{"data":{"skill":{"slug":"tt-a1i-archify","name":"archify","icon":"📦","repo":"https://github.com/tt-a1i/archify/tree/2bfb47132c057195d8dddb3e25ae966dd7c7a72e/archify","status":"approved","author":"tt-a1i","authorVersion":"2.16","skillstoreRevision":1},"audit":{"id":"f67cc946-88d8-4b78-9383-7a6d445c4512","skill_id":"88ae901a-dc02-4fd1-a288-06a8d411205e","version":2,"content_hash":"v3:4a2fb6268a251eebbd457945e9f3f486ca165b32:5bf0cac8cfb50608941f3a0ff66a5e76837662e2dd05ce406297f8c59a740e6a:4ea342b53984b10b0c5c156ae808df84296482156e6cb6dd11405cbfbabc2438:736b696c6c732f74742d6131692f61726368696679:86e6f63358570dda7c8444b5baa63c8f","risk_level":"medium","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"confirmation_required","manual_install_policy":"allowed","summary":"Adjudication dismissed 394 of 400 presented matches as test fixtures, generated data, documentation, or bounded local tooling. Six confirmed URLs cause generated artifacts or the update workflow to contact remote hosts, and semantic review found that the updater runs automatically without prior disclosure. Static presentation was capped at 400 of 8,055 matches, so 7,655 unpresented matches require manual review before automatic publication. Static review was capped at 400/8055 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.","remediation":[{"issue":"Static review capped","severity":"medium","suggestion":"Manually review the omitted 7655 static analyzer matches or reduce bundled generated/vendor/reference content before enabling automatic publication."},{"issue":"Generated HTML contacts Google Fonts when opened.","severity":"low","suggestion":"Bundle the required font files inside each artifact or use a system font stack with no external stylesheet or preconnect."},{"issue":"The skill requires an update check without prior disclosure and hides check failures.","severity":"medium","suggestion":"Require explicit user consent before the first network check, disclose the endpoint and cache path, and report failures without blocking diagram work."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"assets/template.html","line_end":5625,"line_start":5625},{"file":"assets/template.html","line_end":5677,"line_start":5677},{"file":"bin/archify.mjs","line_end":3,"line_start":3},{"file":"bin/archify.mjs","line_end":51,"line_start":51},{"file":"bin/archify.mjs","line_end":35,"line_start":16},{"file":"bin/archify.mjs","line_end":45,"line_start":45},{"file":"bin/archify.mjs","line_end":47,"line_start":47},{"file":"bin/archify.mjs","line_end":78,"line_start":78},{"file":"bin/archify.mjs","line_end":128,"line_start":128},{"file":"bin/archify.mjs","line_end":129,"line_start":129},{"file":"bin/archify.mjs","line_end":207,"line_start":207},{"file":"bin/archify.mjs","line_end":216,"line_start":216},{"file":"bin/archify.mjs","line_end":217,"line_start":217},{"file":"bin/archify.mjs","line_end":236,"line_start":236},{"file":"bin/archify.mjs","line_end":237,"line_start":237},{"file":"bin/archify.mjs","line_end":296,"line_start":296},{"file":"bin/archify.mjs","line_end":304,"line_start":304},{"file":"bin/archify.mjs","line_end":329,"line_start":329},{"file":"bin/archify.mjs","line_end":334,"line_start":334},{"file":"bin/archify.mjs","line_end":358,"line_start":358},{"file":"bin/archify.mjs","line_end":366,"line_start":366},{"file":"bin/archify.mjs","line_end":500,"line_start":500},{"file":"bin/archify.mjs","line_end":507,"line_start":507},{"file":"bin/archify.mjs","line_end":519,"line_start":519},{"file":"bin/archify.mjs","line_end":527,"line_start":527},{"file":"bin/archify.mjs","line_end":550,"line_start":550},{"file":"bin/archify.mjs","line_end":564,"line_start":564},{"file":"bin/archify.mjs","line_end":636,"line_start":636},{"file":"bin/archify.mjs","line_end":669,"line_start":669},{"file":"bin/archify.mjs","line_end":670,"line_start":670},{"file":"bin/archify.mjs","line_end":671,"line_start":671},{"file":"bin/archify.mjs","line_end":691,"line_start":691},{"file":"bin/archify.mjs","line_end":758,"line_start":758},{"file":"bin/archify.mjs","line_end":778,"line_start":778},{"file":"bin/archify.mjs","line_end":779,"line_start":779},{"file":"bin/archify.mjs","line_end":793,"line_start":793},{"file":"bin/archify.mjs","line_end":797,"line_start":797},{"file":"bin/archify.mjs","line_end":819,"line_start":819},{"file":"bin/archify.mjs","line_end":845,"line_start":845},{"file":"bin/archify.mjs","line_end":870,"line_start":870},{"file":"bin/archify.mjs","line_end":938,"line_start":938},{"file":"bin/archify.mjs","line_end":959,"line_start":959},{"file":"bin/archify.mjs","line_end":980,"line_start":980},{"file":"bin/archify.mjs","line_end":1036,"line_start":1036},{"file":"bin/archify.mjs","line_end":1061,"line_start":1061},{"file":"bin/archify.mjs","line_end":1093,"line_start":1093},{"file":"bin/archify.mjs","line_end":1100,"line_start":1100},{"file":"bin/archify.mjs","line_end":1102,"line_start":1102},{"file":"bin/archify.mjs","line_end":1104,"line_start":1104},{"file":"bin/archify.mjs","line_end":1105,"line_start":1105}]},{"factor":"network","evidence":[{"file":"assets/template.html","line_end":36,"line_start":36},{"file":"assets/template.html","line_end":37,"line_start":37},{"file":"assets/template.html","line_end":40,"line_start":40},{"file":"bin/open-artifact.mjs","line_end":80,"line_start":80},{"file":"bin/open-artifact.mjs","line_end":79,"line_start":79},{"file":"bin/open-artifact.mjs","line_end":80,"line_start":80},{"file":"bin/preview.mjs","line_end":128,"line_start":128},{"file":"bin/preview.mjs","line_end":266,"line_start":266},{"file":"bin/preview.mjs","line_end":332,"line_start":332},{"file":"bin/preview.mjs","line_end":13,"line_start":13},{"file":"brand-marks/catalog.json","line_end":14,"line_start":14},{"file":"brand-marks/catalog.json","line_end":15,"line_start":15},{"file":"brand-marks/catalog.json","line_end":13,"line_start":13},{"file":"examples/dataflow-product-analytics.html","line_end":36,"line_start":36},{"file":"examples/dataflow-product-analytics.html","line_end":37,"line_start":37},{"file":"examples/dataflow-product-analytics.html","line_end":40,"line_start":40},{"file":"examples/lifecycle-agent-run.html","line_end":36,"line_start":36},{"file":"examples/lifecycle-agent-run.html","line_end":37,"line_start":37},{"file":"examples/lifecycle-agent-run.html","line_end":40,"line_start":40},{"file":"examples/sequence-cache-miss-request.html","line_end":36,"line_start":36},{"file":"examples/sequence-cache-miss-request.html","line_end":37,"line_start":37},{"file":"examples/sequence-cache-miss-request.html","line_end":40,"line_start":40},{"file":"examples/web-app-rendered.html","line_end":36,"line_start":36},{"file":"examples/web-app-rendered.html","line_end":37,"line_start":37},{"file":"examples/web-app-rendered.html","line_end":40,"line_start":40},{"file":"examples/workflow-agent-tool-call-rendered.html","line_end":36,"line_start":36},{"file":"examples/workflow-agent-tool-call-rendered.html","line_end":37,"line_start":37},{"file":"examples/workflow-agent-tool-call-rendered.html","line_end":40,"line_start":40},{"file":"package-lock.json","line_end":26,"line_start":26},{"file":"package-lock.json","line_end":38,"line_start":38},{"file":"package-lock.json","line_end":43,"line_start":43},{"file":"package-lock.json","line_end":49,"line_start":49},{"file":"package-lock.json","line_end":53,"line_start":53},{"file":"package-lock.json","line_end":60,"line_start":60},{"file":"package-lock.json","line_end":68,"line_start":68},{"file":"package-lock.json","line_end":73,"line_start":73},{"file":"package-lock.json","line_end":80,"line_start":80},{"file":"package-lock.json","line_end":87,"line_start":87},{"file":"package-lock.json","line_end":95,"line_start":95},{"file":"package-lock.json","line_end":100,"line_start":100},{"file":"package-lock.json","line_end":110,"line_start":110},{"file":"package-lock.json","line_end":123,"line_start":123},{"file":"package-lock.json","line_end":129,"line_start":129},{"file":"package-lock.json","line_end":133,"line_start":133},{"file":"package-lock.json","line_end":143,"line_start":143},{"file":"references/brand-marks.md","line_end":30,"line_start":30},{"file":"references/brand-marks.md","line_end":41,"line_start":41},{"file":"renderers/shared/brand-marks.mjs","line_end":181,"line_start":181},{"file":"renderers/shared/generated-brand-marks.mjs","line_end":18,"line_start":18},{"file":"renderers/shared/generated-brand-marks.mjs","line_end":38,"line_start":38}]},{"factor":"filesystem","evidence":[{"file":"assets/template.html","line_end":6060,"line_start":6060},{"file":"assets/template.html","line_end":6066,"line_start":6066},{"file":"assets/template.html","line_end":7965,"line_start":7965},{"file":"assets/template.html","line_end":7966,"line_start":7966},{"file":"bin/archify.mjs","line_end":345,"line_start":345},{"file":"bin/archify.mjs","line_end":349,"line_start":349},{"file":"bin/archify.mjs","line_end":356,"line_start":356},{"file":"bin/archify.mjs","line_end":363,"line_start":363},{"file":"bin/archify.mjs","line_end":364,"line_start":364},{"file":"bin/archify.mjs","line_end":409,"line_start":409},{"file":"bin/archify.mjs","line_end":497,"line_start":497},{"file":"bin/archify.mjs","line_end":504,"line_start":504},{"file":"bin/archify.mjs","line_end":517,"line_start":517},{"file":"bin/archify.mjs","line_end":575,"line_start":575},{"file":"bin/archify.mjs","line_end":576,"line_start":576},{"file":"bin/archify.mjs","line_end":622,"line_start":622},{"file":"bin/archify.mjs","line_end":623,"line_start":623},{"file":"bin/archify.mjs","line_end":636,"line_start":636},{"file":"bin/archify.mjs","line_end":689,"line_start":689},{"file":"bin/archify.mjs","line_end":769,"line_start":769},{"file":"bin/archify.mjs","line_end":817,"line_start":817},{"file":"bin/archify.mjs","line_end":868,"line_start":868},{"file":"bin/archify.mjs","line_end":957,"line_start":957},{"file":"bin/archify.mjs","line_end":1059,"line_start":1059},{"file":"bin/archify.mjs","line_end":1109,"line_start":1109},{"file":"bin/archify.mjs","line_end":1468,"line_start":1468},{"file":"bin/archify.mjs","line_end":1618,"line_start":1618},{"file":"bin/archify.mjs","line_end":1690,"line_start":1690},{"file":"bin/archify.mjs","line_end":1710,"line_start":1710},{"file":"bin/archify.mjs","line_end":1758,"line_start":1758},{"file":"bin/archify.mjs","line_end":1772,"line_start":1772},{"file":"bin/archify.mjs","line_end":1803,"line_start":1803},{"file":"bin/archify.mjs","line_end":1907,"line_start":1907},{"file":"bin/archify.mjs","line_end":1928,"line_start":1928},{"file":"bin/archify.mjs","line_end":325,"line_start":325},{"file":"bin/archify.mjs","line_end":326,"line_start":326},{"file":"bin/archify.mjs","line_end":344,"line_start":344},{"file":"bin/archify.mjs","line_end":363,"line_start":363},{"file":"bin/archify.mjs","line_end":1226,"line_start":1226},{"file":"bin/archify.mjs","line_end":1227,"line_start":1227},{"file":"bin/archify.mjs","line_end":1233,"line_start":1233},{"file":"bin/archify.mjs","line_end":1234,"line_start":1234},{"file":"bin/archify.mjs","line_end":1240,"line_start":1240},{"file":"bin/archify.mjs","line_end":1241,"line_start":1241},{"file":"bin/archify.mjs","line_end":1247,"line_start":1247},{"file":"bin/archify.mjs","line_end":1248,"line_start":1248},{"file":"bin/archify.mjs","line_end":1254,"line_start":1254},{"file":"bin/archify.mjs","line_end":1255,"line_start":1255},{"file":"bin/archify.mjs","line_end":1261,"line_start":1261},{"file":"bin/archify.mjs","line_end":1262,"line_start":1262}]},{"factor":"scripts","evidence":[{"file":"bin/archify.mjs","line_end":419,"line_start":419},{"file":"bin/archify.mjs","line_end":427,"line_start":427},{"file":"bin/archify.mjs","line_end":751,"line_start":751},{"file":"bin/archify.mjs","line_end":1082,"line_start":1082},{"file":"bin/archify.mjs","line_end":1131,"line_start":1131},{"file":"bin/archify.mjs","line_end":1166,"line_start":1166},{"file":"bin/archify.mjs","line_end":1294,"line_start":1294},{"file":"bin/archify.mjs","line_end":1379,"line_start":1379},{"file":"bin/archify.mjs","line_end":1411,"line_start":1411},{"file":"bin/archify.mjs","line_end":1434,"line_start":1434},{"file":"bin/archify.mjs","line_end":1631,"line_start":1631},{"file":"bin/archify.mjs","line_end":1653,"line_start":1653},{"file":"delta/architecture-delta.mjs","line_end":390,"line_start":390},{"file":"delta/architecture-delta.mjs","line_end":395,"line_start":395},{"file":"scripts/check-update.mjs","line_end":692,"line_start":692},{"file":"scripts/update-contract.mjs","line_end":31,"line_start":31},{"file":"test/guide-page.test.mjs","line_end":58,"line_start":58},{"file":"test/preview.test.mjs","line_end":158,"line_start":158},{"file":"test/site-language-integration.mjs","line_end":9,"line_start":9},{"file":"test/start-page.test.mjs","line_end":109,"line_start":109},{"file":"test/start-page.test.mjs","line_end":155,"line_start":155}]},{"factor":"env_access","evidence":[{"file":"bin/archify.mjs","line_end":55,"line_start":55},{"file":"bin/preview.mjs","line_end":516,"line_start":516},{"file":"bin/visual-check.mjs","line_end":107,"line_start":107},{"file":"bin/visual-check.mjs","line_end":250,"line_start":250},{"file":"bin/visual-check.mjs","line_end":294,"line_start":294},{"file":"renderers/shared/brand-marks.mjs","line_end":124,"line_start":124},{"file":"renderers/shared/brand-marks.mjs","line_end":152,"line_start":152},{"file":"renderers/shared/brand-marks.mjs","line_end":173,"line_start":173},{"file":"renderers/shared/brand-marks.mjs","line_end":124,"line_start":124},{"file":"renderers/shared/brand-marks.mjs","line_end":152,"line_start":152},{"file":"renderers/shared/brand-marks.mjs","line_end":173,"line_start":173},{"file":"renderers/shared/cli.mjs","line_end":27,"line_start":27},{"file":"renderers/shared/cli.mjs","line_end":155,"line_start":155},{"file":"renderers/shared/cli.mjs","line_end":27,"line_start":27},{"file":"renderers/shared/cli.mjs","line_end":155,"line_start":155},{"file":"renderers/shared/diagnostics.mjs","line_end":4,"line_start":4},{"file":"renderers/shared/diagnostics.mjs","line_end":4,"line_start":4},{"file":"renderers/shared/geometry.mjs","line_end":949,"line_start":949},{"file":"renderers/shared/geometry.mjs","line_end":949,"line_start":949},{"file":"renderers/workflow/render-workflow.mjs","line_end":16,"line_start":16},{"file":"renderers/workflow/render-workflow.mjs","line_end":16,"line_start":16},{"file":"scripts/check-update.mjs","line_end":1393,"line_start":1393},{"file":"scripts/check-update.mjs","line_end":1397,"line_start":1397},{"file":"scripts/check-update.mjs","line_end":1637,"line_start":1637},{"file":"scripts/check-update.mjs","line_end":1393,"line_start":1393},{"file":"scripts/check-update.mjs","line_end":1397,"line_start":1397},{"file":"scripts/check-update.mjs","line_end":1637,"line_start":1637},{"file":"test/brand-marks.test.mjs","line_end":356,"line_start":356},{"file":"test/brand-marks.test.mjs","line_end":357,"line_start":357},{"file":"test/brand-marks.test.mjs","line_end":377,"line_start":377},{"file":"test/brand-marks.test.mjs","line_end":378,"line_start":378},{"file":"test/brand-marks.test.mjs","line_end":44,"line_start":44},{"file":"test/brand-marks.test.mjs","line_end":58,"line_start":58},{"file":"test/brand-marks.test.mjs","line_end":81,"line_start":81},{"file":"test/brand-marks.test.mjs","line_end":356,"line_start":356},{"file":"test/brand-marks.test.mjs","line_end":357,"line_start":357},{"file":"test/brand-marks.test.mjs","line_end":377,"line_start":377},{"file":"test/brand-marks.test.mjs","line_end":378,"line_start":378},{"file":"test/clean-skill-staging.test.mjs","line_end":235,"line_start":235},{"file":"test/cli.test.mjs","line_end":35,"line_start":35},{"file":"test/cli.test.mjs","line_end":51,"line_start":51},{"file":"test/cli.test.mjs","line_end":20,"line_start":20},{"file":"test/cli.test.mjs","line_end":35,"line_start":35},{"file":"test/cli.test.mjs","line_end":50,"line_start":50},{"file":"test/cli.test.mjs","line_end":51,"line_start":51},{"file":"test/cli.test.mjs","line_end":240,"line_start":240},{"file":"test/cli.test.mjs","line_end":257,"line_start":257},{"file":"test/cli.test.mjs","line_end":667,"line_start":667},{"file":"test/cli.test.mjs","line_end":784,"line_start":784},{"file":"test/cli.test.mjs","line_end":797,"line_start":797}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Undisclosed Automatic Update Check","locations":[{"file":"SKILL.md","line_end":44,"line_start":37},{"file":"scripts/update-contract.mjs","line_end":3,"line_start":1}],"confidence":0.98,"description":"The skill directs the agent to run a packaged update checker after creating the first candidate and to hide successful or failed checks. The checker uses a remote manifest, creating an unrequested network request and local cache state.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The instruction explicitly requires the check and suppresses disclosure in normal and failure cases. The packaged contract defines the remote manifest endpoint."}],"low_findings":[{"title":"Hardcoded URL","locations":[{"file":"assets/template.html","line_end":36,"line_start":36}],"confidence":0.98,"description":"<link rel=\"preconnect\" href=\"https://fonts.gstatic.com\" crossorigin>","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"Opening the generated HTML initiates an external Google Fonts connection, which exposes viewer network metadata and contradicts fully self-contained offline behavior."},{"title":"Hardcoded URL","locations":[{"file":"assets/template.html","line_end":37,"line_start":37}],"confidence":0.98,"description":"<link href=\"https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400;500;600;700&display=swa","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"Opening the generated HTML initiates an external Google Fonts connection, which exposes viewer network metadata and contradicts fully self-contained offline behavior."},{"title":"Hardcoded URL","locations":[{"file":"examples/dataflow-product-analytics.html","line_end":36,"line_start":36}],"confidence":0.98,"description":"<link rel=\"preconnect\" href=\"https://fonts.gstatic.com\" crossorigin>","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"Opening the generated HTML initiates an external Google Fonts connection, which exposes viewer network metadata and contradicts fully self-contained offline behavior."},{"title":"Hardcoded URL","locations":[{"file":"examples/dataflow-product-analytics.html","line_end":37,"line_start":37}],"confidence":0.98,"description":"<link href=\"https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400;500;600;700&display=swa","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"Opening the generated HTML initiates an external Google Fonts connection, which exposes viewer network metadata and contradicts fully self-contained offline behavior."},{"title":"Hardcoded URL","locations":[{"file":"scripts/update-contract.mjs","line_end":3,"line_start":3}],"confidence":0.96,"description":"export const DEFAULT_MANIFEST_URL = 'https://tt-a1i.github.io/archify/skill-updates/archify/stable.j","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"This URL is the configured remote manifest used by the automatic update-check workflow. The check creates an outbound request after diagram authoring begins."},{"title":"Hardcoded URL","locations":[{"file":"skill-release.json","line_end":9,"line_start":9}],"confidence":0.96,"description":"\"updateManifestUrl\": \"https://tt-a1i.github.io/archify/skill-updates/archify/stable.json\"","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"This URL is the configured remote manifest used by the automatic update-check workflow. The check creates an outbound request after diagram authoring begins."}],"dangerous_patterns":[],"files_scanned":190,"total_lines":144837,"audit_model":"codex","audited_at":"2026-08-31T15:49:29.592+00:00","created_at":"2026-09-08T11:12:21.286448+00:00","static_findings":[{"id":"blocker:test/preview.test.mjs:160:system-password-file-access","file":"test/preview.test.mjs","pattern":"System password file access","snippet":"assert.equal((await rawRequest(preview.url, { pathname: '/../../etc/passwd' })).status, 404);","category":"blocker","line_end":160,"severity":"critical","line_start":160},{"id":"obfuscation:multiple:1:heuristic-dangerous-combination-code-execution-n","file":"multiple","pattern":"[HEURISTIC] DANGEROUS COMBINATION: Code execution + Network + Credential access","snippet":"This combination is common in credential stealers and RATs","category":"obfuscation","line_end":1,"severity":"critical","line_start":1},{"id":"network:test/brand-marks.test.mjs:386:aws-azure-metadata-endpoint","file":"test/brand-marks.test.mjs","pattern":"AWS/Azure metadata endpoint","snippet":"'http://[::ffff:169.254.169.254]/',","category":"network","line_end":386,"severity":"critical","line_start":386},{"id":"blocker:bin/visual-check.mjs:63:screen-capture-upload","file":"bin/visual-check.mjs","pattern":"Screen capture upload","snippet":"const screenshots = CAPTURE_VIEWPORTS.flatMap(({ width, height }) => THEMES.map((theme) => ({","category":"blocker","line_end":63,"severity":"high","line_start":63},{"id":"blocker:bin/visual-check.mjs:470:screen-capture-upload","file":"bin/visual-check.mjs","pattern":"Screen capture upload","snippet":"fs.writeFileSync(screenshotPath, Buffer.from(capture.data, 'base64'));","category":"blocker","line_end":470,"severity":"high","line_start":470},{"id":"blocker:bin/visual-check.mjs:802:screen-capture-upload","file":"bin/visual-check.mjs","pattern":"Screen capture upload","snippet":"screenshots: receipt.captures.screenshots,","category":"blocker","line_end":802,"severity":"high","line_start":802},{"id":"sensitive:test/motion-governor.test.mjs:64:browser-storage-access","file":"test/motion-governor.test.mjs","pattern":"Browser storage access","snippet":"assert.match(html, /localStorage\\.setItem\\(STORAGE_KEY, 'still'\\)/);","category":"sensitive","line_end":64,"severity":"high","line_start":64},{"id":"sensitive:test/motion-governor.test.mjs:65:browser-storage-access","file":"test/motion-governor.test.mjs","pattern":"Browser storage access","snippet":"assert.match(html, /localStorage\\.removeItem\\(STORAGE_KEY\\)/);","category":"sensitive","line_end":65,"severity":"high","line_start":65},{"id":"sensitive:test/site-language-continuity.test.mjs:293:browser-storage-access","file":"test/site-language-continuity.test.mjs","pattern":"Browser storage access","snippet":"/localStorage\\.setItem\\(['\"]archify-(?:lang|gallery-language|guide-language)['\"]/,","category":"sensitive","line_end":293,"severity":"high","line_start":293},{"id":"sensitive:assets/template.html:5515:certificate-key-files","file":"assets/template.html","pattern":"Certificate/key files","snippet":"if (e.key === 'ArrowDown' || e.key === 'ArrowUp') {","category":"sensitive","line_end":5515,"severity":"high","line_start":5515},{"id":"sensitive:assets/template.html:5517:certificate-key-files","file":"assets/template.html","pattern":"Certificate/key files","snippet":"if (!isOpen()) open(e.key === 'ArrowUp');","category":"sensitive","line_end":5517,"severity":"high","line_start":5517},{"id":"sensitive:assets/template.html:5529:certificate-key-files","file":"assets/template.html","pattern":"Certificate/key files","snippet":"if (e.key === 'Escape') { e.preventDefault(); close(true); return; }","category":"sensitive","line_end":5529,"severity":"high","line_start":5529},{"id":"sensitive:delta/architecture-delta.mjs:19:certificate-key-files","file":"delta/architecture-delta.mjs","pattern":"Certificate/key files","snippet":"return `{${Object.keys(value).sort(codepointOrder).map((key) => `${JSON.stringify(key)}:${canonical(","category":"sensitive","line_end":19,"severity":"high","line_start":19},{"id":"sensitive:delta/architecture-delta.mjs:173:certificate-key-files","file":"delta/architecture-delta.mjs","pattern":"Certificate/key files","snippet":"for (const id of sorted(new Set([...baseIndex.keys(), ...headIndex.keys()]))) {","category":"sensitive","line_end":173,"severity":"high","line_start":173},{"id":"sensitive:delta/architecture-delta.mjs:231:certificate-key-files","file":"delta/architecture-delta.mjs","pattern":"Certificate/key files","snippet":"const shared = sorted([...baseComponents.keys()].filter((id) => headComponents.has(id)));","category":"sensitive","line_end":231,"severity":"high","line_start":231},{"id":"sensitive:examples/dataflow-product-analytics.html:5626:certificate-key-files","file":"examples/dataflow-product-analytics.html","pattern":"Certificate/key files","snippet":"if (e.key === 'ArrowDown' || e.key === 'ArrowUp') {","category":"sensitive","line_end":5626,"severity":"high","line_start":5626},{"id":"sensitive:examples/dataflow-product-analytics.html:5628:certificate-key-files","file":"examples/dataflow-product-analytics.html","pattern":"Certificate/key files","snippet":"if (!isOpen()) open(e.key === 'ArrowUp');","category":"sensitive","line_end":5628,"severity":"high","line_start":5628},{"id":"sensitive:examples/dataflow-product-analytics.html:5640:certificate-key-files","file":"examples/dataflow-product-analytics.html","pattern":"Certificate/key files","snippet":"if (e.key === 'Escape') { e.preventDefault(); close(true); return; }","category":"sensitive","line_end":5640,"severity":"high","line_start":5640},{"id":"sensitive:renderers/architecture/render-architecture.mjs:511:certificate-key-files","file":"renderers/architecture/render-architecture.mjs","pattern":"Certificate/key files","snippet":"endpointIds: new Set(components.keys()),","category":"sensitive","line_end":511,"severity":"high","line_start":511},{"id":"sensitive:renderers/architecture/render-architecture.mjs:530:certificate-key-files","file":"renderers/architecture/render-architecture.mjs","pattern":"Certificate/key files","snippet":"endpointIds: new Set(components.keys()),","category":"sensitive","line_end":530,"severity":"high","line_start":530},{"id":"sensitive:renderers/architecture/render-architecture.mjs:539:certificate-key-files","file":"renderers/architecture/render-architecture.mjs","pattern":"Certificate/key files","snippet":"endpointIds: new Set(components.keys()),","category":"sensitive","line_end":539,"severity":"high","line_start":539},{"id":"sensitive:scripts/check-render-output.mjs:341:certificate-key-files","file":"scripts/check-render-output.mjs","pattern":"Certificate/key files","snippet":"groupAttrs['data-edge-key'] !== undefined && arrow.key === groupAttrs['data-edge-key']","category":"sensitive","line_end":341,"severity":"high","line_start":341},{"id":"sensitive:scripts/check-render-output.mjs:348:certificate-key-files","file":"scripts/check-render-output.mjs","pattern":"Certificate/key files","snippet":"if (owner.key === undefined && groupAttrs['data-edge-key'] !== undefined) owner.key = groupAttrs['da","category":"sensitive","line_end":348,"severity":"high","line_start":348},{"id":"sensitive:scripts/check-render-output.mjs:409:certificate-key-files","file":"scripts/check-render-output.mjs","pattern":"Certificate/key files","snippet":"const stableIndex = Number(arrow.key);","category":"sensitive","line_end":409,"severity":"high","line_start":409},{"id":"sensitive:test/architecture-delta.test.mjs:112:certificate-key-files","file":"test/architecture-delta.test.mjs","pattern":"Certificate/key files","snippet":"assert.deepEqual(rows.map((row) => row.key), [","category":"sensitive","line_end":112,"severity":"high","line_start":112},{"id":"sensitive:test/architecture-delta.test.mjs:125:certificate-key-files","file":"test/architecture-delta.test.mjs","pattern":"Certificate/key files","snippet":"assert.equal(new Set(rows.map((row) => row.key)).size, rows.length);","category":"sensitive","line_end":125,"severity":"high","line_start":125},{"id":"sensitive:test/architecture-delta.test.mjs:320:certificate-key-files","file":"test/architecture-delta.test.mjs","pattern":"Certificate/key files","snippet":"assert.match(firstHtml, /event\\.key === 'Enter' \\|\\| event\\.key === ' '/);","category":"sensitive","line_end":320,"severity":"high","line_start":320},{"id":"sensitive:bin/archify.mjs:55:environment-file-access","file":"bin/archify.mjs","pattern":"Environment file access","snippet":"env: options.env ? { ...process.env, ...options.env } : process.env,","category":"sensitive","line_end":55,"severity":"high","line_start":55},{"id":"sensitive:bin/preview.mjs:516:environment-file-access","file":"bin/preview.mjs","pattern":"Environment file access","snippet":"env: process.env,","category":"sensitive","line_end":516,"severity":"high","line_start":516},{"id":"sensitive:bin/visual-check.mjs:107:environment-file-access","file":"bin/visual-check.mjs","pattern":"Environment file access","snippet":"export function findChrome({ env = process.env, platform = process.platform } = {}) {","category":"sensitive","line_end":107,"severity":"high","line_start":107},{"id":"sensitive:renderers/shared/brand-marks.mjs:124:environment-file-access","file":"renderers/shared/brand-marks.mjs","pattern":"Environment file access","snippet":"function validateUrlShape(url, allowPrivate = process.env.ARCHIFY_BRAND_ALLOW_PRIVATE === '1') {","category":"sensitive","line_end":124,"severity":"high","line_start":124},{"id":"sensitive:renderers/shared/brand-marks.mjs:152:environment-file-access","file":"renderers/shared/brand-marks.mjs","pattern":"Environment file access","snippet":"const allowPrivate = process.env.ARCHIFY_BRAND_ALLOW_PRIVATE === '1';","category":"sensitive","line_end":152,"severity":"high","line_start":152},{"id":"sensitive:renderers/shared/brand-marks.mjs:173:environment-file-access","file":"renderers/shared/brand-marks.mjs","pattern":"Environment file access","snippet":"const configured = Number(process.env.ARCHIFY_BRAND_CAPTURE_TIMEOUT_MS);","category":"sensitive","line_end":173,"severity":"high","line_start":173},{"id":"sensitive:scripts/check-update.mjs:1393:environment-file-access","file":"scripts/check-update.mjs","pattern":"Environment file access","snippet":"const localData = process.env.LOCALAPPDATA;","category":"sensitive","line_end":1393,"severity":"high","line_start":1393},{"id":"sensitive:scripts/check-update.mjs:1397:environment-file-access","file":"scripts/check-update.mjs","pattern":"Environment file access","snippet":"const xdgCache = process.env.XDG_CACHE_HOME;","category":"sensitive","line_end":1397,"severity":"high","line_start":1397},{"id":"sensitive:scripts/check-update.mjs:1637:environment-file-access","file":"scripts/check-update.mjs","pattern":"Environment file access","snippet":"if (process.env.ARCHIFY_UPDATE_CHECK_DISABLED === '1') return silent('disabled');","category":"sensitive","line_end":1637,"severity":"high","line_start":1637},{"id":"sensitive:test/brand-marks.test.mjs:44:environment-file-access","file":"test/brand-marks.test.mjs","pattern":"Environment file access","snippet":"env: { ...process.env, ...env },","category":"sensitive","line_end":44,"severity":"high","line_start":44},{"id":"sensitive:test/brand-marks.test.mjs:58:environment-file-access","file":"test/brand-marks.test.mjs","pattern":"Environment file access","snippet":"env: { ...process.env, ...env },","category":"sensitive","line_end":58,"severity":"high","line_start":58},{"id":"sensitive:test/brand-marks.test.mjs:81:environment-file-access","file":"test/brand-marks.test.mjs","pattern":"Environment file access","snippet":"env: { ...process.env, ...env },","category":"sensitive","line_end":81,"severity":"high","line_start":81},{"id":"obfuscation:renderers/shared/generated-brand-marks.mjs:779:heuristic-extremely-long-line-2003-chars-likely-","file":"renderers/shared/generated-brand-marks.mjs","pattern":"[HEURISTIC] Extremely long line (2003 chars) - likely obfuscated","snippet":"    \"path\": \"M7.0301.084c-1.2768.0602-2.1487.264-2.911.5634-.7888.3075-1.4575.72-2.1228 1.3877-.6652","category":"obfuscation","line_end":779,"severity":"high","line_start":779},{"id":"obfuscation:renderers/shared/generated-brand-marks.mjs:109:heuristic-extremely-long-line-2150-chars-likely-","file":"renderers/shared/generated-brand-marks.mjs","pattern":"[HEURISTIC] Extremely