{"data":{"skill":{"slug":"wheresryan22-anatomy","name":"anatomy","icon":"📦","repo":"https://github.com/wheresryan22/anatomy/tree/dbf697a527bbf7d358668e1557cb1e35ff725d46/","status":"approved","author":"wheresryan22","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"111bcd14-873b-4c38-aea8-8a88ed3cd8e9","skill_id":"f4e4944f-e4dc-4a66-a39b-94eae048811b","version":1,"content_hash":"v3:a5d66e6915301b999741c6b4437f9eacacc9af0d:8798bed1ba9b1cc5d0e6f77a9613ab61a707ce3fb7fc0750d20b7c0c3ca1d893:c5094cb108cda96d41403fd91ea4be03d364a73098a1afea8408904e763998c4:736b696c6c732f7768657265737279616e32322f616e61746f6d79:57e9c2a675f3b2477b5a978cf6500a43","risk_level":"medium","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"confirmation_required","manual_install_policy":"allowed","summary":"Most presented matches are benign geometry, documentation, local screenshots, and loopback browser control; no evidence found of prompt injection or intentional exfiltration. CLI-selected imports execute host code, and browser checks relax local-file isolation. Three oversized files and 2,518 omitted matches remain review gaps; this audit does not establish complete repository safety. Static review was capped at 400/2918 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.","remediation":[{"issue":"Static review capped","severity":"medium","suggestion":"Manually review the omitted 2518 static analyzer matches or reduce bundled generated/vendor/reference content before enabling automatic publication."},{"issue":"Browser checks relax local-file isolation.","severity":"medium","suggestion":"Remove cross-file access by default. Serve assets from a restricted local directory, or require explicit consent and filesystem isolation for file-mode checks."},{"issue":"Verification imports execute user-selected modules with host privileges.","severity":"medium","suggestion":"Require trusted build targets and explicit execution consent. Run unknown modules in a sandbox without credentials, unrestricted filesystem access, or network access."},{"issue":"Oversized files and capped static results leave incomplete security coverage.","severity":"low","suggestion":"Review all three skipped HTML files and the 2,518 omitted matches. Provide reproducible builds and smaller reviewable artifacts before automatic publication."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":".github/ISSUE_TEMPLATE/bug_report.yml","line_end":9,"line_start":9},{"file":".github/ISSUE_TEMPLATE/bug_report.yml","line_end":84,"line_start":84},{"file":".github/workflows/ci.yml","line_end":64,"line_start":64},{"file":"evals/evals.json","line_end":7,"line_start":7},{"file":"evals/evals.json","line_end":25,"line_start":25},{"file":"evals/evals.json","line_end":31,"line_start":31},{"file":"examples/arcade-cabinet/arcade-cabinet-light.html","line_end":188,"line_start":188},{"file":"examples/arcade-cabinet/arcade-cabinet-light.html","line_end":521,"line_start":521},{"file":"examples/arcade-cabinet/arcade-cabinet-light.html","line_end":532,"line_start":532},{"file":"examples/arcade-cabinet/arcade-cabinet-light.html","line_end":534,"line_start":534},{"file":"examples/arcade-cabinet/arcade-cabinet-light.html","line_end":570,"line_start":570},{"file":"examples/arcade-cabinet/arcade-cabinet-light.html","line_end":575,"line_start":575},{"file":"examples/arcade-cabinet/arcade-cabinet-light.html","line_end":576,"line_start":576},{"file":"examples/arcade-cabinet/arcade-cabinet-light.html","line_end":580,"line_start":580},{"file":"examples/arcade-cabinet/arcade-cabinet-light.html","line_end":582,"line_start":582},{"file":"examples/arcade-cabinet/arcade-cabinet-light.html","line_end":585,"line_start":585},{"file":"examples/arcade-cabinet/arcade-cabinet-light.html","line_end":587,"line_start":587},{"file":"examples/arcade-cabinet/arcade-cabinet-light.html","line_end":590,"line_start":590},{"file":"examples/arcade-cabinet/arcade-cabinet-light.html","line_end":591,"line_start":591},{"file":"examples/arcade-cabinet/arcade-cabinet-light.html","line_end":597,"line_start":596},{"file":"examples/arcade-cabinet/arcade-cabinet-light.html","line_end":604,"line_start":597},{"file":"examples/arcade-cabinet/arcade-cabinet-light.html","line_end":608,"line_start":608},{"file":"examples/arcade-cabinet/arcade-cabinet-light.html","line_end":610,"line_start":610},{"file":"examples/arcade-cabinet/arcade-cabinet-light.html","line_end":621,"line_start":621},{"file":"examples/arcade-cabinet/arcade-cabinet-light.html","line_end":654,"line_start":654},{"file":"examples/arcade-cabinet/arcade-cabinet-light.html","line_end":659,"line_start":659},{"file":"examples/arcade-cabinet/arcade-cabinet-light.html","line_end":663,"line_start":663},{"file":"examples/arcade-cabinet/arcade-cabinet-light.html","line_end":665,"line_start":665},{"file":"examples/arcade-cabinet/arcade-cabinet-light.html","line_end":666,"line_start":666},{"file":"examples/arcade-cabinet/arcade-cabinet-light.html","line_end":675,"line_start":675},{"file":"examples/arcade-cabinet/arcade-cabinet-light.html","line_end":679,"line_start":679},{"file":"examples/arcade-cabinet/arcade-cabinet-light.html","line_end":680,"line_start":680},{"file":"examples/arcade-cabinet/arcade-cabinet-light.html","line_end":683,"line_start":683},{"file":"examples/arcade-cabinet/arcade-cabinet-light.html","line_end":686,"line_start":686},{"file":"examples/arcade-cabinet/arcade-cabinet-light.html","line_end":689,"line_start":689},{"file":"examples/arcade-cabinet/arcade-cabinet-light.html","line_end":692,"line_start":690},{"file":"examples/arcade-cabinet/arcade-cabinet-light.html","line_end":692,"line_start":692},{"file":"examples/arcade-cabinet/arcade-cabinet-light.html","line_end":697,"line_start":694},{"file":"examples/arcade-cabinet/arcade-cabinet-light.html","line_end":702,"line_start":702},{"file":"examples/arcade-cabinet/arcade-cabinet-light.html","line_end":703,"line_start":703},{"file":"examples/arcade-cabinet/arcade-cabinet-light.html","line_end":705,"line_start":705},{"file":"examples/arcade-cabinet/arcade-cabinet-light.html","line_end":708,"line_start":708},{"file":"examples/arcade-cabinet/arcade-cabinet-light.html","line_end":710,"line_start":710},{"file":"examples/arcade-cabinet/arcade-cabinet-light.html","line_end":712,"line_start":712},{"file":"examples/arcade-cabinet/arcade-cabinet-light.html","line_end":715,"line_start":715},{"file":"examples/arcade-cabinet/arcade-cabinet-light.html","line_end":723,"line_start":717},{"file":"examples/arcade-cabinet/arcade-cabinet-light.html","line_end":831,"line_start":724},{"file":"examples/arcade-cabinet/arcade-cabinet-light.html","line_end":1720,"line_start":1720},{"file":"examples/arcade-cabinet/arcade-cabinet-light.html","line_end":2071,"line_start":2071},{"file":"examples/arcade-cabinet/arcade-cabinet-light.html","line_end":2161,"line_start":2161}]},{"factor":"network","evidence":[{"file":".github/ISSUE_TEMPLATE/config.yml","line_end":4,"line_start":4},{"file":"CONTRIBUTING.md","line_end":16,"line_start":16},{"file":"README.md","line_end":136,"line_start":136},{"file":"references/verify.md","line_end":16,"line_start":16},{"file":"scripts/capture.mjs","line_end":133,"line_start":133},{"file":"scripts/capture.mjs","line_end":134,"line_start":134},{"file":"scripts/capture.mjs","line_end":133,"line_start":133},{"file":"scripts/capture.mjs","line_end":133,"line_start":133},{"file":"scripts/drive.mjs","line_end":133,"line_start":133},{"file":"scripts/drive.mjs","line_end":134,"line_start":134},{"file":"scripts/drive.mjs","line_end":133,"line_start":133},{"file":"scripts/drive.mjs","line_end":133,"line_start":133},{"file":"scripts/turn-check.mjs","line_end":51,"line_start":51},{"file":"scripts/turn-check.mjs","line_end":52,"line_start":52},{"file":"scripts/turn-check.mjs","line_end":51,"line_start":51},{"file":"scripts/turn-check.mjs","line_end":51,"line_start":51}]},{"factor":"filesystem","evidence":[{"file":"CONTRIBUTING.md","line_end":23,"line_start":23},{"file":"CONTRIBUTING.md","line_end":23,"line_start":23},{"file":"CONTRIBUTING.md","line_end":23,"line_start":23},{"file":"examples/arcade-cabinet/build.mjs","line_end":1,"line_start":1},{"file":"examples/arcade-cabinet/build.mjs","line_end":683,"line_start":683},{"file":"examples/arcade-cabinet/build.mjs","line_end":684,"line_start":684},{"file":"examples/arcade-cabinet/build.mjs","line_end":688,"line_start":688},{"file":"examples/arcade-cabinet/build.mjs","line_end":689,"line_start":689},{"file":"examples/arcade-cabinet/build.mjs","line_end":690,"line_start":690},{"file":"examples/arcade-cabinet/build.mjs","line_end":711,"line_start":711},{"file":"examples/arcade-cabinet/build.mjs","line_end":4,"line_start":4},{"file":"examples/arcade-cabinet/build.mjs","line_end":5,"line_start":5},{"file":"examples/arcade-cabinet/build.mjs","line_end":6,"line_start":6},{"file":"examples/arcade-cabinet/build.mjs","line_end":7,"line_start":7},{"file":"examples/arcade-cabinet/build.mjs","line_end":8,"line_start":8},{"file":"examples/desk-computer/build.mjs","line_end":1,"line_start":1},{"file":"examples/desk-computer/build.mjs","line_end":434,"line_start":434},{"file":"examples/desk-computer/build.mjs","line_end":4,"line_start":4},{"file":"examples/desk-computer/build.mjs","line_end":5,"line_start":5},{"file":"examples/dial-indicator/build.mjs","line_end":1,"line_start":1},{"file":"examples/dial-indicator/build.mjs","line_end":274,"line_start":274},{"file":"examples/dial-indicator/build.mjs","line_end":4,"line_start":4},{"file":"examples/dial-indicator/build.mjs","line_end":5,"line_start":5},{"file":"examples/raptor-engine/build.mjs","line_end":1,"line_start":1},{"file":"examples/raptor-engine/build.mjs","line_end":931,"line_start":931},{"file":"examples/raptor-engine/build.mjs","line_end":932,"line_start":932},{"file":"examples/raptor-engine/build.mjs","line_end":935,"line_start":935},{"file":"examples/raptor-engine/build.mjs","line_end":4,"line_start":4},{"file":"examples/raptor-engine/build.mjs","line_end":5,"line_start":5},{"file":"examples/raptor-engine/build.mjs","line_end":6,"line_start":6},{"file":"examples/raptor-engine/build.mjs","line_end":7,"line_start":7},{"file":"examples/raptor-engine/build.mjs","line_end":8,"line_start":8},{"file":"examples/raptor-engine/build.mjs","line_end":9,"line_start":9},{"file":"examples/ripple-tank/build.mjs","line_end":1,"line_start":1},{"file":"examples/ripple-tank/build.mjs","line_end":552,"line_start":552},{"file":"examples/ripple-tank/build.mjs","line_end":553,"line_start":553},{"file":"examples/ripple-tank/build.mjs","line_end":554,"line_start":554},{"file":"examples/ripple-tank/build.mjs","line_end":557,"line_start":557},{"file":"examples/ripple-tank/build.mjs","line_end":4,"line_start":4},{"file":"examples/ripple-tank/build.mjs","line_end":5,"line_start":5},{"file":"examples/ripple-tank/build.mjs","line_end":6,"line_start":6},{"file":"examples/ripple-tank/build.mjs","line_end":7,"line_start":7},{"file":"examples/ripple-tank/build.mjs","line_end":8,"line_start":8},{"file":"examples/ripple-tank/live.js","line_end":176,"line_start":176},{"file":"examples/ripple-tank/live.js","line_end":177,"line_start":177},{"file":"examples/ripple-tank/live.js","line_end":233,"line_start":233},{"file":"examples/ripple-tank/live.js","line_end":234,"line_start":234},{"file":"examples/ripple-tank/ripple-tank-light.html","line_end":914,"line_start":914},{"file":"examples/ripple-tank/ripple-tank-light.html","line_end":915,"line_start":915},{"file":"examples/ripple-tank/ripple-tank-light.html","line_end":1381,"line_start":1381}]},{"factor":"scripts","evidence":[{"file":"examples/arcade-cabinet/arcade-cabinet-light.html","line_end":2403,"line_start":2403},{"file":"examples/arcade-cabinet/arcade-cabinet-light.html","line_end":2411,"line_start":2411},{"file":"examples/arcade-cabinet/arcade-cabinet-light.html","line_end":2432,"line_start":2432},{"file":"examples/arcade-cabinet/arcade-cabinet-light.html","line_end":2609,"line_start":2609},{"file":"examples/arcade-cabinet/arcade-cabinet-light.html","line_end":2610,"line_start":2610},{"file":"examples/arcade-cabinet/arcade-cabinet-light.html","line_end":2392,"line_start":2392},{"file":"examples/arcade-cabinet/arcade-cabinet-light.html","line_end":2393,"line_start":2393},{"file":"examples/arcade-cabinet/arcade-cabinet.html","line_end":2403,"line_start":2403},{"file":"examples/arcade-cabinet/arcade-cabinet.html","line_end":2411,"line_start":2411},{"file":"examples/arcade-cabinet/arcade-cabinet.html","line_end":2432,"line_start":2432},{"file":"examples/arcade-cabinet/arcade-cabinet.html","line_end":2609,"line_start":2609},{"file":"examples/arcade-cabinet/arcade-cabinet.html","line_end":2610,"line_start":2610},{"file":"examples/arcade-cabinet/arcade-cabinet.html","line_end":2392,"line_start":2392},{"file":"examples/arcade-cabinet/arcade-cabinet.html","line_end":2393,"line_start":2393},{"file":"examples/arcade-cabinet/live.js","line_end":183,"line_start":183},{"file":"examples/arcade-cabinet/live.js","line_end":191,"line_start":191},{"file":"examples/arcade-cabinet/live.js","line_end":212,"line_start":212},{"file":"examples/arcade-cabinet/live.js","line_end":389,"line_start":389},{"file":"examples/arcade-cabinet/live.js","line_end":390,"line_start":390},{"file":"examples/arcade-cabinet/live.js","line_end":172,"line_start":172},{"file":"examples/arcade-cabinet/live.js","line_end":173,"line_start":173},{"file":"scripts/turn-bench.mjs","line_end":20,"line_start":20},{"file":"scripts/turn-check.mjs","line_end":485,"line_start":485},{"file":"scripts/turn-check.mjs","line_end":486,"line_start":486}]},{"factor":"env_access","evidence":[{"file":"scripts/capture.mjs","line_end":66,"line_start":66},{"file":"scripts/capture.mjs","line_end":66,"line_start":66},{"file":"scripts/drive.mjs","line_end":63,"line_start":63},{"file":"scripts/drive.mjs","line_end":63,"line_start":63},{"file":"scripts/turn-check.mjs","line_end":30,"line_start":30},{"file":"scripts/turn-check.mjs","line_end":30,"line_start":30}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Dynamic import() expression","locations":[{"file":"scripts/turn-bench.mjs","line_end":20,"line_start":20}],"confidence":0.82,"description":"const mod = await import(pathToFileURL(resolve(argv[0])).href);","review_kind":"capability","source_category":"scripts","source_severity":"medium","confidence_reasoning":"The CLI-selected build module executes with Node filesystem and network privileges. An untrusted build target can run arbitrary host code."},{"title":"Dynamic import() expression","locations":[{"file":"scripts/turn-check.mjs","line_end":486,"line_start":486}],"confidence":0.82,"description":"const { T, P } = await import(pathToFileURL(resolve(target)).href);","review_kind":"capability","source_category":"scripts","source_severity":"medium","confidence_reasoning":"The CLI-selected build module executes with Node filesystem and network privileges. An untrusted build target can run arbitrary host code."},{"title":"Browser Checks Enable Cross-File Access","locations":[{"file":"scripts/capture.mjs","line_end":110,"line_start":101},{"file":"scripts/drive.mjs","line_end":112,"line_start":112},{"file":"scripts/turn-check.mjs","line_end":38,"line_start":38},{"file":"SECURITY.md","line_end":5,"line_start":5}],"confidence":0.94,"description":"Browser checks enable --allow-file-access-from-files for user-selected pages. A malicious local page can access other readable local files; temporary profiles do not isolate filesystem access.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"All three browser launchers enable cross-file access and accept local pages. SECURITY.md acknowledges this trust requirement; no malicious use was observed."}],"low_findings":[{"title":"Unscanned file (too_large) — manual review required","locations":[{"file":"examples/raptor-engine/raptor-engine-light.html","line_end":1,"line_start":1}],"confidence":0.45,"description":"[unscanned: too_large]","review_kind":"security","source_category":"metadata","source_severity":"low","confidence_reasoning":"The analyzer skipped this oversized executable HTML file. Its full contents remain unreviewed, so this coverage gap is retained without alleging malware."},{"title":"Unscanned file (too_large) — manual review required","locations":[{"file":"examples/raptor-engine/raptor-engine.html","line_end":1,"line_start":1}],"confidence":0.45,"description":"[unscanned: too_large]","review_kind":"security","source_category":"metadata","source_severity":"low","confidence_reasoning":"The analyzer skipped this oversized executable HTML file. Its full contents remain unreviewed, so this coverage gap is retained without alleging malware."},{"title":"Unscanned file (too_large) — manual review required","locations":[{"file":"examples/turning-dial/turning-stress-light.html","line_end":1,"line_start":1}],"confidence":0.45,"description":"[unscanned: too_large]","review_kind":"security","source_category":"metadata","source_severity":"low","confidence_reasoning":"The analyzer skipped this oversized executable HTML file. Its full contents remain unreviewed, so this coverage gap is retained without alleging malware."}],"dangerous_patterns":[],"files_scanned":91,"total_lines":57606,"audit_model":"codex","audited_at":"2026-10-11T14:34:18.078+00:00","created_at":"2026-10-11T15:40:25.009761+00:00","static_findings":[{"id":"obfuscation:kit/turn-fixed.mjs:49:long-fromcharcode-sequence","file":"kit/turn-fixed.mjs","pattern":"Long fromCharCode sequence","snippet":"return \"\\u0001\" + String.fromCharCode(at & 0xffff, at >>> 16, count, closed ? 1 : 0);","category":"obfuscation","line_end":49,"severity":"critical","line_start":49},{"id":"blocker:.github/ISSUE_TEMPLATE/bug_report.yml:9:screen-capture-upload","file":".github/ISSUE_TEMPLATE/bug_report.yml","pattern":"Screen capture upload","snippet":"Thanks for reporting. A screenshot helps most, and for a drawing fault a 4× close-up (`node scripts/","category":"blocker","line_end":9,"severity":"high","line_start":9},{"id":"blocker:README.md:80:screen-capture-upload","file":"README.md","pattern":"Screen capture upload","snippet":"Every screenshot is the light theme of a page in [`examples/`](examples), captured with the skill's ","category":"blocker","line_end":80,"severity":"high","line_start":80},{"id":"blocker:scripts/capture.mjs:201:screen-capture-upload","file":"scripts/capture.mjs","pattern":"Screen capture upload","snippet":"const shot = await send(\"Page.captureScreenshot\", { format: \"png\", captureBeyondViewport: true, clip","category":"blocker","line_end":201,"severity":"high","line_start":201},{"id":"blocker:scripts/drive.mjs:179:screen-capture-upload","file":"scripts/drive.mjs","pattern":"Screen capture upload","snippet":"const shot = await send(\"Page.captureScreenshot\", { format: \"png\", clip, captureBeyondViewport: true","category":"blocker","line_end":179,"severity":"high","line_start":179},{"id":"sensitive:examples/arcade-cabinet/arcade-cabinet-light.html:956:certificate-key-files","file":"examples/arcade-cabinet/arcade-cabinet-light.html","pattern":"Certificate/key files","snippet":"if (current && current.key === key) {","category":"sensitive","line_end":956,"severity":"high","line_start":956},{"id":"sensitive:examples/arcade-cabinet/arcade-cabinet-light.html:960:certificate-key-files","file":"examples/arcade-cabinet/arcade-cabinet-light.html","pattern":"Certificate/key files","snippet":"if (current && current.key !== null) out.push(current);","category":"sensitive","line_end":960,"severity":"high","line_start":960},{"id":"sensitive:examples/arcade-cabinet/arcade-cabinet-light.html:963:certificate-key-files","file":"examples/arcade-cabinet/arcade-cabinet-light.html","pattern":"Certificate/key files","snippet":"if (current && current.key !== null) out.push(current);","category":"sensitive","line_end":963,"severity":"high","line_start":963},{"id":"sensitive:examples/arcade-cabinet/arcade-cabinet-light.html:1264:certificate-key-files","file":"examples/arcade-cabinet/arcade-cabinet-light.html","pattern":"Certificate/key files","snippet":"const tones = [...new Set(run.flatMap((level) => [...level.groups.keys()]))].sort((x, y) => x - y);","category":"sensitive","line_end":1264,"severity":"high","line_start":1264},{"id":"sensitive:examples/arcade-cabinet/arcade-cabinet-light.html:2771:certificate-key-files","file":"examples/arcade-cabinet/arcade-cabinet-light.html","pattern":"Certificate/key files","snippet":"const key = event.key;","category":"sensitive","line_end":2771,"severity":"high","line_start":2771},{"id":"sensitive:examples/arcade-cabinet/arcade-cabinet-light.html:2796:certificate-key-files","file":"examples/arcade-cabinet/arcade-cabinet-light.html","pattern":"Certificate/key files","snippet":"if (event.key === \"ArrowLeft\" || event.key === \"ArrowRight\") {","category":"sensitive","line_end":2796,"severity":"high","line_start":2796},{"id":"sensitive:examples/arcade-cabinet/arcade-cabinet-light.html:2800:certificate-key-files","file":"examples/arcade-cabinet/arcade-cabinet-light.html","pattern":"Certificate/key files","snippet":"if (event.key === \" \" || event.key === \"Enter\") state.fireHeld = Math.min(state.fireHeld, 0.06);","category":"sensitive","line_end":2800,"severity":"high","line_start":2800},{"id":"sensitive:examples/arcade-cabinet/arcade-cabinet.html:956:certificate-key-files","file":"examples/arcade-cabinet/arcade-cabinet.html","pattern":"Certificate/key files","snippet":"if (current && current.key === key) {","category":"sensitive","line_end":956,"severity":"high","line_start":956},{"id":"sensitive:examples/arcade-cabinet/arcade-cabinet.html:960:certificate-key-files","file":"examples/arcade-cabinet/arcade-cabinet.html","pattern":"Certificate/key files","snippet":"if (current && current.key !== null) out.push(current);","category":"sensitive","line_end":960,"severity":"high","line_start":960},{"id":"sensitive:examples/arcade-cabinet/arcade-cabinet.html:963:certificate-key-files","file":"examples/arcade-cabinet/arcade-cabinet.html","pattern":"Certificate/key files","snippet":"if (current && current.key !