py:135:generic-api-secret-keys","file":"scripts/backends/anthropic_backend.py","pattern":"Generic API/secret keys","snippet":"export ANTHROPIC_API_KEY=\"sk-ant-...\"","category":"env_access","line_end":135,"severity":"high","line_start":135},{"id":"env_access:scripts/backends/anthropic_backend.py:140:generic-api-secret-keys","file":"scripts/backends/anthropic_backend.py","pattern":"Generic API/secret keys","snippet":"api_key: \"sk-ant-...\"","category":"env_access","line_end":140,"severity":"high","line_start":140},{"id":"env_access:scripts/backends/anthropic_backend.py:170:generic-api-secret-keys","file":"scripts/backends/anthropic_backend.py","pattern":"Generic API/secret keys","snippet":"self._client = anthropic.Anthropic(api_key=self.api_key)","category":"env_access","line_end":170,"severity":"high","line_start":170},{"id":"env_access:scripts/backends/anthropic_backend.py:314:generic-api-secret-keys","file":"scripts/backends/anthropic_backend.py","pattern":"Generic API/secret keys","snippet":"api_key = os.getenv(\"ANTHROPIC_API_KEY\")","category":"env_access","line_end":314,"severity":"high","line_start":314},{"id":"env_access:scripts/backends/anthropic_backend.py:315:generic-api-secret-keys","file":"scripts/backends/anthropic_backend.py","pattern":"Generic API/secret keys","snippet":"if not api_key:","category":"env_access","line_end":315,"severity":"high","line_start":315},{"id":"env_access:scripts/backends/anthropic_backend.py:316:generic-api-secret-keys","file":"scripts/backends/anthropic_backend.py","pattern":"Generic API/secret keys","snippet":"return False, \"ANTHROPIC_API_KEY non dĂ©fini\"","category":"env_access","line_end":316,"severity":"high","line_start":316},{"id":"env_access:scripts/backends/anthropic_backend.py:319:generic-api-secret-keys","file":"scripts/backends/anthropic_backend.py","pattern":"Generic API/secret keys","snippet":"masked_key = api_key[:10] + \"...\" + api_key[-4:] if len(api_key) > 14 else \"***\"","category":"env_access","line_end":319,"severity":"high","line_start":319},{"id":"sensitive:scripts/backends/base.py:226:certificate-key-files","file":"scripts/backends/base.py","pattern":"Certificate/key files","snippet":"return list(cls._backends.keys())","category":"sensitive","line_end":226,"severity":"high","line_start":226},{"id":"blocker:scripts/backends/base.py:94:weak-cryptographic-algorithm","file":"scripts/backends/base.py","pattern":"Weak cryptographic algorithm","snippet":"- PrĂ©sence des dĂ©pendances (packages)","category":"blocker","line_end":94,"severity":"high","line_start":94},{"id":"blocker:scripts/backends/base.py:150:weak-cryptographic-algorithm","file":"scripts/backends/base.py","pattern":"Weak cryptographic algorithm","snippet":"Registre des backends disponibles.","category":"blocker","line_end":150,"severity":"high","line_start":150},{"id":"blocker:scripts/backends/base.py:206:weak-cryptographic-algorithm","file":"scripts/backends/base.py","pattern":"Weak cryptographic algorithm","snippet":"Liste des backends dont is_available() == True","category":"blocker","line_end":206,"severity":"high","line_start":206},{"id":"blocker:scripts/backends/base.py:221:weak-cryptographic-algorithm","file":"scripts/backends/base.py","pattern":"Weak cryptographic algorithm","snippet":"Liste les noms des backends enregistrĂ©s.","category":"blocker","line_end":221,"severity":"high","line_start":221},{"id":"blocker:scripts/backends/base.py:224:weak-cryptographic-algorithm","file":"scripts/backends/base.py","pattern":"Weak cryptographic algorithm","snippet":"Liste des noms","category":"blocker","line_end":224,"severity":"high","line_start":224},{"id":"external_commands:scripts/backends/cli_backend.py:109:unix-shell-invocation","file":"scripts/backends/cli_backend.py","pattern":"Unix shell invocation","snippet":"#!/bin/bash","category":"external_commands","line_end":109,"severity":"medium","line_start":109},{"id":"env_access:scripts/backends/cli_backend.py:151:python-environment-access","file":"scripts/backends/cli_backend.py","pattern":"Python environment access","snippet":"env = os.environ.copy()","category":"env_access","line_end":151,"severity":"low","line_start":151},{"id":"env_access:scripts/backends/cli_backend.py:275:configuration-library","file":"scripts/backends/cli_backend.py","pattern":"Configuration library","snippet":"command=config.get(\"command\", cli_name),","category":"env_access","line_end":275,"severity":"low","line_start":275},{"id":"env_access:scripts/backends/cli_backend.py:276:configuration-library","file":"scripts/backends/cli_backend.py","pattern":"Configuration library","snippet":"args=config.get(\"args\", []),","category":"env_access","line_end":276,"severity":"low","line_start":276},{"id":"env_access:scripts/backends/cli_backend.py:277:configuration-library","file":"scripts/backends/cli_backend.py","pattern":"Configuration library","snippet":"env=config.get(\"env\", {})","category":"env_access","line_end":277,"severity":"low","line_start":277},{"id":"blocker:scripts/backends/cli_backend.py:3:weak-cryptographic-algorithm","file":"scripts/backends/cli_backend.py","pattern":"Weak cryptographic algorithm","snippet":"PRD-008 Story 8.3: Support des CLI wrappers personnalisĂ©s.","category":"blocker","line_end":3,"severity":"high","line_start":3},{"id":"network:scripts/config.py:382:hardcoded-url","file":"scripts/config.py","pattern":"Hardcoded URL","snippet":"lines.append(\"# Voir documentation: https://github.com/...\")","category":"network","line_end":382,"severity":"low","line_start":382},{"id":"filesystem:scripts/config.py:7:hidden-file-in-home-directory","file":"scripts/config.py","pattern":"Hidden file in home directory","snippet":"2. ~/.synthese-council/config.yaml (global utilisateur)","category":"filesystem","line_end":7,"severity":"high","line_start":7},{"id":"filesystem:scripts/config.py:168:hidden-file-in-home-directory","file":"scripts/config.py","pattern":"Hidden file in home directory","snippet":"2. ~/.synthese-council/config.yaml - global utilisateur","category":"filesystem","line_end":168,"severity":"high","line_start":168},{"id":"filesystem:scripts/config.py:7:hidden-file-access","file":"scripts/config.py","pattern":"Hidden file access","snippet":"2. ~/.synthese-council/config.yaml (global utilisateur)","category":"filesystem","line_end":7,"severity":"medium","line_start":7},{"id":"filesystem:scripts/config.py:168:hidden-file-access","file":"scripts/config.py","pattern":"Hidden file access","snippet":"2. ~/.synthese-council/config.yaml - global utilisateur","category":"filesystem","line_end":168,"severity":"medium","line_start":168},{"id":"env_access:scripts/config.py:514:configuration-library","file":"scripts/config.py","pattern":"Configuration library","snippet":"custom_roles = config.get(\"expert_roles\", {})","category":"env_access","line_end":514,"severity":"low","line_start":514},{"id":"env_access:scripts/config.py:533:configuration-library","file":"scripts/config.py","pattern":"Configuration library","snippet":"return config.get(\"default_cadrage\", DEFAULT_CONFIG[\"default_cadrage\"]).copy()","category":"env_access","line_end":533,"severity":"low","line_start":533},{"id":"blocker:scripts/config.py:103:weak-cryptographic-algorithm","file":"scripts/config.py","pattern":"Weak cryptographic algorithm","snippet":"\"description\": \"Activer la sauvegarde des trails\"","category":"blocker","line_end":103,"severity":"high","line_start":103},{"id":"blocker:scripts/config.py:113:weak-cryptographic-algorithm","file":"scripts/config.py","pattern":"Weak cryptographic algorithm","snippet":"\"description\": \"Liste des modĂšles Ă  utiliser\"","category":"blocker","line_end":113,"severity":"high","line_start":113},{"id":"blocker:scripts/config.py:127:weak-cryptographic-algorithm","file":"scripts/config.py","pattern":"Weak cryptographic algorithm","snippet":"\"description\": \"Configuration des rĂŽles experts\"","category":"blocker","line_end":127,"severity":"high","line_start":127},{"id":"blocker:scripts/config.py:183:weak-cryptographic-algorithm","file":"scripts/config.py","pattern":"Weak cryptographic algorithm","snippet":"\"\"\"Retourne une copie des valeurs par dĂ©faut.\"\"\"","category":"blocker","line_end":183,"severity":"high","line_start":183},{"id":"blocker:scripts/config.py:318:weak-cryptographic-algorithm","file":"scripts/config.py","pattern":"Weak cryptographic algorithm","snippet":"# VĂ©rification des Ă©lĂ©ments de liste","category":"blocker","line_end":318,"severity":"high","line_start":318},{"id":"blocker:scripts/config.py:435:weak-cryptographic-algorithm","file":"scripts/config.py","pattern":"Weak cryptographic algorithm","snippet":"lines.append(\"# RĂŽles des experts (personnalisable)\")","category":"blocker","line_end":435,"severity":"high","line_start":435},{"id":"env_access:scripts/convergence.py:376:configuration-library","file":"scripts/convergence.py","pattern":"Configuration library","snippet":"backend = config.get(\"convergence\", {}).get(\"backend\", \"hybrid\")","category":"env_access","line_end":376,"severity":"low","line_start":376},{"id":"sensitive:scripts/convergence.py:238:certificate-key-files","file":"scripts/convergence.py","pattern":"Certificate/key files","snippet":"all_words = set(counter_a.keys()) | set(counter_b.keys())","category":"sensitive","line_end":238,"severity":"high","line_start":238},{"id":"blocker:scripts/convergence.py:30:weak-cryptographic-algorithm","file":"scripts/convergence.py","pattern":"Weak cryptographic algorithm","snippet":"\"le\", \"la\", \"les\", \"l\", \"un\", \"une\", \"des\", \"du\", \"de\", \"d\",","category":"blocker","line_end":30,"severity":"high","line_start":30},{"id":"blocker:scripts/convergence.py:32:weak-cryptographic-algorithm","file":"scripts/convergence.py","pattern":"Weak cryptographic algorithm","snippet":"\"Ă \", \"au\", \"aux\", \"de\", \"du\", \"des\", \"en\", \"dans\", \"sur\", \"sous\",","category":"blocker","line_end":32,"severity":"high","line_start":32},{"id":"blocker:scripts/convergence.py:68:weak-cryptographic-algorithm","file":"scripts/convergence.py","pattern":"Weak cryptographic algorithm","snippet":"2. Remplacement des apostrophes par des espaces","category":"blocker","line_end":68,"severity":"high","line_start":68},{"id":"blocker:scripts/convergence.py:71:weak-cryptographic-algorithm","file":"scripts/convergence.py","pattern":"Weak cryptographic algorithm","snippet":"5. Filtrage des stop words et tokens courts","category":"blocker","line_end":71,"severity":"high","line_start":71},{"id":"blocker:scripts/convergence.py:119:weak-cryptographic-algorithm","file":"scripts/convergence.py","pattern":"Weak cryptographic algorithm","snippet":"n: Taille des n-grams (1=unigrams, 2=bigrams, etc.)","category":"blocker","line_end":119,"severity":"high","line_start":119},{"id":"blocker:scripts/convergence.py:185:weak-cryptographic-algorithm","file":"scripts/convergence.py","pattern":"Weak cryptographic algorithm","snippet":"n: Taille des n-grams","category":"blocker","line_end":185,"severity":"high","line_start":185},{"id":"blocker:scripts/convergence.py:284:weak-cryptographic-algorithm","file":"scripts/convergence.py","pattern":"Weak cryptographic algorithm","snippet":"weights: Poids des mĂ©triques (optionnel)","category":"blocker","line_end":284,"severity":"high","line_start":284},{"id":"blocker:scripts/convergence.py:359:weak-cryptographic-algorithm","file":"scripts/convergence.py","pattern":"Weak cryptographic algorithm","snippet":"contents: Liste des contenus Ă  comparer","category":"blocker","line_end":359,"severity":"high","line_start":359},{"id":"blocker:scripts/convergence.py:360:weak-cryptographic-algorithm","file":"scripts/convergence.py","pattern":"Weak cryptographic algorithm","snippet":"weights: Poids des mĂ©triques (optionnel)","category":"blocker","line_end":360,"severity":"high","line_start":360},{"id":"blocker:scripts/convergence.py:442:weak-cryptographic-algorithm","file":"scripts/convergence.py","pattern":"Weak cryptographic algorithm","snippet":"Liste des mots-clĂ©s les plus frĂ©quents","category":"blocker","line_end":442,"severity":"high","line_start":442},{"id":"blocker:scripts/convergence.py:502:weak-cryptographic-algorithm","file":"scripts/convergence.py","pattern":"Weak