long line (2150 chars) - likely obfuscated","snippet":"    \"path\": \"M17.195 16.822l4.002-4.102C23.55 10.308 23.934 5.154 24 .43a.396.396 0 0 0-.246-.373.39","category":"obfuscation","line_end":109,"severity":"high","line_start":109},{"id":"obfuscation:renderers/shared/generated-brand-marks.mjs:1599:heuristic-extremely-long-line-2361-chars-likely-","file":"renderers/shared/generated-brand-marks.mjs","pattern":"[HEURISTIC] Extremely long line (2361 chars) - likely obfuscated","snippet":"    \"path\": \"M24 3.459c0 .646-.418 1.18-1.141 1.18-.723 0-1.142-.534-1.142-1.18 0-.647.419-1.18 1.14","category":"obfuscation","line_end":1599,"severity":"high","line_start":1599},{"id":"obfuscation:renderers/shared/generated-brand-marks.mjs:133:heuristic-extremely-long-line-2623-chars-likely-","file":"renderers/shared/generated-brand-marks.mjs","pattern":"[HEURISTIC] Extremely long line (2623 chars) - likely obfuscated","snippet":"    \"path\": \"M9.71 2.136a1.43 1.43 0 0 0-2.047 0h-.007a1.48 1.48 0 0 0-.421 1.042c0 .41.161.777.422 ","category":"obfuscation","line_end":133,"severity":"high","line_start":133},{"id":"obfuscation:examples/dataflow-product-analytics.html:4964:heuristic-extremely-long-line-26586-chars-likely","file":"examples/dataflow-product-analytics.html","pattern":"[HEURISTIC] Extremely long line (26586 chars) - likely obfuscated","snippet":"    <script id=\"archify-i18n-data\" type=\"application/json\">{\"locale\":\"en\",\"messages\":{\"viewer.kind.f","category":"obfuscation","line_end":4964,"severity":"high","line_start":4964},{"id":"obfuscation:examples/lifecycle-agent-run.html:4964:heuristic-extremely-long-line-26586-chars-likely","file":"examples/lifecycle-agent-run.html","pattern":"[HEURISTIC] Extremely long line (26586 chars) - likely obfuscated","snippet":"    <script id=\"archify-i18n-data\" type=\"application/json\">{\"locale\":\"en\",\"messages\":{\"viewer.kind.f","category":"obfuscation","line_end":4964,"severity":"high","line_start":4964},{"id":"obfuscation:examples/sequence-cache-miss-request.html:4964:heuristic-extremely-long-line-26586-chars-likely","file":"examples/sequence-cache-miss-request.html","pattern":"[HEURISTIC] Extremely long line (26586 chars) - likely obfuscated","snippet":"    <script id=\"archify-i18n-data\" type=\"application/json\">{\"locale\":\"en\",\"messages\":{\"viewer.kind.f","category":"obfuscation","line_end":4964,"severity":"high","line_start":4964},{"id":"obfuscation:renderers/shared/generated-brand-marks.mjs:1455:heuristic-extremely-long-line-2832-chars-likely-","file":"renderers/shared/generated-brand-marks.mjs","pattern":"[HEURISTIC] Extremely long line (2832 chars) - likely obfuscated","snippet":"    \"path\": \"M14.23 12.004a2.236 2.236 0 0 1-2.235 2.236 2.236 2.236 0 0 1-2.236-2.236 2.236 2.236 0","category":"obfuscation","line_end":1455,"severity":"high","line_start":1455},{"id":"obfuscation:renderers/shared/generated-brand-marks.mjs:319:heuristic-extremely-long-line-2902-chars-likely-","file":"renderers/shared/generated-brand-marks.mjs","pattern":"[HEURISTIC] Extremely long line (2902 chars) - likely obfuscated","snippet":"    \"path\": \"M19.57 17.04l-1.997-1.316-1.665 2.782-1.937-.567-1.706 2.604.087.82 9.274-1.71-.538-5.7","category":"obfuscation","line_end":319,"severity":"high","line_start":319},{"id":"obfuscation:renderers/shared/generated-brand-marks.mjs:741:heuristic-extremely-long-line-2926-chars-likely-","file":"renderers/shared/generated-brand-marks.mjs","pattern":"[HEURISTIC] Extremely long line (2926 chars) - likely obfuscated","snippet":"    \"path\": \"M12.025 1.13c-5.77 0-10.449 4.647-10.449 10.378 0 1.112.178 2.181.503 3.185.064-.222.20","category":"obfuscation","line_end":741,"severity":"high","line_start":741},{"id":"obfuscation:delta/architecture-delta.mjs:714:heuristic-extremely-long-line-3214-chars-likely-","file":"delta/architecture-delta.mjs","pattern":"[HEURISTIC] Extremely long line (3214 chars) - likely obfuscated","snippet":".canvas{overflow:hidden;border:1px solid var(--d-line);border-radius:10px;background:#09141e;padding","category":"obfuscation","line_end":714,"severity":"high","line_start":714},{"id":"obfuscation:renderers/shared/generated-brand-marks.mjs:878:heuristic-extremely-long-line-3466-chars-likely-","file":"renderers/shared/generated-brand-marks.mjs","pattern":"[HEURISTIC] Extremely long line (3466 chars) - likely obfuscated","snippet":"    \"path\": \"M10.204 14.35l.007.01-.999 2.413a5.171 5.171 0 0 1-2.075-2.597l2.578-.437.004.005a.44.4","category":"obfuscation","line_end":878,"severity":"high","line_start":878},{"id":"obfuscation:renderers/shared/generated-brand-marks.mjs:1900:heuristic-extremely-long-line-3474-chars-likely-","file":"renderers/shared/generated-brand-marks.mjs","pattern":"[HEURISTIC] Extremely long line (3474 chars) - likely obfuscated","snippet":"    \"path\": \"M.754 9.58a.754.754 0 00-.754.758v2.525c0 .42.339.758.758.758h3.135l1.431.799-.326-.799","category":"obfuscation","line_end":1900,"severity":"high","line_start":1900},{"id":"obfuscation:renderers/shared/generated-brand-marks.mjs:1007:heuristic-extremely-long-line-3531-chars-likely-","file":"renderers/shared/generated-brand-marks.mjs","pattern":"[HEURISTIC] Extremely long line (3531 chars) - likely obfuscated","snippet":"    \"path\": \"M16.405 5.501c-.115 0-.193.014-.274.033v.013h.014c.054.104.146.18.214.273.054.107.1.214","category":"obfuscation","line_end":1007,"severity":"high","line_start":1007},{"id":"obfuscation:renderers/shared/generated-brand-marks.mjs:687:heuristic-extremely-long-line-3721-chars-likely-","file":"renderers/shared/generated-brand-marks.mjs","pattern":"[HEURISTIC] Extremely long line (3721 chars) - likely obfuscated","snippet":"    \"path\": \"M23.02 10.59a8.578 8.578 0 0 0-.862-3.034 8.911 8.911 0 0 0-1.789-2.445c.337-1.342-.413","category":"obfuscation","line_end":687,"severity":"high","line_start":687},{"id":"obfuscation:renderers/shared/generated-brand-marks.mjs:1542:heuristic-extremely-long-line-4151-chars-likely-","file":"renderers/shared/generated-brand-marks.mjs","pattern":"[HEURISTIC] Extremely long line (4151 chars) - likely obfuscated","snippet":"    \"path\": \"M23.8346 11.7033l-1.0073-.6236a13.7268 13.7268 0 00-.0283-.2936l.8656-.8069a.3483.3483 ","category":"obfuscation","line_end":1542,"severity":"high","line_start":1542},{"id":"obfuscation:renderers/shared/generated-validators.mjs:13:heuristic-extremely-long-line-423908-chars-likel","file":"renderers/shared/generated-validators.mjs","pattern":"[HEURISTIC] Extremely long line (423908 chars) - likely obfuscated","snippet":"};const schema34 = {\"type\":\"array\",\"maxItems\":5,\"items\":{\"type\":\"object\",\"additionalProperties\":fals","category":"obfuscation","line_end":13,"severity":"high","line_start":13},{"id":"obfuscation:renderers/shared/generated-brand-marks.mjs:836:heuristic-extremely-long-line-4572-chars-likely-","file":"renderers/shared/generated-brand-marks.mjs","pattern":"[HEURISTIC] Extremely long line (4572 chars) - likely obfuscated","snippet":"    \"path\": \"M2.872 24h-.975a3.866 3.866 0 01-.07-.197c-.215-.666-.594-1.49-.692-2.154-.146-.984.78-","category":"obfuscation","line_end":836,"severity":"high","line_start":836},{"id":"obfuscation:renderers/shared/generated-brand-marks.mjs:1120:heuristic-extremely-long-line-4674-chars-likely-","file":"renderers/shared/generated-brand-marks.mjs","pattern":"[HEURISTIC] Extremely long line (4674 chars) - likely obfuscated","snippet":"    \"path\": \"M16.361 10.26a.894.894 0 0 0-.558.47l-.072.148.001.207c0 .193.004.217.059.353.076.193.1","category":"obfuscation","line_end":1120,"severity":"high","line_start":1120},{"id":"obfuscation:renderers/shared/generated-brand-marks.mjs:158:heuristic-extremely-long-line-4917-chars-likely-","file":"renderers/shared/generated-brand-marks.mjs","pattern":"[HEURISTIC] Extremely long line (4917 chars) - likely obfuscated","snippet":"    \"path\": \"M12.581 0c.436.037.871.1 1.299.186 1.679.383 3.121 1.213 4.382 2.365 1.161 1.06 1.917 2","category":"obfuscation","line_end":158,"severity":"high","line_start":158},{"id":"obfuscation:renderers/shared/generated-brand-marks.mjs:1292:heuristic-extremely-long-line-5106-chars-likely-","file":"renderers/shared/generated-brand-marks.mjs","pattern":"[HEURISTIC] Extremely long line (5106 chars) - likely obfuscated","snippet":"    \"path\": \"M23.5594 14.7228a.5269.5269 0 0 0-.0563-.1191c-.139-.2632-.4768-.3418-1.0074-.2321-1.65","category":"obfuscation","line_end":1292,"severity":"high","line_start":1292},{"id":"obfuscation:renderers/shared/generated-validators.mjs:2:heuristic-extremely-long-line-6586-chars-likely-","file":"renderers/shared/generated-validators.mjs","pattern":"[HEURISTIC] Extremely long line (6586 chars) - likely obfuscated","snippet":"\"use strict\";export const workflow = validate20;const schema31 = {\"$schema\":\"https://json-schema.org","category":"obfuscation","line_end":2,"severity":"high","line_start":2},{"id":"obfuscation:test/semantic-radar.test.mjs:1:heuristic-multiple-bracket-chains-11-jsfuck-obfu","file":"test/semantic-radar.test.mjs","pattern":"[HEURISTIC] Multiple bracket chains (11) - JSFuck/obfuscation pattern","snippet":"})(), })(), })()","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:test/viewer-chrome-layout.test.mjs:1:heuristic-multiple-bracket-chains-19-jsfuck-obfu","file":"test/viewer-chrome-layout.test.mjs","pattern":"[HEURISTIC] Multiple bracket chains (19) - JSFuck/obfuscation pattern","snippet":"})(), })(), })()","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:test/update-notifier.test.mjs:1:heuristic-multiple-bracket-chains-20-jsfuck-obfu","file":"test/update-notifier.test.mjs","pattern":"[HEURISTIC] Multiple bracket chains (20) - JSFuck/obfuscation pattern","snippet":"())}, ()))), ()))","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:assets/template.html:1:heuristic-multiple-bracket-chains-27-jsfuck-obfu","file":"assets/template.html","pattern":"[HEURISTIC] Multiple bracket chains (27) - JSFuck/obfuscation pattern","snippet":"})(), })(), ()))","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:examples/dataflow-product-analytics.html:1:heuristic-multiple-bracket-chains-27-jsfuck-obfu","file":"examples/dataflow-product-analytics.html","pattern":"[HEURISTIC] Multiple bracket chains (27) - JSFuck/obfuscation pattern","snippet":"})(), })(), ()))","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:examples/lifecycle-agent-run.html:1:heuristic-multiple-bracket-chains-27-jsfuck-obfu","file":"examples/lifecycle-agent-run.html","pattern":"[HEURISTIC] Multiple bracket chains (27) - JSFuck/obfuscation pattern","snippet":"})(), })(), ()))","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:examples/sequence-cache-miss-request.html:1:heuristic-multiple-bracket-chains-27-jsfuck-obfu","file":"examples/sequence-cache-miss-request.html","pattern":"[HEURISTIC] Multiple bracket chains (27) - JSFuck/obfuscation pattern","snippet":"})(), })(), ()))","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:test/webm-artifact.smoke.mjs:1:heuristic-multiple-bracket-chains-30-jsfuck-obfu","file":"test/webm-artifact.smoke.mjs","pattern":"[HEURISTIC] Multiple bracket chains (30) - JSFuck/obfuscation pattern","snippet":"})(), })(), })()","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:renderers/shared/generated-validators.mjs:1:heuristic-multiple-bracket-chains-365-jsfuck-obf","file":"renderers/shared/generated-validators.mjs","pattern":"[HEURISTIC] Multiple bracket chains (365) - JSFuck/obfuscation pattern","snippet":"}}}}}, ]}}}}, ]}}}}","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/check-update.mjs:1:heuristic-multiple-bracket-chains-6-jsfuck-obfus","file":"scripts/check-update.mjs","pattern":"[HEURISTIC] Multiple bracket chains (6) - JSFuck/obfuscation pattern","snippet":"]))), )))], ()))","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:test/legend-contract.test.mjs:1:heuristic-multiple-bracket-chains-6-jsfuck-obfus","file":"test/legend-contract.test.mjs","pattern":"[HEURISTIC] Multiple bracket chains (6) - JSFuck/obfuscation pattern","snippet":"}))), }])), })))","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:test/workflow-compiler.test.mjs:1:heuristic-multiple-bracket-chains-6-jsfuck-obfus","file":"test/workflow-compiler.test.mjs","pattern":"[HEURISTIC] Multiple bracket chains (6) - JSFuck/obfuscation pattern","snippet":"{}(), {}(), {}()","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:delta/architecture-delta.mjs:1:heuristic-multiple-bracket-chains-7-jsfuck-obfus","file":"delta/architecture-delta.mjs","pattern":"[HEURISTIC] Multiple bracket chains (7) - JSFuck/obfuscation pattern","snippet":")))), ()]))), {}()","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:renderers/workflow/workflow-compiler.mjs:1:heuristic-multiple-bracket-chains-7-jsfuck-obfus","file":"renderers/workflow/workflow-compiler.mjs","pattern":"[HEURISTIC] Multiple bracket chains (7) - JSFuck/obfuscation pattern","snippet":"()])), [])])], )]))","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:test/layout-rules.test.mjs:1:heuristic-multiple-bracket-chains-7-jsfuck-obfus","file":"test/layout-rules.test.mjs","pattern":"[HEURISTIC] Multiple bracket chains (7) - JSFuck/obfuscation pattern","snippet":")))}, )))}, )))}","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:test/workflow-compiler-hard-contract.test.mjs:1:heuristic-multiple-bracket-chains-7-jsfuck-obfus","file":"test/workflow-compiler-hard-contract.test.mjs","pattern":"[HEURISTIC] Multiple bracket chains (7) - JSFuck/obfuscation pattern","snippet":"([]), ([]), ([])","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:multiple:1:heuristic-suspicious-combination-filesystem-cred","file":"multiple","pattern":"[HEURISTIC] SUSPICIOUS COMBINATION: Filesystem + Credentials + Network","snippet":"This combination could indicate credential harvesting and exfiltration","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:package-lock.json:124:heuristic-very-high-entropy-string-5-53-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.53 bits) - likely encoded/encrypted payload","snippet":"sha512-sQPR5AtK/ijRjou7zw7mlLp08oB6FH7i0lOy5XJ2zp9mJs/yejgiOn7KvQoe2q4YJIx6VmgUS...","category":"obfuscation","line_end":124,"severity":"high","line_start":124},{"id":"obfuscation:package-lock.json:88:heuristic-very-high-entropy-string-5-59-bits-lik","file":"package-lock.json","pattern":"[HEURISTIC] Very high entropy string (5.59 bits) - likely encoded/encrypted payload","snippet":"sha512-IInvU7fabl34qmi9gY8XOVxhYyMyuH2xUNpb2q8/Y+7552KlejkRvqvD19nMoUW/uQGGbqNpA...","category":"obfuscation","line_end":88,"severity":"high","line_start":88},{"id":"obfuscation:recipes/scenarios.mjs:250:heuristic-very-high-entropy-string-5-82-bits-lik","file":"recipes/scenarios.mjs","pattern":"[HEURISTIC] Very high entropy string (5.82 bits) - likely encoded/encrypted payload","snippet":"用 Archify 生命周期模式建模部署对象。展示排队、构建、验证、等待审批、晋级、回滚以及所有终态，并标注允许每次状态转换的事件和守卫条件。","category":"obfuscation","line_end":250,"severity":"high","line_start":250},{"id":"obfuscation:recipes/scenarios.mjs:158:heuristic-very-high-entropy-string-5-84-bits-lik","file":"recipes/scenarios.mjs","pattern":"[HEURISTIC] Very high entropy string (5.84 bits) - likely encoded/encrypted payload","snippet":"用 Archify 时序模式解释这段异步往返链路。展示初始确认、入队或调度、后台处理、回调或轮询、重试与超时，以及调用方何时能观察到最终一致结果。","category":"obfuscation","line_end":158,"severity":"high","line_start":158},{"id":"obfuscation:recipes/scenarios.mjs:179:heuristic-very-high-entropy-string-5-84-bits-lik","file":"recipes/scenarios.mjs","pattern":"[HEURISTIC] Very high entropy string (5.84 bits) - likely encoded/encrypted payload","snippet":"用 Archify 数据流模式梳理这段数据血缘。为每个数据资产和转换命名，展示用户同意或数据分类边界，区分流式与批处理路径，并标明存储和下游消费者；所有数据流都...","category":"obfuscation","line_end":179,"severity":"high","line_start":179},{"id":"obfuscation:recipes/scenarios.mjs:212:heuristic-very-high-entropy-string-5-88-bits-lik","file":"recipes/scenarios.mjs","pattern":"[HEURISTIC] Very high entropy string (5.88 bits) - likely encoded/encrypted payload","snippet":"用 Archify 生命周期模式建模这个对象：[粘贴它的状态、转换事件、等待、重试、取消和终态]。分开执行、等待、可恢复失败和终态，不要隐藏任何结束方式。不需要...","category":"obfuscation","line_end":212,"severity":"high","line_start":212},{"id":"obfuscation:recipes/scenarios.mjs:120:heuristic-very-high-entropy-string-5-91-bits-lik","file":"recipes/scenarios.mjs","pattern":"[HEURISTIC] Very high entropy string (5.91 bits) - likely encoded/encrypted payload","snippet":"用 Archify 时序模式绘制下面的交互：[粘贴参与者、调用、返回、回退和异步副作用]。确保消息顺序无歧义、标签简短，并明确标注未知行为。不需要代码库。","category":"obfuscation","line_end":120,"severity":"high","line_start":120},{"id":"obfuscation:recipes/scenarios.mjs:204:heuristic-very-high-entropy-string-5-94-bits-lik","file":"recipes/scenarios.mjs","pattern":"[HEURISTIC] Very high entropy string (5.94 bits) - likely encoded/encrypted payload","snippet":"用 Archify 数据流模式绘制这段事件流拓扑。命名生产者、事件、Topic、有序处理器、消费者组、状态存储、重放路径和 DLQ；只有在证据充分时才标注归属和...","category":"obfuscation","line_end":204,"severity":"high","line_start":204},{"id":"obfuscation:recipes/scenarios.mjs:112:heuristic-very-high-entropy-string-6-01-bits-lik","file":"recipes/scenarios.mjs","pattern":"[HEURISTIC] Very high entropy string (6.01 bits) - likely encoded/encrypted payload","snippet":"用 Archify 工作流模式把事故处置预案画成响应者泳道。展示发现、分诊、缓解、升级、沟通、回滚和恢复验证；把决策门与操作分开，并让缺失的负责人清晰可见。","category":"obfuscation","line_end":112,"severity":"high","line_start":112},{"id":"obfuscation:recipes/scenarios.mjs:137:heuristic-very-high-entropy-string-6-04-bits-lik","file":"recipes/scenarios.mjs","pattern":"[HEURISTIC] Very high entropy string (6.04 bits) - likely encoded/encrypted payload","snippet":"用 Archify 时序模式展示从调用方到最终响应的完整请求。包含鉴权、缓存命中或未命中、持久化回退、返回消息，以及异步 Trace 或事件上报；消息标签保持简...","category":"obfuscation","line_end":137,"severity":"high","line_start":137},{"id":"obfuscation:recipes/scenarios.mjs:187:heuristic-very-high-entropy-string-6-04-bits-lik","file":"recipes/scenarios.mjs","pattern":"[HEURISTIC] Very high entropy string (6.04 bits) - likely encoded/encrypted payload","snippet":"用 Archify 数据流模式梳理下面的数据路径：[粘贴来源、数据资产、转换、存储、边界和消费者]。为每条数据流标注名称，在有意义时区分流式与批处理，未知的分类...","category":"obfuscation","line_end":187,"severity":"high","line_start":187},{"id":"obfuscation:recipes/scenarios.mjs:229:heuristic-very-high-entropy-string-6-04-bits-lik","file":"recipes/scenarios.mjs","pattern":"[HEURISTIC] Very high entropy string (6.04 bits) - likely encoded/encrypted payload","snippet":"用 Archify 生命周期模式建模这个对象。分开主进度、等待或中断状态和终态；用事件标注转换，并在真实存在时展示重试、取消、超时、成功和失败，不能隐藏任何结束...","category":"obfuscation","line_end":229,"severity":"high","line_start":229},{"id":"obfuscation:recipes/scenarios.mjs:70:heuristic-very-high-entropy-string-6-07-bits-lik","file":"recipes/scenarios.mjs","pattern":"[HEURISTIC] Very high entropy string (6.07 bits) - likely encoded/encrypted payload","snippet":"用 Archify 工作流模式解释这段智能体工具调用。把用户界面、Agent Runtime、策略边界、异常处理、工具执行和可观测性分成泳道；突出成功主路径，并...","category":"obfuscation","line_end":70,"severity":"high","line_start":70},{"id":"obfuscation:recipes/scenarios.mjs:91:heuristic-very-high-entropy-string-6-12-bits-lik","file":"recipes/scenarios.mjs","pattern":"[HEURISTIC] Very high entropy string (6.12 bits) - likely encoded/encrypted payload","snippet":"用 Archify 工作流模式绘制从代码提交到生产发布的流程。拆分开发者、CI、审批、环境和异常泳道；标出阻断检查、冒烟测试、负责人和回滚路径，并保留一条一眼可...","category":"obfuscation","line_end":91,"severity":"high","line_start":91},{"id":"obfuscation:recipes/scenarios.mjs:53:heuristic-very-high-entropy-string-6-18-bits-lik","file":"recipes/scenarios.mjs","pattern":"[HEURISTIC] Very high entropy string (6.18 bits) - likely encoded/encrypted payload","snippet":"用 Archify 工作流模式把下面的描述画成图：[粘贴参与者、主要步骤、决策、审批和异常路径]。不同负责方使用独立泳道，保留一条明确的成功主路径，缺失的负责人...","category":"obfuscation","line_end":53,"severity":"high","line_start":53},{"id":"obfuscation:recipes/scenarios.mjs:24:heuristic-very-high-entropy-string-6-22-bits-lik","file":"recipes/scenarios.mjs","pattern":"[HEURISTIC] Very high entropy string (6.22 bits) - likely encoded/encrypted payload","snippet":"分析这个仓库，然后用 Archify 生成高层系统架构图。展示 8–12 个核心运行时组件、一条主要请求或数据路径、外部依赖、归属或信任边界；支持性细节放进卡片...","category":"obfuscation","line_end":24,"severity":"high","line_start":24},{"id":"obfuscation:recipes/scenarios.mjs:45:heuristic-very-high-entropy-string-6-44-bits-lik","file":"recipes/scenarios.mjs","pattern":"[HEURISTIC] Very high entropy string (6.44 bits) - likely encoded/encrypted payload","snippet":"用 Archify 绘制生产部署拓扑。按区域、网络、集群和负责人分组，展示工作负载与有状态服务，并标注每一种跨边界机制。不要编造部署事实，不确定的区域要明确标出...","category":"obfuscation","line_end":45,"severity":"high","line_start":45},{"id":"obfuscation:recipes/scenarios.mjs:7:heuristic-very-high-entropy-string-6-46-bits-lik","file":"recipes/scenarios.mjs","pattern":"[HEURISTIC] Very high entropy string (6.46 bits) - likely encoded/encrypted payload","snippet":"用 Archify 把下面这段自然语言系统描述画成高层架构图：[在这里描述用户、核心组件、主要路径、外部依赖和边界]。不需要代码库。只追问会实质影响图的缺失信息...","category":"obfuscation","line_end":7,"severity":"high","line_start":7},{"id":"filesystem:test/release-identity.test.mjs:51:hidden-file-in-home-directory","file":"test/release-identity.test.mjs","pattern":"Hidden file in home directory","snippet":"'Raven uses manual ZIP installation: extract archify.zip into `~/.raven/workspace/skills`, which yie","category":"filesystem","line_end":51,"severity":"high","line_start":51},{"id":"filesystem:test/release-identity.test.mjs:58:hidden-file-in-home-directory","file":"test/release-identity.test.mjs","pattern":"Hidden file in home directory","snippet":"'Raven 使用 ZIP 手动安装:将 archify.zip 解压到 `~/.raven/workspace/skills`,解压后会得到 `~/.raven/workspace/skills/a","category":"filesystem","line_end":58,"severity":"high","line_start":58},{"id":"filesystem:test/release-identity.test.mjs:93:hidden-file-in-home-directory","file":"test/release-identity.test.mjs","pattern":"Hidden file in home directory","snippet":"'docs/index.html': `<span>development · v${version} · 开发版 · 9/9 checks</span><p>Raven manual ZIP / Z","category":"filesystem","line_end":93,"severity":"high","line_start":93},{"id":"network:test/webm-artifact.smoke.mjs:257:net-server-creation-opens-port","file":"test/webm-artifact.smoke.mjs","pattern":"Net server creation (opens port)","snippet":"const server = net.createServer();","category":"network","line_end":257,"severity":"high","line_start":257},{"id":"external_commands:bin/archify.mjs:3:node-js-child-process-module","file":"bin/archify.mjs","pattern":"Node.js child_process module","snippet":"import { spawnSync } from 'node:child_process';","category":"external_commands","line_end":3,"severity":"high","line_start":3},{"id":"external_commands:bin/open-artifact.mjs:1:node-js-child-process-module","file":"bin/open-artifact.mjs","pattern":"Node.js child_process module","snippet":"import { spawnSync } from 'node:child_process';","category":"external_commands","line_end":1,"severity":"high","line_start":1},{"id":"external_commands:bin/preview.mjs:1:node-js-child-process-module","file":"bin/preview.mjs","pattern":"Node.js child_process module","snippet":"import { spawn } from 'node:child_process';","category":"external_commands","line_end":1,"severity":"high","line_start":1},{"id":"external_commands:renderers/shared/repository-evidence.mjs:1:node-js-child-process-module","file":"renderers/shared/repository-evidence.mjs","pattern":"Node.js child_process module","snippet":"import { spawnSync } from 'node:child_process';","category":"external_commands","line_end":1,"severity":"high","line_start":1},{"id":"external_commands:scripts/render-examples.mjs:4:node-js-child-process-module","file":"scripts/render-examples.mjs","pattern":"Node.js child_process module","snippet":"import { execFileSync } from 'node:child_process';","category":"external_commands","line_end":4,"severity":"high","line_start":4},{"id":"external_commands:test/animation.test.mjs:3:node-js-child-process-module","file":"test/animation.test.mjs","pattern":"Node.js child_process module","snippet":"import { execFileSync } from 'node:child_process';","category":"external_commands","line_end":3,"severity":"high","line_start":3},{"id":"external_commands:test/architecture-delta.test.mjs:3:node-js-child-process-module","file":"test/architecture-delta.test.mjs","pattern":"Node.js child_process module","snippet":"import { spawnSync } from 'node:child_process';","category":"external_commands","line_end":3,"severity":"high","line_start":3},{"id":"external_commands:test/authored-reachability.test.mjs:3:node-js-child-process-module","file":"test/authored-reachability.test.mjs","pattern":"Node.js child_process module","snippet":"import { execFileSync } from 'node:child_process';","category":"external_commands","line_end":3,"severity":"high","line_start":3},{"id":"scripts:test/guide-page.test.mjs:58:node-js-vm-script-compilation","file":"test/guide-page.test.mjs","pattern":"Node.js VM Script compilation","snippet":"assert.doesNotThrow(() => new vm.Script(scriptMatch[1]));","category":"scripts","line_end":58,"severity":"high","line_start":58},{"id":"scripts:test/preview.test.mjs:158:node-js-vm-script-compilation","file":"test/preview.test.mjs","pattern":"Node.js VM Script compilation","snippet":"assert.doesNotThrow(() => new vm.Script(script));","category":"scripts","line_end":158,"severity":"high","line_start":158},{"id":"scripts:test/start-page.test.mjs:109:node-js-vm-script-compilation","file":"test/start-page.test.mjs","pattern":"Node.js VM Script compilation","snippet":"new vm.Script(scriptMatch[1]).runInContext(context);","category":"scripts","line_end":109,"severity":"high","line_start":109},{"id":"filesystem:bin/archify.mjs:11:path-resolve-with","file":"bin/archify.mjs","pattern":"Path resolve with ..","snippet":"const skillRoot = path.resolve(__dirname, '..');","category":"filesystem","line_end":11,"severity":"high","line_start":11},{"id":"filesystem:bin/preview.mjs:433:path-resolve-with","file":"bin/preview.mjs","pattern":"Path resolve with ..","snippet":"[path.resolve(here, '..'), '<archify-skill>'],","category":"filesystem","line_end":433,"severity":"high","line_start":433},{"id":"filesystem:renderers/shared/cli.mjs:20:path-resolve-with","file":"renderers/shared/cli.mjs","pattern":"Path resolve with ..","snippet":"const skillRoot = path.resolve(rendererDir, '../..');","category":"filesystem","line_end":20,"severity":"high","line_start":20},{"id":"filesystem:renderers/shared/output-path.mjs:28:path-resolve-with","file":"renderers/shared/output-path.mjs","pattern":"Path resolve with ..","snippet":"return path.resolve(current, ...segments.slice(index));","category":"filesystem","line_end":28,"severity":"high","line_start":28},{"id":"filesystem:scripts/check-update.mjs:43:path-resolve-with","file":"scripts/check-update.mjs","pattern":"Path resolve with ..","snippet":"const defaultReleasePath = path.resolve(scriptDirectory, '..', 'skill-release.json');","category":"filesystem","line_end":43,"severity":"high","line_start":43},{"id":"filesystem:scripts/generate-brand-marks.mjs:9:path-resolve-with","file":"scripts/generate-brand-marks.mjs","pattern":"Path resolve with ..","snippet":"const root = path.resolve(here, '..');","category":"filesystem","line_end":9,"severity":"high","line_start":9},{"id":"filesystem:scripts/generate-validators.mjs:10:path-resolve-with","file":"scripts/generate-validators.mjs","pattern":"Path resolve with ..","snippet":"const root = path.resolve(__dirname, '..');","category":"filesystem","line_end":10,"severity":"high","line_start":10},{"id":"filesystem:test/adaptive-reader-layout.test.mjs:17:path-resolve-with","file":"test/adaptive-reader-layout.test.mjs","pattern":"Path resolve with ..","snippet":"const skillRoot = path.resolve(__dirname, '..');","category":"filesystem","line_end":17,"severity":"high","line_start":17},{"id":"filesystem:test/animation.test.mjs:10:path-resolve-with","file":"test/animation.test.mjs","pattern":"Path resolve with ..","snippet":"const skillRoot = path.resolve(__dirname, '..');","category":"filesystem","line_end":10,"severity":"high","line_start":10},{"id":"filesystem:test/architecture-delta.test.mjs:17:path-resolve-with","file":"test/architecture-delta.test.mjs","pattern":"Path resolve with ..","snippet":"const skillRoot = path.resolve(__dirname, '..');","category":"filesystem","line_end":17,"severity":"high","line_start":17},{"id":"filesystem:bin/archify.mjs:419:path-traversal-sequence","file":"bin/archify.mjs","pattern":"Path traversal sequence","snippet":"const { resolveOutputPath } = await import('../renderers/shared/output-path.mjs');","category":"filesystem","line_end":419,"severity":"high","line_start":419},{"id":"filesystem:bin/archify.mjs:751:path-traversal-sequence","file":"bin/archify.mjs","pattern":"Path traversal sequence","snippet":"const { resolveOutputPath } = await import('../renderers/shared/output-path.mjs');","category":"filesystem","line_end":751,"severity":"high","line_start":751},{"id":"filesystem:bin/archify.mjs:1411:path-traversal-sequence","file":"bin/archify.mjs","pattern":"Path traversal sequence","snippet":"const { captureBrandReference } = await import('../renderers/shared/brand-marks.mjs');","category":"filesystem","line_end":1411,"severity":"high","line_start":1411},{"id":"filesystem:migrations/workflow-v2.mjs:1:path-traversal-sequence","file":"migrations/workflow-v2.mjs","pattern":"Path traversal sequence","snippet":"import { compileWorkflow } from '../renderers/workflow/workflow-compiler.mjs';","category":"filesystem","line_end":1,"severity":"high","line_start":1},{"id":"filesystem:migrations/workflow-v2.mjs:6:path-traversal-sequence","file":"migrations/workflow-v2.mjs","pattern":"Path traversal sequence","snippet":"} from '../renderers/workflow/workflow-migration-geometry.mjs';","category":"filesystem","line_end":6,"severity":"high","line_start":6},{"id":"filesystem:migrations/workflow-v2.mjs:7:path-traversal-sequence","file":"migrations/workflow-v2.mjs","pattern":"Path traversal sequence","snippet":"import { validateSchema } from '../renderers/shared/validator.mjs';","category":"filesystem","line_end":7,"severity":"high","line_start":7},{"id":"filesystem:package.json:19:path-traversal-sequence","file":"package.json","pattern":"Path traversal sequence","snippet":"\"check:release-identity\": \"node ../scripts/check-release-identity.mjs\",","category":"filesystem","line_end":19,"severity":"high","line_start":19},{"id":"filesystem:package.json:20:path-traversal-sequence","file":"package.json","pattern":"Path traversal sequence","snippet":"\"build:gallery\": \"node ../scripts/build-gallery.mjs ../docs\",","category":"filesystem","line_end":20,"severity":"high","line_start":20},{"id":"filesystem:package.json:21:path-traversal-sequence","file":"package.json","pattern":"Path traversal sequence","snippet":"\"build:guide\": \"node ../scripts/build-guide.mjs ../docs/guide.html\",","category":"filesystem","line_end":21,"severity":"high","line_start":21},{"id":"filesystem:references/authoring-contract.md:21:path-traversal-sequence","file":"references/authoring-contract.md","pattern":"Path traversal sequence","snippet":"[migration and layout-receipt contract](../renderers/workflow/README.md#migration-and-layout-receipt","category":"filesystem","line_end":21,"severity":"high","line_start":21},{"id":"filesystem:references/authoring-contract.md:23:path-traversal-sequence","file":"references/authoring-contract.md","pattern":"Path traversal sequence","snippet":"[layout contracts](../renderers/workflow/README.md#layout-contracts).","category":"filesystem","line_end":23,"severity":"high","line_start":23},{"id":"filesystem:renderers/architecture/render-architecture.mjs:3:path-traversal-sequence","file":"renderers/architecture/render-architecture.mjs","pattern":"Path traversal sequence","snippet":"import { esc, renderDefinitions, renderSemanticSigil, textUnits } from '../shared/utils.mjs';","category":"filesystem","line_end":3,"severity":"high","line_start":3},{"id":"filesystem:renderers/architecture/render-architecture.mjs:4:path-traversal-sequence","file":"renderers/architecture/render-architecture.mjs","pattern":"Path