== null) out.push(current);","category":"sensitive","line_end":963,"severity":"high","line_start":963},{"id":"sensitive:examples/arcade-cabinet/arcade-cabinet.html:1264:certificate-key-files","file":"examples/arcade-cabinet/arcade-cabinet.html","pattern":"Certificate/key files","snippet":"const tones = [...new Set(run.flatMap((level) => [...level.groups.keys()]))].sort((x, y) => x - y);","category":"sensitive","line_end":1264,"severity":"high","line_start":1264},{"id":"sensitive:kit/audit.mjs:646:certificate-key-files","file":"kit/audit.mjs","pattern":"Certificate/key files","snippet":"export const keyAt = (item, state, V) => item.key + liftOf(item, V) * shareOf(item, state);","category":"sensitive","line_end":646,"severity":"high","line_start":646},{"id":"sensitive:kit/audit.mjs:650:certificate-key-files","file":"kit/audit.mjs","pattern":"Certificate/key files","snippet":"const start = items.map((item) => item.key);","category":"sensitive","line_end":650,"severity":"high","line_start":650},{"id":"sensitive:kit/audit.mjs:723:certificate-key-files","file":"kit/audit.mjs","pattern":"Certificate/key files","snippet":"const order = items.map((item, index) => ({ index, key: keyAt(item, state, V) })).sort((x, y) => x.k","category":"sensitive","line_end":723,"severity":"high","line_start":723},{"id":"sensitive:kit/audit.mjs:1811:certificate-key-files","file":"kit/audit.mjs","pattern":"Certificate/key files","snippet":"items.forEach((item, index) => (item.key = solved.keys[index]));","category":"sensitive","line_end":1811,"severity":"high","line_start":1811},{"id":"sensitive:kit/gl-shared.mjs:95:certificate-key-files","file":"kit/gl-shared.mjs","pattern":"Certificate/key files","snippet":"for (const name of [\"uCanvas\", \"uView\", \"uOrigin\", \"uK\", \"uCam\", \"uTime\", ...uniforms, ...Object.key","category":"sensitive","line_end":95,"severity":"high","line_start":95},{"id":"sensitive:kit/gl.mjs:95:certificate-key-files","file":"kit/gl.mjs","pattern":"Certificate/key files","snippet":"for (const name of [\"uCanvas\", \"uView\", \"uOrigin\", \"uK\", \"uCam\", \"uTime\", ...uniforms, ...Object.key","category":"sensitive","line_end":95,"severity":"high","line_start":95},{"id":"sensitive:kit/lathe.mjs:125:certificate-key-files","file":"kit/lathe.mjs","pattern":"Certificate/key files","snippet":"if (current && current.key === key) {","category":"sensitive","line_end":125,"severity":"high","line_start":125},{"id":"sensitive:kit/lathe.mjs:129:certificate-key-files","file":"kit/lathe.mjs","pattern":"Certificate/key files","snippet":"if (current && current.key !== null) out.push(current);","category":"sensitive","line_end":129,"severity":"high","line_start":129},{"id":"sensitive:kit/lathe.mjs:132:certificate-key-files","file":"kit/lathe.mjs","pattern":"Certificate/key files","snippet":"if (current && current.key !== null) out.push(current);","category":"sensitive","line_end":132,"severity":"high","line_start":132},{"id":"sensitive:kit/lathe.mjs:433:certificate-key-files","file":"kit/lathe.mjs","pattern":"Certificate/key files","snippet":"const tones = [...new Set(run.flatMap((level) => [...level.groups.keys()]))].sort((x, y) => x - y);","category":"sensitive","line_end":433,"severity":"high","line_start":433},{"id":"sensitive:kit/turn-audit.mjs:333:certificate-key-files","file":"kit/turn-audit.mjs","pattern":"Certificate/key files","snippet":"const result = { separation: [], unseparated: [], cycles: [], forced: [], swaps: [], layers: [], rig","category":"sensitive","line_end":333,"severity":"high","line_start":333},{"id":"sensitive:references/kit.md:270:certificate-key-files","file":"references/kit.md","pattern":"Certificate/key files","snippet":"R.items.sort((a, b) => a.key - b.key);","category":"sensitive","line_end":270,"severity":"high","line_start":270},{"id":"sensitive:references/kit.md:343:certificate-key-files","file":"references/kit.md","pattern":"Certificate/key files","snippet":"items.sort((a, b) => a.key - b.key);","category":"sensitive","line_end":343,"severity":"high","line_start":343},{"id":"sensitive:scripts/capture.mjs:53:certificate-key-files","file":"scripts/capture.mjs","pattern":"Certificate/key files","snippet":"else if (arg === \"--key\") options.keys = next().split(\",\");","category":"sensitive","line_end":53,"severity":"high","line_start":53},{"id":"sensitive:scripts/capture.mjs:187:certificate-key-files","file":"scripts/capture.mjs","pattern":"Certificate/key files","snippet":"if (options.keys) {","category":"sensitive","line_end":187,"severity":"high","line_start":187},{"id":"sensitive:scripts/capture.mjs:190:certificate-key-files","file":"scripts/capture.mjs","pattern":"Certificate/key files","snippet":"for (const entry of options.keys) {","category":"sensitive","line_end":190,"severity":"high","line_start":190},{"id":"sensitive:.gitignore:5:environment-file-access","file":".gitignore","pattern":"Environment file access","snippet":".env","category":"sensitive","line_end":5,"severity":"high","line_start":5},{"id":"sensitive:.gitignore:6:environment-file-access","file":".gitignore","pattern":"Environment file access","snippet":".env.*","category":"sensitive","line_end":6,"severity":"high","line_start":6},{"id":"sensitive:scripts/capture.mjs:66:environment-file-access","file":"scripts/capture.mjs","pattern":"Environment file access","snippet":"process.env.CHROME_PATH,","category":"sensitive","line_end":66,"severity":"high","line_start":66},{"id":"sensitive:scripts/drive.mjs:63:environment-file-access","file":"scripts/drive.mjs","pattern":"Environment file access","snippet":"process.env.CHROME_PATH,","category":"sensitive","line_end":63,"severity":"high","line_start":63},{"id":"sensitive:scripts/turn-check.mjs:30:environment-file-access","file":"scripts/turn-check.mjs","pattern":"Environment file access","snippet":"const candidates = [process.env.CHROME_PATH, \"/Applications/Google Chrome.app/Contents/MacOS/Google ","category":"sensitive","line_end":30,"severity":"high","line_start":30},{"id":"obfuscation:examples/desk-computer/desk-computer-light.html:137:heuristic-extremely-long-line-185158-chars-likel","file":"examples/desk-computer/desk-computer-light.html","pattern":"[HEURISTIC] Extremely long line (185158 chars) - likely obfuscated","snippet":"
>> 16, count, closed ? 1 : 0);","category":"obfuscation","line_end":49,"severity":"medium","line_start":49},{"id":"scripts:scripts/turn-bench.mjs:20:dynamic-import-expression","file":"scripts/turn-bench.mjs","pattern":"Dynamic import() expression","snippet":"const mod = await import(pathToFileURL(resolve(argv[0])).href);","category":"scripts","line_end":20,"severity":"medium","line_start":20},{"id":"scripts:scripts/turn-check.mjs:485:dynamic-import-expression","file":"scripts/turn-check.mjs","pattern":"Dynamic import() expression","snippet":"const F = await import(\"./turn-fidelity.mjs\");","category":"scripts","line_end":485,"severity":"medium","line_start":485},{"id":"scripts:scripts/turn-check.mjs:486:dynamic-import-expression","file":"scripts/turn-check.mjs","pattern":"Dynamic import() expression","snippet":"const { T, P } = await import(pathToFileURL(resolve(target)).href);","category":"scripts","line_end":486,"severity":"medium","line_start":486},{"id":"network:scripts/capture.mjs:133:hardcoded-ip-address","file":"scripts/capture.mjs","pattern":"Hardcoded IP address","snippet":"const target = await (await fetch(`http://127.0.0.1:${port}/json/new?about:blank`, { method: \"PUT\" }","category":"network","line_end":133,"severity":"medium","line_start":133},{"id":"network:scripts/drive.mjs:133:hardcoded-ip-address","file":"scripts/drive.mjs","pattern":"Hardcoded IP address","snippet":"const page = await (await fetch(`http://127.0.0.1:${port}/json/new?about:blank`, { method: \"PUT\" }))","category":"network","line_end":133,"severity":"medium","line_start":133},{"id":"network:scripts/turn-check.mjs:51:hardcoded-ip-address","file":"scripts/turn-check.mjs","pattern":"Hardcoded IP address","snippet":"const page = await (await fetch(`http://127.0.0.1:${port}/json/new?about:blank`, { method: \"PUT\" }))","category":"network","line_end":51,"severity":"medium","line_start":51},{"id":"filesystem:CONTRIBUTING.md:23:hidden-file-access","file":"CONTRIBUTING.md","pattern":"Hidden file access","snippet":"ln -s \"$PWD\" ~/.claude/skills/anatomy","category":"filesystem","line_end":23,"severity":"medium","line_start":23},{"id":"filesystem:examples/ripple-tank/live.js:176:hidden-file-access","file":"examples/ripple-tank/live.js","pattern":"Hidden file access","snippet":"float off=(1.-mix(.95,1.-uExpo.x,paper))/.89*base;","category":"filesystem","line_end":176,"severity":"medium","line_start":176},{"id":"filesystem:examples/ripple-tank/live.js:177:hidden-file-access","file":"examples/ripple-tank/live.js","pattern":"Hidden file access","snippet":"float ink=mix(off,(1.-lit)/.89*base,uLight);","category":"filesystem","line_end":177,"severity":"medium","line_start":177},{"id":"filesystem:examples/ripple-tank/live.js:233:hidden-file-access","file":"examples/ripple-tank/live.js","pattern":"Hidden file access","snippet":"float lift=uPale>.5?max(refl-flat0,0.)/.15:refl;","category":"filesystem","line_end":233,"severity":"medium","line_start":233},{"id":"filesystem:examples/ripple-tank/live.js:234:hidden-file-access","file":"examples/ripple-tank/live.js","pattern":"Hidden file access","snippet":"float sink=uPale>.5?max(flat0-refl,0.)/.74:0.;","category":"filesystem","line_end":234,"severity":"medium","line_start":234},{"id":"filesystem:examples/ripple-tank/ripple-tank-light.html:914:hidden-file-access","file":"examples/ripple-tank/ripple-tank-light.html","pattern":"Hidden file access","snippet":"float fbm2(vec2 p){float s=0.;float a=.5;for(int i=0;i<4;i++){s+=a*noise2(p);p=p*2.07+vec2(17.1,9.2)","category":"filesystem","line_end":914,"severity":"medium","line_start":914},{"id":"filesystem:examples/ripple-tank/ripple-tank-light.html:915:hidden-file-access","file":"examples/ripple-tank/ripple-tank-light.html","pattern":"Hidden file access","snippet":"float fbm3(vec3 p){float s=0.;float a=.5;for(int i=0;i<4;i++){s+=a*noise3(p);p=p*2.07+vec3(17.1,9.2,","category":"filesystem","line_end":915,"severity":"medium","line_start":915},{"id":"filesystem:examples/ripple-tank/ripple-tank-light.html:1381:hidden-file-access","file":"examples/ripple-tank/ripple-tank-light.html","pattern":"Hidden file access","snippet":"float off=(1.-mix(.95,1.-uExpo.x,paper))/.89*base;","category":"filesystem","line_end":1381,"severity":"medium","line_start":1381},{"id":"filesystem:examples/ripple-tank/ripple-tank-light.html:1382:hidden-file-access","file":"examples/ripple-tank/ripple-tank-light.html","pattern":"Hidden file access","snippet":"float ink=mix(off,(1.-lit)/.89*base,uLight);","category":"filesystem","line_end":1382,"severity":"medium","line_start":1382},{"id":"filesystem:examples/ripple-tank/ripple-tank-light.html:1438:hidden-file-access","file":"examples/ripple-tank/ripple-tank-light.html","pattern":"Hidden file access","snippet":"float lift=uPale>.5?max(refl-flat0,0.)/.15:refl;","category":"filesystem","line_end":1438,"severity":"medium","line_start":1438},{"id":"filesystem:examples/ripple-tank/ripple-tank-light.html:1439:hidden-file-access","file":"examples/ripple-tank/ripple-tank-light.html","pattern":"Hidden file access","snippet":"float sink=uPale>.5?max(flat0-refl,0.)/.74:0.;","category":"filesystem","line_end":1439,"severity":"medium","line_start":1439},{"id":"filesystem:examples/ripple-tank/ripple-tank.html:914:hidden-file-access","file":"examples/ripple-tank/ripple-tank.html","pattern":"Hidden file access","snippet":"float fbm2(vec2 p){float s=0.;float a=.5;for(int i=0;i<4;i++){s+=a*noise2(p);p=p*2.07+vec2(17.1,9.2)","category":"filesystem","line_end":914,"severity":"medium","line_start":914},{"id":"filesystem:kit/audit.mjs:1468:hidden-file-access","file":"kit/audit.mjs","pattern":"Hidden file access","snippet":"const frame = { m, clip: own ? meetBox(top.clip ?? own, own) : top.clip, skip: top.skip || [\"defs\", ","category":"filesystem","line_end":1468,"severity":"medium","line_start":1468},{"id":"filesystem:kit/gl-shared.mjs:24:hidden-file-access","file":"kit/gl-shared.mjs","pattern":"Hidden file access","snippet":"float fbm2(vec2 p){float s=0.;float a=.5;for(int i=0;i<4;i++){s+=a*noise2(p);p=p*2.07+vec2(17.1,9.2)","category":"filesystem","line_end":24,"severity":"medium","line_start":24},{"id":"filesystem:kit/gl-shared.mjs:25:hidden-file-access","file":"kit/gl-shared.mjs","pattern":"Hidden file access","snippet":"float fbm3(vec3 p){float s=0.;float a=.5;for(int i=0;i<4;i++){s+=a*noise3(p);p=p*2.07+vec3(17.1,9.2,","category":"filesystem","line_end":25,"severity":"medium","line_start":25},{"id":"filesystem:kit/gl.mjs:24:hidden-file-access","file":"kit/gl.mjs","pattern":"Hidden file access","snippet":"float fbm2(vec2 p){float s=0.;float a=.5;for(int i=0;i<4;i++){s+=a*noise2(p);p=p*2.07+vec2(17.1,9.2)","category":"filesystem","line_end":24,"severity":"medium","line_start":24},{"id":"filesystem:kit/gl.mjs:25:hidden-file-access","file":"kit/gl.mjs","pattern":"Hidden file access","snippet":"float fbm3(vec3 p){float s=0.;float a=.5;for(int i=0;i<4;i++){s+=a*noise3(p);p=p*2.07+vec3(17.1,9.2,","category":"filesystem","line_end":25,"severity":"medium","line_start":25},{"id":"filesystem:kit/turn-audit.mjs:252:hidden-file-access","file":"kit/turn-audit.mjs","pattern":"Hidden file access","snippet":"else if (role.type === \"path\" && /^s[0-4]$/.test(role.name)) layers.push({ polys: flatPolys(d), v: N","category":"filesystem","line_end":252,"severity":"medium","line_start":252},{"id":"filesystem:kit/turn-audit.mjs:904:hidden-file-access","file":"kit/turn-audit.mjs","pattern":"Hidden file access","snippet":"else if (role.type === \"path\" && /^s[0-4]$/.test(role.name)) out.sheets.push([areaOfPath(f.d[r]), (f","category":"filesystem","line_end":904,"severity":"medium","line_start":904},{"id":"filesystem:kit/turn-audit.mjs:995:hidden-file-access","file":"kit/turn-audit.mjs","pattern":"Hidden file access","snippet":"const areaRoles = (run) => run.roles.map((role, r) => (role.type === \"face\" || /^s[0-4]$/.test(role.","category":"filesystem","line_end":995,"severity":"medium","line_start":995},{"id":"filesystem:README.md:100:hidden-file-access","file":"README.md","pattern":"Hidden file access","snippet":"| **skills CLI**, for you | `npx skills add wheresryan22/anatomy -g -a claude-code` | `~/.claude/ski","category":"filesystem","line_end":100,"severity":"medium","line_start":100},{"id":"filesystem:README.md:102:hidden-file-access","file":"README.md","pattern":"Hidden file access","snippet":"| **git**, for you | `git clone https://github.com/wheresryan22/anatomy.git ~/.claude/skills/anatomy","category":"filesystem","line_end":102,"severity":"medium","line_start":102},{"id":"filesystem:README.md:104:hidden-file-access","file":"README.md","pattern":"Hidden file access","snippet":"| **Download**, no git | see below | `~/.claude/skills/anatomy` |","category":"filesystem","line_end":104,"severity":"medium","line_start":104},{"id":"filesystem:README.md:131:hidden-file-access","file":"README.md","pattern":"Hidden file access","snippet":"[Download the ZIP](https://github.com/wheresryan22/anatomy/archive/refs/heads/main.zip), unpack it, ","category":"filesystem","line_end":131,"severity":"medium","line_start":131},{"id":"filesystem:README.md:136:hidden-file-access","file":"README.md","pattern":"Hidden file access","snippet":"mkdir -p ~/.claude/skills/anatomy && curl -L https://github.com/wheresryan22/anatomy/archive/refs/he","category":"filesystem","line_end":136,"severity":"medium","line_start":136},{"id":"filesystem:scripts/capture.mjs:93:hidden-file-access","file":"scripts/capture.mjs","pattern":"Hidden file access","snippet":"const url = /^https?:|^file:/.test(options.target) ? options.target : pathToFileURL(resolve(options.","category":"filesystem","line_end":93,"severity":"medium","line_start":93},{"id":"filesystem:scripts/capture.mjs:193:hidden-file-access","file":"scripts/capture.mjs","pattern":"Hidden file access","snippet":"const code = named[key] ?? (/^[0-9]$/.test(key) ? `Digit${key}` : key.length === 1 ? `Key${key.toUpp","category":"filesystem","line_end":193,"severity":"medium","line_start":193},{"id":"filesystem:scripts/drive.mjs:105:hidden-file-access","file":"scripts/drive.mjs","pattern":"Hidden file access","snippet":"const url = /^https?:|^file:/.test(target) ? target : pathToFileURL(resolve(target)).href;","category":"filesystem","line_end":105,"severity":"medium","line_start":105},{"id":"filesystem:scripts/drive.mjs:166:hidden-file-access","file":"scripts/drive.mjs","pattern":"Hidden file access","snippet":"const NO_GL = `(()=>{const get=HTMLCanvasElement.prototype.getContext;HTMLCanvasElement.prototype.ge","category":"filesystem","line_end":166,"severity":"medium","line_start":166},{"id":"filesystem:scripts/drive.mjs:224:hidden-file-access","file":"scripts/drive.mjs","pattern":"Hidden file access","snippet":"const code = args[2] ?? (named[key] ?? (/^[0-9]$/.test(key) ? `Digit${key}` : key.length === 1 ? `Ke","category":"filesystem","line_end":224,"severity":"medium","line_start":224},{"id":"filesystem:scripts/turn-check.mjs:78:hidden-file-access","file":"scripts/turn-check.mjs","pattern":"Hidden file access","snippet":"const NO_GL = `(()=>{const get=HTMLCanvasElement.prototype.getContext;HTMLCanvasElement.prototype.ge","category":"filesystem","line_end":78,"severity":"medium","line_start":78},{"id":"filesystem:scripts/turn-check.mjs:82:hidden-file-access","file":"scripts/turn-check.mjs","pattern":"Hidden file access","snippet":"const url = /^https?:|^file:/.test(target) ? target : pathToFileURL(resolve(target)).href;","category":"filesystem","line_end":82,"severity":"medium","line_start":82},{"id":"filesystem:scripts/turn-fidelity.mjs:21:hidden-file-access","file":"scripts/turn-fidelity.mjs","pattern":"Hidden file access","snippet":"out.push({ pts, closed: /Z\\s*$/.test(body) });","category":"filesystem","line_end":21,"severity":"medium","line_start":21},{"id":"scripts:examples/arcade-cabinet/arcade-cabinet-light.html:2403:innerhtml-assignment-xss-risk","file":"examples/arcade-cabinet/arcade-cabinet-light.html","pattern":"innerHTML assignment (XSS risk)","snippet":"for (const key of [\"fly\", \"chute\", \"fall\"]) if (el[key].innerHTML !== out[key]) el[key].innerHTML = ","category":"scripts","line_end":2403,"severity":"medium","line_start":2403},{"id":"scripts:examples/arcade-cabinet/arcade-cabinet-light.html:2411:innerhtml-assignment-xss-risk","file":"examples/arcade-cabinet/arcade-cabinet-light.html","pattern":"innerHTML assignment (XSS risk)","snippet":"el.pile.innerHTML = out;","category":"scripts","line_end":2411,"severity":"medium","line_start":2411},{"id":"scripts:examples/arcade-cabinet/arcade-cabinet-light.html:2432:innerhtml-assignment-xss-risk","file":"examples/arcade-cabinet/arcade-cabinet-light.html","pattern":"innerHTML assignment (XSS risk)","snippet":"el.wire.innerHTML = lineSvg(pathOf([at(from), at(tip)]), { tone: w.x > 0.3 ? \"lit\" : \"hi\", free: \"en","category":"scripts","line_end":2432,"severity":"medium","line_start":2432},{"id":"scripts:examples/arcade-cabinet/arcade-cabinet-light.html:2609:innerhtml-assignment-xss-risk","file":"examples/arcade-cabinet/arcade-cabinet-light.html","pattern":"innerHTML assignment (XSS risk)","snippet":"el.upper.innerHTML = PARTS.stickUpper(s.x * TILT, 0);","category":"scripts","line_end":2609,"severity":"medium","line_start":2609},{"id":"scripts:examples/arcade-cabinet/arcade-cabinet-light.html:2610:innerhtml-assignment-xss-risk","file":"examples/arcade-cabinet/arcade-cabinet-light.html","pattern":"innerHTML assignment (XSS risk)","snippet":"el.lower.innerHTML = PARTS.stickLower(s.x * TILT, 0);","category":"scripts","line_end":2610,"severity":"medium","line_start":2610},{"id":"scripts:examples/arcade-cabinet/arcade-cabinet.html:2403:innerhtml-assignment-xss-risk","file":"examples/arcade-cabinet/arcade-cabinet.html","pattern":"innerHTML assignment (XSS risk)","snippet":"for (const key of [\"fly\", \"chute\", \"fall\"]) if (el[key].innerHTML !== out[key]) el[key].innerHTML = ","category":"scripts","line_end":2403,"severity":"medium","line_start":2403},{"id":"scripts:examples/arcade-cabinet/arcade-cabinet.html:2411:innerhtml-assignment-xss-risk","file":"examples/arcade-cabinet/arcade-cabinet.html","pattern":"innerHTML assignment (XSS risk)","snippet":"el.pile.innerHTML = out;","category":"scripts","line_end":2411,"severity":"medium","line_start":2411},{"id":"scripts:examples/arcade-cabinet/arcade-cabinet.html:2432:innerhtml-assignment-xss-risk","file":"examples/arcade-cabinet/arcade-cabinet.html","pattern":"innerHTML assignment (XSS risk)","snippet":"el.wire.innerHTML = lineSvg(pathOf([at(from), at(tip)]), { tone: w.x > 0.3 ? \"lit\" : \"hi\", free: \"en","category":"scripts","line_end":2432,"severity":"medium","line_start":2432},{"id":"scripts:examples/arcade-cabinet/arcade-cabinet.html:2609:innerhtml-assignment-xss-risk","file":"examples/arcade-cabinet/arcade-cabinet.html","pattern":"innerHTML assignment (XSS risk)","snippet":"el.upper.innerHTML = PARTS.stickUpper(s.x * TILT, 0);","category":"scripts","line_end":2609,"severity":"medium","line_start":2609},{"id":"scripts:examples/arcade-cabinet/arcade-cabinet.html:2610:innerhtml-assignment-xss-risk","file":"examples/arcade-cabinet/arcade-cabinet.html","pattern":"innerHTML assignment (XSS risk)","snippet":"el.lower.innerHTML = PARTS.stickLower(s.x * TILT, 0);","category":"scripts","line_end":2610,"severity":"medium","line_start":2610},{"id":"scripts:examples/arcade-cabinet/live.js:183:innerhtml-assignment-xss-risk","file":"examples/arcade-cabinet/live.js","pattern":"innerHTML assignment (XSS risk)","snippet":"for (const key of [\"fly\", \"chute\", \"fall\"]) if (el[key].innerHTML !