cryptographic algorithm","snippet":"\"On observe des changements technologiques\"","category":"blocker","line_end":502,"severity":"high","line_start":502},{"id":"blocker:scripts/pedagogy.py:50:weak-cryptographic-algorithm","file":"scripts/pedagogy.py","pattern":"Weak cryptographic algorithm","snippet":"║ 4. La SYNTHÈSE finale (convergence des perspectives) ║","category":"blocker","line_end":50,"severity":"high","line_start":50},{"id":"blocker:scripts/pedagogy.py:63:weak-cryptographic-algorithm","file":"scripts/pedagogy.py","pattern":"Weak cryptographic algorithm","snippet":"│ Le mĂȘme texte donne des synthĂšses diffĂ©rentes selon : │","category":"blocker","line_end":63,"severity":"high","line_start":63},{"id":"blocker:scripts/pedagogy.py:91:weak-cryptographic-algorithm","file":"scripts/pedagogy.py","pattern":"Weak cryptographic algorithm","snippet":"│ Les 3 experts ont des FOCUS diffĂ©rents : │","category":"blocker","line_end":91,"severity":"high","line_start":91},{"id":"blocker:scripts/pedagogy.py:133:weak-cryptographic-algorithm","file":"scripts/pedagogy.py","pattern":"Weak cryptographic algorithm","snippet":"│ Un seul point de vue peut manquer des nuances ou │","category":"blocker","line_end":133,"severity":"high","line_start":133},{"id":"blocker:scripts/pedagogy.py:134:weak-cryptographic-algorithm","file":"scripts/pedagogy.py","pattern":"Weak cryptographic algorithm","snippet":"│ introduire des biais involontaires. │","category":"blocker","line_end":134,"severity":"high","line_start":134},{"id":"blocker:scripts/pedagogy.py:141:weak-cryptographic-algorithm","file":"scripts/pedagogy.py","pattern":"Weak cryptographic algorithm","snippet":"│ Chaque expert Ă©value les analyses des autres : │","category":"blocker","line_end":141,"severity":"high","line_start":141},{"id":"blocker:scripts/pedagogy.py:153:weak-cryptographic-algorithm","file":"scripts/pedagogy.py","pattern":"Weak cryptographic algorithm","snippet":"│ ⚠ CONTRÔLE DES GLISSEMENTS │","category":"blocker","line_end":153,"severity":"high","line_start":153},{"id":"blocker:scripts/pedagogy.py:161:weak-cryptographic-algorithm","file":"scripts/pedagogy.py","pattern":"Weak cryptographic algorithm","snippet":"│ Confondre des termes proches mais distincts │","category":"blocker","line_end":161,"severity":"high","line_start":161},{"id":"blocker:scripts/pedagogy.py:188:weak-cryptographic-algorithm","file":"scripts/pedagogy.py","pattern":"Weak cryptographic algorithm","snippet":"│ ‱ La similitude des analyses produites │","category":"blocker","line_end":188,"severity":"high","line_start":188},{"id":"blocker:scripts/pedagogy.py:190:weak-cryptographic-algorithm","file":"scripts/pedagogy.py","pattern":"Weak cryptographic algorithm","snippet":"│ ‱ La cohĂ©rence des structures proposĂ©es │","category":"blocker","line_end":190,"severity":"high","line_start":190},{"id":"blocker:scripts/pedagogy.py:217:weak-cryptographic-algorithm","file":"scripts/pedagogy.py","pattern":"Weak cryptographic algorithm","snippet":"│ ✓ IntĂšgre les CONVERGENCES des 3 experts │","category":"blocker","line_end":217,"severity":"high","line_start":217},{"id":"blocker:scripts/pedagogy.py:255:weak-cryptographic-algorithm","file":"scripts/pedagogy.py","pattern":"Weak cryptographic algorithm","snippet":"# EXPLICATIONS DES EXPERTS","category":"blocker","line_end":255,"severity":"high","line_start":255},{"id":"blocker:scripts/pedagogy.py:310:weak-cryptographic-algorithm","file":"scripts/pedagogy.py","pattern":"Weak cryptographic algorithm","snippet":"# EXPLICATIONS DES COUCHES","category":"blocker","line_end":310,"severity":"high","line_start":310},{"id":"blocker:scripts/pedagogy.py:353:weak-cryptographic-algorithm","file":"scripts/pedagogy.py","pattern":"Weak cryptographic algorithm","snippet":"Affiche des explications contextuelles Ă  chaque Ă©tape","category":"blocker","line_end":353,"severity":"high","line_start":353},{"id":"blocker:scripts/retry.py:8:weak-cryptographic-algorithm","file":"scripts/retry.py","pattern":"Weak cryptographic algorithm","snippet":"- Classification automatique des erreurs retryables","category":"blocker","line_end":8,"severity":"high","line_start":8},{"id":"blocker:scripts/retry.py:41:weak-cryptographic-algorithm","file":"scripts/retry.py","pattern":"Weak cryptographic algorithm","snippet":"# CLASSIFICATION DES ERREURS (Story 4.3)","category":"blocker","line_end":41,"severity":"high","line_start":41},{"id":"blocker:scripts/retry.py:259:weak-cryptographic-algorithm","file":"scripts/retry.py","pattern":"Weak cryptographic algorithm","snippet":"\"\"\"RĂ©sumĂ© textuel des mĂ©triques.\"\"\"","category":"blocker","line_end":259,"severity":"high","line_start":259},{"id":"external_commands:scripts/sanitize.py:27:ruby-shell-backtick-execution","file":"scripts/sanitize.py","pattern":"Ruby/shell backtick execution","snippet":"\"`\", # Command substitution","category":"external_commands","line_end":42,"severity":"medium","line_start":27},{"id":"external_commands:scripts/sanitize.py:42:ruby-shell-backtick-execution","file":"scripts/sanitize.py","pattern":"Ruby/shell backtick execution","snippet":"r\"`[^`]+`\", # `...` command substitution","category":"external_commands","line_end":42,"severity":"medium","line_start":42},{"id":"external_commands:scripts/sanitize.py:180:ruby-shell-backtick-execution","file":"scripts/sanitize.py","pattern":"Ruby/shell backtick execution","snippet":"result = result.replace(\"`\", \"\\\\`\")","category":"external_commands","line_end":180,"severity":"medium","line_start":180},{"id":"external_commands:scripts/sanitize.py:28:shell-command-substitution","file":"scripts/sanitize.py","pattern":"Shell command substitution","snippet":"\"$(\", # Command substitution","category":"external_commands","line_end":41,"severity":"medium","line_start":28},{"id":"external_commands:scripts/sanitize.py:41:shell-command-substitution","file":"scripts/sanitize.py","pattern":"Shell command substitution","snippet":"r\"\\$\\(.*\\)\", # $(...) command substitution","category":"external_commands","line_end":41,"severity":"medium","line_start":41},{"id":"external_commands:scripts/sanitize.py:27:template-literal-with-command-substitution","file":"scripts/sanitize.py","pattern":"Template literal with command substitution","snippet":"\"`\", # Command substitution","category":"external_commands","line_end":42,"severity":"medium","line_start":27},{"id":"obfuscation:scripts/sanitize.py:35:hex-encoded-characters","file":"scripts/sanitize.py","pattern":"Hex-encoded characters","snippet":"\"\\x00\", # Null byte","category":"obfuscation","line_end":35,"severity":"high","line_start":35},{"id":"obfuscation:scripts/sanitize.py:177:hex-encoded-characters","file":"scripts/sanitize.py","pattern":"Hex-encoded characters","snippet":"result = result.replace(\"\\x00\", \"\")","category":"obfuscation","line_end":177,"severity":"high","line_start":177},{"id":"obfuscation:scripts/sanitize.py:199:hex-encoded-characters","file":"scripts/sanitize.py","pattern":"Hex-encoded characters","snippet":"result = text.replace(\"\\x00\", \"\")","category":"obfuscation","line_end":199,"severity":"high","line_start":199},{"id":"obfuscation:scripts/sanitize.py:202:hex-encoded-characters","file":"scripts/sanitize.py","pattern":"Hex-encoded characters","snippet":"result = re.sub(r'[\\x00-\\x08\\x0b\\x0c\\x0e-\\x1f]', '', result)","category":"obfuscation","line_end":202,"severity":"high","line_start":202},{"id":"blocker:scripts/sanitize.py:2:weak-cryptographic-algorithm","file":"scripts/sanitize.py","pattern":"Weak cryptographic algorithm","snippet":"Module de sanitisation des entrĂ©es pour SynthĂšse Council.","category":"blocker","line_end":2,"severity":"high","line_start":2},{"id":"blocker:scripts/sanitize.py:3:weak-cryptographic-algorithm","file":"scripts/sanitize.py","pattern":"Weak cryptographic algorithm","snippet":"PRD-008 Story 8.4: Validation et nettoyage des entrĂ©es utilisateur.","category":"blocker","line_end":3,"severity":"high","line_start":3},{"id":"blocker:scripts/sanitize.py:5:weak-cryptographic-algorithm","file":"scripts/sanitize.py","pattern":"Weak cryptographic algorithm","snippet":"Ce module fournit des fonctions pour valider et nettoyer les entrĂ©es","category":"blocker","line_end":5,"severity":"high","line_start":5},{"id":"blocker:scripts/sanitize.py:54:weak-cryptographic-algorithm","file":"scripts/sanitize.py","pattern":"Weak cryptographic algorithm","snippet":"\"\"\"Erreur de validation des entrĂ©es.\"\"\"","category":"blocker","line_end":54,"severity":"high","line_start":54},{"id":"blocker:scripts/sanitize.py:144:weak-cryptographic-algorithm","file":"scripts/sanitize.py","pattern":"Weak cryptographic algorithm","snippet":"# VĂ©rifier la longueur des champs","category":"blocker","line_end":144,"severity":"high","line_start":144},{"id":"blocker:scripts/sanitize.py:147:weak-cryptographic-algorithm","file":"scripts/sanitize.py","pattern":"Weak cryptographic algorithm","snippet":"return False, f\"Les clĂ©s du cadrage doivent ĂȘtre des chaĂźnes\"","category":"blocker","line_end":147,"severity":"high","line_start":147},{"id":"blocker:scripts/sanitize.py:150:weak-cryptographic-algorithm","file":"scripts/sanitize.py","pattern":"Weak cryptographic algorithm","snippet":"return False, f\"Les valeurs du cadrage doivent ĂȘtre des chaĂźnes (champ: {key})\"","category":"blocker","line_end":150,"severity":"high","line_start":150},{"id":"blocker:scripts/sanitize.py:296:weak-cryptographic-algorithm","file":"scripts/sanitize.py","pattern":"Weak cryptographic algorithm","snippet":"Liste des patterns dĂ©tectĂ©s","category":"blocker","line_end":296,"severity":"high","line_start":296},{"id":"scripts:scripts/synthese.py:93:dynamic-import-expression","file":"scripts/synthese.py","pattern":"Dynamic import() expression","snippet":"from config import (","category":"scripts","line_end":96,"severity":"medium","line_start":93},{"id":"scripts:scripts/synthese.py:113:dynamic-import-expression","file":"scripts/synthese.py","pattern":"Dynamic import() expression","snippet":"from retry import (","category":"scripts","line_end":118,"severity":"medium","line_start":113},{"id":"scripts:scripts/synthese.py:129:dynamic-import-expression","file":"scripts/synthese.py","pattern":"Dynamic import() expression","snippet":"from pedagogy import (","category":"scripts","line_end":132,"severity":"medium","line_start":129},{"id":"scripts:scripts/synthese.py:139:dynamic-import-expression","file":"scripts/synthese.py","pattern":"Dynamic import() expression","snippet":"from convergence import (","category":"scripts","line_end":142,"severity":"medium","line_start":139},{"id":"scripts:scripts/synthese.py:149:dynamic-import-expression","file":"scripts/synthese.py","pattern":"Dynamic import() expression","snippet":"from backends import (","category":"scripts","line_end":152,"severity":"medium","line_start":149},{"id":"scripts:scripts/synthese.py:159:dynamic-import-expression","file":"scripts/synthese.py","pattern":"Dynamic import() expression","snippet":"from sanitize import (","category":"scripts","line_end":163,"severity":"medium","line_start":159},{"id":"external_commands:scripts/synthese.py:1229:python-subprocess-run","file":"scripts/synthese.py","pattern":"Python subprocess.run","snippet":"result = subprocess.run(","category":"external_commands","line_end":1229,"severity":"high","line_start":1229},{"id":"external_commands:scripts/synthese.py:1317:python-subprocess-run","file":"scripts/synthese.py","pattern":"Python subprocess.run","snippet":"result = subprocess.run(","category":"external_commands","line_end":1317,"severity":"high","line_start":1317},{"id":"external_commands:scripts/synthese.py:2851:ruby-shell-backtick-execution","file":"scripts/synthese.py","pattern":"Ruby/shell backtick execution","snippet":"output.append(f\"| Session | `{session.session_id}` |\")","category":"external_commands","line_end":2851,"severity":"medium","line_start":2851},{"id":"external_commands:scripts/synthese.py:2890:ruby-shell-backtick-execution","file":"scripts/synthese.py","pattern":"Ruby/shell backtick execution","snippet":"output.append(f\"*Trail : `synthese_trails/{session.session_id}.json`*\")","category":"external_commands","line_end":2890,"severity":"medium","line_start":2890},{"id":"network:scripts/synthese.py:836:python-http-libraries","file":"scripts/synthese.py","pattern":"Python HTTP libraries","snippet":"requests.RequestException: Si erreur rĂ©seau","category":"network","line_end":836,"severity":"low","line_start":836},{"id":"network:scripts/synthese.py:848:python-http-libraries","file":"scripts/synthese.py","pattern":"Python HTTP libraries","snippet":"response = requests.get(url, headers=headers, timeout=timeout)","category":"network","line_end":848,"severity":"low","line_start":848},{"id":"network:scripts/synthese.py:1162:hardcoded-url","file":"scripts/synthese.py","pattern":"Hardcoded URL","snippet":"\"Documentation: https://github.com/your-repo/synthese-council#installation\"","category":"network","line_end":1162,"severity":"low","line_start":1162},{"id":"filesystem:scripts/synthese.py:326:node-js-fs-operations","file":"scripts/synthese.py","pattern":"Node.js fs operations","snippet":"valid_refs.append(f\"§{ref}\")","category":"filesystem","line_end":326,"severity":"medium","line_start":326},{"id":"filesystem:scripts/synthese.py:362:node-js-fs-operations","file":"scripts/synthese.py","pattern":"Node.js fs operations","snippet":"valid_refs.append(f\"S:{source_name}§{para_num}\")","category":"filesystem","line_end":362,"severity":"medium","line_start":362},{"id":"filesystem:scripts/synthese.py:374:node-js-fs-operations","file":"scripts/synthese.py","pattern":"Node.js fs operations","snippet":"valid_refs.append(f\"§{ref}\")","category":"filesystem","line_end":374,"severity":"medium","line_start":374},{"id":"filesystem:scripts/synthese.py:708:python-file-write-append","file":"scripts/synthese.py","pattern":"Python file write/append","snippet":"with open(cache_path, \"w\", encoding=\"utf-8\") as f:","category":"filesystem","line_end":708,"severity":"medium","line_start":708},{"id":"filesystem:scripts/synthese.py:2680:python-file-write-append","file":"scripts/synthese.py","pattern":"Python file write/append","snippet":"with open(trail_file, \"w\", encoding=\"utf-8\") as f:","category":"filesystem","line_end":2680,"severity":"medium","line_start":2680},{"id":"filesystem:scripts/synthese.py:2716:python-file-write-append","file":"scripts/synthese.py","pattern":"Python file write/append","snippet":"with open(md_file, \"w\", encoding=\"utf-8\") as f:","category":"filesystem","line_end":2716,"severity":"medium","line_start":2716},{"id":"env_access:scripts/synthese.py:1692:configuration-library","file":"scripts/synthese.py","pattern":"Configuration library","snippet":"self.retry_config = self.config.get(\"retry\", DEFAULT_RETRY_CONFIG)","category":"env_access","line_end":1692,"severity":"low","line_start":1692},{"id":"env_access:scripts/synthese.py:1711:configuration-library","file":"scripts/synthese.py","pattern":"Configuration library","snippet":"cache_config = self.config.get(\"cache\", {})","category":"env_access","line_end":1711,"severity":"low","line_start":1711},{"id":"env_access:scripts/synthese.py:1713:configuration-library","file":"scripts/synthese.py","pattern":"Configuration library","snippet":"enabled=cache_config.get(\"enabled\", True),","category":"env_access","line_end":1713,"severity":"low","line_start":1713},{"id":"env_access:scripts/synthese.py:1714:configuration-library","file":"scripts/synthese.py","pattern":"Configuration library","snippet":"default_ttl=cache_config.get(\"ttl\", 3600),","category":"env_access","line_end":1714,"severity":"low","line_start":1714},{"id":"env_access:scripts/synthese.py:1715:configuration-library","file":"scripts/synthese.py","pattern":"Configuration library","snippet":"cache_dir=Path(cache_config.get(\"directory\", \".cache/synthese\")) if cache_config.get(\"directory\") el","category":"env_access","line_end":1715,"severity":"low","line_start":1715},{"id":"env_access:scripts/synthese.py:2115:configuration-library","file":"scripts/synthese.py","pattern":"Configuration library","snippet":"weights = self.config.get(\"convergence_weights\", None)","category":"env_access","line_end":2115,"severity":"low","line_start":2115},{"id":"env_access:scripts/synthese.py:2616:configuration-library","file":"scripts/synthese.py","pattern":"Configuration library","snippet":"timeout=self.config.get(\"timeout\", 300),","category":"env_access","line_end":2616,"severity":"low","line_start":2616},{"id":"env_access:scripts/synthese.py:3128:configuration-library","file":"scripts/synthese.py","pattern":"Configuration library","snippet":"if council.config.get(\"enable_trail\", True):","category":"env_access","line_end":3128,"severity":"low","line_start":3128},{"id":"env_access:scripts/synthese.py:3449:configuration-library","file":"scripts/synthese.py","pattern":"Configuration library","snippet":"sources = config.get(\"_sources\", [\"default\"])","category":"env_access","line_end":3449,"severity":"low","line_start":3449},{"id":"env_access:scripts/synthese.py:3491:configuration-library","file":"scripts/synthese.py","pattern":"Configuration library","snippet":"sources = config.get(\"_sources\", [\"default\"])","category":"env_access","line_end":3491,"severity":"low","line_start":3491},{"id":"env_access:scripts/synthese.py:1159:generic-api-secret-keys","file":"scripts/synthese.py","pattern":"Generic API/secret keys","snippet":"\" 1. DĂ©finir ANTHROPIC_API_KEY pour utiliser l'API Anthropic\\n\"","category":"env_access","line_end":1159,"severity":"high","line_start":1159},{"id":"env_access:scripts/synthese.py:1765:generic-api-secret-keys","file":"scripts/synthese.py","pattern":"Generic API/secret keys","snippet":"log(\"║ 2. Ou dĂ©finir ANTHROPIC_API_KEY (fallback) ║\")","category":"env_access","line_end":1765,"severity":"high","line_start":1765},{"id":"sensitive:scripts/synthese.py:1790:certificate-key-files","file":"scripts/synthese.py","pattern":"Certificate/key files","snippet":"roles = list(self.expert_roles.keys())","category":"sensitive","line_end":1790,"severity":"high","line_start":1790},{"id":"sensitive:scripts/synthese.py:3243:certificate-key-files","file":"scripts/synthese.py","pattern":"Certificate/key files","snippet":"choices=list(CADRAGE_TEMPLATES.keys()),","category":"sensitive","line_end":3243,"severity":"high","line_start":3243},{"id":"blocker:scripts/synthese.py:168:weak-cryptographic-algorithm","file":"scripts/synthese.py","pattern":"Weak cryptographic algorithm","snippet":"# PRD-018: Import des extracteurs optionnels","category":"blocker","line_end":168,"severity":"high","line_start":168},{"id":"blocker:scripts/synthese.py:205:weak-cryptographic-algorithm","file":"scripts/synthese.py","pattern":"Weak cryptographic algorithm","snippet":"PRD-019: Permet de crĂ©er des rĂ©fĂ©rences vĂ©rifiables vers le texte source.","category":"blocker","line_end":205,"severity":"high","line_start":205},{"id":"blocker:scripts/synthese.py:390:weak-cryptographic-algorithm","file":"scripts/synthese.py","pattern":"Weak cryptographic algorithm","snippet":"valid_refs: Liste des rĂ©fĂ©rences valides","category":"blocker","line_end":390,"severity":"high","line_start":390},{"id":"blocker:scripts/synthese.py:392:weak-cryptographic-algorithm","file":"scripts/synthese.py","pattern":"Weak cryptographic algorithm","snippet":"max_excerpt_len: Longueur max des extraits","category":"blocker","line_end":392,"severity":"high","line_start":392},{"id":"blocker:scripts/synthese.py:437:weak-cryptographic-algorithm","file":"scripts/synthese.py","pattern":"Weak cryptographic algorithm","snippet":"PRD-020: Support des templates de cadrage.","category":"blocker","line_end":437,"severity":"high","line_start":437},{"id":"blocker:scripts/synthese.py:631:weak-cryptographic-algorithm","file":"scripts/synthese.py","pattern":"Weak cryptographic algorithm","snippet":"# CACHE DES RÉPONSES (PRD-024)","category":"blocker","line_end":631,"severity":"high","line_start":631},{"id":"blocker:scripts/synthese.py:759:weak-cryptographic-algorithm","file":"scripts/synthese.py","pattern":"Weak cryptographic algorithm","snippet":"PRD-018: Support des fichiers PDF via pdfplumber.","category":"blocker","line_end":759,"severity":"high","line_start":759},{"id":"blocker:scripts/synthese.py:794:weak-cryptographic-algorithm","file":"scripts/synthese.py","pattern":"Weak cryptographic algorithm","snippet":"PRD-018: Support des fichiers Word via python-docx.","category":"blocker","line_end":794,"severity":"high","line_start":794},{"id":"blocker:scripts/synthese.py:825:weak-cryptographic-algorithm","file":"scripts/synthese.py","pattern":"Weak cryptographic algorithm","snippet":"PRD-018: Support des URLs via requests + BeautifulSoup.","category":"blocker","line_end":825,"severity":"high","line_start":825},{"id":"blocker:scripts/synthese.py:959:weak-cryptographic-algorithm","file":"scripts/synthese.py","pattern":"Weak cryptographic algorithm","snippet":"sources: Liste des sources chargĂ©es","category":"blocker","line_end":959,"severity":"high","line_start":959},{"id":"blocker:scripts/synthese.py:1153:weak-cryptographic-algorithm","file":"scripts/synthese.py","pattern":"Weak cryptographic algorithm","snippet":"PRD-008 Story 8.1: Gestion gracieuse des erreurs de configuration.","category":"blocker","line_end":1153,"severity":"high","line_start":1153},{"id":"blocker:scripts/synthese.py:1206:weak-cryptographic-algorithm","file":"scripts/synthese.py","pattern":"Weak cryptographic algorithm","snippet":"# Destination des logs (stdout par dĂ©faut, stderr si sortie structurĂ©e)","category":"blocker","line_end":1206,"severity":"high","line_start":1206},{"id":"blocker:scripts/synthese.py:1268:weak-cryptographic-algorithm","file":"scripts/synthese.py","pattern":"Weak cryptographic algorithm","snippet":"PRD-008: Support des backends natifs (Anthropic, etc.)","category":"blocker","line_end":1268,"severity":"high","line_start":1268},{"id":"blocker:scripts/synthese.py:1272:weak-cryptographic-algorithm","file":"scripts/synthese.py","pattern":"Weak cryptographic algorithm","snippet":"Liste des backends disponibles","category":"blocker","line_end":1272,"severity":"high","line_start":1272},{"id":"blocker:scripts/synthese.py:1730:weak-cryptographic-algorithm","file":"scripts/synthese.py","pattern":"Weak cryptographic algorithm","snippet":"log(\"║ VÉRIFICATION DES MODÈLES ║\")","category":"blocker","line_end":1730,"severity":"high","line_start":1730},{"id":"blocker:scripts/synthese.py:1830:weak-cryptographic-algorithm","file":"scripts/synthese.py","pattern":"Weak cryptographic algorithm","snippet":"GĂ©nĂšre des personas experts adaptĂ©s au document (PRD-017).","category":"blocker","line_end":1830,"severity":"high","line_start":1830},{"id":"blocker:scripts/synthese.py:1850:weak-cryptographic-algorithm","file":"scripts/synthese.py","pattern":"Weak cryptographic algorithm","snippet":"2. GĂ©nĂšre 3 personas d'experts avec des angles complĂ©mentaires","category":"blocker","line_end":1850,"severity":"high","line_start":1850},{"id":"blocker:scripts/synthese.py:1868:weak-cryptographic-algorithm","file":"scripts/synthese.py","pattern":"Weak cryptographic algorithm","snippet":"log(f\"⚠ GĂ©nĂ©ration personas Ă©chouĂ©e, utilisation des dĂ©fauts\")","category":"blocker","line_end":1868,"severity":"high","line_start":1868},{"id":"blocker:scripts/synthese.py:1903:weak-cryptographic-algorithm","file":"scripts/synthese.py","pattern":"Weak cryptographic algorithm","snippet":"log(\"\\n─── GÉNÉRATION DES PERSONAS ───\")","category":"blocker","line_end":1903,"severity":"high","line_start":1903},{"id":"blocker:scripts/synthese.py:2077:weak-cryptographic-algorithm","file":"scripts/synthese.py","pattern":"Weak cryptographic algorithm","snippet":"Voici les analyses et critiques des experts:","category":"blocker","line_end":2077,"severity":"high","line_start":2077},{"id":"blocker:scripts/synthese.py:2147:weak-cryptographic-algorithm","file":"scripts/synthese.py","pattern":"Weak cryptographic algorithm","snippet":"# EXECUTION PARALLÈLE DES ROUNDS (Story 2.2)","category":"blocker","line_end":2147,"severity":"high","line_start":2147},{"id":"blocker:scripts/synthese.py:2256:weak-cryptographic-algorithm","file":"scripts/synthese.py","pattern":"Weak cryptographic algorithm","snippet":"with_refs: Inclure des rĂ©fĂ©rences [§N] aux passages