traversal sequence","snippet":"import { animateAttr, focusEdgeAttrs, focusNodeAttrs, focusNodeTitle, loadDiagramWithBrandMarks, wri","category":"filesystem","line_end":4,"severity":"high","line_start":4},{"id":"filesystem:renderers/architecture/render-architecture.mjs:5:path-traversal-sequence","file":"renderers/architecture/render-architecture.mjs","pattern":"Path traversal sequence","snippet":"import { componentBox, boundaryBox, connectionPath } from '../shared/layout-report.mjs';","category":"filesystem","line_end":5,"severity":"high","line_start":5},{"id":"filesystem:scripts/check-render-output.mjs:5:path-traversal-sequence","file":"scripts/check-render-output.mjs","pattern":"Path traversal sequence","snippet":"import { collectAmbiguousCorridors, collectBorderRuns, collectLabelRouteClearance, collectRouteRhyth","category":"filesystem","line_end":5,"severity":"high","line_start":5},{"id":"filesystem:scripts/check-render-output.mjs:11:path-traversal-sequence","file":"scripts/check-render-output.mjs","pattern":"Path traversal sequence","snippet":"} from '../renderers/shared/desktop-readability.mjs';","category":"filesystem","line_end":11,"severity":"high","line_start":11},{"id":"filesystem:test/adaptive-reader-layout.test.mjs:14:path-traversal-sequence","file":"test/adaptive-reader-layout.test.mjs","pattern":"Path traversal sequence","snippet":"} from '../renderers/shared/desktop-readability.mjs';","category":"filesystem","line_end":14,"severity":"high","line_start":14},{"id":"filesystem:test/architecture-delta.test.mjs:14:path-traversal-sequence","file":"test/architecture-delta.test.mjs","pattern":"Path traversal sequence","snippet":"} from '../delta/architecture-delta.mjs';","category":"filesystem","line_end":14,"severity":"high","line_start":14},{"id":"filesystem:test/architecture-delta.test.mjs:21:path-traversal-sequence","file":"test/architecture-delta.test.mjs","pattern":"Path traversal sequence","snippet":"const checkedArtifact = path.resolve(skillRoot, '../examples/checkout-platform-delta.html');","category":"filesystem","line_end":21,"severity":"high","line_start":21},{"id":"filesystem:renderers/shared/output-path.mjs:42:path-traversal-with","file":"renderers/shared/output-path.mjs","pattern":"Path traversal with ..","snippet":"return canonicalize(path.join(linkTarget, ...segments.slice(index + 1)), depth + 1);","category":"filesystem","line_end":42,"severity":"high","line_start":42},{"id":"filesystem:test/delivery-contract.test.mjs:8:path-traversal-with","file":"test/delivery-contract.test.mjs","pattern":"Path traversal with ..","snippet":"const skill = readFileSync(path.join(here, '..', 'SKILL.md'), 'utf8');","category":"filesystem","line_end":8,"severity":"high","line_start":8},{"id":"filesystem:test/delivery-contract.test.mjs:9:path-traversal-with","file":"test/delivery-contract.test.mjs","pattern":"Path traversal with ..","snippet":"const delivery = readFileSync(path.join(here, '..', 'references', 'delivery-contract.md'), 'utf8');","category":"filesystem","line_end":9,"severity":"high","line_start":9},{"id":"filesystem:test/skill-metadata.test.mjs:8:path-traversal-with","file":"test/skill-metadata.test.mjs","pattern":"Path traversal with ..","snippet":"const skillRoot = path.join(here, '..');","category":"filesystem","line_end":8,"severity":"high","line_start":8},{"id":"external_commands:bin/open-artifact.mjs:16:powershell-invocation","file":"bin/open-artifact.mjs","pattern":"PowerShell invocation","snippet":"command: 'powershell.exe',","category":"external_commands","line_end":16,"severity":"high","line_start":16},{"id":"external_commands:bin/open-artifact.mjs:17:powershell-invocation","file":"bin/open-artifact.mjs","pattern":"PowerShell invocation","snippet":"method: 'powershell',","category":"external_commands","line_end":17,"severity":"high","line_start":17},{"id":"external_commands:bin/open-artifact.mjs:18:powershell-invocation","file":"bin/open-artifact.mjs","pattern":"PowerShell invocation","snippet":"// Keep the command constant and pass the target through PowerShell's","category":"external_commands","line_end":18,"severity":"high","line_start":18},{"id":"external_commands:test/open-artifact.test.mjs:25:powershell-invocation","file":"test/open-artifact.test.mjs","pattern":"PowerShell invocation","snippet":"command: 'powershell.exe',","category":"external_commands","line_end":25,"severity":"high","line_start":25},{"id":"external_commands:test/open-artifact.test.mjs:33:powershell-invocation","file":"test/open-artifact.test.mjs","pattern":"PowerShell invocation","snippet":"method: 'powershell',","category":"external_commands","line_end":33,"severity":"high","line_start":33},{"id":"external_commands:delta/architecture-delta.mjs:390:process-exec","file":"delta/architecture-delta.mjs","pattern":"Process exec","snippet":"while ((open = opener.exec(svg))) {","category":"external_commands","line_end":390,"severity":"high","line_start":390},{"id":"external_commands:delta/architecture-delta.mjs:395:process-exec","file":"delta/architecture-delta.mjs","pattern":"Process exec","snippet":"while ((tag = tags.exec(svg))) {","category":"external_commands","line_end":395,"severity":"high","line_start":395},{"id":"external_commands:scripts/check-update.mjs:692:process-exec","file":"scripts/check-update.mjs","pattern":"Process exec","snippet":"const match = OPERATION_NAME.exec(name);","category":"external_commands","line_end":692,"severity":"high","line_start":692},{"id":"external_commands:scripts/update-contract.mjs:31:process-exec","file":"scripts/update-contract.mjs","pattern":"Process exec","snippet":"const match = SEMVER.exec(value);","category":"external_commands","line_end":31,"severity":"high","line_start":31},{"id":"external_commands:bin/open-artifact.mjs:45:process-spawn","file":"bin/open-artifact.mjs","pattern":"Process spawn","snippet":"result = spawn(opener.command, opener.args(target), {","category":"external_commands","line_end":45,"severity":"high","line_start":45},{"id":"external_commands:bin/preview.mjs:514:process-spawn","file":"bin/preview.mjs","pattern":"Process spawn","snippet":"child = spawn(process.execPath, args, {","category":"external_commands","line_end":514,"severity":"high","line_start":514},{"id":"external_commands:test/brand-marks.test.mjs:52:process-spawn","file":"test/brand-marks.test.mjs","pattern":"Process spawn","snippet":"const child = spawn(process.execPath, [","category":"external_commands","line_end":52,"severity":"high","line_start":52},{"id":"external_commands:test/brand-marks.test.mjs:79:process-spawn","file":"test/brand-marks.test.mjs","pattern":"Process spawn","snippet":"const child = spawn(process.execPath, [cli, ...args], {","category":"external_commands","line_end":79,"severity":"high","line_start":79},{"id":"external_commands:test/cli.test.mjs:460:process-spawn","file":"test/cli.test.mjs","pattern":"Process spawn","snippet":"const child = spawn(process.execPath, [installedCli, 'preview', 'architecture', input, output, '--qu","category":"external_commands","line_end":460,"severity":"high","line_start":460},{"id":"scripts:delta/architecture-delta.mjs:390:python-exec-function","file":"delta/architecture-delta.mjs","pattern":"Python exec() function","snippet":"while ((open = opener.exec(svg))) {","category":"scripts","line_end":390,"severity":"high","line_start":390},{"id":"scripts:delta/architecture-delta.mjs:395:python-exec-function","file":"delta/architecture-delta.mjs","pattern":"Python exec() function","snippet":"while ((tag = tags.exec(svg))) {","category":"scripts","line_end":395,"severity":"high","line_start":395},{"id":"scripts:scripts/check-update.mjs:692:python-exec-function","file":"scripts/check-update.mjs","pattern":"Python exec() function","snippet":"const match = OPERATION_NAME.exec(name);","category":"scripts","line_end":692,"severity":"high","line_start":692},{"id":"scripts:scripts/update-contract.mjs:31:python-exec-function","file":"scripts/update-contract.mjs","pattern":"Python exec() function","snippet":"const match = SEMVER.exec(value);","category":"scripts","line_end":31,"severity":"high","line_start":31},{"id":"filesystem:test/clean-skill-staging.test.mjs:80:symlink-creation","file":"test/clean-skill-staging.test.mjs","pattern":"Symlink creation","snippet":"fs.symlinkSync(external, runtime, process.platform === 'win32' ? 'junction' : 'dir');","category":"filesystem","line_end":80,"severity":"high","line_start":80},{"id":"filesystem:test/clean-skill-staging.test.mjs:106:symlink-creation","file":"test/clean-skill-staging.test.mjs","pattern":"Symlink creation","snippet":"fs.symlinkSync(external, linked);","category":"filesystem","line_end":106,"severity":"high","line_start":106},{"id":"filesystem:test/clean-skill-staging.test.mjs:141:symlink-creation","file":"test/clean-skill-staging.test.mjs","pattern":"Symlink creation","snippet":"fs.symlinkSync(external, probe, process.platform === 'win32' ? 'junction' : 'dir');","category":"filesystem","line_end":141,"severity":"high","line_start":141},{"id":"external_commands:scripts/render-examples.mjs:21:synchronous-file-execution","file":"scripts/render-examples.mjs","pattern":"Synchronous file execution","snippet":"execFileSync(process.execPath, [","category":"external_commands","line_end":21,"severity":"high","line_start":21},{"id":"external_commands:test/animation.test.mjs:39:synchronous-file-execution","file":"test/animation.test.mjs","pattern":"Synchronous file execution","snippet":"execFileSync('node', [path.join(skillRoot, `renderers/${mode}/render-${mode}.mjs`), input, output], ","category":"external_commands","line_end":39,"severity":"high","line_start":39},{"id":"external_commands:test/authored-reachability.test.mjs:25:synchronous-file-execution","file":"test/authored-reachability.test.mjs","pattern":"Synchronous file execution","snippet":"execFileSync(process.execPath, [","category":"external_commands","line_end":25,"severity":"high","line_start":25},{"id":"external_commands:test/automatic-port-spread.test.mjs:18:synchronous-file-execution","file":"test/automatic-port-spread.test.mjs","pattern":"Synchronous file execution","snippet":"execFileSync('node', [","category":"external_commands","line_end":18,"severity":"high","line_start":18},{"id":"external_commands:bin/archify.mjs:51:synchronous-spawn","file":"bin/archify.mjs","pattern":"Synchronous spawn","snippet":"return spawnSync(process.execPath, args, {","category":"external_commands","line_end":51,"severity":"high","line_start":51},{"id":"external_commands:renderers/shared/repository-evidence.mjs:21:synchronous-spawn","file":"renderers/shared/repository-evidence.mjs","pattern":"Synchronous spawn","snippet":"const result = spawnSync('git', ['-C', repoRoot, ...args], {","category":"external_commands","line_end":21,"severity":"high","line_start":21},{"id":"external_commands:test/architecture-delta.test.mjs:26:synchronous-spawn","file":"test/architecture-delta.test.mjs","pattern":"Synchronous spawn","snippet":"const run = (args) => spawnSync(process.execPath, [cli, ...args], { cwd: skillRoot, encoding: 'utf8'","category":"external_commands","line_end":26,"severity":"high","line_start":26},{"id":"external_commands:test/base-input-compatibility.test.mjs:16:synchronous-spawn","file":"test/base-input-compatibility.test.mjs","pattern":"Synchronous spawn","snippet":"return spawnSync(process.execPath, [","category":"external_commands","line_end":16,"severity":"high","line_start":16},{"id":"external_commands:test/brand-marks.test.mjs:37:synchronous-spawn","file":"test/brand-marks.test.mjs","pattern":"Synchronous spawn","snippet":"const result = spawnSync(process.execPath, [","category":"external_commands","line_end":37,"severity":"high","line_start":37},{"id":"obfuscation:bin/visual-check.mjs:470:buffer-base64-decode","file":"bin/visual-check.mjs","pattern":"Buffer base64 decode","snippet":"fs.writeFileSync(screenshotPath, Buffer.from(capture.data, 'base64'));","category":"obfuscation","line_end":470,"severity":"medium","line_start":470},{"id":"obfuscation:test/brand-marks.test.mjs:238:buffer-base64-decode","file":"test/brand-marks.test.mjs","pattern":"Buffer base64 decode","snippet":"const icon = Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk+A8AAQUBAScY42","category":"obfuscation","line_end":238,"severity":"medium","line_start":238},{"id":"obfuscation:test/brand-marks.test.mjs:278:buffer-base64-decode","file":"test/brand-marks.test.mjs","pattern":"Buffer base64 decode","snippet":"const firstIcon = Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk+A8AAQUBA","category":"obfuscation","line_end":278,"severity":"medium","line_start":278},{"id":"obfuscation:test/brand-marks.test.mjs:310:buffer-base64-decode","file":"test/brand-marks.test.mjs","pattern":"Buffer base64 decode","snippet":"const icon = Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk+A8AAQUBAScY42","category":"obfuscation","line_end":310,"severity":"medium","line_start":310},{"id":"obfuscation:test/webm-artifact.smoke.mjs:880:character-code-conversion","file":"test/webm-artifact.smoke.mjs","pattern":"Character code conversion","snippet":"binary += String.fromCharCode.apply(null, bytes.subarray(offset, offset + 32768));","category":"obfuscation","line_end":880,"severity":"medium","line_start":880},{"id":"obfuscation:test/webm-artifact.smoke.mjs:944:character-code-conversion","file":"test/webm-artifact.smoke.mjs","pattern":"Character code conversion","snippet":"binary += String.fromCharCode.apply(null, bytes.subarray(offset, offset + 32768));","category":"obfuscation","line_end":944,"severity":"medium","line_start":944},{"id":"obfuscation:test/webm-artifact.smoke.mjs:1201:character-code-conversion","file":"test/webm-artifact.smoke.mjs","pattern":"Character code conversion","snippet":"binary += String.fromCharCode.apply(null, bytes.subarray(offset, offset + 32768));","category":"obfuscation","line_end":1201,"severity":"medium","line_start":1201},{"id":"scripts:bin/archify.mjs:419:dynamic-import-expression","file":"bin/archify.mjs","pattern":"Dynamic import() expression","snippet":"const { resolveOutputPath } = await import('../renderers/shared/output-path.mjs');","category":"scripts","line_end":419,"severity":"medium","line_start":419},{"id":"scripts:bin/archify.mjs:427:dynamic-import-expression","file":"bin/archify.mjs","pattern":"Dynamic import() expression","snippet":"deltaRuntime = await import(pathToFileURL(path.join(skillRoot, 'delta/architecture-delta.mjs')).href","category":"scripts","line_end":427,"severity":"medium","line_start":427},{"id":"scripts:bin/archify.mjs:751:dynamic-import-expression","file":"bin/archify.mjs","pattern":"Dynamic import() expression","snippet":"const { resolveOutputPath } = await import('../renderers/shared/output-path.mjs');","category":"scripts","line_end":751,"severity":"medium","line_start":751},{"id":"scripts:test/site-language-integration.mjs:9:dynamic-import-expression","file":"test/site-language-integration.mjs","pattern":"Dynamic import() expression","snippet":"await import('./site-language-continuity.test.mjs');","category":"scripts","line_end":9,"severity":"medium","line_start":9},{"id":"filesystem:bin/preview.mjs:591:file-system-watching","file":"bin/preview.mjs","pattern":"File system watching","snippet":"watcher = fs.watch(path.dirname(inputPath), (event, filename) => {","category":"filesystem","line_end":591,"severity":"medium","line_start":591},{"id":"filesystem:test/output-path.test.mjs:149:hard-link-creation","file":"test/output-path.test.mjs","pattern":"Hard link creation","snippet":"fs.linkSync(input, output);","category":"filesystem","line_end":149,"severity":"medium","line_start":149},{"id":"network:bin/open-artifact.mjs:79:hardcoded-ip-address","file":"bin/open-artifact.mjs","pattern":"Hardcoded IP address","snippet":"if (url.protocol !== 'http:' || url.hostname !== '127.0.0.1' || !url.port) {","category":"network","line_end":79,"severity":"medium","line_start":79},{"id":"network:bin/open-artifact.mjs:80:hardcoded-ip-address","file":"bin/open-artifact.mjs","pattern":"Hardcoded IP address","snippet":"throw new TypeError('Preview URL must be a loopback URL using http://127.0.0.1:<port>.');","category":"network","line_end":80,"severity":"medium","line_start":80},{"id":"network:bin/preview.mjs:13:hardcoded-ip-address","file":"bin/preview.mjs","pattern":"Hardcoded IP address","snippet":"const loopbackHost = '127.0.0.1';","category":"network","line_end":13,"severity":"medium","line_start":13},{"id":"network:brand-marks/catalog.json:13:hardcoded-ip-address","file":"brand-marks/catalog.json","pattern":"Hardcoded IP address","snippet":"\"path\": \"M11.248 18.25q-.825 0-1.568-.314a4.3 4.3 0 0 1-1.32-.874 4 4 0 0 1-1.304.214 4 4 0 0 1-2.04","category":"network","line_end":13,"severity":"medium","line_start":13},{"id":"network:renderers/shared/generated-brand-marks.mjs:14:hardcoded-ip-address","file":"renderers/shared/generated-brand-marks.mjs","pattern":"Hardcoded IP address","snippet":"\"path\": \"M11.992 1.966c-.434 0-.87.086-1.28.257L1.779 5.917c-.503.208-.49.908.012 1.116l8.982 3.558a","category":"network","line_end":14,"severity":"medium","line_start":14},{"id":"network:renderers/shared/generated-brand-marks.mjs:73:hardcoded-ip-address","file":"renderers/shared/generated-brand-marks.mjs","pattern":"Hardcoded IP address","snippet":"\"path\": \"M10.617 11.473l4.686 3.695-3.102-7.662zM12 0C5.371 0 0 5.371 0 12s5.371 12 12 12 12-5.371 1","category":"network","line_end":73,"severity":"medium","line_start":73},{"id":"network:renderers/shared/generated-brand-marks.mjs:109:hardcoded-ip-address","file":"renderers/shared/generated-brand-marks.mjs","pattern":"Hardcoded IP address","snippet":"\"path\": \"M17.195 16.822l4.002-4.102C23.55 10.308 23.934 5.154 24 .43a.396.396 0 0 0-.246-.373.392.39","category":"network","line_end":109,"severity":"medium","line_start":109},{"id":"network:test/brand-marks.test.mjs:250:hardcoded-ip-address","file":"test/brand-marks.test.mjs","pattern":"Hardcoded IP address","snippet":"await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));","category":"network","line_end":250,"severity":"medium","line_start":250},{"id":"network:test/brand-marks.test.mjs:253:hardcoded-ip-address","file":"test/brand-marks.test.mjs","pattern":"Hardcoded IP address","snippet":"const url = `http://127.0.0.1:${address.port}/studio`;","category":"network","line_end":253,"severity":"medium","line_start":253},{"id":"network:test/brand-marks.test.mjs:271:hardcoded-ip-address","file":"test/brand-marks.test.mjs","pattern":"Hardcoded IP address","snippet":"assert.ok(!rendered.html.includes('http://127.0.0.1') || rendered.html.includes('data-node-brand-sou","category":"network","line_end":271,"severity":"medium","line_start":271},{"id":"filesystem:assets/template.html:6060:hidden-file-access","file":"assets/template.html","pattern":"Hidden file access","snippet":"if (rule.type === 7 && /^archify-/.test(rule.name || '')) {","category":"filesystem","line_end":6060,"severity":"medium","line_start":6060},{"id":"filesystem:assets/template.html:6066:hidden-file-access","file":"assets/template.html","pattern":"Hidden file access","snippet":"if (/(^|,)\\s*(svg|:root|\\[data-theme|\\[data-preset|\\.c-|\\.t-|\\.a-|\\.m-)/.test(sel)) {","category":"filesystem","line_end":6066,"severity":"medium","line_start":6066},{"id":"filesystem:assets/template.html:7965:hidden-file-access","file":"assets/template.html","pattern":"Hidden file access","snippet":"if (/\\ba-security\\b/.test(classEvidence) || sourceKind === 'security' || targetKind === 'security' |","category":"filesystem","line_end":7965,"severity":"medium","line_start":7965},{"id":"filesystem:bin/preview.mjs:141:hidden-file-access","file":"bin/preview.mjs","pattern":"Hidden file access","snippet":"const errorLine = lines.findIndex((line) => /^Error:\\s/.test(line));","category":"filesystem","line_end":141,"severity":"medium","line_start":141},{"id":"filesystem:bin/preview.mjs:144:hidden-file-access","file":"bin/preview.mjs","pattern":"Hidden file access","snippet":"const stackLine = relevant.findIndex((line, index) => index > 0 && /^\\s*at\\s/.test(line));","category":"filesystem","line_end":144,"severity":"medium","line_start":144},{"id":"filesystem:delta/architecture-delta.mjs:254:hidden-file-access","file":"delta/architecture-delta.mjs","pattern":"Hidden file access","snippet":"&& /^[a-f0-9]{40}$/.test(baseRepository.revision)","category":"filesystem","line_end":254,"severity":"medium","line_start":254},{"id":"filesystem:delta/architecture-delta.mjs:255:hidden-file-access","file":"delta/architecture-delta.mjs","pattern":"Hidden file access","snippet":"&& /^[a-f0-9]{40}$/.test(headRepository.revision)","category":"filesystem","line_end":255,"severity":"medium","line_start":255},{"id":"filesystem:delta/architecture-delta.mjs:1193:hidden-file-access","file":"delta/architecture-delta.mjs","pattern":"Hidden file access","snippet":"if (targets.some(({ tag }) => !/\\bdata-delta-state=\"[^\"]+\"/.test(tag))) failures.push(`missing Delta","category":"filesystem","line_end":1193,"severity":"medium","line_start":1193},{"id":"filesystem:examples/dataflow-product-analytics.html:6171:hidden-file-access","file":"examples/dataflow-product-analytics.html","pattern":"Hidden file access","snippet":"if (rule.type === 7 && /^archify-/.test(rule.name || '')) {","category":"filesystem","line_end":6171,"severity":"medium","line_start":6171},{"id":"filesystem:examples/dataflow-product-analytics.html:6177:hidden-file-access","file":"examples/dataflow-product-analytics.html","pattern":"Hidden file access","snippet":"if (/(^|,)\\s*(svg|:root|\\[data-theme|\\[data-preset|\\.c-|\\.t-|\\.a-|\\.m-)/.test(sel)) {","category":"filesystem","line_end":6177,"severity":"medium","line_start":6177},{"id":"filesystem:examples/dataflow-product-analytics.html:8076:hidden-file-access","file":"examples/dataflow-product-analytics.html","pattern":"Hidden file access","snippet":"if (/\\ba-security\\b/.test(classEvidence) || sourceKind === 'security' || targetKind === 'security' |","category":"filesystem","line_end":8076,"severity":"medium","line_start":8076},{"id":"filesystem:renderers/shared/brand-marks.mjs:99:hidden-file-access","file":"renderers/shared/brand-marks.mjs","pattern":"Hidden file access","snippet":"if (normalized.startsWith('fc') || normalized.startsWith('fd') || normalized.startsWith('ff') || /^f","category":"filesystem","line_end":99,"severity":"medium","line_start":99},{"id":"filesystem:renderers/shared/repository-evidence.mjs:78:hidden-file-access","file":"renderers/shared/repository-evidence.mjs","pattern":"Hidden file access","snippet":"return lines.length - (/(?:\\r\\n|\\n|\\r)$/.test(content) ? 1 : 0);","category":"filesystem","line_end":78,"severity":"medium","line_start":78},{"id":"filesystem:renderers/shared/validator.mjs:12:hidden-file-access","file":"renderers/shared/validator.mjs","pattern":"Hidden file access","snippet":"node = node[/^\\d+$/.test(seg) ? Number(seg) : seg];","category":"filesystem","line_end":12,"severity":"medium","line_start":12},{"id":"filesystem:scripts/check-render-output.mjs:75:hidden-file-access","file":"scripts/check-render-output.mjs","pattern":"Hidden file access","snippet":"addCheck('finite_svg', !/\\b(?:NaN|undefined|Infinity|-Infinity)\\b/.test(svg));","category":"filesystem","line_end":75,"severity":"medium","line_start":75},{"id":"filesystem:scripts/check-render-output.mjs:284:hidden-file-access","file":"scripts/check-render-output.mjs","pattern":"Hidden file access","snippet":"if (!/\\bclass=\"[^\"]*\\ba-(?:default|emphasis|security|dashed)\\b/.test(raw)) continue;","category":"filesystem","line_end":284,"severity":"medium","line_start":284},{"id":"filesystem:scripts/check-render-output.mjs:285:hidden-file-access","file":"scripts/check-render-output.mjs","pattern":"Hidden file access","snippet":"if (!/\\bmarker-end=/.test(raw)) continue;","category":"filesystem","line_end":285,"severity":"medium","line_start":285},{"id":"filesystem:test/layout-rules.test.mjs:631:hidden-file-access","file":"test/layout-rules.test.mjs","pattern":"Hidden file access","snippet":"!/move detail to sublabel/.test(stderr),","category":"filesystem","line_end":631,"severity":"medium","line_start":631},{"id":"filesystem:test/layout-rules.test.mjs:654:hidden-file-access","file":"test/layout-rules.test.mjs","pattern":"Hidden file access","snippet":"if (!/schema validation failed/.test(stderr)) return;","category":"filesystem","line_end":654,"severity":"medium","line_start":654},{"id":"filesystem:test/release-identity.test.mjs:51:hidden-file-access","file":"test/release-identity.test.mjs","pattern":"Hidden file access","snippet":"'Raven uses manual ZIP installation: extract archify.zip into `~/.raven/workspace/skills`, which yie","category":"filesystem","line_end":51,"severity":"medium","line_start":51},{"id":"filesystem:bin/archify.mjs:345:node-js-fs-operations","file":"bin/archify.mjs","pattern":"Node.js fs operations","snippet":"fs.renameSync(item.target, item.backup);","category":"filesystem","line_end":345,"severity":"medium","line_start":345},{"id":"filesystem:bin/archify.mjs:349:node-js-fs-operations","file":"bin/archify.mjs","pattern":"Node.js fs operations","snippet":"fs.renameSync(item.candidate, item.target);","category":"filesystem","line_end":349,"severity":"medium","line_start":349},{"id":"filesystem:bin/archify.mjs:356:node-js-fs-operations","file":"bin/archify.mjs","pattern":"Node.js fs operations","snippet":"fs.rmSync(item.target, { force: true });","category":"filesystem","line_end":356,"severity":"medium","line_start":356},{"id":"filesystem:renderers/shared/cli.mjs:22:node-js-fs-operations","file":"renderers/shared/cli.mjs","pattern":"Node.js fs operations","snippet":"const diagram = JSON.parse(fs.readFileSync(inputPath, 'utf8'));","category":"filesystem","line_end":22,"severity":"medium","line_start":22},{"id":"filesystem:renderers/shared/cli.mjs:28:node-js-fs-operations","file":"renderers/shared/cli.mjs","pattern":"Node.js fs operations","snippet":"const template = fs.readFileSync(path.join(skillRoot, 'assets/template.html'), 'utf8');","category":"filesystem","line_end":28,"severity":"medium","line_start":28},{"id":"filesystem:renderers/shared/cli.mjs:57:node-js-fs-operations","file":"renderers/shared/cli.mjs","pattern":"Node.js fs operations","snippet":"fs.mkdirSync(path.dirname(outPath), { recursive: true });","category":"filesystem","line_end":57,"severity":"medium","line_start":57},{"id":"filesystem:scripts/check-render-output.mjs:23:node-js-fs-operations","file":"scripts/check-render-output.mjs","pattern":"Node.js fs operations","snippet":"html = fs.readFileSync(htmlPath, 'utf8');","category":"filesystem","line_end":23,"severity":"medium","line_start":23},{"id":"filesystem:scripts/check-update.mjs:515:node-js-fs-operations","file":"scripts/check-update.mjs","pattern":"Node.js fs operations","snippet":"mutate: () => fs.mkdir(resolved, options),","category":"filesystem","line_end":515,"severity":"medium","line_start":515},{"id":"filesystem:scripts/check-update.mjs:599:node-js-fs-operations","file":"scripts/check-update.mjs","pattern":"Node.js fs operations","snippet":"mutate: () => fs.rename(resolvedSource, resolvedDestination),","category":"filesystem","line_end":599,"severity":"medium","line_start":599},{"id":"filesystem:test/adaptive-reader-layout.test.mjs:18:node-js-fs-operations","file":"test/adaptive-reader-layout.test.mjs","pattern":"Node.js fs operations","snippet":"const template = fs.readFileSync(path.join(skillRoot, 'assets', 'template.html'), 'utf8');","category":"filesystem","line_end":18,"severity":"medium","line_start":18},{"id":"filesystem:test/adaptive-reader-layout.test.mjs:19:node-js-fs-operations","file":"test/adaptive-reader-layout.test.mjs","pattern":"Node.js fs operations","snippet":"const skill = fs.readFileSync(path.join(skillRoot, 'SKILL.md'), 'utf8');","category":"filesystem","line_end":19,"severity":"medium","line_start":19},{"id":"filesystem:test/animation.test.mjs:30:node-js-fs-operations","file":"test/animation.test.mjs","pattern":"Node.js fs operations","snippet":"const doc = JSON.parse(fs.readFileSync(path.join(skillRoot, 'examples', example), 'utf8'));","category":"filesystem","line_end":30,"severity":"medium","line_start":30},{"id":"filesystem:test/update-notifier.test.mjs:209:node-js-fs-promises-import","file":"test/update-notifier.test.mjs","pattern":"Node.js fs promises import","snippet":"const originalMkdir = fsPromises.mkdir;","category":"filesystem","line_end":209,"severity":"medium","line_start":209},{"id":"filesystem:test/update-notifier.test.mjs:215:node-js-fs-promises-import","file":"test/update-notifier.test.mjs","pattern":"Node.js fs promises import","snippet":"fsPromises.mkdir = async (target, ...args) => {","category":"filesystem","line_end":215,"severity":"medium","line_start":215},{"id":"filesystem:test/update-notifier.test.mjs:228:node-js-fs-promises-import","file":"test/update-notifier.test.mjs","pattern":"Node.js fs promises import","snippet":"fsPromises.mkdir = originalMkdir;","category":"filesystem","line_end":228,"severity":"medium","line_start":228},{"id":"external_commands:assets/template.html:5625:ruby-shell-backtick-execution","file":"assets/template.html","pattern":"Ruby/shell backtick execution","snippet":"`width`/`height` to viewBox * 4 so the browser rasterizes the","category":"external_commands","line_end":5625,"severity":"medium","line_start":5625},{"id":"external_commands:assets/template.html:5677:ruby-shell-backtick-execution","file":"assets/template.html","pattern":"Ruby/shell backtick execution","snippet":"*   `@media (prefers-color-scheme)` rule so the resulting SVG","category":"external_commands","line_end":5677,"severity":"medium","line_start":5677},{"id":"external_commands:bin/archify.mjs:16:ruby-shell-backtick-execution","file":"bin/archify.mjs","pattern":"Ruby/shell backtick execution","snippet":"return `Usage:","category":"external_commands","line_end":35,"severity":"medium","line_start":16},{"id":"external_commands:bin/archify.mjs:45:ruby-shell-backtick-execution","file":"bin/archify.mjs","pattern":"Ruby/shell backtick execution","snippet":"fail(`Unknown diagram type \"${type}\". Expected one of: ${[...TYPES].join(', ')}`);","category":"external_commands","line_end":45,"severity":"medium","line_start":45},{"id":"external_commands:bin/archify.mjs:47:ruby-shell-backtick-execution","file":"bin/archify.mjs","pattern":"Ruby/shell backtick execution","snippet":"return path.join(skillRoot, 'renderers', type, `render-${type}.mjs`);","category":"external_commands","line_end":47,"severity":"medium","line_start":47},{"id":"external_commands:delta/architecture-delta.mjs:17:ruby-shell-backtick-execution","file":"delta/architecture-delta.mjs","pattern":"Ruby/shell backtick execution","snippet":"if (Array.isArray(value)) return `[${value.map(canonical).join(',')}]`;","category":"external_commands","line_end":17,"severity":"medium","line_start":17},{"id":"external_commands:delta/architecture-delta.mjs:19:ruby-shell-backtick-execution","file":"delta/architecture-delta.mjs","pattern":"Ruby/shell backtick execution","snippet":"return `{${Object.keys(value).sort(codepointOrder).map((key) => `${JSON.stringify(key)}:${canonical(","category":"external_commands","line_end":19,"severity":"medium","line_start":19},{"id":"external_commands:delta/architecture-delta.mjs:79:ruby-shell-backtick-execution","file":"delta/architecture-delta.mjs","pattern":"Ruby/shell backtick execution","snippet":"fail('delta/schema-version-mismatch', `${side} must use schema_version 1.