== out[key]) el[key].innerHTML = ","category":"scripts","line_end":183,"severity":"medium","line_start":183},{"id":"scripts:examples/arcade-cabinet/arcade-cabinet-light.html:2392:insertadjacenthtml-xss-risk","file":"examples/arcade-cabinet/arcade-cabinet-light.html","pattern":"insertAdjacentHTML (XSS risk)","snippet":"svg.querySelector(\"defs\") || svg.insertAdjacentHTML(\"afterbegin\", \"\");","category":"scripts","line_end":2392,"severity":"medium","line_start":2392},{"id":"scripts:examples/arcade-cabinet/arcade-cabinet-light.html:2393:insertadjacenthtml-xss-risk","file":"examples/arcade-cabinet/arcade-cabinet-light.html","pattern":"insertAdjacentHTML (XSS risk)","snippet":"svg.querySelector(\"defs\").insertAdjacentHTML(\"beforeend\", `\");","category":"scripts","line_end":2392,"severity":"medium","line_start":2392},{"id":"scripts:examples/arcade-cabinet/arcade-cabinet.html:2393:insertadjacenthtml-xss-risk","file":"examples/arcade-cabinet/arcade-cabinet.html","pattern":"insertAdjacentHTML (XSS risk)","snippet":"svg.querySelector(\"defs\").insertAdjacentHTML(\"beforeend\", `\");","category":"scripts","line_end":172,"severity":"medium","line_start":172},{"id":"scripts:examples/arcade-cabinet/live.js:173:insertadjacenthtml-xss-risk","file":"examples/arcade-cabinet/live.js","pattern":"insertAdjacentHTML (XSS risk)","snippet":"svg.querySelector(\"defs\").insertAdjacentHTML(\"beforeend\", ` `${at ? \"L\" : \"M\"}${tenth(x)} ${tenth(y)}`).join(\"\") + (closed ? \"","category":"external_commands","line_end":188,"severity":"medium","line_start":188},{"id":"external_commands:examples/arcade-cabinet/arcade-cabinet-light.html:521:ruby-shell-backtick-execution","file":"examples/arcade-cabinet/arcade-cabinet-light.html","pattern":"Ruby/shell backtick execution","snippet":"return `translate(${fine(x)} ${fine(y)})`;","category":"external_commands","line_end":521,"severity":"medium","line_start":521},{"id":"external_commands:examples/arcade-cabinet/arcade-cabinet-light.html:532:ruby-shell-backtick-execution","file":"examples/arcade-cabinet/arcade-cabinet-light.html","pattern":"Ruby/shell backtick execution","snippet":"const matrixOf = (u, v, origin) => `matrix(${thousandth(u[0])} ${thousandth(u[1])} ${thousandth(v[0]","category":"external_commands","line_end":532,"severity":"medium","line_start":532},{"id":"external_commands:examples/arcade-cabinet/arcade-cabinet-light.html:534:ruby-shell-backtick-execution","file":"examples/arcade-cabinet/arcade-cabinet-light.html","pattern":"Ruby/shell backtick execution","snippet":"const text = dx || dy ? `translate(${-dx} ${-dy})` : \"\";","category":"external_commands","line_end":534,"severity":"medium","line_start":534},{"id":"external_commands:examples/arcade-cabinet/arcade-cabinet-light.html:570:ruby-shell-backtick-execution","file":"examples/arcade-cabinet/arcade-cabinet-light.html","pattern":"Ruby/shell backtick execution","snippet":".map(([key, value]) => ` ${key}=\"${escape(String(value))}\"`)","category":"external_commands","line_end":570,"severity":"medium","line_start":570},{"id":"external_commands:examples/arcade-cabinet/arcade-cabinet-light.html:575:ruby-shell-backtick-execution","file":"examples/arcade-cabinet/arcade-cabinet-light.html","pattern":"Ruby/shell backtick execution","snippet":"parts.push(``);","category":"external_commands","line_end":575,"severity":"medium","line_start":575},{"id":"external_commands:examples/arcade-cabinet/arcade-cabinet-light.html:576:ruby-shell-backtick-execution","file":"examples/arcade-cabinet/arcade-cabinet-light.html","pattern":"Ruby/shell backtick execution","snippet":"parts.push(``);","category":"external_commands","line_end":576,"severity":"medium","line_start":576},{"id":"external_commands:examples/arcade-cabinet/arcade-cabinet-light.html:580:ruby-shell-backtick-execution","file":"examples/arcade-cabinet/arcade-cabinet-light.html","pattern":"Ruby/shell backtick execution","snippet":"parts.push(``);","category":"external_commands","line_end":580,"severity":"medium","line_start":580},{"id":"external_commands:examples/arcade-cabinet/arcade-cabinet-light.html:582:ruby-shell-backtick-execution","file":"examples/arcade-cabinet/arcade-cabinet-light.html","pattern":"Ruby/shell backtick execution","snippet":"parts.push(``);","category":"external_commands","line_end":582,"severity":"medium","line_start":582},{"id":"external_commands:examples/arcade-cabinet/arcade-cabinet-light.html:585:ruby-shell-backtick-execution","file":"examples/arcade-cabinet/arcade-cabinet-light.html","pattern":"Ruby/shell backtick execution","snippet":"parts.push(``);","category":"external_commands","line_end":585,"severity":"medium","line_start":585},{"id":"external_commands:examples/arcade-cabinet/arcade-cabinet-light.html:587:ruby-shell-backtick-execution","file":"examples/arcade-cabinet/arcade-cabinet-light.html","pattern":"Ruby/shell backtick execution","snippet":"parts.push(``);","category":"external_commands","line_end":587,"severity":"medium","line_start":587},{"id":"external_commands:kit/audit.mjs:391:ruby-shell-backtick-execution","file":"kit/audit.mjs","pattern":"Ruby/shell backtick execution","snippet":"export const labelOf = (state) => (typeof state === \"number\" ? `share ${Math.round(state * 1000) / 1","category":"external_commands","line_end":391,"severity":"medium","line_start":391},{"id":"external_commands:kit/audit.mjs:406:ruby-shell-backtick-execution","file":"kit/audit.mjs","pattern":"Ruby/shell backtick execution","snippet":"const name = back === undefined ? (on ? \"apart\" : \"together\") : `${on ? \"apart\" : \"together\"}, back ","category":"external_commands","line_end":406,"severity":"medium","line_start":406},{"id":"external_commands:kit/audit.mjs:424:ruby-shell-backtick-execution","file":"kit/audit.mjs","pattern":"Ruby/shell backtick execution","snippet":"if ((frame + 1) % stride === 0) out.push({ label: `${name} ${clock.toFixed(3)} s`, shares: Object.fr","category":"external_commands","line_end":424,"severity":"medium","line_start":424},{"id":"external_commands:kit/audit.mjs:438:ruby-shell-backtick-execution","file":"kit/audit.mjs","pattern":"Ruby/shell backtick execution","snippet":"out.push({ label: `first ${count - 1} out, ${order[count - 1]} at ${s}`, shares: Object.fromEntries(","category":"external_commands","line_end":438,"severity":"medium","line_start":438},{"id":"external_commands:kit/audit.mjs:609:ruby-shell-backtick-execution","file":"kit/audit.mjs","pattern":"Ruby/shell backtick execution","snippet":"const id = `${index}|${offset.map((v) => v.toFixed(2)).join(\",\")}`;","category":"external_commands","line_end":609,"severity":"medium","line_start":609},{"id":"external_commands:kit/audit.mjs:630:ruby-shell-backtick-execution","file":"kit/audit.mjs","pattern":"Ruby/shell backtick execution","snippet":"const id = `${ra.uid}|${rb.uid}|${dx},${dy},${dz.toFixed(3)}`;","category":"external_commands","line_end":630,"severity":"medium","line_start":630},{"id":"external_commands:kit/audit.mjs:663:ruby-shell-backtick-execution","file":"kit/audit.mjs","pattern":"Ruby/shell backtick execution","snippet":"const id = `${front}|${back}`;","category":"external_commands","line_end":663,"severity":"medium","line_start":663},{"id":"external_commands:kit/audit.mjs:719:ruby-shell-backtick-execution","file":"kit/audit.mjs","pattern":"Ruby/shell backtick execution","snippet":"const dropped = new Set((options.solved?.dropped ?? []).map((rule) => `${rule.front}|${rule.back}`))","category":"external_commands","line_end":719,"severity":"medium","line_start":719},{"id":"external_commands:kit/audit.mjs:756:ruby-shell-backtick-execution","file":"kit/audit.mjs","pattern":"Ruby/shell backtick execution","snippet":"entry.unorderable = !rest.includes(pair.state) && dropped.has(`${front_}|${back_}`);","category":"external_commands","line_end":756,"severity":"medium","line_start":756},{"id":"external_commands:kit/audit.mjs:864:ruby-shell-backtick-execution","file":"kit/audit.mjs","pattern":"Ruby/shell backtick execution","snippet":"const id = `${tube.name}|${other.name}`;","category":"external_commands","line_end":864,"severity":"medium","line_start":864},{"id":"external_commands:kit/audit.mjs:949:ruby-shell-backtick-execution","file":"kit/audit.mjs","pattern":"Ruby/shell backtick execution","snippet":"if (a > b && problems.has(`${tubes[b].name}|${tubes[a].name}`)) continue;","category":"external_commands","line_end":949,"severity":"medium","line_start":949},{"id":"external_commands:references/3d.md:69:ruby-shell-backtick-execution","file":"references/3d.md","pattern":"Ruby/shell backtick execution","snippet":"const stage = `
${backSvg}${out.layerS","category":"external_commands","line_end":70,"severity":"medium","line_start":69},{"id":"external_commands:references/3d.md:70:ruby-shell-backtick-execution","file":"references/3d.md","pattern":"Ruby/shell backtick execution","snippet":"const page = k.pageHtml({ title, theme, body: k.plateHtml({ ..., body: `${s","category":"external_commands","line_end":71,"severity":"medium","line_start":70},{"id":"external_commands:references/craft.md:56:ruby-shell-backtick-execution","file":"references/craft.md","pattern":"Ruby/shell backtick execution","snippet":"halo: ``","category":"external_commands","line_end":64,"severity":"medium","line_start":56},{"id":"external_commands:references/craft.md:89:ruby-shell-backtick-execution","file":"references/craft.md","pattern":"Ruby/shell backtick execution","snippet":"svg = `${k.s","category":"external_commands","line_end":91,"severity":"medium","line_start":89},{"id":"external_commands:references/craft.md:91:ruby-shell-backtick-execution","file":"references/craft.md","pattern":"Ruby/shell backtick execution","snippet":"live: el.setAttribute(\"transform\", `translate(${dx} ${dy})`); holdStill(el, [dx, dy]) // dx, dy: t","category":"external_commands","line_end":92,"severity":"medium","line_start":91},{"id":"external_commands:references/webgl.md:168:ruby-shell-backtick-execution","file":"references/webgl.md","pattern":"Ruby/shell backtick execution","snippet":"const frontSvg = `${backSvg}${CSS}${k.plateHtml({ ...card, body: s","category":"external_commands","line_end":171,"severity":"medium","line_start":170},{"id":"external_commands:references/webgl.md:198:ruby-shell-backtick-execution","file":"references/webgl.md","pattern":"Ruby/shell backtick execution","snippet":"}`;","category":"external_commands","line_end":213,"severity":"medium","line_start":198},{"id":"external_commands:scripts/capture.mjs:15:ruby-shell-backtick-execution","file":"scripts/capture.mjs","pattern":"Ruby/shell backtick execution","snippet":"console.log(`Capture a figure with headless Chrome.","category":"external_commands","line_end":35,"severity":"medium","line_start":15},{"id":"external_commands:scripts/capture.mjs:104:ruby-shell-backtick-execution","file":"scripts/capture.mjs","pattern":"Ruby/shell backtick execution","snippet":"`--user-data-dir=${profile}`,","category":"external_commands","line_end":104,"severity":"medium","line_start":104},{"id":"external_commands:scripts/capture.mjs:133:ruby-shell-backtick-execution","file":"scripts/capture.mjs","pattern":"Ruby/shell backtick execution","snippet":"const target = await (await fetch(`http://127.0.0.1:${port}/json/new?about:blank`, { method: \"PUT\" }","category":"external_commands","line_end":133,"severity":"medium","line_start":133},{"id":"external_commands:scripts/capture.mjs:144:ruby-shell-backtick-execution","file":"scripts/capture.mjs","pattern":"Ruby/shell backtick execution","snippet":"problems.push(`console.${data.params.type}: ${data.params.args.map((arg) => arg.value ?? arg.descrip","category":"external_commands","line_end":144,"severity":"medium","line_start":144},{"id":"external_commands:scripts/capture.mjs:147:ruby-shell-backtick-execution","file":"scripts/capture.mjs","pattern":"Ruby/shell backtick execution","snippet":"problems.push(`exception: ${detail.exception?.description ?? detail.text}`.slice(0, 600));","category":"external_commands","line_end":147,"severity":"medium","line_start":147},{"id":"external_commands:scripts/capture.mjs:168:ruby-shell-backtick-execution","file":"scripts/capture.mjs","pattern":"Ruby/shell backtick execution","snippet":"await evaluate(`(async()=>{const h=document.documentElement.scrollHeight;for(let y=0;y{const el=document.querySelector(${JSON.stringify(select)})||document.querySelector(\"","category":"external_commands","line_end":172,"severity":"medium","line_start":172},{"id":"external_commands:scripts/capture.mjs:188:ruby-shell-backtick-execution","file":"scripts/capture.mjs","pattern":"Ruby/shell backtick execution","snippet":"await evaluate(`(()=>{const f=document.querySelector('[tabindex=\"0\"]');if(f)f.focus()})()`);","category":"external_commands","line_end":188,"severity":"medium","line_start":188},{"id":"external_commands:scripts/capture.mjs:189:ruby-shell-backtick-execution","file":"scripts/capture.mjs","pattern":"Ruby/shell backtick execution","snippet":"const named = { \" \": \"Space\", \"-\": \"Minus\", \"=\": \"Equal\", \",\": \"Comma\", \".\": \"Period\", \"/\": \"Slash\",","category":"external_commands","line_end":193,"severity":"medium","line_start":189},{"id":"external_commands:scripts/capture.mjs:193:ruby-shell-backtick-execution","file":"scripts/capture.mjs","pattern":"Ruby/shell backtick execution","snippet":"const code = named[key] ?? (/^[0-9]$/.test(key) ? `Digit${key}` : key.length === 1 ? `Key${key.toUpp","category":"external_commands","line_end":193,"severity":"medium","line_start":193},{"id":"external_commands:scripts/capture.mjs:216:ruby-shell-backtick-execution","file":"scripts/capture.mjs","pattern":"Ruby/shell backtick execution","snippet":"await shoot(out.replace(/\\.png$/, `-${delay}.png`), next.clip, next.scale);","category":"external_commands","line_end":217,"severity":"medium","line_start":216},{"id":"external_commands:SKILL.md:10:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Eight complete examples ship with the skill. Open the closest one before you start. Each framework-f","category":"external_commands","line_end":10,"severity":"medium","line_start":10},{"id":"external_commands:SKILL.md:12:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `examples/dial-indicator/` is the smallest: a dial gauge on a stand, about 300 lines in all.","category":"external_commands","line_end":12,"severity":"medium","line_start":12},{"id":"external_commands:SKILL.md:13:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `examples/desk-computer/` is framework-free SVG: a desk computer with a keyboard you can type on. ","category":"external_commands","line_end":13,"severity":"medium","line_start":13},{"id":"external_commands:SKILL.md:14:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `examples/arcade-cabinet/` is an upright arcade cabinet with its side panel off, a Hero of about 2","category":"external_commands","line_end":14,"severity":"medium","line_start":14},{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `examples/raptor-engine/` is a rocket engine hanging in a test stand. Its round parts come from `k","category":"external_commands","line_end":15,"severity":"medium","line_start":15},{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `examples/ripple-tank/` is a school ripple tank on tall legs over a paper screen, seen from 44° up","category":"external_commands","line_end":16,"severity":"medium","line_start":16},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `examples/test-rig/` is a production figure from a real site (React/Next): a glass button on a spr","category":"external_commands","line_end":17,"severity":"medium","line_start":17},{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `examples/spot-plate/` is a second production figure from the same site: six pairs of glass drops ","category":"external_commands","line_end":18,"severity":"medium","line_start":18},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `examples/turning-dial/` is the optional 3D mode: a combination dial that turns in true 3D with a ","category":"external_commands","line_end":19,"severity":"medium","line_start":19},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Whatever the size, have a working page that opens in the browser within the first hour, and deepen","category":"external_commands","line_end":58,"severity":"medium","line_start":58},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. **Truth first.** Collect the real numbers and behaviour of the thing being explained: sizes, coun","category":"external_commands","line_end":59,"severity":"medium","line_start":59},{"id":"external_commands:.github/workflows/ci.yml:64:shell-command-substitution","file":".github/workflows/ci.yml","pattern":"Shell command substitution","snippet":"test -z \"$(git status --porcelain)\"","category":"external_commands","line_end":64,"severity":"medium","line_start":64},{"id":"external_commands:examples/arcade-cabinet/arcade-cabinet-light.html:2236:shell-command-substitution","file":"examples/arcade-cabinet/arcade-cabinet-light.html","pattern":"Shell command substitution","snippet":"upper: $('[data-part=\"stick-upper\"]'),","category":"external_commands","line_end":2236,"severity":"medium","line_start":2236},{"id":"external_commands:examples/arcade-cabinet/arcade-cabinet-light.html:2237:shell-command-substitution","file":"examples/arcade-cabinet/arcade-cabinet-light.html","pattern":"Shell command substitution","snippet":"lower: $('[data-part=\"stick-lower\"]'),","category":"external_commands","line_end":2237,"severity":"medium","line_start":2237},{"id":"external_commands:examples/arcade-cabinet/arcade-cabinet-light.html:2238:shell-command-substitution","file":"examples/arcade-cabinet/arcade-cabinet-light.html","pattern":"Shell command substitution","snippet":"wire: $('[data-part=\"wire\"]'),","category":"external_commands","line_end":2238,"severity":"medium","line_start":2238},{"id":"external_commands:examples/arcade-cabinet/arcade-cabinet-light.html:2239:shell-command-substitution","file":"examples/arcade-cabinet/arcade-cabinet-light.html","pattern":"Shell command substitution","snippet":"fall: $('[data-part=\"coin-fall\"]'),","category":"external_commands","line_end":2239,"severity":"medium","line_start":2239},{"id":"external_commands:examples/arcade-cabinet/arcade-cabinet-light.html:2240:shell-command-substitution","file":"examples/arcade-cabinet/arcade-cabinet-light.html","pattern":"Shell command substitution","snippet":"chute: $('[data-part=\"coin-chute\"]'),","category":"external_commands","line_end":2240,"severity":"medium","line_start":2240},{"id":"external_commands:examples/arcade-cabinet/arcade-cabinet-light.html:2241:shell-command-substitution","file":"examples/arcade-cabinet/arcade-cabinet-light.html","pattern":"Shell command substitution","snippet":"fly: $('[data-part=\"coin-fly\"]'),","category":"external_commands","line_end":2241,"severity":"medium","line_start":2241},{"id":"external_commands:examples/arcade-cabinet/arcade-cabinet-light.html:2242:shell-command-substitution","file":"examples/arcade-cabinet/arcade-cabinet-light.html","pattern":"Shell command substitution","snippet":"pile: $('[data-part=\"pile\"]'),","category":"external_commands","line_end":2242,"severity":"medium","line_start":2242},{"id":"external_commands:examples/arcade-cabinet/arcade-cabinet-light.html:2243:shell-command-substitution","file":"examples/arcade-cabinet/arcade-cabinet-light.html","pattern":"Shell command substitution","snippet":"screen: $('[data-part=\"screen\"]'),","category":"external_commands","line_end":2243,"severity":"medium","line_start":2243},{"id":"external_commands:examples/arcade-cabinet/arcade-cabinet-light.html:2244:shell-command-substitution","file":"examples/arcade-cabinet/arcade-cabinet-light.html","pattern":"Shell command substitution","snippet":"raster: $('[data-part=\"raster\"]'),","category":"external_commands","line_end":2244,"severity":"medium","line_start":2244},{"id":"external_commands:examples/arcade-cabinet/arcade-cabinet-light.html:2245:shell-command-substitution","file":"examples/arcade-cabinet/arcade-cabinet-light.html","pattern":"Shell command substitution","snippet":"dot: $('[data-part=\"dot\"]'),","category":"external_commands","line_end":2245,"severity":"medium","line_start":2245},{"id":"external_commands:examples/arcade-cabinet/arcade-cabinet-light.html:2246:shell-command-substitution","file":"examples/arcade-cabinet/arcade-cabinet-light.html","pattern":"Shell command substitution","snippet":"test: $('[data-mode=\"test\"]'),","category":"external_commands","line_end":2246,"severity":"medium","line_start":2246},{"id":"filesystem:examples/arcade-cabinet/build.mjs:1:synchronous-file-operations","file":"examples/arcade-cabinet/build.mjs","pattern":"Synchronous file operations","snippet":"import { readFileSync, writeFileSync } from \"node:fs\";","category":"filesystem","line_end":1,"severity":"medium","line_start":1},{"id":"filesystem:examples/arcade-cabinet/build.mjs:683:synchronous-file-operations","file":"examples/arcade-cabinet/build.mjs","pattern":"Synchronous file operations","snippet":"const CSS = readFileSync(join(HERE, \"arcade-cabinet.css\"), \"utf8\");","category":"filesystem","line_end":683,"severity":"medium","line_start":683},{"id":"filesystem:examples/arcade-cabinet/build.mjs:684:synchronous-file-operations","file":"examples/arcade-cabinet/build.mjs","pattern":"Synchronous file operations","snippet":"const latheSource = readFileSync(join(HERE, \"..\", \"..