sources","category":"blocker","line_end":2256,"severity":"high","line_start":2256},{"id":"blocker:scripts/synthese.py:2481:weak-cryptographic-algorithm","file":"scripts/synthese.py","pattern":"Weak cryptographic algorithm","snippet":"# Afficher rĂ©sumĂ© des retries si pertinent","category":"blocker","line_end":2481,"severity":"high","line_start":2481},{"id":"blocker:scripts/synthese.py:2946:weak-cryptographic-algorithm","file":"scripts/synthese.py","pattern":"Weak cryptographic algorithm","snippet":"# PRD-018: RĂ©cupĂ©ration des sources (fichiers, URLs, texte)","category":"blocker","line_end":2946,"severity":"high","line_start":2946},{"id":"blocker:scripts/synthese.py:2999:weak-cryptographic-algorithm","file":"scripts/synthese.py","pattern":"Weak cryptographic algorithm","snippet":"# Construction des overrides CLI (PRD-003)","category":"blocker","line_end":2999,"severity":"high","line_start":2999},{"id":"blocker:scripts/synthese.py:3152:weak-cryptographic-algorithm","file":"scripts/synthese.py","pattern":"Weak cryptographic algorithm","snippet":"# PRD-026: Affichage des mĂ©triques dĂ©taillĂ©es","category":"blocker","line_end":3152,"severity":"high","line_start":3152},{"id":"blocker:scripts/synthese.py:3238:weak-cryptographic-algorithm","file":"scripts/synthese.py","pattern":"Weak cryptographic algorithm","snippet":"help=\"Inclure des rĂ©fĂ©rences [§N] aux passages sources (PRD-019)\"","category":"blocker","line_end":3238,"severity":"high","line_start":3238},{"id":"blocker:scripts/synthese.py:3269:weak-cryptographic-algorithm","file":"scripts/synthese.py","pattern":"Weak cryptographic algorithm","snippet":"help=\"DĂ©sactiver le cache des rĂ©ponses (PRD-024)\"","category":"blocker","line_end":3269,"severity":"high","line_start":3269},{"id":"blocker:scripts/synthese.py:3274:weak-cryptographic-algorithm","file":"scripts/synthese.py","pattern":"Weak cryptographic algorithm","snippet":"help=\"Vider le cache des rĂ©ponses\"","category":"blocker","line_end":3274,"severity":"high","line_start":3274},{"id":"blocker:scripts/synthese.py:3515:weak-cryptographic-algorithm","file":"scripts/synthese.py","pattern":"Weak cryptographic algorithm","snippet":"print(\"║ VÉRIFICATION DES CLI ║\")","category":"blocker","line_end":3515,"severity":"high","line_start":3515},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":32,"severity":"medium","line_start":20},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":36,"severity":"medium","line_start":32},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":38,"severity":"medium","line_start":36},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":54,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":70,"severity":"medium","line_start":54},{"id":"external_commands:SKILL.md:70:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":76,"severity":"medium","line_start":70},{"id":"external_commands:SKILL.md:76:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `--mode` | standard, rapide, critique, pedagogique | standard |","category":"external_commands","line_end":77,"severity":"medium","line_start":76},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `--destinataire` | Public cible | interactif |","category":"external_commands","line_end":78,"severity":"medium","line_start":77},{"id":"external_commands:SKILL.md:78:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `--finalite` | Objectif de la synthĂšse | interactif |","category":"external_commands","line_end":79,"severity":"medium","line_start":78},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `--longueur` | Longueur souhaitĂ©e | 10-15 lignes |","category":"external_commands","line_end":80,"severity":"medium","line_start":79},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `--ton` | Registre de langue | accessible |","category":"external_commands","line_end":81,"severity":"medium","line_start":80},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `--niveau` | Expertise attendue | intermĂ©diaire |","category":"external_commands","line_end":82,"severity":"medium","line_start":81},{"id":"external_commands:SKILL.md:82:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `--timeout` | Timeout par modĂšle (secondes) | 300 |","category":"external_commands","line_end":83,"severity":"medium","line_start":82},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `--no-trail` | DĂ©sactive la sauvegarde | false |","category":"external_commands","line_end":84,"severity":"medium","line_start":83},{"id":"external_commands:SKILL.md:84:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `--json` | Sortie JSON structurĂ©e | false |","category":"external_commands","line_end":98,"severity":"medium","line_start":84},{"id":"external_commands:SKILL.md:98:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":115,"severity":"medium","line_start":98},{"id":"external_commands:SKILL.md:115:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":146,"severity":"medium","line_start":115},{"id":"external_commands:SKILL.md:146:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Chaque session gĂ©nĂšre un fichier JSON dans `synthese_trails/` contenant :","category":"external_commands","line_end":157,"severity":"medium","line_start":146},{"id":"external_commands:SKILL.md:157:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":159,"severity":"medium","line_start":157},{"id":"external_commands:SKILL.md:159:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":175,"severity":"medium","line_start":159},{"id":"external_commands:SKILL.md:175:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Timeout adaptatif par modĂšle (dĂ©faut: 5 minutes). Configurable via `--timeout`.","category":"external_commands","line_end":185,"severity":"medium","line_start":175},{"id":"external_commands:SKILL.md:185:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":191,"severity":"medium","line_start":185},{"id":"external_commands:SKILL.md:191:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":195,"severity":"medium","line_start":191},{"id":"external_commands:SKILL.md:195:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":198,"severity":"medium","line_start":195},{"id":"external_commands:SKILL.md:198:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":202,"severity":"medium","line_start":198},{"id":"external_commands:SKILL.md:202:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":205,"severity":"medium","line_start":202},{"id":"network:SKILL.md:219:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"InspirĂ© de [Council](https://github.com/bacoco/Council-board-skill) par bacoco et du concept [LLM Co","category":"network","line_end":219,"severity":"low","line_start":219},{"id":"blocker:SKILL.md:3:weak-cryptographic-algorithm","file":"SKILL.md","pattern":"Weak cryptographic algorithm","snippet":"description: SynthĂšse co-fabriquĂ©e par un conseil de 3 LLMs (Claude, Gemini, Codex). Ce skill devrai","category":"blocker","line_end":3,"severity":"high","line_start":3},{"id":"blocker:SKILL.md:14:weak-cryptographic-algorithm","file":"SKILL.md","pattern":"Weak cryptographic algorithm","snippet":"Ce skill orchestre trois modĂšles IA avec des rĂŽles experts distincts pour produire une synthĂšse robu","category":"blocker","line_end":14,"severity":"high","line_start":14},{"id":"blocker:SKILL.md:18:weak-cryptographic-algorithm","file":"SKILL.md","pattern":"Weak cryptographic algorithm","snippet":"### Installation des CLI","category":"blocker","line_end":18,"severity":"high","line_start":18},{"id":"blocker:SKILL.md:106:weak-cryptographic-algorithm","file":"SKILL.md","pattern":"Weak cryptographic algorithm","snippet":"├─ DĂ©tection des divergences","category":"blocker","line_end":106,"severity":"high","line_start":106},{"id":"blocker:SKILL.md:111:weak-cryptographic-algorithm","file":"SKILL.md","pattern":"Weak cryptographic algorithm","snippet":"├─ Consolidation des analyses","category":"blocker","line_end":111,"severity":"high","line_start":111},{"id":"blocker:SKILL.md:112:weak-cryptographic-algorithm","file":"SKILL.md","pattern":"Weak cryptographic algorithm","snippet":"├─ RĂ©solution des divergences","category":"blocker","line_end":112,"severity":"high","line_start":112},{"id":"blocker:SKILL.md:114:weak-cryptographic-algorithm","file":"SKILL.md","pattern":"Weak cryptographic algorithm","snippet":"└─ Mention des points de dissensus","category":"blocker","line_end":114,"severity":"high","line_start":114},{"id":"blocker:SKILL.md:138:weak-cryptographic-algorithm","file":"SKILL.md","pattern":"Weak cryptographic algorithm","snippet":"Focus sur la dĂ©tection des glissements. Utile pour vĂ©rifier une synthĂšse existante.","category":"blocker","line_end":138,"severity":"high","line_start":138},{"id":"blocker:SKILL.md:212:weak-cryptographic-algorithm","file":"SKILL.md","pattern":"Weak cryptographic algorithm","snippet":"| [troubleshooting.md](references/troubleshooting.md) | Guide de rĂ©solution des problĂšmes |","category":"blocker","line_end":212,"severity":"high","line_start":212},{"id":"blocker:SKILL.md:214:weak-cryptographic-algorithm","file":"SKILL.md","pattern":"Weak cryptographic algorithm","snippet":"| [couches-semiotiques.md](references/couches-semiotiques.md) | DĂ©tail des 4 couches d'analyse |","category":"blocker","line_end":214,"severity":"high","line_start":214},{"id":"blocker:SKILL.md:215:weak-cryptographic-algorithm","file":"SKILL.md","pattern":"Weak cryptographic algorithm","snippet":"| [glissements.md](references/glissements.md) | Catalogue des glissements sĂ©mantiques courants |","category":"blocker","line_end":215,"severity":"high","line_start":215},{"id":"blocker:synthese.config.yaml:19:weak-cryptographic-algorithm","file":"synthese.config.yaml","pattern":"Weak cryptographic algorithm","snippet":"# Activer la sauvegarde des trails","category":"blocker","line_end":19,"severity":"high","line_start":19},{"id":"blocker:synthese.config.yaml:22:weak-cryptographic-algorithm","file":"synthese.config.yaml","pattern":"Weak cryptographic algorithm","snippet":"# RĂ©pertoire de sauvegarde des trails","category":"blocker","line_end":22,"severity":"high","line_start":22},{"id":"blocker:synthese.config.yaml:28:weak-cryptographic-algorithm","file":"synthese.config.yaml","pattern":"Weak cryptographic algorithm","snippet":"# RĂŽles des experts (personnalisable)","category":"blocker","line_end":28,"severity":"high","line_start":28},{"id":"external_commands:wrappers/claude_wrapper.sh:37:shell-command-substitution","file":"wrappers/claude_wrapper.sh","pattern":"Shell command substitution","snippet":"ESCAPED_PROMPT=$(echo \"$PROMPT\" | python3 -c 'import json,sys; print(json.dumps(sys.stdin.read().str","category":"external_commands","line_end":37,"severity":"medium","line_start":37},{"id":"external_commands:wrappers/claude_wrapper.sh:40:shell-command-substitution","file":"wrappers/claude_wrapper.sh","pattern":"Shell command substitution","snippet":"RESPONSE=$(curl -s -X POST \"$API_URL\" \\","category":"external_commands","line_end":50,"severity":"medium","line_start":40},{"id":"external_commands:wrappers/claude_wrapper.sh:1:unix-shell-invocation","file":"wrappers/claude_wrapper.sh","pattern":"Unix shell invocation","snippet":"#!