`, { side, path: '/schema_v","category":"external_commands","line_end":79,"severity":"medium","line_start":79},{"id":"external_commands:examples/dataflow-product-analytics.html:5736:ruby-shell-backtick-execution","file":"examples/dataflow-product-analytics.html","pattern":"Ruby/shell backtick execution","snippet":"`width`/`height` to viewBox * 4 so the browser rasterizes the","category":"external_commands","line_end":5736,"severity":"medium","line_start":5736},{"id":"external_commands:examples/dataflow-product-analytics.html:5788:ruby-shell-backtick-execution","file":"examples/dataflow-product-analytics.html","pattern":"Ruby/shell backtick execution","snippet":"*   `@media (prefers-color-scheme)` rule so the resulting SVG","category":"external_commands","line_end":5788,"severity":"medium","line_start":5788},{"id":"external_commands:examples/lifecycle-agent-run.html:5685:ruby-shell-backtick-execution","file":"examples/lifecycle-agent-run.html","pattern":"Ruby/shell backtick execution","snippet":"`width`/`height` to viewBox * 4 so the browser rasterizes the","category":"external_commands","line_end":5685,"severity":"medium","line_start":5685},{"id":"external_commands:migrations/workflow-v2.mjs:278:ruby-shell-backtick-execution","file":"migrations/workflow-v2.mjs","pattern":"Ruby/shell backtick execution","snippet":"return `${JSON.stringify(workflow, null, 2)}\\n`;","category":"external_commands","line_end":278,"severity":"medium","line_start":278},{"id":"external_commands:recipes/scenarios.mjs:276:ruby-shell-backtick-execution","file":"recipes/scenarios.mjs","pattern":"Ruby/shell backtick execution","snippet":"throw new Error(`Scenario recipe ${JSON.stringify(recipe.id)} does not define a ${language} start pr","category":"external_commands","line_end":276,"severity":"medium","line_start":276},{"id":"external_commands:recipes/scenarios.mjs:281:ruby-shell-backtick-execution","file":"recipes/scenarios.mjs","pattern":"Ruby/shell backtick execution","snippet":"? `先检查这个仓库里的相关证据,然后${copy.prompt}不要编造代码无法支持的行为。`","category":"external_commands","line_end":281,"severity":"medium","line_start":281},{"id":"external_commands:recipes/scenarios.mjs:282:ruby-shell-backtick-execution","file":"recipes/scenarios.mjs","pattern":"Ruby/shell backtick execution","snippet":": `Inspect this repository for evidence, then ${copy.prompt.charAt(0).toLowerCase()}${copy.prompt.sl","category":"external_commands","line_end":282,"severity":"medium","line_start":282},{"id":"external_commands:renderers/architecture/grid.mjs:45:ruby-shell-backtick-execution","file":"renderers/architecture/grid.mjs","pattern":"Ruby/shell backtick execution","snippet":"problems.push(`Component \"${c.id}\" needs pos [x,y] or grid row/col when layout.mode is \"grid\".`);","category":"external_commands","line_end":45,"severity":"medium","line_start":45},{"id":"external_commands:renderers/architecture/grid.mjs:49:ruby-shell-backtick-execution","file":"renderers/architecture/grid.mjs","pattern":"Ruby/shell backtick execution","snippet":"problems.push(`Component \"${c.id}\" row/col must be non-negative integers.`);","category":"external_commands","line_end":49,"severity":"medium","line_start":49},{"id":"external_commands:renderers/architecture/grid.mjs:53:ruby-shell-backtick-execution","file":"renderers/architecture/grid.mjs","pattern":"Ruby/shell backtick execution","snippet":"problems.push(`Component \"${c.id}\" col ${c.col} exceeds layout.cols ${grid.cols} (valid: 0..${grid.c","category":"external_commands","line_end":53,"severity":"medium","line_start":53},{"id":"external_commands:scripts/check-render-output.mjs:67:ruby-shell-backtick-execution","file":"scripts/check-render-output.mjs","pattern":"Ruby/shell backtick execution","snippet":"addCheck('single_svg', svgMatches.length === 1, [`found ${svgMatches.length} <svg> block(s)`]);","category":"external_commands","line_end":67,"severity":"medium","line_start":67},{"id":"external_commands:scripts/check-render-output.mjs:84:ruby-shell-backtick-execution","file":"scripts/check-render-output.mjs","pattern":"Ruby/shell backtick execution","snippet":"diagonal.map(({ arrow, segmentIndex }) => `${arrow.kind} ${arrow.index} segment ${segmentIndex + 1}:","category":"external_commands","line_end":84,"severity":"medium","line_start":84},{"id":"external_commands:scripts/check-render-output.mjs:228:ruby-shell-backtick-execution","file":"scripts/check-render-output.mjs","pattern":"Ruby/shell backtick execution","snippet":"`[composition/label-route-clearance] ${qualityProfile} label \"${hit.label?.label || hit.labelRelatio","category":"external_commands","line_end":228,"severity":"medium","line_start":228},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. Choose `architecture`, `workflow`, `sequence`, `dataflow`, or `lifecycle` from the question.","category":"external_commands","line_end":19,"severity":"medium","line_start":19},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. Read one matching schema in `schemas/`, `schemas/common.schema.json`, and one matching JSON examp","category":"external_commands","line_end":20,"severity":"medium","line_start":20},{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. Artifact first: the next tool action must write the candidate. Write the candidate before inspect","category":"external_commands","line_end":21,"severity":"medium","line_start":21},{"id":"external_commands:test/adaptive-reader-layout.test.mjs:41:ruby-shell-backtick-execution","file":"test/adaptive-reader-layout.test.mjs","pattern":"Ruby/shell backtick execution","snippet":"assert.match(reader, new RegExp(`var MIN_READER_WIDTH = ${DESKTOP_READER_MIN_WIDTH}`));","category":"external_commands","line_end":41,"severity":"medium","line_start":41},{"id":"external_commands:test/animation.test.mjs:35:ruby-shell-backtick-execution","file":"test/animation.test.mjs","pattern":"Ruby/shell backtick execution","snippet":"const suffix = `${animation || 'static'}-${visualPreset || 'default'}`;","category":"external_commands","line_end":35,"severity":"medium","line_start":35},{"id":"external_commands:test/animation.test.mjs:36:ruby-shell-backtick-execution","file":"test/animation.test.mjs","pattern":"Ruby/shell backtick execution","snippet":"const input = path.join(tmp, `${mode}-${suffix}.json`);","category":"external_commands","line_end":36,"severity":"medium","line_start":36},{"id":"network:bin/preview.mjs:128:server-sent-events","file":"bin/preview.mjs","pattern":"Server-Sent Events","snippet":"var events = new EventSource('/events');","category":"network","line_end":128,"severity":"medium","line_start":128},{"id":"network:test/repository-evidence.test.mjs:64:ssh-protocol-url","file":"test/repository-evidence.test.mjs","pattern":"SSH protocol URL","snippet":"'ssh://git@github.com/example/evidence-repo.git',","category":"network","line_end":64,"severity":"medium","line_start":64},{"id":"filesystem:bin/archify.mjs:409:synchronous-file-operations","file":"bin/archify.mjs","pattern":"Synchronous file operations","snippet":"const artifact = fs.readFileSync(outputPath);","category":"filesystem","line_end":409,"severity":"medium","line_start":409},{"id":"filesystem:bin/archify.mjs:497:synchronous-file-operations","file":"bin/archify.mjs","pattern":"Synchronous file operations","snippet":"baseBuffer = fs.readFileSync(basePath);","category":"filesystem","line_end":497,"severity":"medium","line_start":497},{"id":"filesystem:bin/archify.mjs:504:synchronous-file-operations","file":"bin/archify.mjs","pattern":"Synchronous file operations","snippet":"headBuffer = fs.readFileSync(headPath);","category":"filesystem","line_end":504,"severity":"medium","line_start":504},{"id":"filesystem:renderers/shared/cli.mjs:22:synchronous-file-operations","file":"renderers/shared/cli.mjs","pattern":"Synchronous file operations","snippet":"const diagram = JSON.parse(fs.readFileSync(inputPath, 'utf8'));","category":"filesystem","line_end":22,"severity":"medium","line_start":22},{"id":"filesystem:renderers/shared/cli.mjs:28:synchronous-file-operations","file":"renderers/shared/cli.mjs","pattern":"Synchronous file operations","snippet":"const template = fs.readFileSync(path.join(skillRoot, 'assets/template.html'), 'utf8');","category":"filesystem","line_end":28,"severity":"medium","line_start":28},{"id":"filesystem:renderers/shared/cli.mjs:58:synchronous-file-operations","file":"renderers/shared/cli.mjs","pattern":"Synchronous file operations","snippet":"fs.writeFileSync(outPath, applyTemplate(template, {","category":"filesystem","line_end":58,"severity":"medium","line_start":58},{"id":"filesystem:scripts/check-render-output.mjs:23:synchronous-file-operations","file":"scripts/check-render-output.mjs","pattern":"Synchronous file operations","snippet":"html = fs.readFileSync(htmlPath, 'utf8');","category":"filesystem","line_end":23,"severity":"medium","line_start":23},{"id":"filesystem:scripts/generate-brand-marks.mjs:12:synchronous-file-operations","file":"scripts/generate-brand-marks.mjs","pattern":"Synchronous file operations","snippet":"const catalog = JSON.parse(fs.readFileSync(catalogPath, 'utf8'));","category":"filesystem","line_end":12,"severity":"medium","line_start":12},{"id":"filesystem:scripts/generate-brand-marks.mjs:13:synchronous-file-operations","file":"scripts/generate-brand-marks.mjs","pattern":"Synchronous file operations","snippet":"const simpleIconsVersion = JSON.parse(fs.readFileSync(","category":"filesystem","line_end":13,"severity":"medium","line_start":13},{"id":"filesystem:test/adaptive-reader-layout.test.mjs:18:synchronous-file-operations","file":"test/adaptive-reader-layout.test.mjs","pattern":"Synchronous file operations","snippet":"const template = fs.readFileSync(path.join(skillRoot, 'assets', 'template.html'), 'utf8');","category":"filesystem","line_end":18,"severity":"medium","line_start":18},{"id":"filesystem:test/adaptive-reader-layout.test.mjs:19:synchronous-file-operations","file":"test/adaptive-reader-layout.test.mjs","pattern":"Synchronous file operations","snippet":"const skill = fs.readFileSync(path.join(skillRoot, 'SKILL.md'), 'utf8');","category":"filesystem","line_end":19,"severity":"medium","line_start":19},{"id":"filesystem:test/animation.test.mjs:30:synchronous-file-operations","file":"test/animation.test.mjs","pattern":"Synchronous file operations","snippet":"const doc = JSON.parse(fs.readFileSync(path.join(skillRoot, 'examples', example), 'utf8'));","category":"filesystem","line_end":30,"severity":"medium","line_start":30},{"id":"filesystem:bin/archify.mjs:1863:temp-directory-access","file":"bin/archify.mjs","pattern":"Temp directory access","snippet":"const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'archify-validate-'));","category":"filesystem","line_end":1863,"severity":"medium","line_start":1863},{"id":"filesystem:bin/visual-check.mjs:298:temp-directory-access","file":"bin/visual-check.mjs","pattern":"Temp directory access","snippet":"this.profileRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'archify-visual-check-profile-'));","category":"filesystem","line_end":298,"severity":"medium","line_start":298},{"id":"filesystem:scripts/check-update.mjs:257:temp-directory-access","file":"scripts/check-update.mjs","pattern":"Temp directory access","snippet":"const trustedDirectories = [...new Set([os.homedir(), os.tmpdir()].map((directory) => (","category":"filesystem","line_end":257,"severity":"medium","line_start":257},{"id":"filesystem:test/animation.test.mjs:11:temp-directory-access","file":"test/animation.test.mjs","pattern":"Temp directory access","snippet":"const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'archify-animation-'));","category":"filesystem","line_end":11,"severity":"medium","line_start":11},{"id":"filesystem:test/architecture-delta.test.mjs:23:temp-directory-access","file":"test/architecture-delta.test.mjs","pattern":"Temp directory access","snippet":"const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'archify-delta-'));","category":"filesystem","line_end":23,"severity":"medium","line_start":23},{"id":"filesystem:test/authored-reachability.test.mjs:13:temp-directory-access","file":"test/authored-reachability.test.mjs","pattern":"Temp directory access","snippet":"const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'archify-authored-reach-'));","category":"filesystem","line_end":13,"severity":"medium","line_start":13},{"id":"network:test/webm-artifact.smoke.mjs:284:websocket-connection","file":"test/webm-artifact.smoke.mjs","pattern":"WebSocket connection","snippet":"const socket = new WebSocket(webSocketUrl);","category":"network","line_end":284,"severity":"medium","line_start":284},{"id":"blocker:bin/open-artifact.mjs:24:network-reconnaissance","file":"bin/open-artifact.mjs","pattern":"Network reconnaissance","snippet":"'Start-Process -FilePath $args[0]',","category":"blocker","line_end":24,"severity":"low","line_start":24},{"id":"blocker:renderers/shared/repository-evidence.mjs:115:network-reconnaissance","file":"renderers/shared/repository-evidence.mjs","pattern":"Network reconnaissance","snippet":"evidenceFailure('repository-evidence/root-required', 'This diagram declares source evidence. Pass --","category":"blocker","line_end":115,"severity":"low","line_start":115},{"id":"blocker:renderers/shared/repository-evidence.mjs:117:network-reconnaissance","file":"renderers/shared/repository-evidence.mjs","pattern":"Network reconnaissance","snippet":"supportedFixes: ['pass --repo-root with the matching local Git checkout'],","category":"blocker","line_end":117,"severity":"low","line_start":117},{"id":"blocker:renderers/shared/repository-evidence.mjs:137:network-reconnaissance","file":"renderers/shared/repository-evidence.mjs","pattern":"Network reconnaissance","snippet":"supportedFixes: [`pass --repo-root ${gitRoot}`],","category":"blocker","line_end":137,"severity":"low","line_start":137},{"id":"blocker:test/open-artifact.test.mjs:30:network-reconnaissance","file":"test/open-artifact.test.mjs","pattern":"Network reconnaissance","snippet":"'Start-Process -FilePath $args[0]',","category":"blocker","line_end":30,"severity":"low","line_start":30},{"id":"blocker:test/real-repository-proof.test.mjs:187:network-reconnaissance","file":"test/real-repository-proof.test.mjs","pattern":"Network reconnaissance","snippet":"assert.match(JSON.parse(result.stdout).error, /Pass --repo-root/);","category":"blocker","line_end":187,"severity":"low","line_start":187},{"id":"blocker:test/repair-receipt.test.mjs:146:network-reconnaissance","file":"test/repair-receipt.test.mjs","pattern":"Network reconnaissance","snippet":"assert.deepEqual(repair.supportedFixes, ['pass --repo-root with the matching local Git checkout']);","category":"blocker","line_end":146,"severity":"low","line_start":146},{"id":"blocker:assets/template.html:5403:object-assign-review-for-prototype-pollution","file":"assets/template.html","pattern":"Object.assign (review for prototype pollution)","snippet":"var payload = Object.assign({}, values || {}, { count: count });","category":"blocker","line_end":5403,"severity":"low","line_start":5403},{"id":"blocker:examples/dataflow-product-analytics.html:5514:object-assign-review-for-prototype-pollution","file":"examples/dataflow-product-analytics.html","pattern":"Object.assign (review for prototype pollution)","snippet":"var payload = Object.assign({}, values || {}, { count: count });","category":"blocker","line_end":5514,"severity":"low","line_start":5514},{"id":"blocker:examples/lifecycle-agent-run.html:5463:object-assign-review-for-prototype-pollution","file":"examples/lifecycle-agent-run.html","pattern":"Object.assign (review for prototype pollution)","snippet":"var payload = Object.assign({}, values || {}, { count: count });","category":"blocker","line_end":5463,"severity":"low","line_start":5463},{"id":"blocker:examples/sequence-cache-miss-request.html:5529:object-assign-review-for-prototype-pollution","file":"examples/sequence-cache-miss-request.html","pattern":"Object.assign (review for prototype pollution)","snippet":"var payload = Object.assign({}, values || {}, { count: count });","category":"blocker","line_end":5529,"severity":"low","line_start":5529},{"id":"blocker:assets/template.html:202:system-reconnaissance","file":"assets/template.html","pattern":"System reconnaissance","snippet":"precise grid contrast, squared materials, and drafting marks.","category":"blocker","line_end":202,"severity":"low","line_start":202},{"id":"blocker:assets/template.html:435:system-reconnaissance","file":"assets/template.html","pattern":"System reconnaissance","snippet":"border: 1px solid color-mix(in srgb, var(--frontend-stroke) 42%, var(--toolbar-border));","category":"blocker","line_end":435,"severity":"low","line_start":435},{"id":"blocker:assets/template.html:473:system-reconnaissance","file":"assets/template.html","pattern":"System reconnaissance","snippet":"border-right: 1px solid var(--toolbar-border);","category":"blocker","line_end":473,"severity":"low","line_start":473},{"id":"blocker:bin/archify.mjs:1291:system-reconnaissance","file":"bin/archify.mjs","pattern":"System reconnaissance","snippet":"let validatorsValid = false;","category":"blocker","line_end":1291,"severity":"low","line_start":1291},{"id":"blocker:bin/archify.mjs:1295:system-reconnaissance","file":"bin/archify.mjs","pattern":"System reconnaissance","snippet":"validatorsValid = [...TYPES].every((type) => typeof module[type] === 'function');","category":"blocker","line_end":1295,"severity":"low","line_start":1295},{"id":"blocker:bin/archify.mjs:1297:system-reconnaissance","file":"bin/archify.mjs","pattern":"System reconnaissance","snippet":"validatorsValid = false;","category":"blocker","line_end":1297,"severity":"low","line_start":1297},{"id":"blocker:delta/architecture-delta.mjs:64:system-reconnaissance","file":"delta/architecture-delta.mjs","pattern":"System reconnaissance","snippet":"connections: sortedBy(diagram.connections || [], (connection) => connection.id || ''),","category":"blocker","line_end":64,"severity":"low","line_start":64},{"id":"blocker:delta/architecture-delta.mjs:99:system-reconnaissance","file":"delta/architecture-delta.mjs","pattern":"System reconnaissance","snippet":"supportedFixes: [`add a unique id to every ${collection} item`],","category":"blocker","line_end":99,"severity":"low","line_start":99},{"id":"blocker:delta/architecture-delta.mjs:107:system-reconnaissance","file":"delta/architecture-delta.mjs","pattern":"System reconnaissance","snippet":"supportedFixes: [`make every ${collection} id unique`],","category":"blocker","line_end":107,"severity":"low","line_start":107},{"id":"blocker:examples/async-job-roundtrip.sequence.json:57:system-reconnaissance","file":"examples/async-job-roundtrip.sequence.json","pattern":"System reconnaissance","snippet":"{ \"dot\": \"cyan\", \"title\": \"Fast Acknowledgement\", \"items\": [\"The caller receives a durable job id be","category":"blocker","line_end":57,"severity":"low","line_start":57},{"id":"blocker:examples/dataflow-product-analytics.html:202:system-reconnaissance","file":"examples/dataflow-product-analytics.html","pattern":"System reconnaissance","snippet":"precise grid contrast, squared materials, and drafting marks.","category":"blocker","line_end":202,"severity":"low","line_start":202},{"id":"blocker:examples/dataflow-product-analytics.html:435:system-reconnaissance","file":"examples/dataflow-product-analytics.html","pattern":"System reconnaissance","snippet":"border: 1px solid color-mix(in srgb, var(--frontend-stroke) 42%, var(--toolbar-border));","category":"blocker","line_end":435,"severity":"low","line_start":435},{"id":"blocker:migrations/workflow-v2.mjs:190:system-reconnaissance","file":"migrations/workflow-v2.mjs","pattern":"System reconnaissance","snippet":"// Old absolute pins can be invalid at the new rank centers before their X","category":"blocker","line_end":190,"severity":"low","line_start":190},{"id":"blocker:recipes/scenarios.mjs:309:system-reconnaissance","file":"recipes/scenarios.mjs","pattern":"System reconnaissance","snippet":"if (text === recipe.id || text === recipe.id.replace(/-/g, ' ')) {","category":"blocker","line_end":309,"severity":"low","line_start":309},{"id":"blocker:recipes/scenarios.mjs:337:system-reconnaissance","file":"recipes/scenarios.mjs","pattern":"System reconnaissance","snippet":"alternatives: ranked.filter((entry) => entry.recipe.id !== winner.recipe.id && entry.score > 0)","category":"blocker","line_end":337,"severity":"low","line_start":337},{"id":"blocker:recipes/scenarios.mjs:363:system-reconnaissance","file":"recipes/scenarios.mjs","pattern":"System reconnaissance","snippet":"heading: 'Recommendation', question: 'Question answered', use: 'Use when', avoid: 'Avoid when', incl","category":"blocker","line_end":363,"severity":"low","line_start":363},{"id":"blocker:references/authoring-contract.md:52:system-reconnaissance","file":"references/authoring-contract.md","pattern":"System reconnaissance","snippet":"remain valid and default to English.","category":"blocker","line_end":52,"severity":"low","line_start":52},{"id":"blocker:references/authoring-contract.md:140:system-reconnaissance","file":"references/authoring-contract.md","pattern":"System reconnaissance","snippet":"1. Fix missing/invalid `meta.quality_profile` and schema errors.","category":"blocker","line_end":140,"severity":"low","line_start":140},{"id":"blocker:references/authoring-contract.md:154:system-reconnaissance","file":"references/authoring-contract.md","pattern":"System reconnaissance","snippet":"Grid placement is preferred when the schema supports it. Free positions are appropriate for a bounde","category":"blocker","line_end":154,"severity":"low","line_start":154},{"id":"blocker:renderers/architecture/grid.mjs:1:system-reconnaissance","file":"renderers/architecture/grid.mjs","pattern":"System reconnaissance","snippet":"/** Grid placement for architecture IR (#8). Not auto-layout — fixed cell math only. */","category":"blocker","line_end":1,"severity":"low","line_start":1},{"id":"blocker:renderers/architecture/grid.mjs:45:system-reconnaissance","file":"renderers/architecture/grid.mjs","pattern":"System reconnaissance","snippet":"problems.push(`Component \"${c.id}\" needs pos [x,y] or grid row/col when layout.mode is \"grid\".`);","category":"blocker","line_end":45,"severity":"low","line_start":45},{"id":"blocker:renderers/architecture/grid.mjs:57:system-reconnaissance","file":"renderers/architecture/grid.mjs","pattern":"System reconnaissance","snippet":"problems.push(`Components \"${seen.get(key)}\" and \"${c.id}\" share grid cell row ${c.row} col ${c.col}","category":"blocker","line_end":57,"severity":"low","line_start":57},{"id":"blocker:schemas/README.md:67:system-reconnaissance","file":"schemas/README.md","pattern":"System reconnaissance","snippet":"instead of turning a previously valid schema-v1 document into a hard failure.","category":"blocker","line_end":67,"severity":"low","line_start":67},{"id":"blocker:schemas/README.md:97:system-reconnaissance","file":"schemas/README.md","pattern":"System reconnaissance","snippet":"reordering. ID-less documents remain valid and their relationship pins stay","category":"blocker","line_end":97,"severity":"low","line_start":97},{"id":"blocker:scripts/check-render-output.mjs:338:system-reconnaissance","file":"scripts/check-render-output.mjs","pattern":"System reconnaissance","snippet":"&& (!groupAttrs['data-edge-id'] || !arrow.id || arrow.id === groupAttrs['data-edge-id'])","category":"blocker","line_end":338,"severity":"low","line_start":338},{"id":"blocker:scripts/check-render-output.mjs:343:system-reconnaissance","file":"scripts/check-render-output.mjs","pattern":"System reconnaissance","snippet":"arrow.id === groupAttrs['data-edge-id']","category":"blocker","line_end":343,"severity":"low","line_start":343},{"id":"blocker:SKILL.md:3:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"description: Create polished, validated architecture, workflow, sequence, data-flow, and lifecycle/s","category":"blocker","line_end":3,"severity":"low","line_start":3},{"id":"blocker:SKILL.md:67:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"## Mermaid input","category":"blocker","line_end":67,"severity":"low","line_start":67},{"id":"blocker:test/adaptive-reader-layout.test.mjs:45:system-reconnaissance","file":"test/adaptive-reader-layout.test.mjs","pattern":"System reconnaissance","snippet":"assert.match(template, /\\.diagram-container \\{[\\s\\S]*?border: 1px solid var\\(--panel-border\\)/);","category":"blocker","line_end":45,"severity":"low","line_start":45},{"id":"blocker:test/architecture-delta.test.mjs:48:system-reconnaissance","file":"test/architecture-delta.test.mjs","pattern":"System reconnaissance","snippet":"const checkout = receipt.changes.components.find((change) => change.id === 'checkout');","category":"blocker","line_end":48,"severity":"low","line_start":48},{"id":"obfuscation:bin/visual-check.mjs:561:array-join-empty-string","file":"bin/visual-check.mjs","pattern":"Array join empty string","snippet":"</figure>`).join('');","category":"obfuscation","line_end":561,"severity":"low","line_start":561},{"id":"obfuscation:delta/architecture-delta.mjs:417:array-join-empty-string","file":"delta/architecture-delta.mjs","pattern":"Array join empty string","snippet":"return parts.join('');","category":"obfuscation","line_end":417,"severity":"low","line_start":417},{"id":"obfuscation:delta/architecture-delta.mjs:446:array-join-empty-string","file":"delta/architecture-delta.mjs","pattern":"Array join empty string","snippet":"return parts.join('');","category":"obfuscation","line_end":446,"severity":"low","line_start":446},{"id":"obfuscation:renderers/shared/cli.mjs:193:array-join-empty-string","file":"renderers/shared/cli.mjs","pattern":"Array join empty string","snippet":".join('');","category":"obfuscation","line_end":193,"severity":"low","line_start":193},{"id":"obfuscation:test/brand-marks.test.mjs:577:array-join-empty-string","file":"test/brand-marks.test.mjs","pattern":"Array join empty string","snippet":").join('')}`);","category":"obfuscation","line_end":577,"severity":"low","line_start":577},{"id":"obfuscation:test/webm-artifact.smoke.mjs:856:array-join-empty-string","file":"test/webm-artifact.smoke.mjs","pattern":"Array join empty string","snippet":"signature: Array.from(bytes.slice(0, 8)).map(function (byte) { return byte.toString(16).padStart(2, ","category":"obfuscation","line_end":856,"severity":"low","line_start":856},{"id":"obfuscation:test/webm-artifact.smoke.mjs:882:base64-encode","file":"test/webm-artifact.smoke.mjs","pattern":"Base64 encode","snippet":"return { ok: true, type: blob.type, size: blob.size, base64: btoa(binary) };","category":"obfuscation","line_end":882,"severity":"low","line_start":882},{"id":"obfuscation:test/webm-artifact.smoke.mjs:950:base64-encode","file":"test/webm-artifact.smoke.mjs","pattern":"Base64 encode","snippet":"base64: btoa(binary),","category":"obfuscation","line_end":950,"severity":"low","line_start":950},{"id":"obfuscation:renderers/shared/utils.mjs:201:unicode-code-point-escape","file":"renderers/shared/utils.mjs","pattern":"Unicode code point escape","snippet":"const FULLWIDTH_RE = /[\\u1100-\\u115F\\u231A-\\u231B\\u2329-\\u232A\\u23E9-\\u23EC\\u23F0\\u23F3\\u25FD-\\u25FE","category":"obfuscation","line_end":201,"severity":"low","line_start":201},{"id":"obfuscation:assets/template.html:6277:unicode-escape-sequence","file":"assets/template.html","pattern":"Unicode escape sequence","snippet":"var suffix = '\\u2026';","category":"obfuscation","line_end":6277,"severity":"low","line_start":6277},{"id":"obfuscation:assets/template.html:7471:unicode-escape-sequence","file":"assets/template.html","pattern":"Unicode escape sequence","snippet":"var key = edge.getAttribute('data-edge-key') || (from + '\\u0000' + to + '\\u0000' + (edge.getAttribut","category":"obfuscation","line_end":7471,"severity":"low","line_start":7471},{"id":"obfuscation:bin/preview.mjs:159:unicode-escape-sequence","file":"bin/preview.mjs","pattern":"Unicode escape sequence","snippet":"return JSON.stringify(value).replace(/</g, '\\\\u003c');","category":"obfuscation","line_end":159,"severity":"low","line_start":159},{"id":"obfuscation:delta/architecture-delta.mjs:113:unicode-escape-sequence","file":"delta/architecture-delta.mjs","pattern":"Unicode escape sequence","snippet":"const boundaryKey = (boundary) => `${boundary.kind}\\u001f${boundary.label}`;","category":"obfuscation","line_end":113,"severity":"low","line_start":113},{"id":"obfuscation:delta/architecture-delta.mjs:324:unicode-escape-sequence","file":"delta/architecture-delta.mjs","pattern":"Unicode escape sequence","snippet":"const safeJson = (value) => JSON.stringify(value, null, 2).replaceAll('<', '\\\\u003c').replaceAll('>'","category":"obfuscation","line_end":324,"severity":"low","line_start":324},{"id":"obfuscation:examples/dataflow-product-analytics.html:4964:unicode-escape-sequence","file":"examples/dataflow-product-analytics.html","pattern":"Unicode escape sequence","snippet":"<script id=\"archify-i18n-data\" type=\"application/json\">{\"locale\":\"en\",\"messages\":{\"viewer.kind.front","category":"obfuscation","line_end":4964,"severity":"low","line_start":4964},{"id":"obfuscation:examples/dataflow-product-analytics.html:6388:unicode-escape-sequence","file":"examples/dataflow-product-analytics.html","pattern":"Unicode escape sequence","snippet":"var suffix = '\\u2026';","category":"obfuscation","line_end":6388,"severity":"low","line_start":6388},{"id":"obfuscation:recipes/scenarios.mjs:268:unicode-escape-sequence","file":"recipes/scenarios.mjs","pattern":"Unicode escape sequence","snippet":"return /[\\u3400-\\u9fff]/u.test(value) ? 