\", \"kit\", \"lathe.mjs\"), \"utf8\")","category":"filesystem","line_end":684,"severity":"medium","line_start":684},{"id":"filesystem:examples/arcade-cabinet/build.mjs:688:synchronous-file-operations","file":"examples/arcade-cabinet/build.mjs","pattern":"Synchronous file operations","snippet":"const partsScript = readFileSync(join(HERE, \"parts.mjs\"), \"utf8\").replace(/^export /gm, \"\");","category":"filesystem","line_end":688,"severity":"medium","line_start":688},{"id":"filesystem:examples/arcade-cabinet/build.mjs:689:synchronous-file-operations","file":"examples/arcade-cabinet/build.mjs","pattern":"Synchronous file operations","snippet":"const screenScript = readFileSync(join(HERE, \"screen.mjs\"), \"utf8\").replace(/^export /gm, \"\");","category":"filesystem","line_end":689,"severity":"medium","line_start":689},{"id":"filesystem:examples/arcade-cabinet/build.mjs:690:synchronous-file-operations","file":"examples/arcade-cabinet/build.mjs","pattern":"Synchronous file operations","snippet":"const LIVE = readFileSync(join(HERE, \"live.js\"), \"utf8\").replace(\"__DATA__\", JSON.stringify(DATA));","category":"filesystem","line_end":690,"severity":"medium","line_start":690},{"id":"filesystem:examples/arcade-cabinet/build.mjs:711:synchronous-file-operations","file":"examples/arcade-cabinet/build.mjs","pattern":"Synchronous file operations","snippet":"writeFileSync(join(HERE, name), page);","category":"filesystem","line_end":711,"severity":"medium","line_start":711},{"id":"filesystem:examples/desk-computer/build.mjs:1:synchronous-file-operations","file":"examples/desk-computer/build.mjs","pattern":"Synchronous file operations","snippet":"import { writeFileSync } from \"node:fs\";","category":"filesystem","line_end":1,"severity":"medium","line_start":1},{"id":"filesystem:examples/desk-computer/build.mjs:434:synchronous-file-operations","file":"examples/desk-computer/build.mjs","pattern":"Synchronous file operations","snippet":"writeFileSync(join(HERE, name), k.pageHtml({ title: \"Desk computer\", theme, body, script: kitScript(","category":"filesystem","line_end":434,"severity":"medium","line_start":434},{"id":"filesystem:examples/dial-indicator/build.mjs:1:synchronous-file-operations","file":"examples/dial-indicator/build.mjs","pattern":"Synchronous file operations","snippet":"import { writeFileSync } from \"node:fs\";","category":"filesystem","line_end":1,"severity":"medium","line_start":1},{"id":"filesystem:examples/dial-indicator/build.mjs:274:synchronous-file-operations","file":"examples/dial-indicator/build.mjs","pattern":"Synchronous file operations","snippet":"writeFileSync(join(HERE, theme === \"light\" ? \"dial-indicator-light.html\" : \"dial-indicator.html\"), k","category":"filesystem","line_end":274,"severity":"medium","line_start":274},{"id":"filesystem:references/3d.md:304:synchronous-file-operations","file":"references/3d.md","pattern":"Synchronous file operations","snippet":"import { writeFileSync } from \"node:fs\";","category":"filesystem","line_end":304,"severity":"medium","line_start":304},{"id":"filesystem:references/3d.md:307:synchronous-file-operations","file":"references/3d.md","pattern":"Synchronous file operations","snippet":"writeFileSync(\"clip.json\", JSON.stringify(Array.from({ length: 241 }, (_, i) => at(i / 60))));","category":"filesystem","line_end":307,"severity":"medium","line_start":307},{"id":"filesystem:references/3d.md:308:synchronous-file-operations","file":"references/3d.md","pattern":"Synchronous file operations","snippet":"writeFileSync(\"tilt-path.json\", JSON.stringify(Array.from({ length: 1201 }, (_, i) => follow({ yaw: ","category":"filesystem","line_end":308,"severity":"medium","line_start":308},{"id":"filesystem:scripts/capture.mjs:2:synchronous-file-operations","file":"scripts/capture.mjs","pattern":"Synchronous file operations","snippet":"import { existsSync, mkdtempSync, readdirSync, rmSync, writeFileSync } from \"node:fs\";","category":"filesystem","line_end":2,"severity":"medium","line_start":2},{"id":"filesystem:scripts/capture.mjs:202:synchronous-file-operations","file":"scripts/capture.mjs","pattern":"Synchronous file operations","snippet":"writeFileSync(path, Buffer.from(shot.result.data, \"base64\"));","category":"filesystem","line_end":202,"severity":"medium","line_start":202},{"id":"filesystem:scripts/drive.mjs:2:synchronous-file-operations","file":"scripts/drive.mjs","pattern":"Synchronous file operations","snippet":"import { existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync } from","category":"filesystem","line_end":2,"severity":"medium","line_start":2},{"id":"filesystem:scripts/drive.mjs:99:synchronous-file-operations","file":"scripts/drive.mjs","pattern":"Synchronous file operations","snippet":"else if (arg === \"--preload\") options.preload = readFileSync(argv[++index], \"utf8\");","category":"filesystem","line_end":99,"severity":"medium","line_start":99},{"id":"filesystem:scripts/drive.mjs:100:synchronous-file-operations","file":"scripts/drive.mjs","pattern":"Synchronous file operations","snippet":"else if (arg === \"--actions\") options.actions = JSON.parse(readFileSync(argv[++index], \"utf8\"));","category":"filesystem","line_end":100,"severity":"medium","line_start":100},{"id":"filesystem:scripts/drive.mjs:184:synchronous-file-operations","file":"scripts/drive.mjs","pattern":"Synchronous file operations","snippet":"writeFileSync(out, Buffer.from(base64, \"base64\"));","category":"filesystem","line_end":184,"severity":"medium","line_start":184},{"id":"filesystem:scripts/inline-kit.mjs:1:synchronous-file-operations","file":"scripts/inline-kit.mjs","pattern":"Synchronous file operations","snippet":"import { readFileSync } from \"node:fs\";","category":"filesystem","line_end":1,"severity":"medium","line_start":1},{"id":"filesystem:scripts/inline-kit.mjs:6:synchronous-file-operations","file":"scripts/inline-kit.mjs","pattern":"Synchronous file operations","snippet":"const strip = (file) => readFileSync(join(KIT, file), \"utf8\").replace(/^export /gm, \"\");","category":"filesystem","line_end":6,"severity":"medium","line_start":6},{"id":"filesystem:scripts/turn-check.mjs:2:synchronous-file-operations","file":"scripts/turn-check.mjs","pattern":"Synchronous file operations","snippet":"import { existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync } from","category":"filesystem","line_end":2,"severity":"medium","line_start":2},{"id":"filesystem:scripts/turn-check.mjs:510:synchronous-file-operations","file":"scripts/turn-check.mjs","pattern":"Synchronous file operations","snippet":"const states = statesFile ? JSON.parse(readFileSync(statesFile, \"utf8\")) : null;","category":"filesystem","line_end":510,"severity":"medium","line_start":510},{"id":"filesystem:scripts/turn-check.mjs:591:synchronous-file-operations","file":"scripts/turn-check.mjs","pattern":"Synchronous file operations","snippet":"for (const [key, data] of Object.entries(dumped)) writeFileSync(join(out, `pops-core-${key}.png`), B","category":"filesystem","line_end":591,"severity":"medium","line_start":591},{"id":"external_commands:examples/arcade-cabinet/arcade-cabinet-light.html:2216:template-literal-with-command-substitution","file":"examples/arcade-cabinet/arcade-cabinet-light.html","pattern":"Template literal with command substitution","snippet":"``,","category":"external_commands","line_end":2385,"severity":"medium","line_start":2216},{"id":"external_commands:examples/arcade-cabinet/arcade-cabinet.html:2216:template-literal-with-command-substitution","file":"examples/arcade-cabinet/arcade-cabinet.html","pattern":"Template literal with command substitution","snippet":"``,","category":"external_commands","line_end":2385,"severity":"medium","line_start":2216},{"id":"network:scripts/capture.mjs:134:websocket-connection","file":"scripts/capture.mjs","pattern":"WebSocket connection","snippet":"const socket = new WebSocket(target.webSocketDebuggerUrl);","category":"network","line_end":134,"severity":"medium","line_start":134},{"id":"network:scripts/drive.mjs:134:websocket-connection","file":"scripts/drive.mjs","pattern":"WebSocket connection","snippet":"const socket = new WebSocket(page.webSocketDebuggerUrl);","category":"network","line_end":134,"severity":"medium","line_start":134},{"id":"network:scripts/turn-check.mjs:52:websocket-connection","file":"scripts/turn-check.mjs","pattern":"WebSocket connection","snippet":"const socket = new WebSocket(page.webSocketDebuggerUrl);","category":"network","line_end":52,"severity":"medium","line_start":52},{"id":"metadata:examples/raptor-engine/raptor-engine-light.html:1:unscanned-file-too-large-manual-review-required","file":"examples/raptor-engine/raptor-engine-light.html","pattern":"Unscanned file (too_large) — manual review required","snippet":"[unscanned: too_large]","category":"metadata","line_end":1,"severity":"low","line_start":1},{"id":"metadata:examples/raptor-engine/raptor-engine.html:1:unscanned-file-too-large-manual-review-required","file":"examples/raptor-engine/raptor-engine.html","pattern":"Unscanned file (too_large) — manual review required","snippet":"[unscanned: too_large]","category":"metadata","line_end":1,"severity":"low","line_start":1},{"id":"metadata:examples/turning-dial/turning-stress-light.html:1:unscanned-file-too-large-manual-review-required","file":"examples/turning-dial/turning-stress-light.html","pattern":"Unscanned file (too_large) — manual review required","snippet":"[unscanned: too_large]","category":"metadata","line_end":1,"severity":"low","line_start":1},{"id":"blocker:examples/raptor-engine/live.js:134:network-reconnaissance","file":"examples/raptor-engine/live.js","pattern":"Network reconnaissance","snippet":"state.v += ((state.target - state.x) * SPRING.stiffness - state.v * SPRING.damping) * h;","category":"blocker","line_end":134,"severity":"low","line_start":134},{"id":"blocker:examples/turning-dial/turning-dial-light.html:2267:network-reconnaissance","file":"examples/turning-dial/turning-dial-light.html","pattern":"Network reconnaissance","snippet":"if (Math.abs(guess - x) * r > 0.25) return false;","category":"blocker","line_end":2267,"severity":"low","line_start":2267},{"id":"blocker:examples/turning-dial/turning-dial-verify-light.html:2267:network-reconnaissance","file":"examples/turning-dial/turning-dial-verify-light.html","pattern":"Network reconnaissance","snippet":"if (Math.abs(guess - x) * r > 0.25) return false;","category":"blocker","line_end":2267,"severity":"low","line_start":2267},{"id":"blocker:examples/turning-dial/turning-dial.html:2267:network-reconnaissance","file":"examples/turning-dial/turning-dial.html","pattern":"Network reconnaissance","snippet":"if (Math.abs(guess - x) * r > 0.25) return false;","category":"blocker","line_end":2267,"severity":"low","line_start":2267},{"id":"blocker:kit/audit.mjs:418:network-reconnaissance","file":"kit/audit.mjs","pattern":"Network reconnaissance","snippet":"spring.v += ((spring.target - spring.x) * stiffness - spring.v * damping) * h;","category":"blocker","line_end":418,"severity":"low","line_start":418},{"id":"blocker:kit/turn-fixed.mjs:2139:network-reconnaissance","file":"kit/turn-fixed.mjs","pattern":"Network reconnaissance","snippet":"if (Math.abs(guess - x) * r > 0.25) return false;","category":"blocker","line_end":2139,"severity":"low","line_start":2139},{"id":"blocker:kit/turn.mjs:2099:network-reconnaissance","file":"kit/turn.mjs","pattern":"Network reconnaissance","snippet":"if (Math.abs(guess - x) * r > 0.25) return false;","category":"blocker","line_end":2099,"severity":"low","line_start":2099},{"id":"blocker:.github/ISSUE_TEMPLATE/bug_report.yml:2:system-reconnaissance","file":".github/ISSUE_TEMPLATE/bug_report.yml","pattern":"System reconnaissance","snippet":"description: A figure, the kit, a check script or the install did something wrong.","category":"blocker","line_end":2,"severity":"low","line_start":2},{"id":"blocker:CHANGELOG.md:28:system-reconnaissance","file":"CHANGELOG.md","pattern":"System reconnaissance","snippet":"- The figure card (`.iso-plate`) is square and flat: no rounded corners and no floating shadow, just","category":"blocker","line_end":28,"severity":"low","line_start":28},{"id":"blocker:examples/arcade-cabinet/arcade-cabinet-light.html:116:system-reconnaissance","file":"examples/arcade-cabinet/arcade-cabinet-light.html","pattern":"System reconnaissance","snippet":".ac-stage:focus-visible{outline:1px solid var(--anatomy-muted);outline-offset:6px}","category":"blocker","line_end":116,"severity":"low","line_start":116},{"id":"blocker:examples/arcade-cabinet/arcade-cabinet-light.html:591:system-reconnaissance","file":"examples/arcade-cabinet/arcade-cabinet-light.html","pattern":"System reconnaissance","snippet":"return `> 1;","category":"blocker","line_end":1728,"severity":"low","line_start":1728},{"id":"blocker:examples/arcade-cabinet/arcade-cabinet-light.html:1730:system-reconnaissance","file":"examples/arcade-cabinet/arcade-cabinet-light.html","pattern":"System reconnaissance","snippet":"else hi = mid - 1;","category":"blocker","line_end":1730,"severity":"low","line_start":1730},{"id":"blocker:examples/arcade-cabinet/arcade-cabinet-light.html:2350:system-reconnaissance","file":"examples/arcade-cabinet/arcade-cabinet-light.html","pattern":"System reconnaissance","snippet":"const mid = [(c.from[0] + SLOT_OUT[0]) / 2, (c.from[1] + SLOT_OUT[1]) / 2, Math.max(c.from[2], SLOT_","category":"blocker","line_end":2350,"severity":"low","line_start":2350},{"id":"blocker:kit/audit.mjs:21:system-reconnaissance","file":"kit/audit.mjs","pattern":"System reconnaissance","snippet":"const mid = (a + b) / 2;","category":"blocker","line_end":21,"severity":"low","line_start":21},{"id":"blocker:kit/audit.mjs:401:system-reconnaissance","file":"kit/audit.mjs","pattern":"System reconnaissance","snippet":"for (const id of value ? order : [...order].reverse()) {","category":"blocker","line_end":401,"severity":"low","line_start":401},{"id":"blocker:kit/audit.mjs:602:system-reconnaissance","file":"kit/audit.mjs","pattern":"System reconnaissance","snippet":"let uid = 0;","category":"blocker","line_end":602,"severity":"low","line_start":602},{"id":"blocker:kit/audit.mjs:606:system-reconnaissance","file":"kit/audit.mjs","pattern":"System reconnaissance","snippet":"const slid = new Map();","category":"blocker","line_end":606,"severity":"low","line_start":606},{"id":"blocker:kit/audit.mjs:609:system-reconnaissance","file":"kit/audit.mjs","pattern":"System reconnaissance","snippet":"const id = `${index}|${offset.map((v) => v.toFixed(2)).join(\",\")}`;","category":"blocker","line_end":609,"severity":"low","line_start":609},{"id":"blocker:kit/audit.mjs:630:system-reconnaissance","file":"kit/audit.mjs","pattern":"System reconnaissance","snippet":"const id = `${ra.uid}|${rb.uid}|${dx},${dy},${dz.toFixed(3)}`;","category":"blocker","line_end":630,"severity":"low","line_start":630},{"id":"blocker:kit/audit.mjs:663:system-reconnaissance","file":"kit/audit.mjs","pattern":"System reconnaissance","snippet":"const id = `${front}|${back}`;","category":"blocker","line_end":663,"severity":"low","line_start":663},{"id":"blocker:kit/audit.mjs:864:system-reconnaissance","file":"kit/audit.mjs","pattern":"System reconnaissance","snippet":"const id = `${tube.name}|${other.name}`;","category":"blocker","line_end":864,"severity":"low","line_start":864},{"id":"blocker:kit/audit.mjs:958:system-reconnaissance","file":"kit/audit.mjs","pattern":"System reconnaissance","snippet":"const id = [c.tube, c.other].sort().join(\"|\");","category":"blocker","line_end":958,"severity":"low","line_start":958},{"id":"blocker:kit/audit.mjs:1260:system-reconnaissance","file":"kit/audit.mjs","pattern":"System reconnaissance","snippet":"if (rod) return Boolean(entry) && (entry.shape.name === rod.solid || (!entry.shape.name && entry.ite","category":"blocker","line_end":1260,"severity":"low","line_start":1260},{"id":"blocker:README.md:88:system-reconnaissance","file":"README.md","pattern":"System reconnaissance","snippet":"| **SVG** | The core. Solid isometric parts with four-tone shading, painted back to front, in a card","category":"blocker","line_end":88,"severity":"low","line_start":88},{"id":"blocker:README.md:141:system-reconnaissance","file":"README.md","pattern":"System reconnaissance","snippet":"Claude Code picks up new skills in a running session. If the `skills` folder itself did not exist wh","category":"blocker","line_end":141,"severity":"low","line_start":141},{"id":"blocker:references/3d.md:3:system-reconnaissance","file":"references/3d.md","pattern":"System reconnaissance","snippet":"The optional 3D mode (\"turning groups\") lets some parts of a figure move as rigid bodies: a dial or ","category":"blocker","line_end":3,"severity":"low","line_start":3},{"id":"blocker:references/3d.md:31:system-reconnaissance","file":"references/3d.md","pattern":"System reconnaissance","snippet":"- **Groups.** A group is a rigid frame with a pose. Kinds: `turn` (about a vertical axis through `pi","category":"blocker","line_end":31,"severity":"low","line_start":31},{"id":"blocker:references/3d.md:94:system-reconnaissance","file":"references/3d.md","pattern":"System reconnaissance","snippet":"| `T.group(name, { parent?, free: { origin } })` | A free rigid body (section 7). Value `{ R: [9] \\|","category":"blocker","line_end":94,"severity":"low","line_start":94},{"id":"blocker:references/3d.md:202:system-reconnaissance","file":"references/3d.md","pattern":"System reconnaissance","snippet":"`T.group(\"pod\", { parent: dial, free: { origin } })` makes a rigid body whose pose the figure sets e","category":"blocker","line_end":202,"severity":"low","line_start":202},{"id":"blocker:references/3d.md:259:system-reconnaissance","file":"references/3d.md","pattern":"System reconnaissance","snippet":"Options: `sweep: { at(x), from, to, frame }` (the turn), `clips: [{ name, at(t), from, to, frame }]`","category":"blocker","line_end":259,"severity":"low","line_start":259},{"id":"blocker:references/3d.md:274:system-reconnaissance","file":"references/3d.md","pattern":"System reconnaissance","snippet":"| `rigid` | Kit clearances, terminals, supports, solid clearances at rest | As in the kit audit. `su","category":"blocker","line_end":274,"severity":"low","line_start":274},{"id":"blocker:references/3d.md:278:system-reconnaissance","file":"references/3d.md","pattern":"System reconnaissance","snippet":"| `crowding` | A live route's end or bend lands on the outline of a slender solid (a rod, post, stem","category":"blocker","line_end":278,"severity":"low","line_start":278},{"id":"blocker:references/craft.md:37:system-reconnaissance","file":"references/craft.md","pattern":"System reconnaissance","snippet":"- **Colour everywhere.** Keep it monochrome unless colour is the subject: one lit accent plus true R","category":"blocker","line_end":37,"severity":"low","line_start":37},{"id":"blocker:references/craft.md:44:system-reconnaissance","file":"references/craft.md","pattern":"System reconnaissance","snippet":"- **Textures that stop, on flat faces too.** The same fault came back on a later figure's boxes, whe","category":"blocker","line_end":44,"severity":"low","line_start":44},{"id":"blocker:references/craft.md:45:system-reconnaissance","file":"references/craft.md","pattern":"System reconnaissance","snippet":"- **Stand-in shapes.** To quiet the audit a builder recorded a 0.45-thick disc at the tip of each of","category":"blocker","line_end":45,"severity":"low","line_start":45},{"id":"blocker:scripts/capture.mjs:115:system-reconnaissance","file":"scripts/capture.mjs","pattern":"System reconnaissance","snippet":"const timer = setTimeout(() => fail(new Error(\"Chrome did not start\")), 20000);","category":"blocker","line_end":115,"severity":"low","line_start":115},{"id":"blocker:scripts/capture.mjs:135:system-reconnaissance","file":"scripts/capture.mjs","pattern":"System reconnaissance","snippet":"let id = 0;","category":"blocker","line_end":135,"severity":"low","line_start":135},{"id":"blocker:scripts/capture.mjs:140:system-reconnaissance","file":"scripts/capture.mjs","pattern":"System reconnaissance","snippet":"if (data.id && pending.has(data.id)) {","category":"blocker","line_end":140,"severity":"low","line_start":140},{"id":"blocker:scripts/drive.mjs:115:system-reconnaissance","file":"scripts/drive.mjs","pattern":"System reconnaissance","snippet":"const timer = setTimeout(() => fail(new Error(\"Chrome did not start\")), 20000);","category":"blocker","line_end":115,"severity":"low","line_start":115},{"id":"blocker:scripts/drive.mjs:135:system-reconnaissance","file":"scripts/drive.mjs","pattern":"System reconnaissance","snippet":"let id = 0;","category":"blocker","line_end":135,"severity":"low","line_start":135},{"id":"blocker:scripts/drive.mjs:140:system-reconnaissance","file":"scripts/drive.mjs","pattern":"System reconnaissance","snippet":"if (data.id && pending.has(data.id)) {","category":"blocker","line_end":140,"severity":"low","line_start":140},{"id":"blocker:scripts/drive.mjs:278:system-reconnaissance","file":"scripts/drive.mjs","pattern":"System reconnaissance","snippet":"console.log(\"lines: the check did not run\");","category":"blocker","line_end":278,"severity":"low","line_start":278},{"id":"blocker:scripts/line-ends.mjs:122:system-reconnaissance","file":"scripts/line-ends.mjs","pattern":"System reconnaissance","snippet":"const grid = new Map();","category":"blocker","line_end":122,"severity":"low","line_start":122},{"id":"blocker:scripts/line-ends.mjs:124:system-reconnaissance","file":"scripts/line-ends.mjs","pattern":"System reconnaissance","snippet":"const id = `${gx},${gy}`;","category":"blocker","line_end":124,"severity":"low","line_start":124},{"id":"blocker:scripts/turn-check.mjs:41:system-reconnaissance","file":"scripts/turn-check.mjs","pattern":"System reconnaissance","snippet":"const timer = setTimeout(() => fail(new Error(\"Chrome did not start\")), 20000);","category":"blocker","line_end":41,"severity":"low","line_start":41},{"id":"blocker:SECURITY.md:7:system-reconnaissance","file":"SECURITY.md","pattern":"System reconnaissance","snippet":"A security problem is anything in this repository that could let a page, a prompt or a file run code","category":"blocker","line_end":7,"severity":"low","line_start":7},{"id":"blocker:SKILL.md:3:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"description: Build crafted, highly detailed, interactive isometric SVG figures that explain a techni","category":"blocker","line_end":3,"severity":"low","line_start":3},{"id":"obfuscation:examples/arcade-cabinet/arcade-cabinet-light.html:188:array-join-empty-string","file":"examples/arcade-cabinet/arcade-cabinet-light.html","pattern":"Array join empty string","snippet":"return points.map(([x, y], at) => `${at ? \"L\" : \"M\"}${tenth(x)} ${tenth(y)}`).join(\"\") + (closed ? \"","category":"obfuscation","line_end":188,"severity":"low","line_start":188},{"id":"obfuscation:examples/arcade-cabinet/arcade-cabinet-light.html:190:array-join-empty-string","file":"examples/arcade-cabinet/arcade-cabinet-light.html","pattern":"Array join empty string","snippet":"const joinPaths = (paths) => paths.filter(Boolean).join(\"\");","category":"obfuscation","line_end":190,"severity":"low","line_start":190},{"id":"obfuscation:examples/arcade-cabinet/arcade-cabinet-light.html:305:array-join-empty-string","file":"examples/arcade-cabinet/arcade-cabinet-light.html","pattern":"Array join empty string","snippet":"fill = parts.join(\"\");","category":"obfuscation","line_end":305,"severity":"low","line_start":305},{"id":"obfuscation:examples/arcade-cabinet/arcade-cabinet-light.html:334:array-join-empty-string","file":"examples/arcade-cabinet/arcade-cabinet-light.html","pattern":"Array join empty string","snippet":".join(\"\");","category":"obfuscation","line_end":334,"severity":"low","line_start":334},{"id":"obfuscation:examples/arcade-cabinet/arcade-cabinet-light.html:338:array-join-empty-string","file":"examples/arcade-cabinet/arcade-cabinet-light.html","pattern":"Array join empty string","snippet":"outline: outline.join(\"\"),","category":"obfuscation","line_end":338,"severity":"low","line_start":338},{"id":"obfuscation:examples/arcade-cabinet/arcade-cabinet-light.html:339:array-join-empty-string","file":"examples/arcade-cabinet/arcade-cabinet-light.html","pattern":"Array join empty string","snippet":"crease: crease.join(\"\"),","category":"obfuscation","line_end":339,"severity":"low","line_start":339},{"id":"obfuscation:examples/arcade-cabinet/arcade-cabinet-light.html:341:array-join-empty-string","file":"examples/arcade-cabinet/arcade-cabinet-light.html","pattern":"Array join empty string","snippet":"shades: buckets.map((paths) => paths.join(\"\")),","category":"obfuscation","line_end":341,"severity":"low","line_start":341},{"id":"obfuscation:examples/arcade-cabinet/arcade-cabinet-light.html:403:array-join-empty-string","file":"examples/arcade-cabinet/arcade-cabinet-light.html","pattern":"Array join empty string","snippet":"return lines.join(\"\");","category":"obfuscation","line_end":403,"severity":"low","line_start":403},{"id":"obfuscation:examples/arcade-cabinet/arcade-cabinet-light.html:426:array-join-empty-string","file":"examples/arcade-cabinet/arcade-cabinet-light.html","pattern":"Array join empty string","snippet":"return runsOf(facing, true).map((run) => pathOf(run.map((index) => iso([ring[index][0], ring[index][","category":"obfuscation","line_end":426,"severity":"low","line_start":426},{"id":"obfuscation:examples/arcade-cabinet/arcade-cabinet-light.html:469:array-join-empty-string","file":"examples/arcade-cabinet/arcade-cabinet-light.html","pattern":"Array join empty string","snippet":"return { back: back.join(\"\"), front: front.join(\"\") };","category":"obfuscation","line_end":469,"severity":"low","line_start":469},{"id":"obfuscation:kit/canvas-painter.mjs:691:array-join-empty-string","file":"kit/canvas-painter.mjs","pattern":"Array join empty string","snippet":"return `<","category":"obfuscation","line_end":691,"severity":"low","line_start":691},{"id":"obfuscation:kit/gl-shared.mjs:77:array-join-empty-string","file":"kit/gl-shared.mjs","pattern":"Array join empty string","snippet":"const fs = compile(gl.FRAGMENT_SHADER, enabled.map((name) => `#extension ${name} : enable\\n`).join(\"","category":"obfuscation","line_end":77,"severity":"low","line_start":77},{"id":"obfuscation:kit/gl.mjs:77:array-join-empty-string","file":"kit/gl.mjs","pattern":"Array join empty string","snippet":"const fs = compile(gl.FRAGMENT_SHADER, enabled.map((name) => `#extension ${name} : enable\\n`).join(\"","category":"obfuscation","line_end":77,"severity":"low","line_start":77},{"id":"obfuscation:kit/iso-kit.mjs:31:array-join-empty-string","file":"kit/iso-kit.mjs","pattern":"Array join empty string","snippet":"return points.map(([x, y], at) => `${at ? \"L\" : \"M\"}${tenth(x)} ${tenth(y)}`).join(\"\") + (closed ? \"","category":"obfuscation","line_end":31,"severity":"low","line_start":31},{"id":"obfuscation:kit/iso-kit.mjs:33:array-join-empty-string","file":"kit/iso-kit.mjs","pattern":"Array join empty string","snippet":"export const joinPaths = (paths) => paths.filter(Boolean).join(\"\");","category":"obfuscation","line_end":33,"severity":"low","line_start":33},{"id":"obfuscation:kit/iso-kit.mjs:148:array-join-empty-string","file":"kit/iso-kit.mjs","pattern":"Array join empty string","snippet":"fill = parts.join(\"\");","category":"obfuscation","line_end":148,"severity":"low","line_start":148},{"id":"obfuscation:kit/iso-kit.mjs:177:array-join-empty-string","file":"kit/iso-kit.mjs","pattern":"Array join empty string","snippet":".join(\"\");","category":"obfuscation","line_end":177,"severity":"low","line_start":177},{"id":"obfuscation:kit/iso-kit.mjs:181:array-join-empty-string","file":"kit/iso-kit.mjs","pattern":"Array join empty string","snippet":"outline: outline.join(\"\"),","category":"obfuscation","line_end":181,"severity":"low","line_start":181},{"id":"obfuscation:kit/iso-kit.mjs:182:array-join-empty-string","file":"kit/iso-kit.mjs","pattern":"Array join empty string","snippet":"crease: crease.join(\"\"),","category":"obfuscation","line_end":182,"severity":"low","line_start":182},{"id":"obfuscation:kit/iso-kit.mjs:184:array-join-empty-string","file":"kit/iso-kit.mjs","pattern":"Array join empty string","snippet":"shades: buckets.map((paths) => paths.join(\"\")),","category":"obfuscation","line_end":184,"severity":"low","line_start":184},{"id":"obfuscation:references/webgl.md:168:array-join-empty-string","file":"references/webgl.md","pattern":"Array join empty string","snippet":"const frontSvg = ` ' ({ tone: t, d })), { tone: 4, d: kitFine.top }","category":"obfuscation","line_end":280,"severity":"low","line_start":280},{"id":"obfuscation:scripts/turn-fidelity.mjs:371:array-join-empty-string","file":"scripts/turn-fidelity.mjs","pattern":"Array join empty string","snippet":"const scaled = (d) => subpaths(d).map((pts) => \"M\" + pts.map(([x, y]) => `${x / 10 + shift[0]} ${y /","category":"obfuscation","line_end":371,"severity":"low","line_start":371},{"id":"obfuscation:scripts/turn-fidelity.mjs:389:array-join-empty-string","file":"scripts/turn-fidelity.mjs","pattern":"Array join empty string","snippet":"const mine = run.roles.filter((role) => role.name.startsWith(\"r\")).map((role) => f.d[run.role[role.n","category":"obfuscation","line_end":389,"severity":"low","line_start":389},{"id":"obfuscation:scripts/turn-fidelity.mjs:390:array-join-empty-string","file":"scripts/turn-fidelity.mjs","pattern":"Array join empty string","snippet":"const theirs = scaled(piece.rings.filter((ring) => ring.alpha * 32 >= 0.5).map((ring) => ring.d).joi","category":"obfuscation","line_end":390,"severity":"low","line_start":390},{"id":"obfuscation:kit/canvas-painter.mjs:341:unicode-escape-sequence","file":"kit/canvas-painter.mjs","pattern":"Unicode escape sequence","snippet":"if (t === \"\\u0002\") return f.tm[link.r];","category":"obfuscation","line_end":341,"severity":"low","line_start":341},{"id":"obfuscation:kit/turn-fixed.mjs:49:unicode-escape-sequence","file":"kit/turn-fixed.mjs","pattern":"Unicode escape sequence","snippet":"return \"\\u0001\" + String.fromCharCode(at & 0xffff, at >>> 16, count, closed ? 1 : 0);","category":"obfuscation","line_end":49,"severity":"low","line_start":49},{"id":"obfuscation:kit/turn-fixed.mjs:61:unicode-escape-sequence","file":"kit/turn-fixed.mjs","pattern":"Unicode escape sequence","snippet":"return \"\\u0002\";","category":"obfuscation","line_end":61,"severity":"low","line_start":61},{"id":"env_access:scripts/capture.mjs:66:environment-variable-access-dot-notation","file":"scripts/capture.mjs","pattern":"Environment variable access (dot notation)","snippet":"process.env.CHROME_PATH,","category":"env_access","line_end":66,"severity":"low","line_start":66},{"id":"env_access:scripts/drive.mjs:63:environment-variable-access-dot-notation","file":"scripts/drive.mjs","pattern":"Environment variable access (dot notation)","snippet":"process.env.CHROME_PATH,","category":"env_access","line_end":63,"severity":"low","line_start":63},{"id":"env_access:scripts/turn-check.mjs:30:environment-variable-access-dot-notation","file":"scripts/turn-check.mjs","pattern":"Environment variable access (dot notation)","snippet":"const candidates = [process.env.CHROME_PATH, \"/Applications/Google Chrome.app/Contents/MacOS/Google ","category":"env_access","line_end":30,"severity":"low","line_start":30},{"id":"env_access:scripts/capture.mjs:66:environment-variable-object","file":"scripts/capture.mjs","pattern":"Environment variable object","snippet":"process.env.CHROME_PATH,","category":"env_access","line_end":66,"severity":"low","line_start":66},{"id":"env_access:scripts/drive.mjs:63:environment-variable-object","file":"scripts/drive.mjs","pattern":"Environment variable object","snippet":"process.env.CHROME_PATH,","category":"env_access","line_end":63,"severity":"low","line_start":63},{"id":"env_access:scripts/turn-check.mjs:30:environment-variable-object","file":"scripts/turn-check.mjs","pattern":"Environment variable object","snippet":"const candidates = [process.env.CHROME_PATH, \"/Applications/Google Chrome.app/Contents/MacOS/Google ","category":"env_access","line_end":30,"severity":"low","line_start":30},{"id":"network:scripts/capture.mjs:133:fetch-api-call","file":"scripts/capture.mjs","pattern":"Fetch API call","snippet":"const target = await (await fetch(`http://127.0.0.1:${port}/json/new?about:blank`, { method: \"PUT\" }","category":"network","line_end":133,"severity":"low","line_start":133},{"id":"network:scripts/drive.mjs:133:fetch-api-call","file":"scripts/drive.mjs","pattern":"Fetch API call","snippet":"const page = await (await fetch(`http://127.0.0.1:${port}/json/new?about:blank`, { method: \"PUT\" }))","category":"network","line_end":133,"severity":"low","line_start":133},{"id":"network:scripts/turn-check.mjs:51:fetch-api-call","file":"scripts/turn-check.mjs","pattern":"Fetch API call","snippet":"const page = await (await fetch(`http://127.0.0.1:${port}/json/new?about:blank`, { method: \"PUT\" }))","category":"network","line_end":51,"severity":"low","line_start":51},{"id":"network:.github/ISSUE_TEMPLATE/config.yml:4:hardcoded-url","file":".github/ISSUE_TEMPLATE/config.yml","pattern":"Hardcoded URL","snippet":"url: https://github.com/wheresryan22/anatomy/security/advisories/new","category":"network","line_end":4,"severity":"low","line_start":4},{"id":"network:CONTRIBUTING.md:16:hardcoded-url","file":"CONTRIBUTING.md","pattern":"Hardcoded URL","snippet":"git clone https://github.com/wheresryan22/anatomy.git","category":"network","line_end":16,"severity":"low","line_start":16},{"id":"network:README.md:136:hardcoded-url","file":"README.md","pattern":"Hardcoded URL","snippet":"mkdir -p ~/.claude/skills/anatomy && curl -L https://github.com/wheresryan22/anatomy/archive/refs/he","category":"network","line_end":136,"severity":"low","line_start":136},{"id":"network:references/verify.md:16:hardcoded-url","file":"references/verify.md","pattern":"Hardcoded URL","snippet":"node scripts/capture.mjs http://localhost:3000/docs --select \"figure:nth-of-type(3) .iso-plate\" # ","category":"network","line_end":16,"severity":"low","line_start":16},{"id":"network:scripts/capture.mjs:133:hardcoded-url","file":"scripts/capture.mjs","pattern":"Hardcoded URL","snippet":"const target = await (await fetch(`http://127.0.0.1:${port}/json/new?about:blank`, { method: \"PUT\" }","category":"network","line_end":133,"severity":"low","line_start":133},{"id":"network:scripts/drive.mjs:133:hardcoded-url","file":"scripts/drive.mjs","pattern":"Hardcoded URL","snippet":"const page = await (await fetch(`http://127.0.0.1:${port}/json/new?about:blank`, { method: \"PUT\" }))","category":"network","line_end":133,"severity":"low","line_start":133},{"id":"network:scripts/turn-check.mjs:51:hardcoded-url","file":"scripts/turn-check.mjs","pattern":"Hardcoded URL","snippet":"const page = await (await fetch(`http://127.0.0.1:${port}/json/new?about:blank`, { method: \"PUT\" }))","category":"network","line_end":51,"severity":"low","line_start":51},{"id":"filesystem:scripts/capture.mjs:2:temp-file-creation","file":"scripts/capture.mjs","pattern":"Temp file creation","snippet":"import { existsSync, mkdtempSync, readdirSync, rmSync, writeFileSync } from \"node:fs\";","category":"filesystem","line_end":2,"severity":"low","line_start":2},{"id":"filesystem:scripts/capture.mjs:100:temp-file-creation","file":"scripts/capture.mjs","pattern":"Temp file creation","snippet":"const profile = mkdtempSync(join(tmpdir(), \"iso-capture-\"));","category":"filesystem","line_end":100,"severity":"low","line_start":100},{"id":"filesystem:scripts/drive.mjs:2:temp-file-creation","file":"scripts/drive.mjs","pattern":"Temp file creation","snippet":"import { existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync } from","category":"filesystem","line_end":2,"severity":"low","line_start":2},{"id":"filesystem:scripts/drive.mjs:111:temp-file-creation","file":"scripts/drive.mjs","pattern":"Temp file creation","snippet":"const profile = mkdtempSync(join(tmpdir(), \"iso-drive-\"));","category":"filesystem","line_end":111,"severity":"low","line_start":111},{"id":"filesystem:scripts/turn-check.mjs:2:temp-file-creation","file":"scripts/turn-check.mjs","pattern":"Temp file creation","snippet":"import { existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync } from","category":"filesystem","line_end":2,"severity":"low","line_start":2},{"id":"filesystem:scripts/turn-check.mjs:37:temp-file-creation","file":"scripts/turn-check.mjs","pattern":"Temp file creation","snippet":"const profile = mkdtempSync(join(tmpdir(), \"turn-check-\"));","category":"filesystem","line_end":37,"severity":"low","line_start":37}],"finding_verdicts":[{"id":"obfuscation:kit/turn-fixed.mjs:49:long-fromcharcode-sequence","reason":"t3Token packs a geometry arena offset, vertex count, and closure flag into four characters. This is rendering metadata, not concealed executable code.","verdict":"false_positive","confidence":0.99},{"id":"blocker:.github/ISSUE_TEMPLATE/bug_report.yml:9:screen-capture-upload","reason":"This text describes example screenshots or requests voluntary bug-report images. No automatic desktop capture or unauthorized upload is present.","verdict":"false_positive","confidence":0.97},{"id":"blocker:README.md:80:screen-capture-upload","reason":"This text describes example screenshots or requests voluntary bug-report images. No automatic desktop capture or unauthorized upload is present.","verdict":"false_positive","confidence":0.97},{"id":"blocker:scripts/capture.mjs:201:screen-capture-upload","reason":"Page.captureScreenshot captures the explicitly selected browser page through local DevTools. The resulting PNG is saved locally; no upload destination appears.","verdict":"false_positive","confidence":0.97},{"id":"blocker:scripts/drive.mjs:179:screen-capture-upload","reason":"Page.captureScreenshot captures the explicitly selected browser page through local DevTools. The resulting PNG is saved locally; no upload destination appears.","verdict":"false_positive","confidence":0.97},{"id":"sensitive:examples/arcade-cabinet/arcade-cabinet-light.html:956:certificate-key-files","reason":"The matched key properties identify geometry ordering or collection entries. No certificate path, private-key read, or credential handling appears.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:examples/arcade-cabinet/arcade-cabinet-light.html:960:certificate-key-files","reason":"The matched key properties identify geometry ordering or collection entries. No certificate path, private-key read, or credential handling appears.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:examples/arcade-cabinet/arcade-cabinet-light.html:963:certificate-key-files","reason":"The matched key properties identify geometry ordering or collection entries. No certificate path, private-key read, or credential handling appears.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:examples/arcade-cabinet/arcade-cabinet-light.html:1264:certificate-key-files","reason":"The matched key properties identify geometry ordering or collection entries. No certificate path, private-key read, or credential handling appears.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:examples/arcade-cabinet/arcade-cabinet-light.html:2771:certificate-key-files","reason":"The matched keys are keyboard inputs used for figure interaction. They do not refer to certificate files or private keys.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:examples/arcade-cabinet/arcade-cabinet-light.html:2796:certificate-key-files","reason":"The matched keys are keyboard inputs used for figure interaction. They do not refer to certificate files or private keys.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:examples/arcade-cabinet/arcade-cabinet-light.html:2800:certificate-key-files","reason":"The matched keys are keyboard inputs used for figure interaction. They do not refer to certificate files or private keys.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:examples/arcade-cabinet/arcade-cabinet.html:956:certificate-key-files","reason":"The matched key properties identify geometry ordering or collection entries. No certificate path, private-key read, or credential handling appears.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:examples/arcade-cabinet/arcade-cabinet.html:960:certificate-key-files","reason":"The matched key properties identify geometry ordering or collection entries. No certificate path, private-key read, or credential handling appears.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:examples/arcade-cabinet/arcade-cabinet.html:963:certificate-key-files","reason":"The matched key properties identify geometry ordering or collection entries. No certificate path, private-key read, or credential handling appears.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:examples/arcade-cabinet/arcade-cabinet.html:1264:certificate-key-files","reason":"The matched key properties identify geometry ordering or collection entries. No certificate path, private-key read, or credential handling appears.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:kit/audit.mjs:646:certificate-key-files","reason":"The matched key properties identify geometry ordering or collection entries. No certificate path, private-key read, or credential handling appears.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:kit/audit.mjs:650:certificate-key-files","reason":"The matched key properties identify geometry ordering or collection entries. No certificate path, private-key read, or credential handling appears.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:kit/audit.mjs:723:certificate-key-files","reason":"The matched key properties identify geometry ordering or collection entries. No certificate path, private-key read, or credential handling appears.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:kit/audit.mjs:1811:certificate-key-files","reason":"The matched key properties identify geometry ordering or collection entries. No certificate path, private-key read, or credential handling appears.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:kit/gl-shared.mjs:95:certificate-key-files","reason":"The matched key properties identify geometry ordering or collection entries. No certificate path, private-key read, or credential handling appears.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:kit/gl.mjs:95:certificate-key-files","reason":"The matched key properties identify geometry ordering or collection entries. No certificate path, private-key read, or credential handling appears.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:kit/lathe.mjs:125:certificate-key-files","reason":"The matched key properties identify geometry ordering or collection entries. No certificate path, private-key read, or credential handling appears.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:kit/lathe.mjs:129:certificate-key-files","reason":"The matched key properties identify geometry ordering or collection entries. No certificate path, private-key read, or credential handling appears.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:kit/lathe.mjs:132:certificate-key-files","reason":"The matched key properties identify geometry ordering or collection entries. No certificate path, private-key read, or credential handling appears.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:kit/lathe.mjs:433:certificate-key-files","reason":"The matched key properties identify geometry ordering or collection entries. No certificate path, private-key read, or credential handling appears.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:kit/turn-audit.mjs:333:certificate-key-files","reason":"The matched key properties identify geometry ordering or collection entries. No certificate path, private-key read, or credential handling appears.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:references/kit.md:270:certificate-key-files","reason":"The matched key properties identify geometry ordering or collection entries. No certificate path, private-key read, or credential handling appears.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:references/kit.md:343:certificate-key-files","reason":"The matched key properties identify geometry ordering or collection entries. No certificate path, private-key read, or credential handling appears.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:scripts/capture.mjs:53:certificate-key-files","reason":"The matched keys are keyboard inputs used for figure interaction. They do not refer to certificate files or private keys.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:scripts/capture.mjs:187:certificate-key-files","reason":"The matched keys are keyboard inputs used for figure interaction. They do not refer to certificate files or private keys.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:scripts/capture.mjs:190:certificate-key-files","reason":"The matched keys are keyboard inputs used for figure interaction. They do not refer to certificate files or private keys.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:.gitignore:5:environment-file-access","reason":"These ignore rules prevent environment files from entering version control. They do not read environment files or expose secrets.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:.gitignore:6:environment-file-access","reason":"These ignore rules prevent environment files from entering version control. They do not read environment files or expose secrets.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:scripts/capture.mjs:66:environment-file-access","reason":"Only CHROME_PATH is read to locate the user-selected browser executable. No environment file or secret variable is accessed here.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:scripts/drive.mjs:63:environment-file-access","reason":"Only CHROME_PATH is read to locate the user-selected browser executable. No environment file or secret variable is accessed here.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:scripts/turn-check.mjs:30:environment-file-access","reason":"Only CHROME_PATH is read to locate the user-selected browser executable. No environment file or secret variable is accessed here.