/bin/bash","category":"external_commands","line_end":1,"severity":"medium","line_start":1},{"id":"network:wrappers/claude_wrapper.sh:20:hardcoded-url","file":"wrappers/claude_wrapper.sh","pattern":"Hardcoded URL","snippet":"API_URL=\"https://api.anthropic.com/v1/messages\"","category":"network","line_end":20,"severity":"low","line_start":20},{"id":"env_access:wrappers/claude_wrapper.sh:9:generic-api-secret-keys","file":"wrappers/claude_wrapper.sh","pattern":"Generic API/secret keys","snippet":"# - ANTHROPIC_API_KEY dĂ©fini","category":"env_access","line_end":9,"severity":"high","line_start":9},{"id":"env_access:wrappers/claude_wrapper.sh:23:generic-api-secret-keys","file":"wrappers/claude_wrapper.sh","pattern":"Generic API/secret keys","snippet":"if [ -z \"$ANTHROPIC_API_KEY\" ]; then","category":"env_access","line_end":23,"severity":"high","line_start":23},{"id":"env_access:wrappers/claude_wrapper.sh:24:generic-api-secret-keys","file":"wrappers/claude_wrapper.sh","pattern":"Generic API/secret keys","snippet":"echo \"Erreur: ANTHROPIC_API_KEY non dĂ©fini\" >&2","category":"env_access","line_end":24,"severity":"high","line_start":24},{"id":"env_access:wrappers/claude_wrapper.sh:42:generic-api-secret-keys","file":"wrappers/claude_wrapper.sh","pattern":"Generic API/secret keys","snippet":"-H \"x-api-key: $ANTHROPIC_API_KEY\" \\","category":"env_access","line_end":42,"severity":"high","line_start":42},{"id":"external_commands:wrappers/ollama_wrapper.sh:37:shell-command-substitution","file":"wrappers/ollama_wrapper.sh","pattern":"Shell command substitution","snippet":"ESCAPED_PROMPT=$(echo \"$PROMPT\" | python3 -c 'import json,sys; print(json.dumps(sys.stdin.read().str","category":"external_commands","line_end":37,"severity":"medium","line_start":37},{"id":"external_commands:wrappers/ollama_wrapper.sh:40:shell-command-substitution","file":"wrappers/ollama_wrapper.sh","pattern":"Shell command substitution","snippet":"RESPONSE=$(curl -s -X POST \"$HOST/api/generate\" \\","category":"external_commands","line_end":46,"severity":"medium","line_start":40},{"id":"external_commands:wrappers/ollama_wrapper.sh:1:unix-shell-invocation","file":"wrappers/ollama_wrapper.sh","pattern":"Unix shell invocation","snippet":"#!/bin/bash","category":"external_commands","line_end":1,"severity":"medium","line_start":1},{"id":"network:wrappers/ollama_wrapper.sh:13:hardcoded-url","file":"wrappers/ollama_wrapper.sh","pattern":"Hardcoded URL","snippet":"# - OLLAMA_HOST: URL du serveur (dĂ©faut: http://localhost:11434)","category":"network","line_end":13,"severity":"low","line_start":13},{"id":"network:wrappers/ollama_wrapper.sh:19:hardcoded-url","file":"wrappers/ollama_wrapper.sh","pattern":"Hardcoded URL","snippet":"HOST=\"${OLLAMA_HOST:-http://localhost:11434}\"","category":"network","line_end":19,"severity":"low","line_start":19},{"id":"filesystem:wrappers/ollama_wrapper.sh:30:standard-device-file-access","file":"wrappers/ollama_wrapper.sh","pattern":"Standard device file access","snippet":"if ! curl -s --connect-timeout 2 \"$HOST/api/tags\" > /dev/null 2>&1; then","category":"filesystem","line_end":30,"severity":"low","line_start":30},{"id":"external_commands:wrappers/README.md:57:unix-shell-invocation","file":"wrappers/README.md","pattern":"Unix shell invocation","snippet":"#!/bin/bash","category":"external_commands","line_end":57,"severity":"medium","line_start":57},{"id":"external_commands:wrappers/README.md:142:sudo-privilege-escalation","file":"wrappers/README.md","pattern":"sudo privilege escalation","snippet":"sudo apt install curl","category":"external_commands","line_end":142,"severity":"high","line_start":142},{"id":"network:wrappers/README.md:96:python-http-libraries","file":"wrappers/README.md","pattern":"Python HTTP libraries","snippet":"response = requests.post(","category":"network","line_end":96,"severity":"low","line_start":96},{"id":"network:wrappers/README.md:97:hardcoded-url","file":"wrappers/README.md","pattern":"Hardcoded URL","snippet":"\"https://api.example.com/generate\",","category":"network","line_end":97,"severity":"low","line_start":97},{"id":"env_access:wrappers/README.md:16:generic-api-secret-keys","file":"wrappers/README.md","pattern":"Generic API/secret keys","snippet":"| `claude_wrapper.sh` | Claude (API) | `ANTHROPIC_API_KEY`, curl |","category":"env_access","line_end":16,"severity":"high","line_start":16},{"id":"env_access:wrappers/README.md:45:generic-api-secret-keys","file":"wrappers/README.md","pattern":"Generic API/secret keys","snippet":"export ANTHROPIC_API_KEY=\"sk-ant-...\"","category":"env_access","line_end":45,"severity":"high","line_start":45},{"id":"env_access:wrappers/README.md:115:generic-api-secret-keys","file":"wrappers/README.md","pattern":"Generic API/secret keys","snippet":"| `ANTHROPIC_API_KEY` | ClĂ© API Anthropic | - |","category":"env_access","line_end":115,"severity":"high","line_start":115},{"id":"blocker:wrappers/README.md:3:weak-cryptographic-algorithm","file":"wrappers/README.md","pattern":"Weak cryptographic algorithm","snippet":"Ce dossier contient des exemples de scripts wrapper pour intĂ©grer diffĂ©rents LLMs avec SynthĂšse Coun","category":"blocker","line_end":3,"severity":"high","line_start":3},{"id":"obfuscation:scripts/synthese.py:1:heuristic-multiple-bracket-chains-8-jsfuck-obfus","file":"scripts/synthese.py","pattern":"[HEURISTIC] Multiple bracket chains (8) - JSFuck/obfuscation pattern","snippet":"())[, ())[, ())}","category":"obfuscation","line_end":1,"severity":"high","line_start":1}],"finding_verdicts":[{"id":"blocker:references/cadrage.md:7:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:references/cadrage.md:59:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:references/cadrage.md:71:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"env_access:references/configuration.md:128:generic-api-secret-keys","reason":"The referenced documentation names an environment variable or placeholder value, not an embedded secret. It does not read or expose a credential at runtime.","verdict":"false_positive","confidence":0.86},{"id":"blocker:references/configuration.md:65:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:references/configuration.md:89:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:references/configuration.md:131:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:references/configuration.md:135:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:references/configuration.md:36:system-reconnaissance","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:references/configuration.md:37:system-reconnaissance","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:references/glissements.md:1:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:references/glissements.md:12:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:references/glissements.md:39:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:references/glissements.md:52:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:references/metrics.md:5:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:references/metrics.md:26:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:references/metrics.md:60:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:references/metrics.md:115:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:references/metrics.md:146:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"env_access:references/troubleshooting.md:64:generic-api-secret-keys","reason":"The referenced documentation names an environment variable or placeholder value, not an embedded secret. It does not read or expose a credential at runtime.","verdict":"false_positive","confidence":0.86},{"id":"env_access:references/troubleshooting.md:69:generic-api-secret-keys","reason":"The referenced documentation names an environment variable or placeholder value, not an embedded secret. It does not read or expose a credential at runtime.","verdict":"false_positive","confidence":0.86},{"id":"env_access:references/troubleshooting.md:75:generic-api-secret-keys","reason":"The troubleshooting guide tells users to print the first part of ANTHROPIC_API_KEY. Even partial credential disclosure can leak through logs, history, or screenshots.","verdict":"confirmed","severity":"high","confidence":0.86},{"id":"blocker:references/troubleshooting.md:3:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:references/troubleshooting.md:106:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:references/troubleshooting.md:116:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:references/troubleshooting.md:136:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:references/troubleshooting.md:138:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:references/troubleshooting.md:220:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:references/troubleshooting.md:72:system-reconnaissance","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"scripts:scripts/backends/__init__.py:22:dynamic-import-expression","reason":"The snippet is a normal Python import inside a static try/except block. It is not a dynamic import expression or runtime code loading from user input.","verdict":"false_positive","confidence":0.95},{"id":"scripts:scripts/backends/__init__.py:30:dynamic-import-expression","reason":"The snippet is a normal Python import inside a static try/except block. It is not a dynamic import expression or runtime code loading from user input.","verdict":"false_positive","confidence":0.95},{"id":"scripts:scripts/backends/__init__.py:41:dynamic-import-expression","reason":"The snippet is a normal Python import inside a static try/except block. It is not a dynamic import expression or runtime code loading from user input.","verdict":"false_positive","confidence":0.95},{"id":"env_access:scripts/backends/anthropic_backend.py:108:python-getenv-function","reason":"The backend reads ANTHROPIC_API_KEY from the process environment. This is expected for API use, but it confirms secret-bearing environment access.","verdict":"confirmed","severity":"medium","confidence":0.9},{"id":"env_access:scripts/backends/anthropic_backend.py:314:python-getenv-function","reason":"The backend reads ANTHROPIC_API_KEY from the process environment. This is expected for API use, but it confirms secret-bearing environment access.","verdict":"confirmed","severity":"medium","confidence":0.9},{"id":"env_access:scripts/backends/anthropic_backend.py:108:getenv-function-call","reason":"The backend reads ANTHROPIC_API_KEY from the process environment. This is expected for API use, but it confirms secret-bearing environment access.","verdict":"confirmed","severity":"medium","confidence":0.9},{"id":"env_access:scripts/backends/anthropic_backend.py:314:getenv-function-call","reason":"The backend reads ANTHROPIC_API_KEY from the process environment. This is expected for API use, but it confirms secret-bearing environment access.","verdict":"confirmed","severity":"medium","confidence":0.9},{"id":"env_access:scripts/backends/anthropic_backend.py:9:generic-api-secret-keys","reason":"This line is a docstring, type annotation, variable name, or missing-key branch rather than a credential read or disclosure. The real API key reads are handled in separate confirmed verdicts.","verdict":"false_positive","confidence":0.82},{"id":"env_access:scripts/backends/anthropic_backend.py:64:generic-api-secret-keys","reason":"This line is a docstring, type annotation, variable name, or missing-key branch rather than a credential read or disclosure. The real API key reads are handled in separate confirmed verdicts.","verdict":"false_positive","confidence":0.82},{"id":"env_access:scripts/backends/anthropic_backend.py:65:generic-api-secret-keys","reason":"This line is a docstring, type annotation, variable name, or missing-key branch rather than a credential read or disclosure. The real API key reads are handled in separate confirmed verdicts.","verdict":"false_positive","confidence":0.82},{"id":"env_access:scripts/backends/anthropic_backend.py:77:generic-api-secret-keys","reason":"This line is a docstring, type annotation, variable name, or missing-key branch rather than a credential read or disclosure. The real API key reads are handled in separate confirmed verdicts.","verdict":"false_positive","confidence":0.82},{"id":"env_access:scripts/backends/anthropic_backend.py:85:generic-api-secret-keys","reason":"This line is a docstring, type annotation, variable name, or missing-key branch rather than a credential read or disclosure. The real API key reads are handled in separate confirmed verdicts.","verdict":"false_positive","confidence":0.82},{"id":"env_access:scripts/backends/anthropic_backend.py:89:generic-api-secret-keys","reason":"This line is a docstring, type annotation, variable name, or missing-key branch rather than a credential read or disclosure. The real API key reads are handled in separate confirmed verdicts.","verdict":"false_positive","confidence":0.82},{"id":"env_access:scripts/backends/anthropic_backend.py:106:generic-api-secret-keys","reason":"This line is a docstring, type annotation, variable name, or missing-key branch rather than a credential read or disclosure. The real API key reads are handled in separate confirmed verdicts.","verdict":"false_positive","confidence":0.82},{"id":"env_access:scripts/backends/anthropic_backend.py:108:generic-api-secret-keys","reason":"The