'zh' : 'en';","category":"obfuscation","line_end":268,"severity":"low","line_start":268},{"id":"obfuscation:renderers/shared/geometry.mjs:172:unicode-escape-sequence","file":"renderers/shared/geometry.mjs","pattern":"Unicode escape sequence","snippet":"if (relation?.id) return `id:${relation.from || ''}\\u0000${relation.to || ''}\\u0000${relation.id}`;","category":"obfuscation","line_end":172,"severity":"low","line_start":172},{"id":"obfuscation:renderers/shared/geometry.mjs:1219:unicode-escape-sequence","file":"renderers/shared/geometry.mjs","pattern":"Unicode escape sequence","snippet":"const key = `${rect.id}\\u0000${side}`;","category":"obfuscation","line_end":1219,"severity":"low","line_start":1219},{"id":"obfuscation:scripts/update-contract.mjs:5:unicode-escape-sequence","file":"scripts/update-contract.mjs","pattern":"Unicode escape sequence","snippet":"const CONTROL_OR_BIDI = /[\\u0000-\\u001f\\u007f-\\u009f\\u202a-\\u202e\\u2066-\\u2069]/u;","category":"obfuscation","line_end":5,"severity":"low","line_start":5},{"id":"obfuscation:test/chapter-delta-preview.test.mjs:77:unicode-escape-sequence","file":"test/chapter-delta-preview.test.mjs","pattern":"Unicode escape sequence","snippet":"assert.match(html, /var compact = '=' \\+ delta\\.stay\\.length \\+ ' \\+' \\+ delta\\.enter\\.length \\+ ' \\","category":"obfuscation","line_end":77,"severity":"low","line_start":77},{"id":"obfuscation:test/finder.test.mjs:56:unicode-escape-sequence","file":"test/finder.test.mjs","pattern":"Unicode escape sequence","snippet":"assert.match(html, /var key = from \\+ '\\\\u0000' \\+ to/);","category":"obfuscation","line_end":56,"severity":"low","line_start":56},{"id":"obfuscation:test/golden.mjs:67:url-decode","file":"test/golden.mjs","pattern":"URL decode","snippet":"try { messages.push(decodeURIComponent(message)); } catch { messages.push(message); }","category":"obfuscation","line_end":67,"severity":"low","line_start":67},{"id":"obfuscation:test/site-language-continuity.test.mjs:96:url-decode","file":"test/site-language-continuity.test.mjs","pattern":"URL decode","snippet":"const relative = decodeURIComponent(requestUrl.pathname).replace(/^\\/+/, '') || 'index.html';","category":"obfuscation","line_end":96,"severity":"low","line_start":96},{"id":"env_access:renderers/shared/brand-marks.mjs:124:environment-variable-access-dot-notation","file":"renderers/shared/brand-marks.mjs","pattern":"Environment variable access (dot notation)","snippet":"function validateUrlShape(url, allowPrivate = process.env.ARCHIFY_BRAND_ALLOW_PRIVATE === '1') {","category":"env_access","line_end":124,"severity":"low","line_start":124},{"id":"env_access:renderers/shared/brand-marks.mjs:152:environment-variable-access-dot-notation","file":"renderers/shared/brand-marks.mjs","pattern":"Environment variable access (dot notation)","snippet":"const allowPrivate = process.env.ARCHIFY_BRAND_ALLOW_PRIVATE === '1';","category":"env_access","line_end":152,"severity":"low","line_start":152},{"id":"env_access:scripts/check-update.mjs:1393:environment-variable-access-dot-notation","file":"scripts/check-update.mjs","pattern":"Environment variable access (dot notation)","snippet":"const localData = process.env.LOCALAPPDATA;","category":"env_access","line_end":1393,"severity":"low","line_start":1393},{"id":"env_access:scripts/check-update.mjs:1397:environment-variable-access-dot-notation","file":"scripts/check-update.mjs","pattern":"Environment variable access (dot notation)","snippet":"const xdgCache = process.env.XDG_CACHE_HOME;","category":"env_access","line_end":1397,"severity":"low","line_start":1397},{"id":"env_access:test/brand-marks.test.mjs:356:environment-variable-access-dot-notation","file":"test/brand-marks.test.mjs","pattern":"Environment variable access (dot notation)","snippet":"const priorAllowPrivate = process.env.ARCHIFY_BRAND_ALLOW_PRIVATE;","category":"env_access","line_end":356,"severity":"low","line_start":356},{"id":"env_access:test/brand-marks.test.mjs:357:environment-variable-access-dot-notation","file":"test/brand-marks.test.mjs","pattern":"Environment variable access (dot notation)","snippet":"process.env.ARCHIFY_BRAND_ALLOW_PRIVATE = '1';","category":"env_access","line_end":357,"severity":"low","line_start":357},{"id":"env_access:bin/archify.mjs:55:environment-variable-object","file":"bin/archify.mjs","pattern":"Environment variable object","snippet":"env: options.env ? { ...process.env, ...options.env } : process.env,","category":"env_access","line_end":55,"severity":"low","line_start":55},{"id":"env_access:bin/preview.mjs:516:environment-variable-object","file":"bin/preview.mjs","pattern":"Environment variable object","snippet":"env: process.env,","category":"env_access","line_end":516,"severity":"low","line_start":516},{"id":"env_access:renderers/shared/brand-marks.mjs:124:environment-variable-object","file":"renderers/shared/brand-marks.mjs","pattern":"Environment variable object","snippet":"function validateUrlShape(url, allowPrivate = process.env.ARCHIFY_BRAND_ALLOW_PRIVATE === '1') {","category":"env_access","line_end":124,"severity":"low","line_start":124},{"id":"env_access:renderers/shared/brand-marks.mjs:152:environment-variable-object","file":"renderers/shared/brand-marks.mjs","pattern":"Environment variable object","snippet":"const allowPrivate = process.env.ARCHIFY_BRAND_ALLOW_PRIVATE === '1';","category":"env_access","line_end":152,"severity":"low","line_start":152},{"id":"env_access:scripts/check-update.mjs:1393:environment-variable-object","file":"scripts/check-update.mjs","pattern":"Environment variable object","snippet":"const localData = process.env.LOCALAPPDATA;","category":"env_access","line_end":1393,"severity":"low","line_start":1393},{"id":"env_access:scripts/check-update.mjs:1397:environment-variable-object","file":"scripts/check-update.mjs","pattern":"Environment variable object","snippet":"const xdgCache = process.env.XDG_CACHE_HOME;","category":"env_access","line_end":1397,"severity":"low","line_start":1397},{"id":"env_access:test/brand-marks.test.mjs:44:environment-variable-object","file":"test/brand-marks.test.mjs","pattern":"Environment variable object","snippet":"env: { ...process.env, ...env },","category":"env_access","line_end":44,"severity":"low","line_start":44},{"id":"env_access:test/brand-marks.test.mjs:58:environment-variable-object","file":"test/brand-marks.test.mjs","pattern":"Environment variable object","snippet":"env: { ...process.env, ...env },","category":"env_access","line_end":58,"severity":"low","line_start":58},{"id":"network:test/cli.test.mjs:482:fetch-api-call","file":"test/cli.test.mjs","pattern":"Fetch API call","snippet":"state = await fetch(new URL('/state', previewUrl)).then((response) => response.json());","category":"network","line_end":482,"severity":"low","line_start":482},{"id":"network:test/cli.test.mjs:494:fetch-api-call","file":"test/cli.test.mjs","pattern":"Fetch API call","snippet":"await assert.rejects(fetch(previewUrl));","category":"network","line_end":494,"severity":"low","line_start":494},{"id":"network:assets/template.html:36:hardcoded-url","file":"assets/template.html","pattern":"Hardcoded URL","snippet":"<link rel=\"preconnect\" href=\"https://fonts.gstatic.com\" crossorigin>","category":"network","line_end":36,"severity":"low","line_start":36},{"id":"network:assets/template.html:37:hardcoded-url","file":"assets/template.html","pattern":"Hardcoded URL","snippet":"<link href=\"https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400;500;600;700&display=swa","category":"network","line_end":37,"severity":"low","line_start":37},{"id":"network:bin/open-artifact.mjs:80:hardcoded-url","file":"bin/open-artifact.mjs","pattern":"Hardcoded URL","snippet":"throw new TypeError('Preview URL must be a loopback URL using http://127.0.0.1:<port>.');","category":"network","line_end":80,"severity":"low","line_start":80},{"id":"network:bin/preview.mjs:266:hardcoded-url","file":"bin/preview.mjs","pattern":"Hardcoded URL","snippet":"url = new URL(req.url, `http://${expectedHost}`);","category":"network","line_end":266,"severity":"low","line_start":266},{"id":"network:brand-marks/catalog.json:14:hardcoded-url","file":"brand-marks/catalog.json","pattern":"Hardcoded URL","snippet":"\"source\": \"https://openai.com/brand/\",","category":"network","line_end":14,"severity":"low","line_start":14},{"id":"network:brand-marks/catalog.json:15:hardcoded-url","file":"brand-marks/catalog.json","pattern":"Hardcoded URL","snippet":"\"guidelines\": \"https://openai.com/brand/\"","category":"network","line_end":15,"severity":"low","line_start":15},{"id":"network:examples/dataflow-product-analytics.html:36:hardcoded-url","file":"examples/dataflow-product-analytics.html","pattern":"Hardcoded URL","snippet":"<link rel=\"preconnect\" href=\"https://fonts.gstatic.com\" crossorigin>","category":"network","line_end":36,"severity":"low","line_start":36},{"id":"network:examples/dataflow-product-analytics.html:37:hardcoded-url","file":"examples/dataflow-product-analytics.html","pattern":"Hardcoded URL","snippet":"<link href=\"https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400;500;600;700&display=swa","category":"network","line_end":37,"severity":"low","line_start":37},{"id":"network:package-lock.json:26:hardcoded-url","file":"package-lock.json","pattern":"Hardcoded URL","snippet":"\"resolved\": \"https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz\",","category":"network","line_end":26,"severity":"low","line_start":26},{"id":"network:package-lock.json:38:hardcoded-url","file":"package-lock.json","pattern":"Hardcoded URL","snippet":"\"url\": \"https://github.com/sponsors/epoberezkin\"","category":"network","line_end":38,"severity":"low","line_start":38},{"id":"network:references/brand-marks.md:30:hardcoded-url","file":"references/brand-marks.md","pattern":"Hardcoded URL","snippet":"node bin/archify.mjs brands capture \"https://partner.example.com\" --json","category":"network","line_end":30,"severity":"low","line_start":30},{"id":"network:references/brand-marks.md:41:hardcoded-url","file":"references/brand-marks.md","pattern":"Hardcoded URL","snippet":"\"url\": \"https://partner.example.com\",","category":"network","line_end":41,"severity":"low","line_start":41},{"id":"network:renderers/shared/generated-brand-marks.mjs:18:hardcoded-url","file":"renderers/shared/generated-brand-marks.mjs","pattern":"Hardcoded URL","snippet":"\"source\": \"https://airtable.com/newsroom\"","category":"network","line_end":18,"severity":"low","line_start":18},{"id":"network:renderers/shared/generated-brand-marks.mjs:38:hardcoded-url","file":"renderers/shared/generated-brand-marks.mjs","pattern":"Hardcoded URL","snippet":"\"source\": \"https://www.alibabagroup.com/en/ir/reports\"","category":"network","line_end":38,"severity":"low","line_start":38},{"id":"network:schemas/architecture.schema.json:2:hardcoded-url","file":"schemas/architecture.schema.json","pattern":"Hardcoded URL","snippet":"\"$schema\": \"https://json-schema.org/draft/2020-12/schema\",","category":"network","line_end":2,"severity":"low","line_start":2},{"id":"network:schemas/architecture.schema.json:3:hardcoded-url","file":"schemas/architecture.schema.json","pattern":"Hardcoded URL","snippet":"\"$id\": \"https://github.com/tt-a1i/archify/schemas/architecture.schema.json\",","category":"network","line_end":3,"severity":"low","line_start":3},{"id":"network:scripts/update-contract.mjs:2:hardcoded-url","file":"scripts/update-contract.mjs","pattern":"Hardcoded URL","snippet":"export const EXPECTED_REPOSITORY = 'https://github.com/tt-a1i/archify';","category":"network","line_end":2,"severity":"low","line_start":2},{"id":"network:scripts/update-contract.mjs:3:hardcoded-url","file":"scripts/update-contract.mjs","pattern":"Hardcoded URL","snippet":"export const DEFAULT_MANIFEST_URL = 'https://tt-a1i.github.io/archify/skill-updates/archify/stable.j","category":"network","line_end":3,"severity":"low","line_start":3},{"id":"network:skill-release.json:7:hardcoded-url","file":"skill-release.json","pattern":"Hardcoded URL","snippet":"\"repository\": \"https://github.com/tt-a1i/archify\"","category":"network","line_end":7,"severity":"low","line_start":7},{"id":"network:skill-release.json:9:hardcoded-url","file":"skill-release.json","pattern":"Hardcoded URL","snippet":"\"updateManifestUrl\": \"https://tt-a1i.github.io/archify/skill-updates/archify/stable.json\"","category":"network","line_end":9,"severity":"low","line_start":9},{"id":"network:test/architecture-delta.test.mjs:257:hardcoded-url","file":"test/architecture-delta.test.mjs","pattern":"Hardcoded URL","snippet":"base.meta.repository = { url: 'https://github.com/example/one', revision: 'a'.repeat(40) };","category":"network","line_end":257,"severity":"low","line_start":257},{"id":"network:test/architecture-delta.test.mjs:258:hardcoded-url","file":"test/architecture-delta.test.mjs","pattern":"Hardcoded URL","snippet":"head.meta.repository = { url: 'https://github.com/example/two', revision: 'b'.repeat(40) };","category":"network","line_end":258,"severity":"low","line_start":258},{"id":"network:renderers/shared/brand-marks.mjs:181:http-client-library","file":"renderers/shared/brand-marks.mjs","pattern":"HTTP client library","snippet":"const request = transport.request(url, {","category":"network","line_end":181,"severity":"low","line_start":181},{"id":"network:test/preview.test.mjs:40:http-client-library","file":"test/preview.test.mjs","pattern":"HTTP client library","snippet":"const request = http.request({","category":"network","line_end":40,"severity":"low","line_start":40},{"id":"network:test/preview.test.mjs:40:http-https-request","file":"test/preview.test.mjs","pattern":"HTTP/HTTPS request","snippet":"const request = http.request({","category":"network","line_end":40,"severity":"low","line_start":40},{"id":"filesystem:bin/archify.mjs:325:node-js-fs-stat-operations","file":"bin/archify.mjs","pattern":"Node.js fs stat operations","snippet":"if (!fs.existsSync(item.target)) continue;","category":"filesystem","line_end":325,"severity":"low","line_start":325},{"id":"filesystem:bin/archify.mjs:326:node-js-fs-stat-operations","file":"bin/archify.mjs","pattern":"Node.js fs stat operations","snippet":"const existing = fs.lstatSync(item.target);","category":"filesystem","line_end":326,"severity":"low","line_start":326},{"id":"filesystem:renderers/shared/output-path.mjs:25:node-js-fs-stat-operations","file":"renderers/shared/output-path.mjs","pattern":"Node.js fs stat operations","snippet":"stat = fs.lstatSync(candidate);","category":"filesystem","line_end":25,"severity":"low","line_start":25},{"id":"filesystem:renderers/shared/output-path.mjs:45:node-js-fs-stat-operations","file":"renderers/shared/output-path.mjs","pattern":"Node.js fs stat operations","snippet":"current = fs.realpathSync.native(candidate);","category":"filesystem","line_end":45,"severity":"low","line_start":45},{"id":"filesystem:scripts/check-update.mjs:214:node-js-fs-stat-operations","file":"scripts/check-update.mjs","pattern":"Node.js fs stat operations","snippet":"const pathMetadata = await fs.lstat(target, { bigint: true });","category":"filesystem","line_end":214,"severity":"low","line_start":214},{"id":"filesystem:scripts/check-update.mjs:225:node-js-fs-stat-operations","file":"scripts/check-update.mjs","pattern":"Node.js fs stat operations","snippet":"const currentPathMetadata = await fs.lstat(target, { bigint: true });","category":"filesystem","line_end":225,"severity":"low","line_start":225},{"id":"filesystem:test/architecture-delta.test.mjs:477:node-js-fs-stat-operations","file":"test/architecture-delta.test.mjs","pattern":"Node.js fs stat operations","snippet":"assert.equal(fs.existsSync(path.join(tmp, 'preserved.receipt.json')), false);","category":"filesystem","line_end":477,"severity":"low","line_start":477},{"id":"filesystem:test/architecture-delta.test.mjs:489:node-js-fs-stat-operations","file":"test/architecture-delta.test.mjs","pattern":"Node.js fs stat operations","snippet":"assert.equal(fs.existsSync(output), false);","category":"filesystem","line_end":489,"severity":"low","line_start":489},{"id":"filesystem:bin/archify.mjs:1831:standard-device-file-access","file":"bin/archify.mjs","pattern":"Standard device file access","snippet":"const result = runNode([renderer, input, '/dev/null', '--layout-json'], {","category":"filesystem","line_end":1831,"severity":"low","line_start":1831},{"id":"filesystem:bin/archify.mjs:525:temp-file-creation","file":"bin/archify.mjs","pattern":"Temp file creation","snippet":"stagingDirectory = fs.mkdtempSync(path.join(outputDirectory, '.archify-compare-'));","category":"filesystem","line_end":525,"severity":"low","line_start":525},{"id":"filesystem:bin/archify.mjs:843:temp-file-creation","file":"bin/archify.mjs","pattern":"Temp file creation","snippet":"stagingDirectory = fs.mkdtempSync(path.join(outputDirectory, '.archify-delivery-'));","category":"filesystem","line_end":843,"severity":"low","line_start":843},{"id":"filesystem:test/animation.test.mjs:11:temp-file-creation","file":"test/animation.test.mjs","pattern":"Temp file creation","snippet":"const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'archify-animation-'));","category":"filesystem","line_end":11,"severity":"low","line_start":11},{"id":"filesystem:test/architecture-delta.test.mjs:23:temp-file-creation","file":"test/architecture-delta.test.mjs","pattern":"Temp file creation","snippet":"const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'archify-delta-'));","category":"filesystem","line_end":23,"severity":"low","line_start":23},{"id":"network:test/start-page.test.mjs:169:xmlhttprequest","file":"test/start-page.test.mjs","pattern":"XMLHttpRequest","snippet":"assert.doesNotMatch(scriptMatch[1], /fetch\\(|sendBeacon\\(|XMLHttpRequest/);","category":"network","line_end":169,"severity":"low","line_start":169}],"finding_verdicts":[{"id":"blocker:test/preview.test.mjs:160:system-password-file-access","reason":"This is a traversal-regression test that requests /../../etc/passwd and asserts a 404 response. It verifies denial rather than reading the password file.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:multiple:1:heuristic-dangerous-combination-code-execution-n","reason":"This repository-wide heuristic combines unrelated diagram tooling, bounded network features, tests, and local process execution. No credential collection or exfiltration flow is present.","verdict":"false_positive","confidence":0.96},{"id":"network:test/brand-marks.test.mjs:386:aws-azure-metadata-endpoint","reason":"The metadata address is a test vector for the brand-capture SSRF filter. Production code rejects link-local and other private addresses before connecting.","verdict":"false_positive","confidence":0.96},{"id":"blocker:bin/visual-check.mjs:63:screen-capture-upload","reason":"visual-check captures local browser screenshots and writes them to caller-selected sidecar files. The cited code contains no upload or outbound transfer.","verdict":"false_positive","confidence":0.96},{"id":"blocker:bin/visual-check.mjs:470:screen-capture-upload","reason":"visual-check captures local browser screenshots and writes them to caller-selected sidecar files. The cited code contains no upload or outbound transfer.","verdict":"false_positive","confidence":0.96},{"id":"blocker:bin/visual-check.mjs:802:screen-capture-upload","reason":"visual-check captures local browser screenshots and writes them to caller-selected sidecar files. The cited code contains no upload or outbound transfer.","verdict":"false_positive","confidence":0.96},{"id":"sensitive:test/motion-governor.test.mjs:64:browser-storage-access","reason":"The test verifies localStorage persistence for viewer motion or language preferences. It does not read credentials or transmit stored values.","verdict":"false_positive","confidence":0.96},{"id":"sensitive:test/motion-governor.test.mjs:65:browser-storage-access","reason":"The test verifies localStorage persistence for viewer motion or language preferences. It does not read credentials or transmit stored values.","verdict":"false_positive","confidence":0.96},{"id":"sensitive:test/site-language-continuity.test.mjs:293:browser-storage-access","reason":"The test verifies localStorage persistence for viewer motion or language preferences. It does not read credentials or transmit stored values.","verdict":"false_positive","confidence":0.96},{"id":"sensitive:assets/template.html:5515:certificate-key-files","reason":"The scanner matched JavaScript properties such as e.key, Object.keys, Map keys, and data-edge-key. These are keyboard or collection identifiers, not certificate or private-key paths.","verdict":"false_positive","confidence":0.96},{"id":"sensitive:assets/template.html:5517:certificate-key-files","reason":"The scanner matched JavaScript properties such as e.key, Object.keys, Map keys, and data-edge-key. These are keyboard or collection identifiers, not certificate or private-key paths.","verdict":"false_positive","confidence":0.96},{"id":"sensitive:assets/template.html:5529:certificate-key-files","reason":"The scanner matched JavaScript properties such as e.key, Object.keys, Map keys, and data-edge-key. These are keyboard or collection identifiers, not certificate or private-key paths.","verdict":"false_positive","confidence":0.96},{"id":"sensitive:delta/architecture-delta.mjs:19:certificate-key-files","reason":"The scanner matched JavaScript properties such as e.key, Object.keys, Map keys, and data-edge-key. These are keyboard or collection identifiers, not certificate or private-key paths.","verdict":"false_positive","confidence":0.96},{"id":"sensitive:delta/architecture-delta.mjs:173:certificate-key-files","reason":"The scanner matched JavaScript properties such as e.key, Object.keys, Map keys, and data-edge-key. These are keyboard or collection identifiers, not certificate or private-key paths.","verdict":"false_positive","confidence":0.96},{"id":"sensitive:delta/architecture-delta.mjs:231:certificate-key-files","reason":"The scanner matched JavaScript properties such as e.key, Object.keys, Map keys, and data-edge-key. These are keyboard or collection identifiers, not certificate or private-key paths.","verdict":"false_positive","confidence":0.96},{"id":"sensitive:examples/dataflow-product-analytics.html:5626:certificate-key-files","reason":"The scanner matched JavaScript properties such as e.key, Object.keys, Map keys, and data-edge-key. These are keyboard or collection identifiers, not certificate or private-key paths.","verdict":"false_positive","confidence":0.96},{"id":"sensitive:examples/dataflow-product-analytics.html:5628:certificate-key-files","reason":"The scanner matched JavaScript properties such as e.key, Object.keys, Map keys, and data-edge-key. These are keyboard or collection identifiers, not certificate or private-key paths.","verdict":"false_positive","confidence":0.96},{"id":"sensitive:examples/dataflow-product-analytics.html:5640:certificate-key-files","reason":"The scanner matched JavaScript properties such as e.key, Object.keys, Map keys, and data-edge-key. These are keyboard or collection identifiers, not certificate or private-key paths.","verdict":"false_positive","confidence":0.96},{"id":"sensitive:renderers/architecture/render-architecture.mjs:511:certificate-key-files","reason":"The scanner matched JavaScript properties such as e.key, Object.keys, Map keys, and data-edge-key. These are keyboard or collection identifiers, not certificate or private-key paths.","verdict":"false_positive","confidence":0.96},{"id":"sensitive:renderers/architecture/render-architecture.mjs:530:certificate-key-files","reason":"The scanner matched JavaScript properties such as e.key, Object.keys, Map keys, and data-edge-key. These are keyboard or collection identifiers, not certificate or private-key paths.","verdict":"false_positive","confidence":0.96},{"id":"sensitive:renderers/architecture/render-architecture.mjs:539:certificate-key-files","reason":"The scanner matched JavaScript properties such as e.key, Object.keys, Map keys, and data-edge-key. These are keyboard or collection identifiers, not certificate or private-key paths.","verdict":"false_positive","confidence":0.96},{"id":"sensitive:scripts/check-render-output.mjs:341:certificate-key-files","reason":"The scanner matched JavaScript properties such as e.key, Object.keys, Map keys, and data-edge-key. These are keyboard or collection identifiers, not certificate or private-key paths.","verdict":"false_positive","confidence":0.96},{"id":"sensitive:scripts/check-render-output.mjs:348:certificate-key-files","reason":"The scanner matched JavaScript properties such as e.key, Object.keys, Map keys, and data-edge-key. These are keyboard or collection identifiers, not certificate or private-key paths.","verdict":"false_positive","confidence":0.96},{"id":"sensitive:scripts/check-render-output.mjs:409:certificate-key-files","reason":"The scanner matched JavaScript properties such as e.key, Object.keys, Map keys, and data-edge-key. These are keyboard or collection identifiers, not certificate or private-key paths.","verdict":"false_positive","confidence":0.96},{"id":"sensitive:test/architecture-delta.test.mjs:112:certificate-key-files","reason":"The scanner matched JavaScript properties such as e.key, Object.keys, Map keys, and data-edge-key. These are keyboard or collection identifiers, not certificate or private-key paths.","verdict":"false_positive","confidence":0.96},{"id":"sensitive:test/architecture-delta.test.mjs:125:certificate-key-files","reason":"The scanner matched JavaScript properties such as e.key, Object.keys, Map keys, and data-edge-key. These are keyboard or collection identifiers, not certificate or private-key paths.","verdict":"false_positive","confidence":0.96},{"id":"sensitive:test/architecture-delta.test.mjs:320:certificate-key-files","reason":"The scanner matched JavaScript properties such as e.key, Object.keys, Map keys, and data-edge-key. These are keyboard or collection identifiers, not certificate or private-key paths.","verdict":"false_positive","confidence":0.96},{"id":"sensitive:bin/archify.mjs:55:environment-file-access","reason":"The code reads selected process environment values or inherits the environment in a local child process. It does not open .env files or collect environment secrets for transmission.","verdict":"false_positive","confidence":0.96},{"id":"sensitive:bin/preview.mjs:516:environment-file-access","reason":"The code reads selected process environment values or inherits the environment in a local child process. It does not open .env files or collect environment secrets for transmission.","verdict":"false_positive","confidence":0.96},{"id":"sensitive:bin/visual-check.mjs:107:environment-file-access","reason":"The code reads selected process environment values or inherits the environment in a local child process. It does not open .env files or collect environment secrets for transmission.","verdict":"false_positive","confidence":0.96},{"id":"sensitive:renderers/shared/brand-marks.mjs:124:environment-file-access","reason":"The code reads selected process environment values or inherits the environment in a local child process. It does not open .env files or collect environment secrets for transmission.","verdict":"false_positive","confidence":0.96},{"id":"sensitive:renderers/shared/brand-marks.mjs:152:environment-file-access","reason":"The code reads selected process environment values or inherits the environment in a local child process. It does not open .env files or collect environment secrets for transmission.","verdict":"false_positive","confidence":0.96},{"id":"sensitive:renderers/shared/brand-marks.mjs:173:environment-file-access","reason":"The code reads selected process environment values or inherits the environment in a local child process. It does not open .env files or collect environment secrets for transmission.","verdict":"false_positive","confidence":0.96},{"id":"sensitive:scripts/check-update.mjs:1393:environment-file-access","reason":"The code reads selected process environment values or inherits the environment in a local child process. It does not open .env files or collect environment secrets for transmission.","verdict":"false_positive","confidence":0.96},{"id":"sensitive:scripts/check-update.mjs:1397:environment-file-access","reason":"The code reads selected process environment values or inherits the environment in a local child process. It does not open .env files or collect environment secrets for transmission.","verdict":"false_positive","confidence":0.96},{"id":"sensitive:scripts/check-update.mjs:1637:environment-file-access","reason":"The code reads selected process environment values or inherits the environment in a local child process. It does not open .env files or collect environment secrets for transmission.","verdict":"false_positive","confidence":0.96},{"id":"sensitive:test/brand-marks.test.mjs:44:environment-file-access","reason":"The code reads selected process environment values or inherits the environment in a local child process. It does not open .env files or collect environment secrets for transmission.","verdict":"false_positive","confidence":0.96},{"id":"sensitive:test/brand-marks.test.mjs:58:environment-file-access","reason":"The code reads selected process environment values or inherits the environment in a local child process. It does not open .env files or collect environment secrets for transmission.","verdict":"false_positive","confidence":0.96},{"id":"sensitive:test/brand-marks.test.mjs:81:environment-file-access","reason":"The code reads selected process environment values or inherits the environment in a local child process. It does not open .env files or collect environment secrets for transmission.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:renderers/shared/generated-brand-marks.mjs:779:heuristic-extremely-long-line-2003-chars-likely-","reason":"The long line is generated SVG path geometry for a bundled brand mark. It is readable data, not an encoded executable payload.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:renderers/shared/generated-brand-marks.mjs:109:heuristic-extremely-long-line-2150-chars-likely-","reason":"The long line is generated SVG path geometry for a bundled brand mark. It is readable data, not an encoded executable payload.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:renderers/shared/generated-brand-marks.mjs:1599:heuristic-extremely-long-line-2361-chars-likely-","reason":"The long line is generated SVG path geometry for a bundled brand mark. It is readable data, not an encoded executable payload.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:renderers/shared/generated-brand-marks.mjs:133:heuristic-extremely-long-line-2623-chars-likely-","reason":"The long line is generated SVG path geometry for a bundled brand mark. It is readable data, not an encoded executable payload.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:examples/dataflow-product-analytics.html:4964:heuristic-extremely-long-line-26586-chars-likely","reason":"The long line is embedded localization data in a generated standalone HTML example. It is structured viewer content, not an obfuscated payload.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:examples/lifecycle-agent-run.html:4964:heuristic-extremely-long-line-26586-chars-likely","reason":"The long line is embedded localization data in a generated standalone HTML example. It is structured viewer content, not an obfuscated payload.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:examples/sequence-cache-miss-request.html:4964:heuristic-extremely-long-line-26586-chars-likely","reason":"The long line is embedded localization data in a generated standalone HTML example. It is structured viewer content, not an obfuscated payload.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:renderers/shared/generated-brand-marks.mjs:1455:heuristic-extremely-long-line-2832-chars-likely-","reason":"The long line is generated SVG path geometry for a bundled brand mark. It is readable data, not an encoded executable payload.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:renderers/shared/generated-brand-marks.mjs:319:heuristic-extremely-long-line-2902-chars-likely-","reason":"The long line is generated SVG path geometry for a bundled brand mark. It is readable data, not an encoded executable payload.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:renderers/shared/generated-brand-marks.mjs:741:heuristic-extremely-long-line-2926-chars-likely-","reason":"The long line is generated SVG path geometry for a bundled brand mark. It is readable data, not an encoded executable payload.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:delta/architecture-delta.mjs:714:heuristic-extremely-long-line-3214-chars-likely-","reason":"The long line is an embedded CSS template used to render an architecture delta artifact. It is presentation source, not concealed executable data.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:renderers/shared/generated-brand-marks.mjs:878:heuristic-extremely-long-line-3466-chars-likely-","reason":"The long line is generated SVG path geometry for a bundled brand mark. It is readable data, not an encoded executable payload.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:renderers/shared/generated-brand-marks.mjs:1900:heuristic-extremely-long-line-3474-chars-likely-","reason":"The long line is generated SVG path geometry for a bundled brand mark. It is readable data, not an encoded executable payload.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:renderers/shared/generated-brand-marks.mjs:1007:heuristic-extremely-long-line-3531-chars-likely-","reason":"The long line is generated SVG path geometry for a bundled brand mark. It is readable data, not an encoded executable payload.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:renderers/shared/generated-brand-marks.mjs:687:heuristic-extremely-long-line-3721-chars-likely-","reason":"The long line is generated SVG path geometry for a bundled brand mark. It is readable data, not an encoded executable payload.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:renderers/shared/generated-brand-marks.mjs:1542:heuristic-extremely-long-line-4151-chars-likely-","reason":"The long line is generated SVG path geometry for a bundled brand mark. It is readable data, not an encoded executable payload.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:renderers/shared/generated-validators.mjs:13:heuristic-extremely-long-line-423908-chars-likel","reason":"The long line is generated schema-validator source produced from bundled JSON schemas. Its size reflects code generation, not concealment.