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:examples/desk-computer/desk-computer-light.html:137:heuristic-extremely-long-line-185158-chars-likel","reason":"The line contains generated SVG paths and figure markup in a standalone page. Dense vector geometry explains its length.","verdict":"false_positive","confidence":0.95},{"id":"obfuscation:examples/desk-computer/desk-computer.html:137:heuristic-extremely-long-line-185158-chars-likel","reason":"The line contains generated SVG paths and figure markup in a standalone page. Dense vector geometry explains its length.","verdict":"false_positive","confidence":0.95},{"id":"obfuscation:evals/evals.json:25:heuristic-extremely-long-line-2469-chars-likely-","reason":"The long line is a readable expected-output description in evaluation data. It is not an encoded program.","verdict":"false_positive","confidence":0.95},{"id":"obfuscation:references/kit.md:240:heuristic-extremely-long-line-2492-chars-likely-","reason":"The long line documents the tubePieces API and its geometry options. Markdown table length does not indicate concealed executable behavior.","verdict":"false_positive","confidence":0.95},{"id":"obfuscation:examples/turning-dial/turning-dial-verify-light.html:3963:heuristic-extremely-long-line-27857-chars-likely","reason":"The line contains serialized coordinates, scene parts, or verification shapes. Its length comes from geometry data, not executable obfuscation.","verdict":"false_positive","confidence":0.95},{"id":"obfuscation:examples/arcade-cabinet/arcade-cabinet-light.html:2222:heuristic-extremely-long-line-4135-chars-likely-","reason":"The line contains serialized coordinates, scene parts, or verification shapes. Its length comes from geometry data, not executable obfuscation.","verdict":"false_positive","confidence":0.95},{"id":"obfuscation:examples/arcade-cabinet/arcade-cabinet.html:2222:heuristic-extremely-long-line-4135-chars-likely-","reason":"The line contains serialized coordinates, scene parts, or verification shapes. Its length comes from geometry data, not executable obfuscation.","verdict":"false_positive","confidence":0.95},{"id":"obfuscation:examples/turning-dial/turning-dial-light.html:169:heuristic-extremely-long-line-420961-chars-likel","reason":"The line contains generated SVG paths and figure markup in a standalone page. Dense vector geometry explains its length.","verdict":"false_positive","confidence":0.95},{"id":"obfuscation:examples/turning-dial/turning-dial-verify-light.html:169:heuristic-extremely-long-line-420961-chars-likel","reason":"The line contains generated SVG paths and figure markup in a standalone page. Dense vector geometry explains its length.","verdict":"false_positive","confidence":0.95},{"id":"obfuscation:examples/turning-dial/turning-dial.html:169:heuristic-extremely-long-line-420961-chars-likel","reason":"The line contains generated SVG paths and figure markup in a standalone page. Dense vector geometry explains its length.","verdict":"false_positive","confidence":0.95},{"id":"obfuscation:examples/ripple-tank/ripple-tank-light.html:217:heuristic-extremely-long-line-424208-chars-likel","reason":"The line contains generated SVG paths and figure markup in a standalone page. Dense vector geometry explains its length.","verdict":"false_positive","confidence":0.95},{"id":"obfuscation:examples/ripple-tank/ripple-tank.html:217:heuristic-extremely-long-line-424208-chars-likel","reason":"The line contains generated SVG paths and figure markup in a standalone page. Dense vector geometry explains its length.","verdict":"false_positive","confidence":0.95},{"id":"obfuscation:examples/turning-dial/turning-dial-light.html:3963:heuristic-extremely-long-line-69463-chars-likely","reason":"The line contains serialized coordinates, scene parts, or verification shapes. Its length comes from geometry data, not executable obfuscation.","verdict":"false_positive","confidence":0.95},{"id":"obfuscation:examples/turning-dial/turning-dial-verify-light.html:3964:heuristic-extremely-long-line-69463-chars-likely","reason":"The line contains serialized coordinates, scene parts, or verification shapes. Its length comes from geometry data, not executable obfuscation.","verdict":"false_positive","confidence":0.95},{"id":"obfuscation:examples/turning-dial/turning-dial.html:3963:heuristic-extremely-long-line-69463-chars-likely","reason":"The line contains serialized coordinates, scene parts, or verification shapes. Its length comes from geometry data, not executable obfuscation.","verdict":"false_positive","confidence":0.95},{"id":"obfuscation:examples/arcade-cabinet/arcade-cabinet-light.html:158:heuristic-extremely-long-line-877477-chars-likel","reason":"The line contains generated SVG paths and figure markup in a standalone page. Dense vector geometry explains its length.","verdict":"false_positive","confidence":0.95},{"id":"obfuscation:examples/arcade-cabinet/arcade-cabinet.html:158:heuristic-extremely-long-line-877477-chars-likel","reason":"The line contains generated SVG paths and figure markup in a standalone page. Dense vector geometry explains its length.","verdict":"false_positive","confidence":0.95},{"id":"obfuscation:examples/dial-indicator/dial-indicator.html:114:heuristic-extremely-long-line-89108-chars-likely","reason":"The line contains generated SVG paths and figure markup in a standalone page. Dense vector geometry explains its length.","verdict":"false_positive","confidence":0.95},{"id":"obfuscation:examples/dial-indicator/dial-indicator-light.html:114:heuristic-extremely-long-line-89109-chars-likely","reason":"The line contains generated SVG paths and figure markup in a standalone page. Dense vector geometry explains its length.","verdict":"false_positive","confidence":0.95},{"id":"obfuscation:examples/spot-plate/drops.ts:1:heuristic-multiple-bracket-chains-10-jsfuck-obfu","reason":"The file uses readable named functions, nested arrays, and geometry expressions. Repeated closing brackets are not a JSFuck executable payload.","verdict":"false_positive","confidence":0.91},{"id":"obfuscation:examples/turning-dial/turning-dial-verify-light.html:1:heuristic-multiple-bracket-chains-118-jsfuck-obf","reason":"The file uses readable named functions, nested arrays, and geometry expressions. Repeated closing brackets are not a JSFuck executable payload.","verdict":"false_positive","confidence":0.91},{"id":"obfuscation:kit/turn-audit.mjs:1:heuristic-multiple-bracket-chains-15-jsfuck-obfu","reason":"The file uses readable named functions, nested arrays, and geometry expressions. Repeated closing brackets are not a JSFuck executable payload.","verdict":"false_positive","confidence":0.91},{"id":"obfuscation:scripts/drive.mjs:1:heuristic-multiple-bracket-chains-15-jsfuck-obfu","reason":"The file uses readable named functions, nested arrays, and geometry expressions. Repeated closing brackets are not a JSFuck executable payload.","verdict":"false_positive","confidence":0.91},{"id":"obfuscation:scripts/turn-check.mjs:1:heuristic-multiple-bracket-chains-15-jsfuck-obfu","reason":"The file uses readable named functions, nested arrays, and geometry expressions. Repeated closing brackets are not a JSFuck executable payload.","verdict":"false_positive","confidence":0.91},{"id":"obfuscation:kit/lathe.mjs:1:heuristic-multiple-bracket-chains-24-jsfuck-obfu","reason":"The file uses readable named functions, nested arrays, and geometry expressions. Repeated closing brackets are not a JSFuck executable payload.","verdict":"false_positive","confidence":0.91},{"id":"obfuscation:kit/turn-build.mjs:1:heuristic-multiple-bracket-chains-26-jsfuck-obfu","reason":"The file uses readable named functions, nested arrays, and geometry expressions. Repeated closing brackets are not a JSFuck executable payload.","verdict":"false_positive","confidence":0.91},{"id":"obfuscation:examples/turning-dial/turning-dial-light.html:1:heuristic-multiple-bracket-chains-34-jsfuck-obfu","reason":"The file uses readable named functions, nested arrays, and geometry expressions. Repeated closing brackets are not a JSFuck executable payload.","verdict":"false_positive","confidence":0.91},{"id":"obfuscation:examples/turning-dial/turning-dial.html:1:heuristic-multiple-bracket-chains-34-jsfuck-obfu","reason":"The file uses readable named functions, nested arrays, and geometry expressions. Repeated closing brackets are not a JSFuck executable payload.","verdict":"false_positive","confidence":0.91},{"id":"obfuscation:examples/arcade-cabinet/arcade-cabinet-light.html:1:heuristic-multiple-bracket-chains-37-jsfuck-obfu","reason":"The file uses readable named functions, nested arrays, and geometry expressions. Repeated closing brackets are not a JSFuck executable payload.","verdict":"false_positive","confidence":0.91},{"id":"obfuscation:examples/arcade-cabinet/arcade-cabinet.html:1:heuristic-multiple-bracket-chains-37-jsfuck-obfu","reason":"The file uses readable named functions, nested arrays, and geometry expressions. Repeated closing brackets are not a JSFuck executable payload.","verdict":"false_positive","confidence":0.91},{"id":"obfuscation:examples/arcade-cabinet/build.mjs:1:heuristic-multiple-bracket-chains-38-jsfuck-obfu","reason":"The file uses readable named functions, nested arrays, and geometry expressions. Repeated closing brackets are not a JSFuck executable payload.","verdict":"false_positive","confidence":0.91},{"id":"obfuscation:examples/raptor-engine/build.mjs:1:heuristic-multiple-bracket-chains-38-jsfuck-obfu","reason":"The file uses readable named functions, nested arrays, and geometry expressions. Repeated closing brackets are not a JSFuck executable payload.","verdict":"false_positive","confidence":0.91},{"id":"obfuscation:kit/audit.mjs:1:heuristic-multiple-bracket-chains-41-jsfuck-obfu","reason":"The file uses readable named functions, nested arrays, and geometry expressions. Repeated closing brackets are not a JSFuck executable payload.","verdict":"false_positive","confidence":0.91},{"id":"obfuscation:kit/turn-fixed.mjs:1:heuristic-multiple-bracket-chains-6-jsfuck-obfus","reason":"The file uses readable named functions, nested arrays, and geometry expressions. Repeated closing brackets are not a JSFuck executable payload.","verdict":"false_positive","confidence":0.91},{"id":"obfuscation:kit/turn.mjs:1:heuristic-multiple-bracket-chains-6-jsfuck-obfus","reason":"The file uses readable named functions, nested arrays, and geometry expressions. Repeated closing brackets are not a JSFuck executable payload.","verdict":"false_positive","confidence":0.91},{"id":"obfuscation:examples/desk-computer/desk-computer-light.html:1:heuristic-multiple-bracket-chains-7-jsfuck-obfus","reason":"The file uses readable named functions, nested arrays, and geometry expressions. Repeated closing brackets are not a JSFuck executable payload.","verdict":"false_positive","confidence":0.91},{"id":"obfuscation:examples/desk-computer/desk-computer.html:1:heuristic-multiple-bracket-chains-7-jsfuck-obfus","reason":"The file uses readable named functions, nested arrays, and geometry expressions. Repeated closing brackets are not a JSFuck executable payload.","verdict":"false_positive","confidence":0.91},{"id":"obfuscation:examples/dial-indicator/dial-indicator-light.html:1:heuristic-multiple-bracket-chains-7-jsfuck-obfus","reason":"The file uses readable named functions, nested arrays, and geometry expressions. Repeated closing brackets are not a JSFuck executable payload.","verdict":"false_positive","confidence":0.91},{"id":"obfuscation:examples/dial-indicator/dial-indicator.html:1:heuristic-multiple-bracket-chains-7-jsfuck-obfus","reason":"The file uses readable named functions, nested arrays, and geometry expressions. Repeated closing brackets are not a JSFuck executable payload.","verdict":"false_positive","confidence":0.91},{"id":"obfuscation:examples/spot-plate/geometry.ts:1:heuristic-multiple-bracket-chains-7-jsfuck-obfus","reason":"The file uses readable named functions, nested arrays, and geometry expressions. Repeated closing brackets are not a JSFuck executable payload.","verdict":"false_positive","confidence":0.91},{"id":"obfuscation:kit/iso-kit.mjs:1:heuristic-multiple-bracket-chains-7-jsfuck-obfus","reason":"The file uses readable named functions, nested arrays, and geometry expressions. Repeated closing brackets are not a JSFuck executable payload.","verdict":"false_positive","confidence":0.91},{"id":"obfuscation:kit/tube.mjs:1:heuristic-multiple-bracket-chains-7-jsfuck-obfus","reason":"The file uses readable named functions, nested arrays, and geometry expressions. Repeated closing brackets are not a JSFuck executable payload.","verdict":"false_positive","confidence":0.91},{"id":"obfuscation:examples/ripple-tank/ripple-tank-light.html:1:heuristic-multiple-bracket-chains-8-jsfuck-obfus","reason":"The file uses readable named functions, nested arrays, and geometry expressions. Repeated closing brackets are not a JSFuck executable payload.","verdict":"false_positive","confidence":0.91},{"id":"obfuscation:examples/ripple-tank/ripple-tank.html:1:heuristic-multiple-bracket-chains-8-jsfuck-obfus","reason":"The file uses readable named functions, nested arrays, and geometry expressions. Repeated closing brackets are not a JSFuck executable payload.","verdict":"false_positive","confidence":0.91},{"id":"filesystem:CONTRIBUTING.md:23:hidden-file-in-home-directory","reason":"The documented command installs or links the skill in the standard user skill directory. This is explicit installation, not covert persistence.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:README.md:100:hidden-file-in-home-directory","reason":"The documented command installs or links the skill in the standard user skill directory. This is explicit installation, not covert persistence.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:README.md:102:hidden-file-in-home-directory","reason":"The documented command installs or links the skill in the standard user skill directory. This is explicit installation, not covert persistence.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:README.md:104:hidden-file-in-home-directory","reason":"The documented command installs or links the skill in the standard user skill directory. This is explicit installation, not covert persistence.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:README.md:131:hidden-file-in-home-directory","reason":"The documented command installs or links the skill in the standard user skill directory. This is explicit installation, not covert persistence.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:README.md:136:hidden-file-in-home-directory","reason":"The documented command installs or links the skill in the standard user skill directory. This is explicit installation, not covert persistence.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:scripts/capture.mjs:1:node-js-child-process-module","reason":"The imported spawn function launches headless Chrome or the local Node verification wrapper with argument arrays. No shell command construction is present.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:scripts/drive.mjs:1:node-js-child-process-module","reason":"The imported spawn function launches headless Chrome or the local Node verification wrapper with argument arrays. No shell command construction is present.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:scripts/lines.mjs:1:node-js-child-process-module","reason":"The imported spawn function launches headless Chrome or the local Node verification wrapper with argument arrays. No shell command construction is present.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:scripts/turn-check.mjs:1:node-js-child-process-module","reason":"The imported spawn function launches headless Chrome or the local Node verification wrapper with argument arrays. No shell command construction is present.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:examples/arcade-cabinet/build.mjs:4:path-traversal-sequence","reason":"The parent-directory segments belong to fixed repository-relative module imports. No attacker-controlled path is used to escape a filesystem boundary.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:examples/arcade-cabinet/build.mjs:5:path-traversal-sequence","reason":"The parent-directory segments belong to fixed repository-relative module imports. No attacker-controlled path is used to escape a filesystem boundary.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:examples/arcade-cabinet/build.mjs:6:path-traversal-sequence","reason":"The parent-directory segments belong to fixed repository-relative module imports. No attacker-controlled path is used to escape a filesystem boundary.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:examples/arcade-cabinet/build.mjs:7:path-traversal-sequence","reason":"The parent-directory segments belong to fixed repository-relative module imports. No attacker-controlled path is used to escape a filesystem boundary.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:examples/arcade-cabinet/build.mjs:8:path-traversal-sequence","reason":"The parent-directory segments belong to fixed repository-relative module imports. No attacker-controlled path is used to escape a filesystem boundary.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:examples/desk-computer/build.mjs:4:path-traversal-sequence","reason":"The parent-directory segments belong to fixed repository-relative module imports. No attacker-controlled path is used to escape a filesystem boundary.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:examples/desk-computer/build.mjs:5:path-traversal-sequence","reason":"The parent-directory segments belong to fixed repository-relative module imports. No attacker-controlled path is used to escape a filesystem boundary.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:examples/dial-indicator/build.mjs:4:path-traversal-sequence","reason":"The parent-directory segments belong to fixed repository-relative module imports. No attacker-controlled path is used to escape a filesystem boundary.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:examples/dial-indicator/build.mjs:5:path-traversal-sequence","reason":"The parent-directory segments belong to fixed repository-relative module imports. No attacker-controlled path is used to escape a filesystem boundary.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:examples/raptor-engine/build.mjs:4:path-traversal-sequence","reason":"The parent-directory segments belong to fixed repository-relative module imports. No attacker-controlled path is used to escape a filesystem boundary.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:examples/raptor-engine/build.mjs:5:path-traversal-sequence","reason":"The parent-directory segments belong to fixed repository-relative module imports. No attacker-controlled path is used to escape a filesystem boundary.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:kit/react/draw.tsx:2:path-traversal-sequence","reason":"The parent-directory segments belong to fixed repository-relative module imports. No attacker-controlled path is used to escape a filesystem boundary.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:references/3d.md:42:path-traversal-sequence","reason":"The parent-directory segments belong to fixed repository-relative module imports. No attacker-controlled path is used to escape a filesystem boundary.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:references/3d.md:43:path-traversal-sequence","reason":"The parent-directory segments belong to fixed repository-relative module imports. No attacker-controlled path is used to escape a filesystem boundary.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:references/3d.md:44:path-traversal-sequence","reason":"The parent-directory segments belong to fixed repository-relative module imports. No attacker-controlled path is used to escape a filesystem boundary.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:references/3d.md:45:path-traversal-sequence","reason":"The parent-directory segments belong to fixed repository-relative module imports. No attacker-controlled path is used to escape a filesystem boundary.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:references/3d.md:46:path-traversal-sequence","reason":"The parent-directory segments belong to fixed repository-relative module imports. No attacker-controlled path is used to escape a filesystem boundary.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:references/kit.md:151:path-traversal-sequence","reason":"The parent-directory segments belong to fixed repository-relative module imports. No attacker-controlled path is used to escape a filesystem boundary.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:references/kit.md:236:path-traversal-sequence","reason":"The parent-directory segments belong to fixed repository-relative module imports. No attacker-controlled path is used to escape a filesystem boundary.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:references/kit.md:262:path-traversal-sequence","reason":"The parent-directory segments belong to fixed repository-relative module imports. No attacker-controlled path is used to escape a filesystem boundary.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:references/kit.md:385:path-traversal-sequence","reason":"The parent-directory segments belong to fixed repository-relative module imports. No attacker-controlled path is used to escape a filesystem boundary.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:references/kit.md:386:path-traversal-sequence","reason":"The parent-directory segments belong to fixed repository-relative module imports. No attacker-controlled path is used to escape a filesystem boundary.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:references/kit.md:387:path-traversal-sequence","reason":"The parent-directory segments belong to fixed repository-relative module imports. No attacker-controlled path is used to escape a filesystem boundary.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:scripts/turn-bench.mjs:3:path-traversal-sequence","reason":"The parent-directory segments belong to fixed repository-relative module imports. No attacker-controlled path is used to escape a filesystem boundary.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:scripts/turn-fidelity.mjs:1:path-traversal-sequence","reason":"The parent-directory segments belong to fixed repository-relative module imports. No attacker-controlled path is used to escape a filesystem boundary.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:scripts/turn-fidelity.mjs:2:path-traversal-sequence","reason":"The parent-directory segments belong to fixed repository-relative module imports. No attacker-controlled path is used to escape a filesystem boundary.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:scripts/turn-fidelity.mjs:3:path-traversal-sequence","reason":"The parent-directory segments belong to fixed repository-relative module imports. No attacker-controlled path is used to escape a filesystem boundary.