backend reads ANTHROPIC_API_KEY from the process environment. This is expected for API use, but it confirms secret-bearing environment access.","verdict":"confirmed","severity":"medium","confidence":0.9},{"id":"env_access:scripts/backends/anthropic_backend.py:116:generic-api-secret-keys","reason":"This line is a docstring, type annotation, variable name, or missing-key branch rather than a credential read or disclosure. The real API key reads are handled in separate confirmed verdicts.","verdict":"false_positive","confidence":0.82},{"id":"env_access:scripts/backends/anthropic_backend.py:121:generic-api-secret-keys","reason":"The availability check calls the api_key property and depends on a secret being present. This is legitimate credential handling, but still a security-sensitive path.","verdict":"confirmed","severity":"medium","confidence":0.78},{"id":"env_access:scripts/backends/anthropic_backend.py:135:generic-api-secret-keys","reason":"This line is a docstring, type annotation, variable name, or missing-key branch rather than a credential read or disclosure. The real API key reads are handled in separate confirmed verdicts.","verdict":"false_positive","confidence":0.82},{"id":"env_access:scripts/backends/anthropic_backend.py:140:generic-api-secret-keys","reason":"The configuration help suggests placing an API key in YAML. That can persist credentials in files that may be copied or committed.","verdict":"confirmed","severity":"medium","confidence":0.68},{"id":"env_access:scripts/backends/anthropic_backend.py:170:generic-api-secret-keys","reason":"The Anthropic client is created with the API key and can send source content to the external provider. Credential use is confirmed and should be documented.","verdict":"confirmed","severity":"high","confidence":0.9},{"id":"env_access:scripts/backends/anthropic_backend.py:314:generic-api-secret-keys","reason":"The backend reads ANTHROPIC_API_KEY from the process environment. This is expected for API use, but it confirms secret-bearing environment access.","verdict":"confirmed","severity":"medium","confidence":0.9},{"id":"env_access:scripts/backends/anthropic_backend.py:315:generic-api-secret-keys","reason":"This line is a docstring, type annotation, variable name, or missing-key branch rather than a credential read or disclosure. The real API key reads are handled in separate confirmed verdicts.","verdict":"false_positive","confidence":0.82},{"id":"env_access:scripts/backends/anthropic_backend.py:316:generic-api-secret-keys","reason":"This line is a docstring, type annotation, variable name, or missing-key branch rather than a credential read or disclosure. The real API key reads are handled in separate confirmed verdicts.","verdict":"false_positive","confidence":0.82},{"id":"env_access:scripts/backends/anthropic_backend.py:319:generic-api-secret-keys","reason":"The code constructs a masked API key string for display. Partial key display reduces exposure, but still leaks credential fragments into output.","verdict":"confirmed","severity":"medium","confidence":0.82},{"id":"sensitive:scripts/backends/base.py:226:certificate-key-files","reason":"The match is a dictionary keys() call or choices list, not a certificate or private key file. No sensitive key material is referenced at this location.","verdict":"false_positive","confidence":0.95},{"id":"blocker:scripts/backends/base.py:94:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/backends/base.py:150:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/backends/base.py:206:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/backends/base.py:221:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/backends/base.py:224:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"external_commands:scripts/backends/cli_backend.py:109:unix-shell-invocation","reason":"The shebang is inside a help string that shows how to write a wrapper. The actual command execution risk is covered separately in semantic findings.","verdict":"false_positive","confidence":0.88},{"id":"env_access:scripts/backends/cli_backend.py:151:python-environment-access","reason":"The CLI backend copies the full process environment before launching a child process. This can propagate unrelated secrets to custom LLM wrappers.","verdict":"confirmed","severity":"medium","confidence":0.9},{"id":"env_access:scripts/backends/cli_backend.py:275:configuration-library","reason":"The CLI backend accepts command, args, and env values from configuration. A malicious or mistaken config can execute local programs with chosen environment variables.","verdict":"confirmed","severity":"high","confidence":0.86},{"id":"env_access:scripts/backends/cli_backend.py:276:configuration-library","reason":"The CLI backend accepts command, args, and env values from configuration. A malicious or mistaken config can execute local programs with chosen environment variables.","verdict":"confirmed","severity":"high","confidence":0.86},{"id":"env_access:scripts/backends/cli_backend.py:277:configuration-library","reason":"The CLI backend accepts command, args, and env values from configuration. A malicious or mistaken config can execute local programs with chosen environment variables.","verdict":"confirmed","severity":"high","confidence":0.86},{"id":"blocker:scripts/backends/cli_backend.py:3:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"network:scripts/config.py:382:hardcoded-url","reason":"The URL appears in documentation, credits, or example text. It is not an automatic network request.","verdict":"false_positive","confidence":0.92},{"id":"filesystem:scripts/config.py:7:hidden-file-in-home-directory","reason":"The configuration design loads a hidden file under the user home directory. This is legitimate configuration behavior, but it accesses user-home filesystem state.","verdict":"confirmed","severity":"medium","confidence":0.82},{"id":"filesystem:scripts/config.py:168:hidden-file-in-home-directory","reason":"The configuration design loads a hidden file under the user home directory. This is legitimate configuration behavior, but it accesses user-home filesystem state.","verdict":"confirmed","severity":"medium","confidence":0.82},{"id":"filesystem:scripts/config.py:7:hidden-file-access","reason":"The configuration design loads a hidden file under the user home directory. This is legitimate configuration behavior, but it accesses user-home filesystem state.","verdict":"confirmed","severity":"medium","confidence":0.82},{"id":"filesystem:scripts/config.py:168:hidden-file-access","reason":"The configuration design loads a hidden file under the user home directory. This is legitimate configuration behavior, but it accesses user-home filesystem state.","verdict":"confirmed","severity":"medium","confidence":0.82},{"id":"env_access:scripts/config.py:514:configuration-library","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"env_access:scripts/config.py:533:configuration-library","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/config.py:103:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/config.py:113:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/config.py:127:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/config.py:183:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/config.py:318:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/config.py:435:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"env_access:scripts/convergence.py:376:configuration-library","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"sensitive:scripts/convergence.py:238:certificate-key-files","reason":"The match is a dictionary keys() call or choices list, not a certificate or private key file. No sensitive key material is referenced at this location.","verdict":"false_positive","confidence":0.95},{"id":"blocker:scripts/convergence.py:30:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/convergence.py:32:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/convergence.py:68:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/convergence.py:71:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/convergence.py:119:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/convergence.py:185:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/convergence.py:284:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/convergence.py:359:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/convergence.py:360:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/convergence.py:442:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/convergence.py:502:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/pedagogy.py:50:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/pedagogy.py:63:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/pedagogy.py:91:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/pedagogy.py:133:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/pedagogy.py:134:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/pedagogy.py:141:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/pedagogy.py:153:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/pedagogy.py:161:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/pedagogy.py:188:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/pedagogy.py:190:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/pedagogy.py:217:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/pedagogy.py:255:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/pedagogy.py:310:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/pedagogy.py:353:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/retry.py:8:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/retry.py:41:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/retry.py:259:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"external_commands:scripts/sanitize.py:27:ruby-shell-backtick-execution","reason":"The matched shell tokens are denylist patterns and escaping logic used to detect injection attempts. They are not executed as commands.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:scripts/sanitize.py:42:ruby-shell-backtick-execution","reason":"The matched shell tokens are denylist patterns and escaping logic used to detect injection attempts. They are not executed as commands.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:scripts/sanitize.py:180:ruby-shell-backtick-execution","reason":"The matched shell tokens are denylist patterns and escaping logic used to detect injection attempts. They are not executed as commands.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:scripts/sanitize.py:28:shell-command-substitution","reason":"The matched shell tokens are denylist patterns and escaping logic used to detect injection attempts. They are not executed as commands.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:scripts/sanitize.py:41:shell-command-substitution","reason":"The matched shell tokens are denylist patterns and escaping logic used to detect injection attempts. They are not executed as commands.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:scripts/sanitize.py:27:template-literal-with-command-substitution","reason":"The matched shell tokens are denylist patterns and escaping logic used to detect injection attempts. They are not executed as commands.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:scripts/sanitize.py:35:hex-encoded-characters","reason":"The hex escape appears in input sanitization code that removes control characters. It is defensive validation, not obfuscation.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:scripts/sanitize.py:177:hex-encoded-characters","reason":"The hex escape appears in input sanitization code that removes control characters. It is defensive validation, not obfuscation.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:scripts/sanitize.py:199:hex-encoded-characters","reason":"The hex escape appears in input sanitization code that removes control characters. It is defensive validation, not obfuscation.