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:renderers/shared/generated-brand-marks.mjs:836:heuristic-extremely-long-line-4572-chars-likely-","reason":"The long line is generated SVG path geometry for a bundled brand mark. It is readable data, not an encoded executable payload.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:renderers/shared/generated-brand-marks.mjs:1120:heuristic-extremely-long-line-4674-chars-likely-","reason":"The long line is generated SVG path geometry for a bundled brand mark. It is readable data, not an encoded executable payload.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:renderers/shared/generated-brand-marks.mjs:158:heuristic-extremely-long-line-4917-chars-likely-","reason":"The long line is generated SVG path geometry for a bundled brand mark. It is readable data, not an encoded executable payload.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:renderers/shared/generated-brand-marks.mjs:1292:heuristic-extremely-long-line-5106-chars-likely-","reason":"The long line is generated SVG path geometry for a bundled brand mark. It is readable data, not an encoded executable payload.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:renderers/shared/generated-validators.mjs:2:heuristic-extremely-long-line-6586-chars-likely-","reason":"The long line is generated schema-validator source produced from bundled JSON schemas. Its size reflects code generation, not concealment.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:test/semantic-radar.test.mjs:1:heuristic-multiple-bracket-chains-11-jsfuck-obfu","reason":"The heuristic counted ordinary nested JavaScript, generated validator expressions, or bundled HTML runtime syntax. The cited content is not JSFuck or an encoded execution chain.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:test/viewer-chrome-layout.test.mjs:1:heuristic-multiple-bracket-chains-19-jsfuck-obfu","reason":"The heuristic counted ordinary nested JavaScript, generated validator expressions, or bundled HTML runtime syntax. The cited content is not JSFuck or an encoded execution chain.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:test/update-notifier.test.mjs:1:heuristic-multiple-bracket-chains-20-jsfuck-obfu","reason":"The heuristic counted ordinary nested JavaScript, generated validator expressions, or bundled HTML runtime syntax. The cited content is not JSFuck or an encoded execution chain.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:assets/template.html:1:heuristic-multiple-bracket-chains-27-jsfuck-obfu","reason":"The heuristic counted ordinary nested JavaScript, generated validator expressions, or bundled HTML runtime syntax. The cited content is not JSFuck or an encoded execution chain.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:examples/dataflow-product-analytics.html:1:heuristic-multiple-bracket-chains-27-jsfuck-obfu","reason":"The heuristic counted ordinary nested JavaScript, generated validator expressions, or bundled HTML runtime syntax. The cited content is not JSFuck or an encoded execution chain.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:examples/lifecycle-agent-run.html:1:heuristic-multiple-bracket-chains-27-jsfuck-obfu","reason":"The heuristic counted ordinary nested JavaScript, generated validator expressions, or bundled HTML runtime syntax. The cited content is not JSFuck or an encoded execution chain.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:examples/sequence-cache-miss-request.html:1:heuristic-multiple-bracket-chains-27-jsfuck-obfu","reason":"The heuristic counted ordinary nested JavaScript, generated validator expressions, or bundled HTML runtime syntax. The cited content is not JSFuck or an encoded execution chain.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:test/webm-artifact.smoke.mjs:1:heuristic-multiple-bracket-chains-30-jsfuck-obfu","reason":"The heuristic counted ordinary nested JavaScript, generated validator expressions, or bundled HTML runtime syntax. The cited content is not JSFuck or an encoded execution chain.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:renderers/shared/generated-validators.mjs:1:heuristic-multiple-bracket-chains-365-jsfuck-obf","reason":"The heuristic counted ordinary nested JavaScript, generated validator expressions, or bundled HTML runtime syntax. The cited content is not JSFuck or an encoded execution chain.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:scripts/check-update.mjs:1:heuristic-multiple-bracket-chains-6-jsfuck-obfus","reason":"The heuristic counted ordinary nested JavaScript, generated validator expressions, or bundled HTML runtime syntax. The cited content is not JSFuck or an encoded execution chain.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:test/legend-contract.test.mjs:1:heuristic-multiple-bracket-chains-6-jsfuck-obfus","reason":"The heuristic counted ordinary nested JavaScript, generated validator expressions, or bundled HTML runtime syntax. The cited content is not JSFuck or an encoded execution chain.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:test/workflow-compiler.test.mjs:1:heuristic-multiple-bracket-chains-6-jsfuck-obfus","reason":"The heuristic counted ordinary nested JavaScript, generated validator expressions, or bundled HTML runtime syntax. The cited content is not JSFuck or an encoded execution chain.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:delta/architecture-delta.mjs:1:heuristic-multiple-bracket-chains-7-jsfuck-obfus","reason":"The heuristic counted ordinary nested JavaScript, generated validator expressions, or bundled HTML runtime syntax. The cited content is not JSFuck or an encoded execution chain.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:renderers/workflow/workflow-compiler.mjs:1:heuristic-multiple-bracket-chains-7-jsfuck-obfus","reason":"The heuristic counted ordinary nested JavaScript, generated validator expressions, or bundled HTML runtime syntax. The cited content is not JSFuck or an encoded execution chain.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:test/layout-rules.test.mjs:1:heuristic-multiple-bracket-chains-7-jsfuck-obfus","reason":"The heuristic counted ordinary nested JavaScript, generated validator expressions, or bundled HTML runtime syntax. The cited content is not JSFuck or an encoded execution chain.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:test/workflow-compiler-hard-contract.test.mjs:1:heuristic-multiple-bracket-chains-7-jsfuck-obfus","reason":"The heuristic counted ordinary nested JavaScript, generated validator expressions, or bundled HTML runtime syntax. The cited content is not JSFuck or an encoded execution chain.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:multiple:1:heuristic-suspicious-combination-filesystem-cred","reason":"This repository-wide heuristic combines unrelated diagram tooling, bounded network features, tests, and local process execution. No credential collection or exfiltration flow is present.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:package-lock.json:124:heuristic-very-high-entropy-string-5-53-bits-lik","reason":"The value is an npm SHA-512 integrity checksum in the dependency lockfile. It authenticates package content and is not an encrypted payload.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:package-lock.json:88:heuristic-very-high-entropy-string-5-59-bits-lik","reason":"The value is an npm SHA-512 integrity checksum in the dependency lockfile. It authenticates package content and is not an encrypted payload.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:recipes/scenarios.mjs:250:heuristic-very-high-entropy-string-5-82-bits-lik","reason":"The cited value is natural-language Chinese scenario text. Unicode character diversity triggered the entropy heuristic without indicating encoding or concealment.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:recipes/scenarios.mjs:158:heuristic-very-high-entropy-string-5-84-bits-lik","reason":"The cited value is natural-language Chinese scenario text. Unicode character diversity triggered the entropy heuristic without indicating encoding or concealment.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:recipes/scenarios.mjs:179:heuristic-very-high-entropy-string-5-84-bits-lik","reason":"The cited value is natural-language Chinese scenario text. Unicode character diversity triggered the entropy heuristic without indicating encoding or concealment.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:recipes/scenarios.mjs:212:heuristic-very-high-entropy-string-5-88-bits-lik","reason":"The cited value is natural-language Chinese scenario text. Unicode character diversity triggered the entropy heuristic without indicating encoding or concealment.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:recipes/scenarios.mjs:120:heuristic-very-high-entropy-string-5-91-bits-lik","reason":"The cited value is natural-language Chinese scenario text. Unicode character diversity triggered the entropy heuristic without indicating encoding or concealment.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:recipes/scenarios.mjs:204:heuristic-very-high-entropy-string-5-94-bits-lik","reason":"The cited value is natural-language Chinese scenario text. Unicode character diversity triggered the entropy heuristic without indicating encoding or concealment.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:recipes/scenarios.mjs:112:heuristic-very-high-entropy-string-6-01-bits-lik","reason":"The cited value is natural-language Chinese scenario text. Unicode character diversity triggered the entropy heuristic without indicating encoding or concealment.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:recipes/scenarios.mjs:137:heuristic-very-high-entropy-string-6-04-bits-lik","reason":"The cited value is natural-language Chinese scenario text. Unicode character diversity triggered the entropy heuristic without indicating encoding or concealment.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:recipes/scenarios.mjs:187:heuristic-very-high-entropy-string-6-04-bits-lik","reason":"The cited value is natural-language Chinese scenario text. Unicode character diversity triggered the entropy heuristic without indicating encoding or concealment.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:recipes/scenarios.mjs:229:heuristic-very-high-entropy-string-6-04-bits-lik","reason":"The cited value is natural-language Chinese scenario text. Unicode character diversity triggered the entropy heuristic without indicating encoding or concealment.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:recipes/scenarios.mjs:70:heuristic-very-high-entropy-string-6-07-bits-lik","reason":"The cited value is natural-language Chinese scenario text. Unicode character diversity triggered the entropy heuristic without indicating encoding or concealment.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:recipes/scenarios.mjs:91:heuristic-very-high-entropy-string-6-12-bits-lik","reason":"The cited value is natural-language Chinese scenario text. Unicode character diversity triggered the entropy heuristic without indicating encoding or concealment.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:recipes/scenarios.mjs:53:heuristic-very-high-entropy-string-6-18-bits-lik","reason":"The cited value is natural-language Chinese scenario text. Unicode character diversity triggered the entropy heuristic without indicating encoding or concealment.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:recipes/scenarios.mjs:24:heuristic-very-high-entropy-string-6-22-bits-lik","reason":"The cited value is natural-language Chinese scenario text. Unicode character diversity triggered the entropy heuristic without indicating encoding or concealment.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:recipes/scenarios.mjs:45:heuristic-very-high-entropy-string-6-44-bits-lik","reason":"The cited value is natural-language Chinese scenario text. Unicode character diversity triggered the entropy heuristic without indicating encoding or concealment.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:recipes/scenarios.mjs:7:heuristic-very-high-entropy-string-6-46-bits-lik","reason":"The cited value is natural-language Chinese scenario text. Unicode character diversity triggered the entropy heuristic without indicating encoding or concealment.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:test/release-identity.test.mjs:51:hidden-file-in-home-directory","reason":"The path appears only in release-identity test fixtures describing manual installation. The cited test does not create or modify that home-directory path.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:test/release-identity.test.mjs:58:hidden-file-in-home-directory","reason":"The path appears only in release-identity test fixtures describing manual installation. The cited test does not create or modify that home-directory path.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:test/release-identity.test.mjs:93:hidden-file-in-home-directory","reason":"The path appears only in release-identity test fixtures describing manual installation. The cited test does not create or modify that home-directory path.","verdict":"false_positive","confidence":0.96},{"id":"network:test/webm-artifact.smoke.mjs:257:net-server-creation-opens-port","reason":"The server is created inside a WebM smoke test to emulate a bounded local endpoint. It is test infrastructure, not a persistent or externally exposed service.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:bin/archify.mjs:3:node-js-child-process-module","reason":"The module launches the packaged Node CLI with structured arguments for validation, delivery, or preview. The executable is fixed and no shell interpolation is used.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:bin/open-artifact.mjs:1:node-js-child-process-module","reason":"The module launches a fixed platform opener with shell disabled and passes the target as a separate argument. User input is not interpolated into executable source.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:bin/preview.mjs:1:node-js-child-process-module","reason":"The module launches the packaged Node CLI with structured arguments for validation, delivery, or preview. The executable is fixed and no shell interpolation is used.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:renderers/shared/repository-evidence.mjs:1:node-js-child-process-module","reason":"The module runs git with an argument array against a verified local repository. Source paths and revisions are validated, and no shell is used.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/render-examples.mjs:4:node-js-child-process-module","reason":"The module is used by tests or example generation to execute the packaged Node CLI with argument arrays. It does not invoke a shell or execute downloaded content.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:test/animation.test.mjs:3:node-js-child-process-module","reason":"The module is used by tests or example generation to execute the packaged Node CLI with argument arrays. It does not invoke a shell or execute downloaded content.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:test/architecture-delta.test.mjs:3:node-js-child-process-module","reason":"The module is used by tests or example generation to execute the packaged Node CLI with argument arrays. It does not invoke a shell or execute downloaded content.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:test/authored-reachability.test.mjs:3:node-js-child-process-module","reason":"The module is used by tests or example generation to execute the packaged Node CLI with argument arrays. It does not invoke a shell or execute downloaded content.","verdict":"false_positive","confidence":0.96},{"id":"scripts:test/guide-page.test.mjs:58:node-js-vm-script-compilation","reason":"This test parses or runs a script extracted from a locally generated page to verify syntax and behavior. It does not compile untrusted network input in production.","verdict":"false_positive","confidence":0.96},{"id":"scripts:test/preview.test.mjs:158:node-js-vm-script-compilation","reason":"This test parses or runs a script extracted from a locally generated page to verify syntax and behavior. It does not compile untrusted network input in production.","verdict":"false_positive","confidence":0.96},{"id":"scripts:test/start-page.test.mjs:109:node-js-vm-script-compilation","reason":"This test parses or runs a script extracted from a locally generated page to verify syntax and behavior. It does not compile untrusted network input in production.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:bin/archify.mjs:11:path-resolve-with","reason":"The parent segment is a fixed module, documentation, test-fixture, or repository-relative path. It is not concatenated from an unvalidated traversal request.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:bin/preview.mjs:433:path-resolve-with","reason":"The parent segment is a fixed module, documentation, test-fixture, or repository-relative path. It is not concatenated from an unvalidated traversal request.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:renderers/shared/cli.mjs:20:path-resolve-with","reason":"The parent segment is a fixed module, documentation, test-fixture, or repository-relative path. It is not concatenated from an unvalidated traversal request.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:renderers/shared/output-path.mjs:28:path-resolve-with","reason":"Parent segments appear in symlink-aware output-path canonicalization. The routine resolves filesystem identity and detects cycles rather than blindly trusting traversal input.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:scripts/check-update.mjs:43:path-resolve-with","reason":"The parent segment is a fixed module, documentation, test-fixture, or repository-relative path. It is not concatenated from an unvalidated traversal request.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:scripts/generate-brand-marks.mjs:9:path-resolve-with","reason":"The parent segment is a fixed module, documentation, test-fixture, or repository-relative path. It is not concatenated from an unvalidated traversal request.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:scripts/generate-validators.mjs:10:path-resolve-with","reason":"The parent segment is a fixed module, documentation, test-fixture, or repository-relative path. It is not concatenated from an unvalidated traversal request.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:test/adaptive-reader-layout.test.mjs:17:path-resolve-with","reason":"The parent segment is a fixed module, documentation, test-fixture, or repository-relative path. It is not concatenated from an unvalidated traversal request.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:test/animation.test.mjs:10:path-resolve-with","reason":"The parent segment is a fixed module, documentation, test-fixture, or repository-relative path. It is not concatenated from an unvalidated traversal request.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:test/architecture-delta.test.mjs:17:path-resolve-with","reason":"The parent segment is a fixed module, documentation, test-fixture, or repository-relative path. It is not concatenated from an unvalidated traversal request.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:bin/archify.mjs:419:path-traversal-sequence","reason":"The parent segment is a fixed module, documentation, test-fixture, or repository-relative path. It is not concatenated from an unvalidated traversal request.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:bin/archify.mjs:751:path-traversal-sequence","reason":"The parent segment is a fixed module, documentation, test-fixture, or repository-relative path. It is not concatenated from an unvalidated traversal request.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:bin/archify.mjs:1411:path-traversal-sequence","reason":"The parent segment is a fixed module, documentation, test-fixture, or repository-relative path. It is not concatenated from an unvalidated traversal request.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:migrations/workflow-v2.mjs:1:path-traversal-sequence","reason":"The parent segment is a fixed module, documentation, test-fixture, or repository-relative path. It is not concatenated from an unvalidated traversal request.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:migrations/workflow-v2.mjs:6:path-traversal-sequence","reason":"The parent segment is a fixed module, documentation, test-fixture, or repository-relative path. It is not concatenated from an unvalidated traversal request.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:migrations/workflow-v2.mjs:7:path-traversal-sequence","reason":"The parent segment is a fixed module, documentation, test-fixture, or repository-relative path. It is not concatenated from an unvalidated traversal request.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:package.json:19:path-traversal-sequence","reason":"The parent segment is a fixed module, documentation, test-fixture, or repository-relative path. It is not concatenated from an unvalidated traversal request.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:package.json:20:path-traversal-sequence","reason":"The parent segment is a fixed module, documentation, test-fixture, or repository-relative path. It is not concatenated from an unvalidated traversal request.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:package.json:21:path-traversal-sequence","reason":"The parent segment is a fixed module, documentation, test-fixture, or repository-relative path. It is not concatenated from an unvalidated traversal request.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:references/authoring-contract.md:21:path-traversal-sequence","reason":"The parent segment is a fixed module, documentation, test-fixture, or repository-relative path. It is not concatenated from an unvalidated traversal request.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:references/authoring-contract.md:23:path-traversal-sequence","reason":"The parent segment is a fixed module, documentation, test-fixture, or repository-relative path. It is not concatenated from an unvalidated traversal request.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:renderers/architecture/render-architecture.mjs:3:path-traversal-sequence","reason":"The parent segment is a fixed module, documentation, test-fixture, or repository-relative path. It is not concatenated from an unvalidated traversal request.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:renderers/architecture/render-architecture.mjs:4:path-traversal-sequence","reason":"The parent segment is a fixed module, documentation, test-fixture, or repository-relative path. It is not concatenated from an unvalidated traversal request.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:renderers/architecture/render-architecture.mjs:5:path-traversal-sequence","reason":"The parent segment is a fixed module, documentation, test-fixture, or repository-relative path. It is not concatenated from an unvalidated traversal request.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:scripts/check-render-output.mjs:5:path-traversal-sequence","reason":"The parent segment is a fixed module, documentation, test-fixture, or repository-relative path. It is not concatenated from an unvalidated traversal request.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:scripts/check-render-output.mjs:11:path-traversal-sequence","reason":"The parent segment is a fixed module, documentation, test-fixture, or repository-relative path. It is not concatenated from an unvalidated traversal request.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:test/adaptive-reader-layout.test.mjs:14:path-traversal-sequence","reason":"The parent segment is a fixed module, documentation, test-fixture, or repository-relative path. It is not concatenated from an unvalidated traversal request.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:test/architecture-delta.test.mjs:14:path-traversal-sequence","reason":"The parent segment is a fixed module, documentation, test-fixture, or repository-relative path. It is not concatenated from an unvalidated traversal request.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:test/architecture-delta.test.mjs:21:path-traversal-sequence","reason":"The parent segment is a fixed module, documentation, test-fixture, or repository-relative path. It is not concatenated from an unvalidated traversal request.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:renderers/shared/output-path.mjs:42:path-traversal-with","reason":"Parent segments appear in symlink-aware output-path canonicalization. The routine resolves filesystem identity and detects cycles rather than blindly trusting traversal input.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:test/delivery-contract.test.mjs:8:path-traversal-with","reason":"The parent segment is a fixed module, documentation, test-fixture, or repository-relative path. It is not concatenated from an unvalidated traversal request.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:test/delivery-contract.test.mjs:9:path-traversal-with","reason":"The parent segment is a fixed module, documentation, test-fixture, or repository-relative path. It is not concatenated from an unvalidated traversal request.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:test/skill-metadata.test.mjs:8:path-traversal-with","reason":"The parent segment is a fixed module, documentation, test-fixture, or repository-relative path. It is not concatenated from an unvalidated traversal request.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:bin/open-artifact.mjs:16:powershell-invocation","reason":"Windows opening uses a constant PowerShell command and passes the resolved target through the argument array. The implementation disables profiles and avoids target interpolation.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:bin/open-artifact.mjs:17:powershell-invocation","reason":"Windows opening uses a constant PowerShell command and passes the resolved target through the argument array. The implementation disables profiles and avoids target interpolation.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:bin/open-artifact.mjs:18:powershell-invocation","reason":"Windows opening uses a constant PowerShell command and passes the resolved target through the argument array. The implementation disables profiles and avoids target interpolation.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:test/open-artifact.test.mjs:25:powershell-invocation","reason":"Windows opening uses a constant PowerShell command and passes the resolved target through the argument array. The implementation disables profiles and avoids target interpolation.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:test/open-artifact.test.mjs:33:powershell-invocation","reason":"Windows opening uses a constant PowerShell command and passes the resolved target through the argument array. The implementation disables profiles and avoids target interpolation.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:delta/architecture-delta.mjs:390:process-exec","reason":"The cited .exec call is JavaScript RegExp matching for SVG or version parsing. It is not process execution or Python code evaluation.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:delta/architecture-delta.mjs:395:process-exec","reason":"The cited .exec call is JavaScript RegExp matching for SVG or version parsing. It is not process execution or Python code evaluation.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/check-update.mjs:692:process-exec","reason":"The cited .exec call is JavaScript RegExp matching for SVG or version parsing. It is not process execution or Python code evaluation.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/update-contract.mjs:31:process-exec","reason":"The cited .exec call is JavaScript RegExp matching for SVG or version parsing. It is not process execution or Python code evaluation.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:bin/open-artifact.mjs:45:process-spawn","reason":"The spawn invokes a fixed operating-system opener with shell disabled and a separate target argument. No command string is assembled from user input.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:bin/preview.mjs:514:process-spawn","reason":"The spawn runs the current Node executable with structured arguments for packaged CLI or test behavior. It does not use a shell or a user-selected executable.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:test/brand-marks.test.mjs:52:process-spawn","reason":"The spawn runs the current Node executable with structured arguments for packaged CLI or test behavior. It does not use a shell or a user-selected executable.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:test/brand-marks.test.mjs:79:process-spawn","reason":"The spawn runs the current Node executable with structured arguments for packaged CLI or test behavior. It does not use a shell or a user-selected executable.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:test/cli.test.mjs:460:process-spawn","reason":"The spawn runs the current Node executable with structured arguments for packaged CLI or test behavior. It does not use a shell or a user-selected executable.","verdict":"false_positive","confidence":0.96},{"id":"scripts:delta/architecture-delta.mjs:390:python-exec-function","reason":"The cited .exec call is JavaScript RegExp matching for SVG or version parsing. It is not process execution or Python code evaluation.","verdict":"false_positive","confidence":0.96},{"id":"scripts:delta/architecture-delta.mjs:395:python-exec-function","reason":"The cited .exec call is JavaScript RegExp matching for SVG or version parsing. It is not process execution or Python code evaluation.","verdict":"false_positive","confidence":0.96},{"id":"scripts:scripts/check-update.mjs:692:python-exec-function","reason":"The cited .exec call is JavaScript RegExp matching for SVG or version parsing. It is not process execution or Python code evaluation.","verdict":"false_positive","confidence":0.96},{"id":"scripts:scripts/update-contract.mjs:31:python-exec-function","reason":"The cited .exec call is JavaScript RegExp matching for SVG or version parsing. It is not process execution or Python code evaluation.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:test/clean-skill-staging.test.mjs:80:symlink-creation","reason":"The test deliberately creates temporary links and junctions to verify clean staging and symlink defenses. It does not create persistent links in user directories.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:test/clean-skill-staging.test.mjs:106:symlink-creation","reason":"The test deliberately creates temporary links and junctions to verify clean staging and symlink defenses. It does not create persistent links in user directories.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:test/clean-skill-staging.test.mjs:141:symlink-creation","reason":"The test deliberately creates temporary links and junctions to verify clean staging and symlink defenses. It does not create persistent links in user directories.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/render-examples.mjs:21:synchronous-file-execution","reason":"The call executes the packaged Node CLI from tests or controlled command dispatch. Executable paths and arguments are structured, with no downloaded code or shell interpolation.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:test/animation.test.mjs:39:synchronous-file-execution","reason":"The call executes the packaged Node CLI from tests or controlled command dispatch. Executable paths and arguments are structured, with no downloaded code or shell interpolation.