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:scripts/turn-fidelity.mjs:4:path-traversal-sequence","reason":"The parent-directory segments belong to fixed repository-relative module imports. No attacker-controlled path is used to escape a filesystem boundary.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:scripts/capture.mjs:8:process-spawn","reason":"The script launches the current Node executable with the local verification script or WebSocket compatibility flag. Arguments are passed without a shell.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:scripts/capture.mjs:101:process-spawn","reason":"The user-selected Chrome executable receives a fixed argument array and a temporary profile. Shell interpretation is not enabled.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:scripts/drive.mjs:9:process-spawn","reason":"The script launches the current Node executable with the local verification script or WebSocket compatibility flag. Arguments are passed without a shell.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:scripts/drive.mjs:112:process-spawn","reason":"The user-selected Chrome executable receives a fixed argument array and a temporary profile. Shell interpretation is not enabled.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:scripts/lines.mjs:30:process-spawn","reason":"The script launches the current Node executable with the local verification script or WebSocket compatibility flag. Arguments are passed without a shell.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:scripts/turn-check.mjs:38:process-spawn","reason":"The user-selected Chrome executable receives a fixed argument array and a temporary profile. Shell interpretation is not enabled.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:scripts/turn-check.mjs:644:process-spawn","reason":"The script launches the current Node executable with the local verification script or WebSocket compatibility flag. Arguments are passed without a shell.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:CONTRIBUTING.md:23:symlink-creation","reason":"The documented command installs or links the skill in the standard user skill directory. This is explicit installation, not covert persistence.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:examples/turning-dial/turning-dial-light.html:596:base64-decode","reason":"t3Unpack decodes packed separating-plane geometry into DataView values and numeric arrays. The decoded bytes are not executed.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:examples/turning-dial/turning-dial-verify-light.html:596:base64-decode","reason":"t3Unpack decodes packed separating-plane geometry into DataView values and numeric arrays. The decoded bytes are not executed.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:examples/turning-dial/turning-dial.html:596:base64-decode","reason":"t3Unpack decodes packed separating-plane geometry into DataView values and numeric arrays. The decoded bytes are not executed.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:kit/turn-fixed.mjs:463:base64-decode","reason":"t3Unpack decodes packed separating-plane geometry into DataView values and numeric arrays. The decoded bytes are not executed.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:kit/turn.mjs:428:base64-decode","reason":"t3Unpack decodes packed separating-plane geometry into DataView values and numeric arrays. The decoded bytes are not executed.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/capture.mjs:202:buffer-base64-decode","reason":"The decoded data is PNG screenshot or diagnostic image content saved to a local output file. No executable decoding occurs.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:scripts/drive.mjs:184:buffer-base64-decode","reason":"The decoded data is PNG screenshot or diagnostic image content saved to a local output file. No executable decoding occurs.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:scripts/turn-check.mjs:591:buffer-base64-decode","reason":"The decoded data is PNG screenshot or diagnostic image content saved to a local output file. No executable decoding occurs.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:kit/turn-fixed.mjs:49:character-code-conversion","reason":"t3Token packs a geometry arena offset, vertex count, and closure flag into four characters. This is rendering metadata, not concealed executable code.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/turn-bench.mjs:20:dynamic-import-expression","reason":"The CLI-selected build module executes with Node filesystem and network privileges. An untrusted build target can run arbitrary host code.","verdict":"confirmed","confidence":0.82},{"id":"scripts:scripts/turn-check.mjs:485:dynamic-import-expression","reason":"The import targets the fixed local fidelity-check module. It does not load a remote or attacker-selected dependency.","verdict":"false_positive","confidence":0.94},{"id":"scripts:scripts/turn-check.mjs:486:dynamic-import-expression","reason":"The CLI-selected build module executes with Node filesystem and network privileges. An untrusted build target can run arbitrary host code.","verdict":"confirmed","confidence":0.82},{"id":"network:scripts/capture.mjs:133:hardcoded-ip-address","reason":"The connection targets the newly launched Chrome instance through loopback DevTools. It is local browser control, not an external data destination.","verdict":"false_positive","confidence":0.99},{"id":"network:scripts/drive.mjs:133:hardcoded-ip-address","reason":"The connection targets the newly launched Chrome instance through loopback DevTools. It is local browser control, not an external data destination.","verdict":"false_positive","confidence":0.99},{"id":"network:scripts/turn-check.mjs:51:hardcoded-ip-address","reason":"The connection targets the newly launched Chrome instance through loopback DevTools. It is local browser control, not an external data destination.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:CONTRIBUTING.md:23:hidden-file-access","reason":"The documented command installs or links the skill in the standard user skill directory. This is explicit installation, not covert persistence.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:examples/ripple-tank/live.js:176:hidden-file-access","reason":"The match is GLSL arithmetic or a decimal constant in a shader. It contains no filesystem operation.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:examples/ripple-tank/live.js:177:hidden-file-access","reason":"The match is GLSL arithmetic or a decimal constant in a shader. It contains no filesystem operation.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:examples/ripple-tank/live.js:233:hidden-file-access","reason":"The match is GLSL arithmetic or a decimal constant in a shader. It contains no filesystem operation.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:examples/ripple-tank/live.js:234:hidden-file-access","reason":"The match is GLSL arithmetic or a decimal constant in a shader. It contains no filesystem operation.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:examples/ripple-tank/ripple-tank-light.html:914:hidden-file-access","reason":"The match is GLSL arithmetic or a decimal constant in a shader. It contains no filesystem operation.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:examples/ripple-tank/ripple-tank-light.html:915:hidden-file-access","reason":"The match is GLSL arithmetic or a decimal constant in a shader. It contains no filesystem operation.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:examples/ripple-tank/ripple-tank-light.html:1381:hidden-file-access","reason":"The match is GLSL arithmetic or a decimal constant in a shader. It contains no filesystem operation.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:examples/ripple-tank/ripple-tank-light.html:1382:hidden-file-access","reason":"The match is GLSL arithmetic or a decimal constant in a shader. It contains no filesystem operation.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:examples/ripple-tank/ripple-tank-light.html:1438:hidden-file-access","reason":"The match is GLSL arithmetic or a decimal constant in a shader. It contains no filesystem operation.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:examples/ripple-tank/ripple-tank-light.html:1439:hidden-file-access","reason":"The match is GLSL arithmetic or a decimal constant in a shader. It contains no filesystem operation.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:examples/ripple-tank/ripple-tank.html:914:hidden-file-access","reason":"The match is GLSL arithmetic or a decimal constant in a shader. It contains no filesystem operation.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:kit/audit.mjs:1468:hidden-file-access","reason":"The match is a regular expression or browser-rendering expression. It does not access a hidden file.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:kit/gl-shared.mjs:24:hidden-file-access","reason":"The match is GLSL arithmetic or a decimal constant in a shader. It contains no filesystem operation.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:kit/gl-shared.mjs:25:hidden-file-access","reason":"The match is GLSL arithmetic or a decimal constant in a shader. It contains no filesystem operation.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:kit/gl.mjs:24:hidden-file-access","reason":"The match is GLSL arithmetic or a decimal constant in a shader. It contains no filesystem operation.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:kit/gl.mjs:25:hidden-file-access","reason":"The match is GLSL arithmetic or a decimal constant in a shader. It contains no filesystem operation.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:kit/turn-audit.mjs:252:hidden-file-access","reason":"The match is a regular expression or browser-rendering expression. It does not access a hidden file.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:kit/turn-audit.mjs:904:hidden-file-access","reason":"The match is a regular expression or browser-rendering expression. It does not access a hidden file.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:kit/turn-audit.mjs:995:hidden-file-access","reason":"The match is a regular expression or browser-rendering expression. It does not access a hidden file.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:README.md:100:hidden-file-access","reason":"The documented command installs or links the skill in the standard user skill directory. This is explicit installation, not covert persistence.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:README.md:102:hidden-file-access","reason":"The documented command installs or links the skill in the standard user skill directory. This is explicit installation, not covert persistence.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:README.md:104:hidden-file-access","reason":"The documented command installs or links the skill in the standard user skill directory. This is explicit installation, not covert persistence.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:README.md:131:hidden-file-access","reason":"The documented command installs or links the skill in the standard user skill directory. This is explicit installation, not covert persistence.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:README.md:136:hidden-file-access","reason":"The documented command installs or links the skill in the standard user skill directory. This is explicit installation, not covert persistence.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:scripts/capture.mjs:93:hidden-file-access","reason":"The match is a regular expression or browser-rendering expression. It does not access a hidden file.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/capture.mjs:193:hidden-file-access","reason":"The match is a regular expression or browser-rendering expression. It does not access a hidden file.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/drive.mjs:105:hidden-file-access","reason":"The match is a regular expression or browser-rendering expression. It does not access a hidden file.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/drive.mjs:166:hidden-file-access","reason":"The match is a regular expression or browser-rendering expression. It does not access a hidden file.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/drive.mjs:224:hidden-file-access","reason":"The match is a regular expression or browser-rendering expression. It does not access a hidden file.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/turn-check.mjs:78:hidden-file-access","reason":"The match is a regular expression or browser-rendering expression. It does not access a hidden file.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/turn-check.mjs:82:hidden-file-access","reason":"The match is a regular expression or browser-rendering expression. It does not access a hidden file.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/turn-fidelity.mjs:21:hidden-file-access","reason":"The match is a regular expression or browser-rendering expression. It does not access a hidden file.","verdict":"false_positive","confidence":0.99},{"id":"scripts:examples/arcade-cabinet/arcade-cabinet-light.html:2403:innerhtml-assignment-xss-risk","reason":"The assigned SVG is generated from internal numeric coin, wire, or joystick geometry. No untrusted HTML string enters this assignment.","verdict":"false_positive","confidence":0.96},{"id":"scripts:examples/arcade-cabinet/arcade-cabinet-light.html:2411:innerhtml-assignment-xss-risk","reason":"The assigned SVG is generated from internal numeric coin, wire, or joystick geometry. No untrusted HTML string enters this assignment.","verdict":"false_positive","confidence":0.96},{"id":"scripts:examples/arcade-cabinet/arcade-cabinet-light.html:2432:innerhtml-assignment-xss-risk","reason":"The assigned SVG is generated from internal numeric coin, wire, or joystick geometry. No untrusted HTML string enters this assignment.","verdict":"false_positive","confidence":0.96},{"id":"scripts:examples/arcade-cabinet/arcade-cabinet-light.html:2609:innerhtml-assignment-xss-risk","reason":"The assigned SVG is generated from internal numeric coin, wire, or joystick geometry. No untrusted HTML string enters this assignment.","verdict":"false_positive","confidence":0.96},{"id":"scripts:examples/arcade-cabinet/arcade-cabinet-light.html:2610:innerhtml-assignment-xss-risk","reason":"The assigned SVG is generated from internal numeric coin, wire, or joystick geometry. No untrusted HTML string enters this assignment.","verdict":"false_positive","confidence":0.96},{"id":"scripts:examples/arcade-cabinet/arcade-cabinet.html:2403:innerhtml-assignment-xss-risk","reason":"The assigned SVG is generated from internal numeric coin, wire, or joystick geometry. No untrusted HTML string enters this assignment.","verdict":"false_positive","confidence":0.96},{"id":"scripts:examples/arcade-cabinet/arcade-cabinet.html:2411:innerhtml-assignment-xss-risk","reason":"The assigned SVG is generated from internal numeric coin, wire, or joystick geometry. No untrusted HTML string enters this assignment.","verdict":"false_positive","confidence":0.96},{"id":"scripts:examples/arcade-cabinet/arcade-cabinet.html:2432:innerhtml-assignment-xss-risk","reason":"The assigned SVG is generated from internal numeric coin, wire, or joystick geometry. No untrusted HTML string enters this assignment.","verdict":"false_positive","confidence":0.96},{"id":"scripts:examples/arcade-cabinet/arcade-cabinet.html:2609:innerhtml-assignment-xss-risk","reason":"The assigned SVG is generated from internal numeric coin, wire, or joystick geometry. No untrusted HTML string enters this assignment.","verdict":"false_positive","confidence":0.96},{"id":"scripts:examples/arcade-cabinet/arcade-cabinet.html:2610:innerhtml-assignment-xss-risk","reason":"The assigned SVG is generated from internal numeric coin, wire, or joystick geometry. No untrusted HTML string enters this assignment.","verdict":"false_positive","confidence":0.96},{"id":"scripts:examples/arcade-cabinet/live.js:183:innerhtml-assignment-xss-risk","reason":"The assigned SVG is generated from internal numeric coin, wire, or joystick geometry. No untrusted HTML string enters this assignment.","verdict":"false_positive","confidence":0.96},{"id":"scripts:examples/arcade-cabinet/arcade-cabinet-light.html:2392:insertadjacenthtml-xss-risk","reason":"The inserted content is fixed SVG definitions and clip paths computed from internal coordinates. No external markup is interpolated.","verdict":"false_positive","confidence":0.97},{"id":"scripts:examples/arcade-cabinet/arcade-cabinet-light.html:2393:insertadjacenthtml-xss-risk","reason":"The inserted content is fixed SVG definitions and clip paths computed from internal coordinates. No external markup is interpolated.","verdict":"false_positive","confidence":0.97},{"id":"scripts:examples/arcade-cabinet/arcade-cabinet.html:2392:insertadjacenthtml-xss-risk","reason":"The inserted content is fixed SVG definitions and clip paths computed from internal coordinates. No external markup is interpolated.","verdict":"false_positive","confidence":0.97},{"id":"scripts:examples/arcade-cabinet/arcade-cabinet.html:2393:insertadjacenthtml-xss-risk","reason":"The inserted content is fixed SVG definitions and clip paths computed from internal coordinates. No external markup is interpolated.","verdict":"false_positive","confidence":0.97},{"id":"scripts:examples/arcade-cabinet/live.js:172:insertadjacenthtml-xss-risk","reason":"The inserted content is fixed SVG definitions and clip paths computed from internal coordinates. No external markup is interpolated.","verdict":"false_positive","confidence":0.97},{"id":"scripts:examples/arcade-cabinet/live.js:173:insertadjacenthtml-xss-risk","reason":"The inserted content is fixed SVG definitions and clip paths computed from internal coordinates. No external markup is interpolated.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:.github/ISSUE_TEMPLATE/bug_report.yml:9:ruby-shell-backtick-execution","reason":"Backticks delimit documentation examples or JavaScript template strings in reference content. They do not invoke Ruby or a shell.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:.github/ISSUE_TEMPLATE/bug_report.yml:84:ruby-shell-backtick-execution","reason":"Backticks delimit documentation examples or JavaScript template strings in reference content. They do not invoke Ruby or a shell.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:evals/evals.json:7:ruby-shell-backtick-execution","reason":"Backticks delimit documentation examples or JavaScript template strings in reference content. They do not invoke Ruby or a shell.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:evals/evals.json:25:ruby-shell-backtick-execution","reason":"Backticks delimit documentation examples or JavaScript template strings in reference content. They do not invoke Ruby or a shell.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:evals/evals.json:31:ruby-shell-backtick-execution","reason":"Backticks delimit documentation examples or JavaScript template strings in reference content. They do not invoke Ruby or a shell.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:examples/arcade-cabinet/arcade-cabinet-light.html:188:ruby-shell-backtick-execution","reason":"Backticks create JavaScript template strings for rendering, diagnostics, or browser automation. No shell backtick execution occurs.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:examples/arcade-cabinet/arcade-cabinet-light.html:521:ruby-shell-backtick-execution","reason":"Backticks create JavaScript template strings for rendering, diagnostics, or browser automation. No shell backtick execution occurs.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:examples/arcade-cabinet/arcade-cabinet-light.html:532:ruby-shell-backtick-execution","reason":"Backticks create JavaScript template strings for rendering, diagnostics, or browser automation. No shell backtick execution occurs.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:examples/arcade-cabinet/arcade-cabinet-light.html:534:ruby-shell-backtick-execution","reason":"Backticks create JavaScript template strings for rendering, diagnostics, or browser automation. No shell backtick execution occurs.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:examples/arcade-cabinet/arcade-cabinet-light.html:570:ruby-shell-backtick-execution","reason":"Backticks create JavaScript template strings for rendering, diagnostics, or browser automation. No shell backtick execution occurs.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:examples/arcade-cabinet/arcade-cabinet-light.html:575:ruby-shell-backtick-execution","reason":"Backticks create JavaScript template strings for rendering, diagnostics, or browser automation. No shell backtick execution occurs.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:examples/arcade-cabinet/arcade-cabinet-light.html:576:ruby-shell-backtick-execution","reason":"Backticks create JavaScript template strings for rendering, diagnostics, or browser automation. No shell backtick execution occurs.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:examples/arcade-cabinet/arcade-cabinet-light.html:580:ruby-shell-backtick-execution","reason":"Backticks create JavaScript template strings for rendering, diagnostics, or browser automation. No shell backtick execution occurs.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:examples/arcade-cabinet/arcade-cabinet-light.html:582:ruby-shell-backtick-execution","reason":"Backticks create JavaScript template strings for rendering, diagnostics, or browser automation. No shell backtick execution occurs.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:examples/arcade-cabinet/arcade-cabinet-light.html:585:ruby-shell-backtick-execution","reason":"Backticks create JavaScript template strings for rendering, diagnostics, or browser automation. No shell backtick execution occurs.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:examples/arcade-cabinet/arcade-cabinet-light.html:587:ruby-shell-backtick-execution","reason":"Backticks create JavaScript template strings for rendering, diagnostics, or browser automation. No shell backtick execution occurs.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:kit/audit.mjs:391:ruby-shell-backtick-execution","reason":"Backticks create JavaScript template strings for rendering, diagnostics, or browser automation. No shell backtick execution occurs.