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:scripts/sanitize.py:202:hex-encoded-characters","reason":"The hex escape appears in input sanitization code that removes control characters. It is defensive validation, not obfuscation.","verdict":"false_positive","confidence":0.96},{"id":"blocker:scripts/sanitize.py:2:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/sanitize.py:3:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/sanitize.py:5:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/sanitize.py:54:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/sanitize.py:144:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/sanitize.py:147:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/sanitize.py:150:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/sanitize.py:296:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"scripts:scripts/synthese.py:93:dynamic-import-expression","reason":"The snippet is a normal Python import inside a static try/except block. It is not a dynamic import expression or runtime code loading from user input.","verdict":"false_positive","confidence":0.95},{"id":"scripts:scripts/synthese.py:113:dynamic-import-expression","reason":"The snippet is a normal Python import inside a static try/except block. It is not a dynamic import expression or runtime code loading from user input.","verdict":"false_positive","confidence":0.95},{"id":"scripts:scripts/synthese.py:129:dynamic-import-expression","reason":"The snippet is a normal Python import inside a static try/except block. It is not a dynamic import expression or runtime code loading from user input.","verdict":"false_positive","confidence":0.95},{"id":"scripts:scripts/synthese.py:139:dynamic-import-expression","reason":"The snippet is a normal Python import inside a static try/except block. It is not a dynamic import expression or runtime code loading from user input.","verdict":"false_positive","confidence":0.95},{"id":"scripts:scripts/synthese.py:149:dynamic-import-expression","reason":"The snippet is a normal Python import inside a static try/except block. It is not a dynamic import expression or runtime code loading from user input.","verdict":"false_positive","confidence":0.95},{"id":"scripts:scripts/synthese.py:159:dynamic-import-expression","reason":"The snippet is a normal Python import inside a static try/except block. It is not a dynamic import expression or runtime code loading from user input.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:scripts/synthese.py:1229:python-subprocess-run","reason":"The code runs installed model CLIs with --version to detect availability. Arguments are fixed, but local external command execution is confirmed.","verdict":"confirmed","severity":"medium","confidence":0.87},{"id":"external_commands:scripts/synthese.py:1317:python-subprocess-run","reason":"The code runs Claude, Gemini, or Codex CLIs and passes the prompt as an argument. There is no shell injection, but external tool execution and data disclosure are real.","verdict":"confirmed","severity":"high","confidence":0.91},{"id":"external_commands:scripts/synthese.py:2851:ruby-shell-backtick-execution","reason":"The match is markdown formatting that prints file or session names in backticks. It does not execute shell code.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:scripts/synthese.py:2890:ruby-shell-backtick-execution","reason":"The match is markdown formatting that prints file or session names in backticks. It does not execute shell code.","verdict":"false_positive","confidence":0.94},{"id":"network:scripts/synthese.py:836:python-http-libraries","reason":"This line is a docstring describing a possible requests exception. The actual network call is adjudicated separately.","verdict":"false_positive","confidence":0.88},{"id":"network:scripts/synthese.py:848:python-http-libraries","reason":"The URL loader fetches arbitrary user-supplied URLs with requests. This enables outbound network access and can ingest untrusted remote prompt content.","verdict":"confirmed","severity":"medium","confidence":0.9},{"id":"network:scripts/synthese.py:1162:hardcoded-url","reason":"The hardcoded URL is only documentation shown in an error message. It is not fetched by the program.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/synthese.py:326:node-js-fs-operations","reason":"The matched string builds source reference labels, not filesystem operations. No file is read or written at this location.","verdict":"false_positive","confidence":0.94},{"id":"filesystem:scripts/synthese.py:362:node-js-fs-operations","reason":"The matched string builds source reference labels, not filesystem operations. No file is read or written at this location.","verdict":"false_positive","confidence":0.94},{"id":"filesystem:scripts/synthese.py:374:node-js-fs-operations","reason":"The matched string builds source reference labels, not filesystem operations. No file is read or written at this location.","verdict":"false_positive","confidence":0.94},{"id":"filesystem:scripts/synthese.py:708:python-file-write-append","reason":"The response cache writes model output to local JSON files. This can persist source-derived content on disk.","verdict":"confirmed","severity":"medium","confidence":0.87},{"id":"filesystem:scripts/synthese.py:2680:python-file-write-append","reason":"The audit trail writes the full session object to a local JSON file. This can persist source text, model responses, and metadata.","verdict":"confirmed","severity":"high","confidence":0.92},{"id":"filesystem:scripts/synthese.py:2716:python-file-write-append","reason":"The skill writes final summaries to Markdown files under an output directory. This is intended but can persist sensitive summaries locally.","verdict":"confirmed","severity":"medium","confidence":0.88},{"id":"env_access:scripts/synthese.py:1692:configuration-library","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"env_access:scripts/synthese.py:1711:configuration-library","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"env_access:scripts/synthese.py:1713:configuration-library","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"env_access:scripts/synthese.py:1714:configuration-library","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"env_access:scripts/synthese.py:1715:configuration-library","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"env_access:scripts/synthese.py:2115:configuration-library","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"env_access:scripts/synthese.py:2616:configuration-library","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"env_access:scripts/synthese.py:3128:configuration-library","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"env_access:scripts/synthese.py:3449:configuration-library","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"env_access:scripts/synthese.py:3491:configuration-library","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"env_access:scripts/synthese.py:1159:generic-api-secret-keys","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"env_access:scripts/synthese.py:1765:generic-api-secret-keys","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"sensitive:scripts/synthese.py:1790:certificate-key-files","reason":"The match is a dictionary keys() call or choices list, not a certificate or private key file. No sensitive key material is referenced at this location.","verdict":"false_positive","confidence":0.95},{"id":"sensitive:scripts/synthese.py:3243:certificate-key-files","reason":"The match is a dictionary keys() call or choices list, not a certificate or private key file. No sensitive key material is referenced at this location.","verdict":"false_positive","confidence":0.95},{"id":"blocker:scripts/synthese.py:168:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/synthese.py:205:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/synthese.py:390:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/synthese.py:392:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/synthese.py:437:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/synthese.py:631:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/synthese.py:759:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/synthese.py:794:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/synthese.py:825:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/synthese.py:959:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/synthese.py:1153:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/synthese.py:1206:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/synthese.py:1268:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/synthese.py:1272:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/synthese.py:1730:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/synthese.py:1830:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/synthese.py:1850:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/synthese.py:1868:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/synthese.py:1903:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/synthese.py:2077:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/synthese.py:2147:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/synthese.py:2256:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/synthese.py:2481:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/synthese.py:2946:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/synthese.py:2999:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/synthese.py:3152:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/synthese.py:3238:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/synthese.py:3269:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/synthese.py:3274:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:scripts/synthese.py:3515:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","reason":"The match is markdown documentation or an example command block. It is not automatic execution by the skill runtime.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","reason":"The match is markdown documentation or an example command block. It is not automatic execution by the skill runtime.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","reason":"The match is markdown documentation or an example command block. It is not automatic execution by the skill runtime.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"The match is markdown documentation or an example command block. It is not automatic execution by the skill runtime.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","reason":"The match is markdown documentation or an example command block. It is not automatic execution by the skill runtime.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:70:ruby-shell-backtick-execution","reason":"The match is markdown documentation or an example command block. It is not automatic execution by the skill runtime.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:76:ruby-shell-backtick-execution","reason":"The match is markdown documentation or an example command block. It is not automatic execution by the skill runtime.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","reason":"The match is markdown documentation or an example command block. It is not automatic execution by the skill runtime.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:78:ruby-shell-backtick-execution","reason":"The match is markdown documentation or an example command block. It is not automatic execution by the skill runtime.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","reason":"The match is markdown documentation or an example command block. It is not automatic execution by the skill runtime.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","reason":"The match is markdown documentation or an example command block. It is not automatic execution by the skill runtime.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","reason":"The match is markdown documentation or an example command block. It is not automatic execution by the skill runtime.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:82:ruby-shell-backtick-execution","reason":"The match is markdown documentation or an example command block. It is not automatic execution by the skill runtime.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","reason":"The match is markdown documentation or an example command block. It is not automatic execution by the skill runtime.