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:test/authored-reachability.test.mjs:25:synchronous-file-execution","reason":"The call executes the packaged Node CLI from tests or controlled command dispatch. Executable paths and arguments are structured, with no downloaded code or shell interpolation.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:test/automatic-port-spread.test.mjs:18:synchronous-file-execution","reason":"The call executes the packaged Node CLI from tests or controlled command dispatch. Executable paths and arguments are structured, with no downloaded code or shell interpolation.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:bin/archify.mjs:51:synchronous-spawn","reason":"The call executes the packaged Node CLI from tests or controlled command dispatch. Executable paths and arguments are structured, with no downloaded code or shell interpolation.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:renderers/shared/repository-evidence.mjs:21:synchronous-spawn","reason":"The synchronous command is git with a fixed executable and validated argument array for local evidence checks. It does not use shell parsing.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:test/architecture-delta.test.mjs:26:synchronous-spawn","reason":"The call executes the packaged Node CLI from tests or controlled command dispatch. Executable paths and arguments are structured, with no downloaded code or shell interpolation.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:test/base-input-compatibility.test.mjs:16:synchronous-spawn","reason":"The call executes the packaged Node CLI from tests or controlled command dispatch. Executable paths and arguments are structured, with no downloaded code or shell interpolation.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:test/brand-marks.test.mjs:37:synchronous-spawn","reason":"The call executes the packaged Node CLI from tests or controlled command dispatch. Executable paths and arguments are structured, with no downloaded code or shell interpolation.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:bin/visual-check.mjs:470:buffer-base64-decode","reason":"The Base64 data is a local PNG screenshot or a one-pixel image fixture. Decoding image bytes is required for artifact testing and does not conceal executable code.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:test/brand-marks.test.mjs:238:buffer-base64-decode","reason":"The Base64 data is a local PNG screenshot or a one-pixel image fixture. Decoding image bytes is required for artifact testing and does not conceal executable code.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:test/brand-marks.test.mjs:278:buffer-base64-decode","reason":"The Base64 data is a local PNG screenshot or a one-pixel image fixture. Decoding image bytes is required for artifact testing and does not conceal executable code.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:test/brand-marks.test.mjs:310:buffer-base64-decode","reason":"The Base64 data is a local PNG screenshot or a one-pixel image fixture. Decoding image bytes is required for artifact testing and does not conceal executable code.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:test/webm-artifact.smoke.mjs:880:character-code-conversion","reason":"The conversion serializes WebM test bytes into a browser-compatible binary string. It operates on generated media data, not hidden script text.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:test/webm-artifact.smoke.mjs:944:character-code-conversion","reason":"The conversion serializes WebM test bytes into a browser-compatible binary string. It operates on generated media data, not hidden script text.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:test/webm-artifact.smoke.mjs:1201:character-code-conversion","reason":"The conversion serializes WebM test bytes into a browser-compatible binary string. It operates on generated media data, not hidden script text.","verdict":"false_positive","confidence":0.96},{"id":"scripts:bin/archify.mjs:419:dynamic-import-expression","reason":"The import target is selected from a fixed diagram-type set and resolves to packaged renderer modules. Arbitrary module paths are not accepted.","verdict":"false_positive","confidence":0.96},{"id":"scripts:bin/archify.mjs:427:dynamic-import-expression","reason":"The import target is selected from a fixed diagram-type set and resolves to packaged renderer modules. Arbitrary module paths are not accepted.","verdict":"false_positive","confidence":0.96},{"id":"scripts:bin/archify.mjs:751:dynamic-import-expression","reason":"The import target is selected from a fixed diagram-type set and resolves to packaged renderer modules. Arbitrary module paths are not accepted.","verdict":"false_positive","confidence":0.96},{"id":"scripts:test/site-language-integration.mjs:9:dynamic-import-expression","reason":"The dynamic import loads a local integration module during a test. It does not accept a remote URL or downloaded module.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:bin/preview.mjs:591:file-system-watching","reason":"Preview mode watches the selected input directory so it can rebuild after edits. This is an explicit local preview feature with bounded file handling.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:test/output-path.test.mjs:149:hard-link-creation","reason":"The hard link is created in a temporary test fixture to verify output-path identity protections. It is not part of normal skill execution.","verdict":"false_positive","confidence":0.96},{"id":"network:bin/open-artifact.mjs:79:hardcoded-ip-address","reason":"The address is 127.0.0.1 and is used to constrain preview access to loopback. This reduces network exposure instead of enabling an external connection.","verdict":"false_positive","confidence":0.96},{"id":"network:bin/open-artifact.mjs:80:hardcoded-ip-address","reason":"The address is 127.0.0.1 and is used to constrain preview access to loopback. This reduces network exposure instead of enabling an external connection.","verdict":"false_positive","confidence":0.96},{"id":"network:bin/preview.mjs:13:hardcoded-ip-address","reason":"The address is 127.0.0.1 and is used to constrain preview access to loopback. This reduces network exposure instead of enabling an external connection.","verdict":"false_positive","confidence":0.96},{"id":"network:brand-marks/catalog.json:13:hardcoded-ip-address","reason":"The numeric sequence is part of bundled brand-mark metadata or SVG geometry. It is not used as a network destination.","verdict":"false_positive","confidence":0.96},{"id":"network:renderers/shared/generated-brand-marks.mjs:14:hardcoded-ip-address","reason":"The numeric sequence is part of bundled brand-mark metadata or SVG geometry. It is not used as a network destination.","verdict":"false_positive","confidence":0.96},{"id":"network:renderers/shared/generated-brand-marks.mjs:73:hardcoded-ip-address","reason":"The numeric sequence is part of bundled brand-mark metadata or SVG geometry. It is not used as a network destination.","verdict":"false_positive","confidence":0.96},{"id":"network:renderers/shared/generated-brand-marks.mjs:109:hardcoded-ip-address","reason":"The numeric sequence is part of bundled brand-mark metadata or SVG geometry. It is not used as a network destination.","verdict":"false_positive","confidence":0.96},{"id":"network:test/brand-marks.test.mjs:250:hardcoded-ip-address","reason":"The address is a test vector for loopback, private-address, or SSRF behavior. It is not a production destination.","verdict":"false_positive","confidence":0.96},{"id":"network:test/brand-marks.test.mjs:253:hardcoded-ip-address","reason":"The address is a test vector for loopback, private-address, or SSRF behavior. It is not a production destination.","verdict":"false_positive","confidence":0.96},{"id":"network:test/brand-marks.test.mjs:271:hardcoded-ip-address","reason":"The address is a test vector for loopback, private-address, or SSRF behavior. It is not a production destination.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:assets/template.html:6060:hidden-file-access","reason":"The scanner matched regular-expression escapes, CSS class checks, or ordinary dot-prefixed staging names. The cited code does not access concealed credential files.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:assets/template.html:6066:hidden-file-access","reason":"The scanner matched regular-expression escapes, CSS class checks, or ordinary dot-prefixed staging names. The cited code does not access concealed credential files.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:assets/template.html:7965:hidden-file-access","reason":"The scanner matched regular-expression escapes, CSS class checks, or ordinary dot-prefixed staging names. The cited code does not access concealed credential files.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:bin/preview.mjs:141:hidden-file-access","reason":"The scanner matched regular-expression escapes, CSS class checks, or ordinary dot-prefixed staging names. The cited code does not access concealed credential files.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:bin/preview.mjs:144:hidden-file-access","reason":"The scanner matched regular-expression escapes, CSS class checks, or ordinary dot-prefixed staging names. The cited code does not access concealed credential files.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:delta/architecture-delta.mjs:254:hidden-file-access","reason":"The scanner matched regular-expression escapes, CSS class checks, or ordinary dot-prefixed staging names. The cited code does not access concealed credential files.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:delta/architecture-delta.mjs:255:hidden-file-access","reason":"The scanner matched regular-expression escapes, CSS class checks, or ordinary dot-prefixed staging names. The cited code does not access concealed credential files.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:delta/architecture-delta.mjs:1193:hidden-file-access","reason":"The scanner matched regular-expression escapes, CSS class checks, or ordinary dot-prefixed staging names. The cited code does not access concealed credential files.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:examples/dataflow-product-analytics.html:6171:hidden-file-access","reason":"The scanner matched regular-expression escapes, CSS class checks, or ordinary dot-prefixed staging names. The cited code does not access concealed credential files.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:examples/dataflow-product-analytics.html:6177:hidden-file-access","reason":"The scanner matched regular-expression escapes, CSS class checks, or ordinary dot-prefixed staging names. The cited code does not access concealed credential files.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:examples/dataflow-product-analytics.html:8076:hidden-file-access","reason":"The scanner matched regular-expression escapes, CSS class checks, or ordinary dot-prefixed staging names. The cited code does not access concealed credential files.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:renderers/shared/brand-marks.mjs:99:hidden-file-access","reason":"The scanner matched regular-expression escapes, CSS class checks, or ordinary dot-prefixed staging names. The cited code does not access concealed credential files.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:renderers/shared/repository-evidence.mjs:78:hidden-file-access","reason":"The scanner matched regular-expression escapes, CSS class checks, or ordinary dot-prefixed staging names. The cited code does not access concealed credential files.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:renderers/shared/validator.mjs:12:hidden-file-access","reason":"The scanner matched regular-expression escapes, CSS class checks, or ordinary dot-prefixed staging names. The cited code does not access concealed credential files.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:scripts/check-render-output.mjs:75:hidden-file-access","reason":"The scanner matched regular-expression escapes, CSS class checks, or ordinary dot-prefixed staging names. The cited code does not access concealed credential files.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:scripts/check-render-output.mjs:284:hidden-file-access","reason":"The scanner matched regular-expression escapes, CSS class checks, or ordinary dot-prefixed staging names. The cited code does not access concealed credential files.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:scripts/check-render-output.mjs:285:hidden-file-access","reason":"The scanner matched regular-expression escapes, CSS class checks, or ordinary dot-prefixed staging names. The cited code does not access concealed credential files.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:test/layout-rules.test.mjs:631:hidden-file-access","reason":"The scanner matched regular-expression escapes, CSS class checks, or ordinary dot-prefixed staging names. The cited code does not access concealed credential files.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:test/layout-rules.test.mjs:654:hidden-file-access","reason":"The scanner matched regular-expression escapes, CSS class checks, or ordinary dot-prefixed staging names. The cited code does not access concealed credential files.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:test/release-identity.test.mjs:51:hidden-file-access","reason":"The scanner matched regular-expression escapes, CSS class checks, or ordinary dot-prefixed staging names. The cited code does not access concealed credential files.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:bin/archify.mjs:345:node-js-fs-operations","reason":"The operation reads diagram inputs and templates or atomically manages generated artifacts and updater state. It is expected local file handling, not covert collection.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:bin/archify.mjs:349:node-js-fs-operations","reason":"The operation reads diagram inputs and templates or atomically manages generated artifacts and updater state. It is expected local file handling, not covert collection.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:bin/archify.mjs:356:node-js-fs-operations","reason":"The operation reads diagram inputs and templates or atomically manages generated artifacts and updater state. It is expected local file handling, not covert collection.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:renderers/shared/cli.mjs:22:node-js-fs-operations","reason":"The operation reads diagram inputs and templates or atomically manages generated artifacts and updater state. It is expected local file handling, not covert collection.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:renderers/shared/cli.mjs:28:node-js-fs-operations","reason":"The operation reads diagram inputs and templates or atomically manages generated artifacts and updater state. It is expected local file handling, not covert collection.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:renderers/shared/cli.mjs:57:node-js-fs-operations","reason":"The operation reads diagram inputs and templates or atomically manages generated artifacts and updater state. It is expected local file handling, not covert collection.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:scripts/check-render-output.mjs:23:node-js-fs-operations","reason":"The operation reads diagram inputs and templates or atomically manages generated artifacts and updater state. It is expected local file handling, not covert collection.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:scripts/check-update.mjs:515:node-js-fs-operations","reason":"The operation reads diagram inputs and templates or atomically manages generated artifacts and updater state. It is expected local file handling, not covert collection.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:scripts/check-update.mjs:599:node-js-fs-operations","reason":"The operation reads diagram inputs and templates or atomically manages generated artifacts and updater state. It is expected local file handling, not covert collection.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:test/adaptive-reader-layout.test.mjs:18:node-js-fs-operations","reason":"The operation reads diagram inputs and templates or atomically manages generated artifacts and updater state. It is expected local file handling, not covert collection.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:test/adaptive-reader-layout.test.mjs:19:node-js-fs-operations","reason":"The operation reads diagram inputs and templates or atomically manages generated artifacts and updater state. It is expected local file handling, not covert collection.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:test/animation.test.mjs:30:node-js-fs-operations","reason":"The operation reads diagram inputs and templates or atomically manages generated artifacts and updater state. It is expected local file handling, not covert collection.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:test/update-notifier.test.mjs:209:node-js-fs-promises-import","reason":"The operation reads diagram inputs and templates or atomically manages generated artifacts and updater state. It is expected local file handling, not covert collection.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:test/update-notifier.test.mjs:215:node-js-fs-promises-import","reason":"The operation reads diagram inputs and templates or atomically manages generated artifacts and updater state. It is expected local file handling, not covert collection.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:test/update-notifier.test.mjs:228:node-js-fs-promises-import","reason":"The operation reads diagram inputs and templates or atomically manages generated artifacts and updater state. It is expected local file handling, not covert collection.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:assets/template.html:5625:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template literals or Markdown inline code. They are not shell or Ruby command substitution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:assets/template.html:5677:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template literals or Markdown inline code. They are not shell or Ruby command substitution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:bin/archify.mjs:16:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template literals or Markdown inline code. They are not shell or Ruby command substitution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:bin/archify.mjs:45:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template literals or Markdown inline code. They are not shell or Ruby command substitution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:bin/archify.mjs:47:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template literals or Markdown inline code. They are not shell or Ruby command substitution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:delta/architecture-delta.mjs:17:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template literals or Markdown inline code. They are not shell or Ruby command substitution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:delta/architecture-delta.mjs:19:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template literals or Markdown inline code. They are not shell or Ruby command substitution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:delta/architecture-delta.mjs:79:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template literals or Markdown inline code. They are not shell or Ruby command substitution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:examples/dataflow-product-analytics.html:5736:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template literals or Markdown inline code. They are not shell or Ruby command substitution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:examples/dataflow-product-analytics.html:5788:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template literals or Markdown inline code. They are not shell or Ruby command substitution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:examples/lifecycle-agent-run.html:5685:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template literals or Markdown inline code. They are not shell or Ruby command substitution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:migrations/workflow-v2.mjs:278:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template literals or Markdown inline code. They are not shell or Ruby command substitution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:recipes/scenarios.mjs:276:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template literals or Markdown inline code. They are not shell or Ruby command substitution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:recipes/scenarios.mjs:281:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template literals or Markdown inline code. They are not shell or Ruby command substitution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:recipes/scenarios.mjs:282:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template literals or Markdown inline code. They are not shell or Ruby command substitution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:renderers/architecture/grid.mjs:45:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template literals or Markdown inline code. They are not shell or Ruby command substitution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:renderers/architecture/grid.mjs:49:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template literals or Markdown inline code. They are not shell or Ruby command substitution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:renderers/architecture/grid.mjs:53:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template literals or Markdown inline code. They are not shell or Ruby command substitution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/check-render-output.mjs:67:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template literals or Markdown inline code. They are not shell or Ruby command substitution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/check-render-output.mjs:84:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template literals or Markdown inline code. They are not shell or Ruby command substitution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/check-render-output.mjs:228:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template literals or Markdown inline code. They are not shell or Ruby command substitution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template literals or Markdown inline code. They are not shell or Ruby command substitution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template literals or Markdown inline code. They are not shell or Ruby command substitution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template literals or Markdown inline code. They are not shell or Ruby command substitution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:test/adaptive-reader-layout.test.mjs:41:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template literals or Markdown inline code. They are not shell or Ruby command substitution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:test/animation.test.mjs:35:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template literals or Markdown inline code. They are not shell or Ruby command substitution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:test/animation.test.mjs:36:ruby-shell-backtick-execution","reason":"The backticks delimit JavaScript template literals or Markdown inline code. They are not shell or Ruby command substitution.","verdict":"false_positive","confidence":0.96},{"id":"network:bin/preview.mjs:128:server-sent-events","reason":"EventSource connects only to the loopback preview server to report rebuild state. It is a local development channel, not an external stream.","verdict":"false_positive","confidence":0.96},{"id":"network:test/repository-evidence.test.mjs:64:ssh-protocol-url","reason":"The SSH URL is a repository-evidence test case used to normalize a GitHub origin. No SSH connection is opened.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:bin/archify.mjs:409:synchronous-file-operations","reason":"The operation reads diagram inputs and templates or atomically manages generated artifacts and updater state. It is expected local file handling, not covert collection.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:bin/archify.mjs:497:synchronous-file-operations","reason":"The operation reads diagram inputs and templates or atomically manages generated artifacts and updater state. It is expected local file handling, not covert collection.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:bin/archify.mjs:504:synchronous-file-operations","reason":"The operation reads diagram inputs and templates or atomically manages generated artifacts and updater state. It is expected local file handling, not covert collection.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:renderers/shared/cli.mjs:22:synchronous-file-operations","reason":"The operation reads diagram inputs and templates or atomically manages generated artifacts and updater state. It is expected local file handling, not covert collection.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:renderers/shared/cli.mjs:28:synchronous-file-operations","reason":"The operation reads diagram inputs and templates or atomically manages generated artifacts and updater state. It is expected local file handling, not covert collection.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:renderers/shared/cli.mjs:58:synchronous-file-operations","reason":"The operation reads diagram inputs and templates or atomically manages generated artifacts and updater state. It is expected local file handling, not covert collection.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:scripts/check-render-output.mjs:23:synchronous-file-operations","reason":"The operation reads diagram inputs and templates or atomically manages generated artifacts and updater state. It is expected local file handling, not covert collection.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:scripts/generate-brand-marks.mjs:12:synchronous-file-operations","reason":"The operation reads diagram inputs and templates or atomically manages generated artifacts and updater state. It is expected local file handling, not covert collection.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:scripts/generate-brand-marks.mjs:13:synchronous-file-operations","reason":"The operation reads diagram inputs and templates or atomically manages generated artifacts and updater state. It is expected local file handling, not covert collection.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:test/adaptive-reader-layout.test.mjs:18:synchronous-file-operations","reason":"The operation reads diagram inputs and templates or atomically manages generated artifacts and updater state. It is expected local file handling, not covert collection.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:test/adaptive-reader-layout.test.mjs:19:synchronous-file-operations","reason":"The operation reads diagram inputs and templates or atomically manages generated artifacts and updater state. It is expected local file handling, not covert collection.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:test/animation.test.mjs:30:synchronous-file-operations","reason":"The operation reads diagram inputs and templates or atomically manages generated artifacts and updater state. It is expected local file handling, not covert collection.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:bin/archify.mjs:1863:temp-directory-access","reason":"The code uses temporary or same-directory staging for validation, browser profiles, and atomic artifact delivery. Cleanup is part of the bounded operation.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:bin/visual-check.mjs:298:temp-directory-access","reason":"The code uses temporary or same-directory staging for validation, browser profiles, and atomic artifact delivery. Cleanup is part of the bounded operation.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:scripts/check-update.mjs:257:temp-directory-access","reason":"The code uses temporary or same-directory staging for validation, browser profiles, and atomic artifact delivery. Cleanup is part of the bounded operation.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:test/animation.test.mjs:11:temp-directory-access","reason":"The code uses temporary or same-directory staging for validation, browser profiles, and atomic artifact delivery. Cleanup is part of the bounded operation.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:test/architecture-delta.test.mjs:23:temp-directory-access","reason":"The code uses temporary or same-directory staging for validation, browser profiles, and atomic artifact delivery. Cleanup is part of the bounded operation.