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:84:ruby-shell-backtick-execution","reason":"The match is markdown documentation or an example command block. It is not automatic execution by the skill runtime.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:98:ruby-shell-backtick-execution","reason":"The match is markdown documentation or an example command block. It is not automatic execution by the skill runtime.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:115:ruby-shell-backtick-execution","reason":"The match is markdown documentation or an example command block. It is not automatic execution by the skill runtime.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:146:ruby-shell-backtick-execution","reason":"The match is markdown documentation or an example command block. It is not automatic execution by the skill runtime.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:157:ruby-shell-backtick-execution","reason":"The match is markdown documentation or an example command block. It is not automatic execution by the skill runtime.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:159:ruby-shell-backtick-execution","reason":"The match is markdown documentation or an example command block. It is not automatic execution by the skill runtime.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:175:ruby-shell-backtick-execution","reason":"The match is markdown documentation or an example command block. It is not automatic execution by the skill runtime.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:185:ruby-shell-backtick-execution","reason":"The match is markdown documentation or an example command block. It is not automatic execution by the skill runtime.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:191:ruby-shell-backtick-execution","reason":"The match is markdown documentation or an example command block. It is not automatic execution by the skill runtime.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:195:ruby-shell-backtick-execution","reason":"The match is markdown documentation or an example command block. It is not automatic execution by the skill runtime.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:198:ruby-shell-backtick-execution","reason":"The match is markdown documentation or an example command block. It is not automatic execution by the skill runtime.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:202:ruby-shell-backtick-execution","reason":"The match is markdown documentation or an example command block. It is not automatic execution by the skill runtime.","verdict":"false_positive","confidence":0.93},{"id":"network:SKILL.md:219:hardcoded-url","reason":"The URL appears in documentation, credits, or example text. It is not an automatic network request.","verdict":"false_positive","confidence":0.92},{"id":"blocker:SKILL.md:3:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:SKILL.md:14:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:SKILL.md:18:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:SKILL.md:106:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:SKILL.md:111:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:SKILL.md:112:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:SKILL.md:114:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:SKILL.md:138:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:SKILL.md:212:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:SKILL.md:214:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:SKILL.md:215:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:synthese.config.yaml:19:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:synthese.config.yaml:22:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"blocker:synthese.config.yaml:28:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"external_commands:wrappers/claude_wrapper.sh:37:shell-command-substitution","reason":"The shell wrapper invokes python3 in command substitution to JSON-escape the prompt. Quoting reduces injection risk, but external command execution is present.","verdict":"confirmed","severity":"medium","confidence":0.78},{"id":"external_commands:wrappers/claude_wrapper.sh:40:shell-command-substitution","reason":"The wrapper executes curl to send the prompt and API key to Anthropic. This is intentional but confirms networked external command execution.","verdict":"confirmed","severity":"high","confidence":0.93},{"id":"external_commands:wrappers/claude_wrapper.sh:1:unix-shell-invocation","reason":"This file is an executable shell wrapper for model calls. Shell script execution is an intended feature and should require user trust.","verdict":"confirmed","severity":"medium","confidence":0.83},{"id":"network:wrappers/claude_wrapper.sh:20:hardcoded-url","reason":"The Claude wrapper targets the Anthropic messages API. This confirms outbound network calls to an external model provider.","verdict":"confirmed","severity":"high","confidence":0.91},{"id":"env_access:wrappers/claude_wrapper.sh:9:generic-api-secret-keys","reason":"The matched line is a comment or error message about the API key, not a read, transmission, or disclosure of the secret value.","verdict":"false_positive","confidence":0.82},{"id":"env_access:wrappers/claude_wrapper.sh:23:generic-api-secret-keys","reason":"The wrapper reads ANTHROPIC_API_KEY from the shell environment. This is intended, but it confirms credential-dependent execution.","verdict":"confirmed","severity":"medium","confidence":0.82},{"id":"env_access:wrappers/claude_wrapper.sh:24:generic-api-secret-keys","reason":"The matched line is a comment or error message about the API key, not a read, transmission, or disclosure of the secret value.","verdict":"false_positive","confidence":0.82},{"id":"env_access:wrappers/claude_wrapper.sh:42:generic-api-secret-keys","reason":"The wrapper sends ANTHROPIC_API_KEY in an HTTP header to the Anthropic API. This is legitimate API use but a real credential handling risk.","verdict":"confirmed","severity":"high","confidence":0.93},{"id":"external_commands:wrappers/ollama_wrapper.sh:37:shell-command-substitution","reason":"The shell wrapper invokes python3 in command substitution to JSON-escape the prompt. Quoting reduces injection risk, but external command execution is present.","verdict":"confirmed","severity":"medium","confidence":0.78},{"id":"external_commands:wrappers/ollama_wrapper.sh:40:shell-command-substitution","reason":"The wrapper executes curl against the configured Ollama endpoint. It is local by default, but it is still external command and network execution.","verdict":"confirmed","severity":"medium","confidence":0.9},{"id":"external_commands:wrappers/ollama_wrapper.sh:1:unix-shell-invocation","reason":"This file is an executable shell wrapper for a local Ollama backend. Shell script execution is an intended feature and should require user trust.","verdict":"confirmed","severity":"medium","confidence":0.83},{"id":"network:wrappers/ollama_wrapper.sh:13:hardcoded-url","reason":"This line documents the OLLAMA_HOST option. The default host assignment and curl calls are reviewed separately.","verdict":"false_positive","confidence":0.86},{"id":"network:wrappers/ollama_wrapper.sh:19:hardcoded-url","reason":"The Ollama wrapper defaults to a localhost HTTP endpoint. It is low risk by default, but confirms network access through a configurable host.","verdict":"confirmed","severity":"low","confidence":0.86},{"id":"filesystem:wrappers/ollama_wrapper.sh:30:standard-device-file-access","reason":"The /dev/null redirect discards curl health-check output. It is not sensitive device access or data extraction.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:wrappers/README.md:57:unix-shell-invocation","reason":"The match is README guidance or an example command for a user to run manually. It is not executed by the skill automatically.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:wrappers/README.md:142:sudo-privilege-escalation","reason":"The match is README guidance or an example command for a user to run manually. It is not executed by the skill automatically.","verdict":"false_positive","confidence":0.93},{"id":"network:wrappers/README.md:96:python-http-libraries","reason":"The URL appears in documentation, credits, or example text. It is not an automatic network request.","verdict":"false_positive","confidence":0.92},{"id":"network:wrappers/README.md:97:hardcoded-url","reason":"The URL appears in documentation, credits, or example text. It is not an automatic network request.","verdict":"false_positive","confidence":0.92},{"id":"env_access:wrappers/README.md:16:generic-api-secret-keys","reason":"The README contains placeholder API key setup text. No actual credential is embedded, and the documentation itself does not access the environment.","verdict":"false_positive","confidence":0.9},{"id":"env_access:wrappers/README.md:45:generic-api-secret-keys","reason":"The README contains placeholder API key setup text. No actual credential is embedded, and the documentation itself does not access the environment.","verdict":"false_positive","confidence":0.9},{"id":"env_access:wrappers/README.md:115:generic-api-secret-keys","reason":"The README contains placeholder API key setup text. No actual credential is embedded, and the documentation itself does not access the environment.","verdict":"false_positive","confidence":0.9},{"id":"blocker:wrappers/README.md:3:weak-cryptographic-algorithm","reason":"No dangerous behavior is present in the cited snippet. The pattern is explained by documentation, identifiers, or benign implementation context.","verdict":"false_positive","confidence":0.8},{"id":"obfuscation:scripts/synthese.py:1:heuristic-multiple-bracket-chains-8-jsfuck-obfus","reason":"The heuristic appears to trigger on formatting or generated syntax rather than concealed executable logic. No obfuscated payload is present at the cited line.","verdict":"false_positive","confidence":0.9}],"semantic_findings":[{"title":"Persistent Audit Trails Store Source Text and Model Outputs","severity":"high","locations":[{"file":"SKILL.md","line_end":153,"line_start":146},{"file":"scripts/synthese.py","line_end":2682,"line_start":2677}],"confidence":0.93,"description":"The skill documents local audit trails that include source text, framing, model responses, convergence data, and final summaries. The implementation writes the session object to disk, which can persist confidential user content beyond the chat session.","confidence_reasoning":"Documentation lists the data stored in each trail, and the code writes the serialized session to a local JSON file."},{"title":"Untrusted URL Content Is Sent Into LLM Prompts","severity":"medium","locations":[{"file":"scripts/synthese.py","line_end":848,"line_start":821},{"file":"scripts/synthese.py","line_end":933,"line_start":923}],"confidence":0.86,"description":"The URL loader fetches arbitrary pages and extracts text for synthesis. Remote page content can contain prompt-injection text that influences downstream Claude, Gemini, or Codex calls.","confidence_reasoning":"The code accepts URL input, fetches it with requests, and appends the extracted text as source material for model prompts."},{"title":"Custom CLI Backend Executes Configured Commands With Inherited Environment","severity":"high","locations":[{"file":"scripts/backends/cli_backend.py","line_end":64,"line_start":45},{"file":"scripts/backends/cli_backend.py","line_end":160,"line_start":147},{"file":"scripts/backends/cli_backend.py","line_end":278,"line_start":271}],"confidence":0.91,"description":"The CLI backend accepts command, args, and env values from configuration, then executes the command with a copied process environment. A malicious configuration can run arbitrary local programs and receive inherited secrets.","confidence_reasoning":"The code builds commands from configuration and passes os.environ.copy() plus configured environment values to create_subprocess_exec."}],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"high","confirmedFindingCount":3,"capabilityReviewCount":35,"needsReviewCount":0,"falsePositiveCount":115,"agentAutoInstallPolicy":"confirmation_required","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}