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:test/authored-reachability.test.mjs:13:temp-directory-access","reason":"The code uses temporary or same-directory staging for validation, browser profiles, and atomic artifact delivery. Cleanup is part of the bounded operation.","verdict":"false_positive","confidence":0.96},{"id":"network:test/webm-artifact.smoke.mjs:284:websocket-connection","reason":"The WebSocket is used by a browser smoke test against its local test server. It does not connect to a remote service.","verdict":"false_positive","confidence":0.96},{"id":"blocker:bin/open-artifact.mjs:24:network-reconnaissance","reason":"The scanner matched words such as Start-Process, repo-root, or local test text. The cited code does not enumerate hosts, ports, interfaces, or network services.","verdict":"false_positive","confidence":0.96},{"id":"blocker:renderers/shared/repository-evidence.mjs:115:network-reconnaissance","reason":"The scanner matched words such as Start-Process, repo-root, or local test text. The cited code does not enumerate hosts, ports, interfaces, or network services.","verdict":"false_positive","confidence":0.96},{"id":"blocker:renderers/shared/repository-evidence.mjs:117:network-reconnaissance","reason":"The scanner matched words such as Start-Process, repo-root, or local test text. The cited code does not enumerate hosts, ports, interfaces, or network services.","verdict":"false_positive","confidence":0.96},{"id":"blocker:renderers/shared/repository-evidence.mjs:137:network-reconnaissance","reason":"The scanner matched words such as Start-Process, repo-root, or local test text. The cited code does not enumerate hosts, ports, interfaces, or network services.","verdict":"false_positive","confidence":0.96},{"id":"blocker:test/open-artifact.test.mjs:30:network-reconnaissance","reason":"The scanner matched words such as Start-Process, repo-root, or local test text. The cited code does not enumerate hosts, ports, interfaces, or network services.","verdict":"false_positive","confidence":0.96},{"id":"blocker:test/real-repository-proof.test.mjs:187:network-reconnaissance","reason":"The scanner matched words such as Start-Process, repo-root, or local test text. The cited code does not enumerate hosts, ports, interfaces, or network services.","verdict":"false_positive","confidence":0.96},{"id":"blocker:test/repair-receipt.test.mjs:146:network-reconnaissance","reason":"The scanner matched words such as Start-Process, repo-root, or local test text. The cited code does not enumerate hosts, ports, interfaces, or network services.","verdict":"false_positive","confidence":0.96},{"id":"blocker:assets/template.html:5403:object-assign-review-for-prototype-pollution","reason":"The assignment creates a new local viewer payload and then adds a fixed count field. It does not merge values into global prototypes or shared configuration.","verdict":"false_positive","confidence":0.96},{"id":"blocker:examples/dataflow-product-analytics.html:5514:object-assign-review-for-prototype-pollution","reason":"The assignment creates a new local viewer payload and then adds a fixed count field. It does not merge values into global prototypes or shared configuration.","verdict":"false_positive","confidence":0.96},{"id":"blocker:examples/lifecycle-agent-run.html:5463:object-assign-review-for-prototype-pollution","reason":"The assignment creates a new local viewer payload and then adds a fixed count field. It does not merge values into global prototypes or shared configuration.","verdict":"false_positive","confidence":0.96},{"id":"blocker:examples/sequence-cache-miss-request.html:5529:object-assign-review-for-prototype-pollution","reason":"The assignment creates a new local viewer payload and then adds a fixed count field. It does not merge values into global prototypes or shared configuration.","verdict":"false_positive","confidence":0.96},{"id":"blocker:assets/template.html:202:system-reconnaissance","reason":"The match is lexical noise from words such as architecture, grid, valid, IDs, or system descriptions. No host or operating-system discovery occurs.","verdict":"false_positive","confidence":0.96},{"id":"blocker:assets/template.html:435:system-reconnaissance","reason":"The match is lexical noise from words such as architecture, grid, valid, IDs, or system descriptions. No host or operating-system discovery occurs.","verdict":"false_positive","confidence":0.96},{"id":"blocker:assets/template.html:473:system-reconnaissance","reason":"The match is lexical noise from words such as architecture, grid, valid, IDs, or system descriptions. No host or operating-system discovery occurs.","verdict":"false_positive","confidence":0.96},{"id":"blocker:bin/archify.mjs:1291:system-reconnaissance","reason":"The match is lexical noise from words such as architecture, grid, valid, IDs, or system descriptions. No host or operating-system discovery occurs.","verdict":"false_positive","confidence":0.96},{"id":"blocker:bin/archify.mjs:1295:system-reconnaissance","reason":"The match is lexical noise from words such as architecture, grid, valid, IDs, or system descriptions. No host or operating-system discovery occurs.","verdict":"false_positive","confidence":0.96},{"id":"blocker:bin/archify.mjs:1297:system-reconnaissance","reason":"The match is lexical noise from words such as architecture, grid, valid, IDs, or system descriptions. No host or operating-system discovery occurs.","verdict":"false_positive","confidence":0.96},{"id":"blocker:delta/architecture-delta.mjs:64:system-reconnaissance","reason":"The match is lexical noise from words such as architecture, grid, valid, IDs, or system descriptions. No host or operating-system discovery occurs.","verdict":"false_positive","confidence":0.96},{"id":"blocker:delta/architecture-delta.mjs:99:system-reconnaissance","reason":"The match is lexical noise from words such as architecture, grid, valid, IDs, or system descriptions. No host or operating-system discovery occurs.","verdict":"false_positive","confidence":0.96},{"id":"blocker:delta/architecture-delta.mjs:107:system-reconnaissance","reason":"The match is lexical noise from words such as architecture, grid, valid, IDs, or system descriptions. No host or operating-system discovery occurs.","verdict":"false_positive","confidence":0.96},{"id":"blocker:examples/async-job-roundtrip.sequence.json:57:system-reconnaissance","reason":"The match is lexical noise from words such as architecture, grid, valid, IDs, or system descriptions. No host or operating-system discovery occurs.","verdict":"false_positive","confidence":0.96},{"id":"blocker:examples/dataflow-product-analytics.html:202:system-reconnaissance","reason":"The match is lexical noise from words such as architecture, grid, valid, IDs, or system descriptions. No host or operating-system discovery occurs.","verdict":"false_positive","confidence":0.96},{"id":"blocker:examples/dataflow-product-analytics.html:435:system-reconnaissance","reason":"The match is lexical noise from words such as architecture, grid, valid, IDs, or system descriptions. No host or operating-system discovery occurs.","verdict":"false_positive","confidence":0.96},{"id":"blocker:migrations/workflow-v2.mjs:190:system-reconnaissance","reason":"The match is lexical noise from words such as architecture, grid, valid, IDs, or system descriptions. No host or operating-system discovery occurs.","verdict":"false_positive","confidence":0.96},{"id":"blocker:recipes/scenarios.mjs:309:system-reconnaissance","reason":"The match is lexical noise from words such as architecture, grid, valid, IDs, or system descriptions. No host or operating-system discovery occurs.","verdict":"false_positive","confidence":0.96},{"id":"blocker:recipes/scenarios.mjs:337:system-reconnaissance","reason":"The match is lexical noise from words such as architecture, grid, valid, IDs, or system descriptions. No host or operating-system discovery occurs.","verdict":"false_positive","confidence":0.96},{"id":"blocker:recipes/scenarios.mjs:363:system-reconnaissance","reason":"The match is lexical noise from words such as architecture, grid, valid, IDs, or system descriptions. No host or operating-system discovery occurs.","verdict":"false_positive","confidence":0.96},{"id":"blocker:references/authoring-contract.md:52:system-reconnaissance","reason":"The match is lexical noise from words such as architecture, grid, valid, IDs, or system descriptions. No host or operating-system discovery occurs.","verdict":"false_positive","confidence":0.96},{"id":"blocker:references/authoring-contract.md:140:system-reconnaissance","reason":"The match is lexical noise from words such as architecture, grid, valid, IDs, or system descriptions. No host or operating-system discovery occurs.","verdict":"false_positive","confidence":0.96},{"id":"blocker:references/authoring-contract.md:154:system-reconnaissance","reason":"The match is lexical noise from words such as architecture, grid, valid, IDs, or system descriptions. No host or operating-system discovery occurs.","verdict":"false_positive","confidence":0.96},{"id":"blocker:renderers/architecture/grid.mjs:1:system-reconnaissance","reason":"The match is lexical noise from words such as architecture, grid, valid, IDs, or system descriptions. No host or operating-system discovery occurs.","verdict":"false_positive","confidence":0.96},{"id":"blocker:renderers/architecture/grid.mjs:45:system-reconnaissance","reason":"The match is lexical noise from words such as architecture, grid, valid, IDs, or system descriptions. No host or operating-system discovery occurs.","verdict":"false_positive","confidence":0.96},{"id":"blocker:renderers/architecture/grid.mjs:57:system-reconnaissance","reason":"The match is lexical noise from words such as architecture, grid, valid, IDs, or system descriptions. No host or operating-system discovery occurs.","verdict":"false_positive","confidence":0.96},{"id":"blocker:schemas/README.md:67:system-reconnaissance","reason":"The match is lexical noise from words such as architecture, grid, valid, IDs, or system descriptions. No host or operating-system discovery occurs.","verdict":"false_positive","confidence":0.96},{"id":"blocker:schemas/README.md:97:system-reconnaissance","reason":"The match is lexical noise from words such as architecture, grid, valid, IDs, or system descriptions. No host or operating-system discovery occurs.","verdict":"false_positive","confidence":0.96},{"id":"blocker:scripts/check-render-output.mjs:338:system-reconnaissance","reason":"The match is lexical noise from words such as architecture, grid, valid, IDs, or system descriptions. No host or operating-system discovery occurs.","verdict":"false_positive","confidence":0.96},{"id":"blocker:scripts/check-render-output.mjs:343:system-reconnaissance","reason":"The match is lexical noise from words such as architecture, grid, valid, IDs, or system descriptions. No host or operating-system discovery occurs.","verdict":"false_positive","confidence":0.96},{"id":"blocker:SKILL.md:3:system-reconnaissance","reason":"The match is lexical noise from words such as architecture, grid, valid, IDs, or system descriptions. No host or operating-system discovery occurs.","verdict":"false_positive","confidence":0.96},{"id":"blocker:SKILL.md:67:system-reconnaissance","reason":"The match is lexical noise from words such as architecture, grid, valid, IDs, or system descriptions. No host or operating-system discovery occurs.","verdict":"false_positive","confidence":0.96},{"id":"blocker:test/adaptive-reader-layout.test.mjs:45:system-reconnaissance","reason":"The match is lexical noise from words such as architecture, grid, valid, IDs, or system descriptions. No host or operating-system discovery occurs.","verdict":"false_positive","confidence":0.96},{"id":"blocker:test/architecture-delta.test.mjs:48:system-reconnaissance","reason":"The match is lexical noise from words such as architecture, grid, valid, IDs, or system descriptions. No host or operating-system discovery occurs.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:bin/visual-check.mjs:561:array-join-empty-string","reason":"The join assembles HTML, SVG, or text fragments produced by the renderer. It is normal serialization and does not decode hidden instructions.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:delta/architecture-delta.mjs:417:array-join-empty-string","reason":"The join assembles HTML, SVG, or text fragments produced by the renderer. It is normal serialization and does not decode hidden instructions.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:delta/architecture-delta.mjs:446:array-join-empty-string","reason":"The join assembles HTML, SVG, or text fragments produced by the renderer. It is normal serialization and does not decode hidden instructions.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:renderers/shared/cli.mjs:193:array-join-empty-string","reason":"The join assembles HTML, SVG, or text fragments produced by the renderer. It is normal serialization and does not decode hidden instructions.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:test/brand-marks.test.mjs:577:array-join-empty-string","reason":"The join assembles HTML, SVG, or text fragments produced by the renderer. It is normal serialization and does not decode hidden instructions.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:test/webm-artifact.smoke.mjs:856:array-join-empty-string","reason":"The join assembles HTML, SVG, or text fragments produced by the renderer. It is normal serialization and does not decode hidden instructions.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:test/webm-artifact.smoke.mjs:882:base64-encode","reason":"The encoding converts generated WebM media bytes for a browser test. It is not used to conceal or transmit sensitive data.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:test/webm-artifact.smoke.mjs:950:base64-encode","reason":"The encoding converts generated WebM media bytes for a browser test. It is not used to conceal or transmit sensitive data.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:renderers/shared/utils.mjs:201:unicode-code-point-escape","reason":"The escapes support text-width classification, safe JSON embedding, delimiters, or visible ellipsis characters. They are not an obfuscation layer.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:assets/template.html:6277:unicode-escape-sequence","reason":"The escapes support text-width classification, safe JSON embedding, delimiters, or visible ellipsis characters. They are not an obfuscation layer.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:assets/template.html:7471:unicode-escape-sequence","reason":"The escapes support text-width classification, safe JSON embedding, delimiters, or visible ellipsis characters. They are not an obfuscation layer.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:bin/preview.mjs:159:unicode-escape-sequence","reason":"The escapes support text-width classification, safe JSON embedding, delimiters, or visible ellipsis characters. They are not an obfuscation layer.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:delta/architecture-delta.mjs:113:unicode-escape-sequence","reason":"The escapes support text-width classification, safe JSON embedding, delimiters, or visible ellipsis characters. They are not an obfuscation layer.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:delta/architecture-delta.mjs:324:unicode-escape-sequence","reason":"The escapes support text-width classification, safe JSON embedding, delimiters, or visible ellipsis characters. They are not an obfuscation layer.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:examples/dataflow-product-analytics.html:4964:unicode-escape-sequence","reason":"The escapes support text-width classification, safe JSON embedding, delimiters, or visible ellipsis characters. They are not an obfuscation layer.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:examples/dataflow-product-analytics.html:6388:unicode-escape-sequence","reason":"The escapes support text-width classification, safe JSON embedding, delimiters, or visible ellipsis characters. They are not an obfuscation layer.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:recipes/scenarios.mjs:268:unicode-escape-sequence","reason":"The escapes support text-width classification, safe JSON embedding, delimiters, or visible ellipsis characters. They are not an obfuscation layer.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:renderers/shared/geometry.mjs:172:unicode-escape-sequence","reason":"The escapes support text-width classification, safe JSON embedding, delimiters, or visible ellipsis characters. They are not an obfuscation layer.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:renderers/shared/geometry.mjs:1219:unicode-escape-sequence","reason":"The escapes support text-width classification, safe JSON embedding, delimiters, or visible ellipsis characters. They are not an obfuscation layer.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:scripts/update-contract.mjs:5:unicode-escape-sequence","reason":"The escapes support text-width classification, safe JSON embedding, delimiters, or visible ellipsis characters. They are not an obfuscation layer.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:test/chapter-delta-preview.test.mjs:77:unicode-escape-sequence","reason":"The escapes support text-width classification, safe JSON embedding, delimiters, or visible ellipsis characters. They are not an obfuscation layer.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:test/finder.test.mjs:56:unicode-escape-sequence","reason":"The escapes support text-width classification, safe JSON embedding, delimiters, or visible ellipsis characters. They are not an obfuscation layer.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:test/golden.mjs:67:url-decode","reason":"The decoding occurs in tests that parse generated artifact URLs. It does not unpack executable content or bypass URL validation.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:test/site-language-continuity.test.mjs:96:url-decode","reason":"The decoding occurs in tests that parse generated artifact URLs. It does not unpack executable content or bypass URL validation.","verdict":"false_positive","confidence":0.96},{"id":"env_access:renderers/shared/brand-marks.mjs:124:environment-variable-access-dot-notation","reason":"Environment access is limited to documented runtime controls, cache locations, or inheritance by the packaged Node child. No values are sent as credentials or telemetry.","verdict":"false_positive","confidence":0.96},{"id":"env_access:renderers/shared/brand-marks.mjs:152:environment-variable-access-dot-notation","reason":"Environment access is limited to documented runtime controls, cache locations, or inheritance by the packaged Node child. No values are sent as credentials or telemetry.","verdict":"false_positive","confidence":0.96},{"id":"env_access:scripts/check-update.mjs:1393:environment-variable-access-dot-notation","reason":"Environment access is limited to documented runtime controls, cache locations, or inheritance by the packaged Node child. No values are sent as credentials or telemetry.","verdict":"false_positive","confidence":0.96},{"id":"env_access:scripts/check-update.mjs:1397:environment-variable-access-dot-notation","reason":"Environment access is limited to documented runtime controls, cache locations, or inheritance by the packaged Node child. No values are sent as credentials or telemetry.","verdict":"false_positive","confidence":0.96},{"id":"env_access:test/brand-marks.test.mjs:356:environment-variable-access-dot-notation","reason":"Environment access is limited to documented runtime controls, cache locations, or inheritance by the packaged Node child. No values are sent as credentials or telemetry.","verdict":"false_positive","confidence":0.96},{"id":"env_access:test/brand-marks.test.mjs:357:environment-variable-access-dot-notation","reason":"Environment access is limited to documented runtime controls, cache locations, or inheritance by the packaged Node child. No values are sent as credentials or telemetry.","verdict":"false_positive","confidence":0.96},{"id":"env_access:bin/archify.mjs:55:environment-variable-object","reason":"Environment access is limited to documented runtime controls, cache locations, or inheritance by the packaged Node child. No values are sent as credentials or telemetry.","verdict":"false_positive","confidence":0.96},{"id":"env_access:bin/preview.mjs:516:environment-variable-object","reason":"Environment access is limited to documented runtime controls, cache locations, or inheritance by the packaged Node child. No values are sent as credentials or telemetry.","verdict":"false_positive","confidence":0.96},{"id":"env_access:renderers/shared/brand-marks.mjs:124:environment-variable-object","reason":"Environment access is limited to documented runtime controls, cache locations, or inheritance by the packaged Node child. No values are sent as credentials or telemetry.","verdict":"false_positive","confidence":0.96},{"id":"env_access:renderers/shared/brand-marks.mjs:152:environment-variable-object","reason":"Environment access is limited to documented runtime controls, cache locations, or inheritance by the packaged Node child. No values are sent as credentials or telemetry.","verdict":"false_positive","confidence":0.96},{"id":"env_access:scripts/check-update.mjs:1393:environment-variable-object","reason":"Environment access is limited to documented runtime controls, cache locations, or inheritance by the packaged Node child. No values are sent as credentials or telemetry.","verdict":"false_positive","confidence":0.96},{"id":"env_access:scripts/check-update.mjs:1397:environment-variable-object","reason":"Environment access is limited to documented runtime controls, cache locations, or inheritance by the packaged Node child. No values are sent as credentials or telemetry.","verdict":"false_positive","confidence":0.96},{"id":"env_access:test/brand-marks.test.mjs:44:environment-variable-object","reason":"Environment access is limited to documented runtime controls, cache locations, or inheritance by the packaged Node child. No values are sent as credentials or telemetry.","verdict":"false_positive","confidence":0.96},{"id":"env_access:test/brand-marks.test.mjs:58:environment-variable-object","reason":"Environment access is limited to documented runtime controls, cache locations, or inheritance by the packaged Node child. No values are sent as credentials or telemetry.","verdict":"false_positive","confidence":0.96},{"id":"network:test/cli.test.mjs:482:fetch-api-call","reason":"The fetch is in a CLI test and targets the loopback preview URL to inspect state and shutdown behavior. It does not contact an external endpoint.","verdict":"false_positive","confidence":0.96},{"id":"network:test/cli.test.mjs:494:fetch-api-call","reason":"The fetch is in a CLI test and targets the loopback preview URL to inspect state and shutdown behavior. It does not contact an external endpoint.","verdict":"false_positive","confidence":0.96},{"id":"network:assets/template.html:36:hardcoded-url","reason":"Opening the generated HTML initiates an external Google Fonts connection, which exposes viewer network metadata and contradicts fully self-contained offline behavior.","verdict":"confirmed","severity":"low","confidence":0.98},{"id":"network:assets/template.html:37:hardcoded-url","reason":"Opening the generated HTML initiates an external Google Fonts connection, which exposes viewer network metadata and contradicts fully self-contained offline behavior.","verdict":"confirmed","severity":"low","confidence":0.98},{"id":"network:bin/open-artifact.mjs:80:hardcoded-url","reason":"The URL is constructed or validated as an HTTP loopback preview address. External hosts and credential-bearing URLs are rejected.","verdict":"false_positive","confidence":0.96},{"id":"network:bin/preview.mjs:266:hardcoded-url","reason":"The URL is constructed or validated as an HTTP loopback preview address. External hosts and credential-bearing URLs are rejected.","verdict":"false_positive","confidence":0.96},{"id":"network:brand-marks/catalog.json:14:hardcoded-url","reason":"The URL is bundled source or documentation metadata for a brand mark. Rendering uses generated local mark data and does not fetch this URL.","verdict":"false_positive","confidence":0.96},{"id":"network:brand-marks/catalog.json:15:hardcoded-url","reason":"The URL is bundled source or documentation metadata for a brand mark. Rendering uses generated local mark data and does not fetch this URL.","verdict":"false_positive","confidence":0.96},{"id":"network:examples/dataflow-product-analytics.html:36:hardcoded-url","reason":"Opening the generated HTML initiates an external Google Fonts connection, which exposes viewer network metadata and contradicts fully self-contained offline behavior.","verdict":"confirmed","severity":"low","confidence":0.98},{"id":"network:examples/dataflow-product-analytics.html:37:hardcoded-url","reason":"Opening the generated HTML initiates an external Google Fonts connection, which exposes viewer network metadata and contradicts fully self-contained offline behavior.","verdict":"confirmed","severity":"low","confidence":0.98},{"id":"network:package-lock.json:26:hardcoded-url","reason":"The URL is dependency provenance or funding metadata in the npm lockfile. Merely storing it does not perform a runtime request.","verdict":"false_positive","confidence":0.96},{"id":"network:package-lock.json:38:hardcoded-url","reason":"The URL is dependency provenance or funding metadata in the npm lockfile. Merely storing it does not perform a runtime request.","verdict":"false_positive","confidence":0.96},{"id":"network:references/brand-marks.md:30:hardcoded-url","reason":"The URL is bundled source or documentation metadata for a brand mark. Rendering uses generated local mark data and does not fetch this URL.","verdict":"false_positive","confidence":0.96},{"id":"network:references/brand-marks.md:41:hardcoded-url","reason":"The URL is bundled source or documentation metadata for a brand mark. Rendering uses generated local mark data and does not fetch this URL.","verdict":"false_positive","confidence":0.96},{"id":"network:renderers/shared/generated-brand-marks.mjs:18:hardcoded-url","reason":"The URL is bundled source or documentation metadata for a brand mark. Rendering uses generated local mark data and does not fetch this URL.","verdict":"false_positive","confidence":0.96},{"id":"network:renderers/shared/generated-brand-marks.mjs:38:hardcoded-url","reason":"The URL is bundled source or documentation metadata for a brand mark. Rendering uses generated local mark data and does not fetch this URL.","verdict":"false_positive","confidence":0.96},{"id":"network:schemas/architecture.schema.json:2:hardcoded-url","reason":"The URL is a JSON Schema identifier and does not trigger a network fetch during validation. Validators are generated and bundled locally.","verdict":"false_positive","confidence":0.96},{"id":"network:schemas/architecture.schema.json:3:hardcoded-url","reason":"The URL is a JSON Schema identifier and does not trigger a network fetch during validation. Validators are generated and bundled locally.","verdict":"false_positive","confidence":0.96},{"id":"network:scripts/update-contract.mjs:2:hardcoded-url","reason":"The URL records repository provenance and is not itself an executed request.","verdict":"false_positive","confidence":0.96},{"id":"network:scripts/update-contract.mjs:3:hardcoded-url","reason":"This URL is the configured remote manifest used by the automatic update-check workflow. The check creates an outbound request after diagram authoring begins.","verdict":"confirmed","severity":"low","confidence":0.96},{"id":"network:skill-release.json:7:hardcoded-url","reason":"The URL records repository provenance and is not itself an executed request.","verdict":"false_positive","confidence":0.96},{"id":"network:skill-release.json:9:hardcoded-url","reason":"This URL is the configured remote manifest used by the automatic update-check workflow. The check creates an outbound request after diagram authoring begins.","verdict":"confirmed","severity":"low","confidence":0.96},{"id":"network:test/architecture-delta.test.mjs:257:hardcoded-url","reason":"The URL is test data for repository comparison and is never requested. It does not create runtime network behavior.","verdict":"false_positive","confidence":0.96},{"id":"network:test/architecture-delta.test.mjs:258:hardcoded-url","reason":"The URL is test data for repository comparison and is never requested. It does not create runtime network behavior.","verdict":"false_positive","confidence":0.96},{"id":"network:renderers/shared/brand-marks.mjs:181:http-client-library","reason":"Brand capture performs an explicit, user-requested bounded GET. It rejects credentials and private addresses, pins validated DNS results, limits redirects, and caps response sizes.","verdict":"false_positive","confidence":0.96},{"id":"network:test/preview.test.mjs:40:http-client-library","reason":"The HTTP client is a test helper that targets the loopback preview server. It does not send data to an external host.","verdict":"false_positive","confidence":0.96},{"id":"network:test/preview.test.mjs:40:http-https-request","reason":"The request is a test helper for the loopback preview server. It does not contact an external destination.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:bin/archify.mjs:325:node-js-fs-stat-operations","reason":"Stat calls support atomic output replacement, symlink-aware path checks, and updater-state validation. They do not inspect unrelated user files.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:bin/archify.mjs:326:node-js-fs-stat-operations","reason":"Stat calls support atomic output replacement, symlink-aware path checks, and updater-state validation. They do not inspect unrelated user files.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:renderers/shared/output-path.mjs:25:node-js-fs-stat-operations","reason":"Stat calls support atomic output replacement, symlink-aware path checks, and updater-state validation. They do not inspect unrelated user files.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:renderers/shared/output-path.mjs:45:node-js-fs-stat-operations","reason":"Stat calls support atomic output replacement, symlink-aware path checks, and updater-state validation. They do not inspect unrelated user files.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:scripts/check-update.mjs:214:node-js-fs-stat-operations","reason":"Stat calls support atomic output replacement, symlink-aware path checks, and updater-state validation. They do not inspect unrelated user files.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:scripts/check-update.mjs:225:node-js-fs-stat-operations","reason":"Stat calls support atomic output replacement, symlink-aware path checks, and updater-state validation. They do not inspect unrelated user files.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:test/architecture-delta.test.mjs:477:node-js-fs-stat-operations","reason":"Stat calls support atomic output replacement, symlink-aware path checks, and updater-state validation. They do not inspect unrelated user files.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:test/architecture-delta.test.mjs:489:node-js-fs-stat-operations","reason":"Stat calls support atomic output replacement, symlink-aware path checks, and updater-state validation. They do not inspect unrelated user files.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:bin/archify.mjs:1831:standard-device-file-access","reason":"The CLI sends renderer output to /dev/null during a layout-only diagnostic. It neither reads device data nor accesses a sensitive device.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:bin/archify.mjs:525:temp-file-creation","reason":"The code uses temporary or same-directory staging for validation, browser profiles, and atomic artifact delivery. Cleanup is part of the bounded operation.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:bin/archify.mjs:843:temp-file-creation","reason":"The code uses temporary or same-directory staging for validation, browser profiles, and atomic artifact delivery. Cleanup is part of the bounded operation.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:test/animation.test.mjs:11:temp-file-creation","reason":"The code uses temporary or same-directory staging for validation, browser profiles, and atomic artifact delivery. Cleanup is part of the bounded operation.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:test/architecture-delta.test.mjs:23:temp-file-creation","reason":"The code uses temporary or same-directory staging for validation, browser profiles, and atomic artifact delivery. Cleanup is part of the bounded operation.","verdict":"false_positive","confidence":0.96},{"id":"network:test/start-page.test.mjs:169:xmlhttprequest","reason":"XMLHttpRequest is a stubbed browser API in a generated-page test. It does not perform a production network request.","verdict":"false_positive","confidence":0.96}],"semantic_findings":[{"title":"Undisclosed Automatic Update Check","severity":"medium","locations":[{"file":"SKILL.md","line_end":44,"line_start":37},{"file":"scripts/update-contract.mjs","line_end":3,"line_start":1}],"confidence":0.98,"description":"The skill directs the agent to run a packaged update checker after creating the first candidate and to hide successful or failed checks. The checker uses a remote manifest, creating an unrequested network request and local cache state.","confidence_reasoning":"The instruction explicitly requires the check and suppresses disclosure in normal and failure cases. The packaged contract defines the remote manifest endpoint."}],"subject_marketplace_commit_sha":"4a2fb6268a251eebbd457945e9f3f486ca165b32","subject_content_hash":"5bf0cac8cfb50608941f3a0ff66a5e76837662e2dd05ce406297f8c59a740e6a","subject_tree_hash":"4ea342b53984b10b0c5c156ae808df84296482156e6cb6dd11405cbfbabc2438","subject_plugin_path":"skills/tt-a1i/archify","audit_payload_hash":"86e6f63358570dda7c8444b5baa63c8f","confirmed_risk_level":"medium","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"4a2fb6268a251eebbd457945e9f3f486ca165b32","contentHash":"5bf0cac8cfb50608941f3a0ff66a5e76837662e2dd05ce406297f8c59a740e6a","treeHash":"4ea342b53984b10b0c5c156ae808df84296482156e6cb6dd11405cbfbabc2438","pluginPath":"skills/tt-a1i/archify","auditPayloadHash":"86e6f63358570dda7c8444b5baa63c8f"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/tt-a1i-archify/audits/2/attestation","status":"superseded"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":1,"capabilityReviewCount":6,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"confirmation_required","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"superseded","verificationState":"not_verified"},"isLatest":false}}