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:kit/audit.mjs:406:ruby-shell-backtick-execution","reason":"Backticks create JavaScript template strings for rendering, diagnostics, or browser automation. No shell backtick execution occurs.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:kit/audit.mjs:424:ruby-shell-backtick-execution","reason":"Backticks create JavaScript template strings for rendering, diagnostics, or browser automation. No shell backtick execution occurs.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:kit/audit.mjs:438:ruby-shell-backtick-execution","reason":"Backticks create JavaScript template strings for rendering, diagnostics, or browser automation. No shell backtick execution occurs.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:kit/audit.mjs:609:ruby-shell-backtick-execution","reason":"Backticks create JavaScript template strings for rendering, diagnostics, or browser automation. No shell backtick execution occurs.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:kit/audit.mjs:630:ruby-shell-backtick-execution","reason":"Backticks create JavaScript template strings for rendering, diagnostics, or browser automation. No shell backtick execution occurs.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:kit/audit.mjs:663:ruby-shell-backtick-execution","reason":"Backticks create JavaScript template strings for rendering, diagnostics, or browser automation. No shell backtick execution occurs.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:kit/audit.mjs:719:ruby-shell-backtick-execution","reason":"Backticks create JavaScript template strings for rendering, diagnostics, or browser automation. No shell backtick execution occurs.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:kit/audit.mjs:756:ruby-shell-backtick-execution","reason":"Backticks create JavaScript template strings for rendering, diagnostics, or browser automation. No shell backtick execution occurs.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:kit/audit.mjs:864:ruby-shell-backtick-execution","reason":"Backticks create JavaScript template strings for rendering, diagnostics, or browser automation. No shell backtick execution occurs.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:kit/audit.mjs:949:ruby-shell-backtick-execution","reason":"Backticks create JavaScript template strings for rendering, diagnostics, or browser automation. No shell backtick execution occurs.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:references/3d.md:69:ruby-shell-backtick-execution","reason":"Backticks delimit documentation examples or JavaScript template strings in reference content. They do not invoke Ruby or a shell.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:references/3d.md:70:ruby-shell-backtick-execution","reason":"Backticks delimit documentation examples or JavaScript template strings in reference content. They do not invoke Ruby or a shell.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:references/craft.md:56:ruby-shell-backtick-execution","reason":"Backticks delimit documentation examples or JavaScript template strings in reference content. They do not invoke Ruby or a shell.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:references/craft.md:89:ruby-shell-backtick-execution","reason":"Backticks delimit documentation examples or JavaScript template strings in reference content. They do not invoke Ruby or a shell.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:references/craft.md:91:ruby-shell-backtick-execution","reason":"Backticks delimit documentation examples or JavaScript template strings in reference content. They do not invoke Ruby or a shell.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:references/webgl.md:168:ruby-shell-backtick-execution","reason":"Backticks delimit documentation examples or JavaScript template strings in reference content. They do not invoke Ruby or a shell.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:references/webgl.md:169:ruby-shell-backtick-execution","reason":"Backticks delimit documentation examples or JavaScript template strings in reference content. They do not invoke Ruby or a shell.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:references/webgl.md:170:ruby-shell-backtick-execution","reason":"Backticks delimit documentation examples or JavaScript template strings in reference content. They do not invoke Ruby or a shell.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:references/webgl.md:198:ruby-shell-backtick-execution","reason":"Backticks delimit documentation examples or JavaScript template strings in reference content. They do not invoke Ruby or a shell.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:scripts/capture.mjs:15:ruby-shell-backtick-execution","reason":"Backticks create JavaScript template strings for rendering, diagnostics, or browser automation. No shell backtick execution occurs.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:scripts/capture.mjs:104:ruby-shell-backtick-execution","reason":"Backticks create JavaScript template strings for rendering, diagnostics, or browser automation. No shell backtick execution occurs.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:scripts/capture.mjs:133:ruby-shell-backtick-execution","reason":"Backticks create JavaScript template strings for rendering, diagnostics, or browser automation. No shell backtick execution occurs.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:scripts/capture.mjs:144:ruby-shell-backtick-execution","reason":"Backticks create JavaScript template strings for rendering, diagnostics, or browser automation. No shell backtick execution occurs.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:scripts/capture.mjs:147:ruby-shell-backtick-execution","reason":"Backticks create JavaScript template strings for rendering, diagnostics, or browser automation. No shell backtick execution occurs.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:scripts/capture.mjs:168:ruby-shell-backtick-execution","reason":"Backticks create JavaScript template strings for rendering, diagnostics, or browser automation. No shell backtick execution occurs.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:scripts/capture.mjs:172:ruby-shell-backtick-execution","reason":"Backticks create JavaScript template strings for rendering, diagnostics, or browser automation. No shell backtick execution occurs.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:scripts/capture.mjs:188:ruby-shell-backtick-execution","reason":"Backticks create JavaScript template strings for rendering, diagnostics, or browser automation. No shell backtick execution occurs.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:scripts/capture.mjs:189:ruby-shell-backtick-execution","reason":"Backticks create JavaScript template strings for rendering, diagnostics, or browser automation. No shell backtick execution occurs.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:scripts/capture.mjs:193:ruby-shell-backtick-execution","reason":"Backticks create JavaScript template strings for rendering, diagnostics, or browser automation. No shell backtick execution occurs.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:scripts/capture.mjs:216:ruby-shell-backtick-execution","reason":"Backticks create JavaScript template strings for rendering, diagnostics, or browser automation. No shell backtick execution occurs.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:10:ruby-shell-backtick-execution","reason":"Backticks delimit documentation examples or JavaScript template strings in reference content. They do not invoke Ruby or a shell.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:12:ruby-shell-backtick-execution","reason":"Backticks delimit documentation examples or JavaScript template strings in reference content. They do not invoke Ruby or a shell.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:13:ruby-shell-backtick-execution","reason":"Backticks delimit documentation examples or JavaScript template strings in reference content. They do not invoke Ruby or a shell.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:14:ruby-shell-backtick-execution","reason":"Backticks delimit documentation examples or JavaScript template strings in reference content. They do not invoke Ruby or a shell.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","reason":"Backticks delimit documentation examples or JavaScript template strings in reference content. They do not invoke Ruby or a shell.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","reason":"Backticks delimit documentation examples or JavaScript template strings in reference content. They do not invoke Ruby or a shell.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","reason":"Backticks delimit documentation examples or JavaScript template strings in reference content. They do not invoke Ruby or a shell.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","reason":"Backticks delimit documentation examples or JavaScript template strings in reference content. They do not invoke Ruby or a shell.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","reason":"Backticks delimit documentation examples or JavaScript template strings in reference content. They do not invoke Ruby or a shell.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","reason":"Backticks delimit documentation examples or JavaScript template strings in reference content. They do not invoke Ruby or a shell.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","reason":"Backticks delimit documentation examples or JavaScript template strings in reference content. They do not invoke Ruby or a shell.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:.github/workflows/ci.yml:64:shell-command-substitution","reason":"The fixed git status command checks whether example rebuilds modified tracked files. No untrusted command text is interpolated.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:examples/arcade-cabinet/arcade-cabinet-light.html:2236:shell-command-substitution","reason":"The dollar-sign function is a local SVG querySelector helper. Its calls are JavaScript DOM lookups, not shell substitution.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:examples/arcade-cabinet/arcade-cabinet-light.html:2237:shell-command-substitution","reason":"The dollar-sign function is a local SVG querySelector helper. Its calls are JavaScript DOM lookups, not shell substitution.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:examples/arcade-cabinet/arcade-cabinet-light.html:2238:shell-command-substitution","reason":"The dollar-sign function is a local SVG querySelector helper. Its calls are JavaScript DOM lookups, not shell substitution.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:examples/arcade-cabinet/arcade-cabinet-light.html:2239:shell-command-substitution","reason":"The dollar-sign function is a local SVG querySelector helper. Its calls are JavaScript DOM lookups, not shell substitution.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:examples/arcade-cabinet/arcade-cabinet-light.html:2240:shell-command-substitution","reason":"The dollar-sign function is a local SVG querySelector helper. Its calls are JavaScript DOM lookups, not shell substitution.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:examples/arcade-cabinet/arcade-cabinet-light.html:2241:shell-command-substitution","reason":"The dollar-sign function is a local SVG querySelector helper. Its calls are JavaScript DOM lookups, not shell substitution.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:examples/arcade-cabinet/arcade-cabinet-light.html:2242:shell-command-substitution","reason":"The dollar-sign function is a local SVG querySelector helper. Its calls are JavaScript DOM lookups, not shell substitution.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:examples/arcade-cabinet/arcade-cabinet-light.html:2243:shell-command-substitution","reason":"The dollar-sign function is a local SVG querySelector helper. Its calls are JavaScript DOM lookups, not shell substitution.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:examples/arcade-cabinet/arcade-cabinet-light.html:2244:shell-command-substitution","reason":"The dollar-sign function is a local SVG querySelector helper. Its calls are JavaScript DOM lookups, not shell substitution.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:examples/arcade-cabinet/arcade-cabinet-light.html:2245:shell-command-substitution","reason":"The dollar-sign function is a local SVG querySelector helper. Its calls are JavaScript DOM lookups, not shell substitution.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:examples/arcade-cabinet/arcade-cabinet-light.html:2246:shell-command-substitution","reason":"The dollar-sign function is a local SVG querySelector helper. Its calls are JavaScript DOM lookups, not shell substitution.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:examples/arcade-cabinet/build.mjs:1:synchronous-file-operations","reason":"The operation reads local build assets or writes generated figure pages. These are expected build outputs, not secret collection.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:examples/arcade-cabinet/build.mjs:683:synchronous-file-operations","reason":"The operation reads local build assets or writes generated figure pages. These are expected build outputs, not secret collection.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:examples/arcade-cabinet/build.mjs:684:synchronous-file-operations","reason":"The operation reads local build assets or writes generated figure pages. These are expected build outputs, not secret collection.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:examples/arcade-cabinet/build.mjs:688:synchronous-file-operations","reason":"The operation reads local build assets or writes generated figure pages. These are expected build outputs, not secret collection.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:examples/arcade-cabinet/build.mjs:689:synchronous-file-operations","reason":"The operation reads local build assets or writes generated figure pages. These are expected build outputs, not secret collection.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:examples/arcade-cabinet/build.mjs:690:synchronous-file-operations","reason":"The operation reads local build assets or writes generated figure pages. These are expected build outputs, not secret collection.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:examples/arcade-cabinet/build.mjs:711:synchronous-file-operations","reason":"The operation reads local build assets or writes generated figure pages. These are expected build outputs, not secret collection.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:examples/desk-computer/build.mjs:1:synchronous-file-operations","reason":"The operation reads local build assets or writes generated figure pages. These are expected build outputs, not secret collection.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:examples/desk-computer/build.mjs:434:synchronous-file-operations","reason":"The operation reads local build assets or writes generated figure pages. These are expected build outputs, not secret collection.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:examples/dial-indicator/build.mjs:1:synchronous-file-operations","reason":"The operation reads local build assets or writes generated figure pages. These are expected build outputs, not secret collection.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:examples/dial-indicator/build.mjs:274:synchronous-file-operations","reason":"The operation reads local build assets or writes generated figure pages. These are expected build outputs, not secret collection.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:references/3d.md:304:synchronous-file-operations","reason":"The operation handles user-selected test inputs, local PNG outputs, or documented motion fixtures. No unauthorized secret access appears at this location.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:references/3d.md:307:synchronous-file-operations","reason":"The operation handles user-selected test inputs, local PNG outputs, or documented motion fixtures. No unauthorized secret access appears at this location.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:references/3d.md:308:synchronous-file-operations","reason":"The operation handles user-selected test inputs, local PNG outputs, or documented motion fixtures. No unauthorized secret access appears at this location.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:scripts/capture.mjs:2:synchronous-file-operations","reason":"The operation handles user-selected test inputs, local PNG outputs, or documented motion fixtures. No unauthorized secret access appears at this location.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:scripts/capture.mjs:202:synchronous-file-operations","reason":"The operation handles user-selected test inputs, local PNG outputs, or documented motion fixtures. No unauthorized secret access appears at this location.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:scripts/drive.mjs:2:synchronous-file-operations","reason":"The operation handles user-selected test inputs, local PNG outputs, or documented motion fixtures. No unauthorized secret access appears at this location.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:scripts/drive.mjs:99:synchronous-file-operations","reason":"The operation handles user-selected test inputs, local PNG outputs, or documented motion fixtures. No unauthorized secret access appears at this location.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:scripts/drive.mjs:100:synchronous-file-operations","reason":"The operation handles user-selected test inputs, local PNG outputs, or documented motion fixtures. No unauthorized secret access appears at this location.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:scripts/drive.mjs:184:synchronous-file-operations","reason":"The operation handles user-selected test inputs, local PNG outputs, or documented motion fixtures. No unauthorized secret access appears at this location.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:scripts/inline-kit.mjs:1:synchronous-file-operations","reason":"The operation reads local build assets or writes generated figure pages. These are expected build outputs, not secret collection.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:scripts/inline-kit.mjs:6:synchronous-file-operations","reason":"The operation reads local build assets or writes generated figure pages. These are expected build outputs, not secret collection.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:scripts/turn-check.mjs:2:synchronous-file-operations","reason":"The operation handles user-selected test inputs, local PNG outputs, or documented motion fixtures. No unauthorized secret access appears at this location.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:scripts/turn-check.mjs:510:synchronous-file-operations","reason":"The operation handles user-selected test inputs, local PNG outputs, or documented motion fixtures. No unauthorized secret access appears at this location.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:scripts/turn-check.mjs:591:synchronous-file-operations","reason":"The operation handles user-selected test inputs, local PNG outputs, or documented motion fixtures. No unauthorized secret access appears at this location.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:examples/arcade-cabinet/arcade-cabinet-light.html:2216:template-literal-with-command-substitution","reason":"The template literal is a fixed SVG ellipse element. It does not contain or execute a shell command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:examples/arcade-cabinet/arcade-cabinet.html:2216:template-literal-with-command-substitution","reason":"The template literal is a fixed SVG ellipse element. It does not contain or execute a shell command.","verdict":"false_positive","confidence":0.99},{"id":"network:scripts/capture.mjs:134:websocket-connection","reason":"The connection targets the newly launched Chrome instance through loopback DevTools. It is local browser control, not an external data destination.","verdict":"false_positive","confidence":0.99},{"id":"network:scripts/drive.mjs:134:websocket-connection","reason":"The connection targets the newly launched Chrome instance through loopback DevTools. It is local browser control, not an external data destination.","verdict":"false_positive","confidence":0.99},{"id":"network:scripts/turn-check.mjs:52:websocket-connection","reason":"The connection targets the newly launched Chrome instance through loopback DevTools. It is local browser control, not an external data destination.","verdict":"false_positive","confidence":0.99},{"id":"metadata:examples/raptor-engine/raptor-engine-light.html:1:unscanned-file-too-large-manual-review-required","reason":"The analyzer skipped this oversized executable HTML file. Its full contents remain unreviewed, so this coverage gap is retained without alleging malware.","verdict":"confirmed","confidence":0.45},{"id":"metadata:examples/raptor-engine/raptor-engine.html:1:unscanned-file-too-large-manual-review-required","reason":"The analyzer skipped this oversized executable HTML file. Its full contents remain unreviewed, so this coverage gap is retained without alleging malware.","verdict":"confirmed","confidence":0.45},{"id":"metadata:examples/turning-dial/turning-stress-light.html:1:unscanned-file-too-large-manual-review-required","reason":"The analyzer skipped this oversized executable HTML file. Its full contents remain unreviewed, so this coverage gap is retained without alleging malware.","verdict":"confirmed","confidence":0.45},{"id":"blocker:examples/raptor-engine/live.js:134:network-reconnaissance","reason":"The expression performs spring integration or numeric geometry comparison. It does not probe hosts, ports, or network interfaces.","verdict":"false_positive","confidence":0.99},{"id":"blocker:examples/turning-dial/turning-dial-light.html:2267:network-reconnaissance","reason":"The expression performs spring integration or numeric geometry comparison. It does not probe hosts, ports, or network interfaces.","verdict":"false_positive","confidence":0.99},{"id":"blocker:examples/turning-dial/turning-dial-verify-light.html:2267:network-reconnaissance","reason":"The expression performs spring integration or numeric geometry comparison. It does not probe hosts, ports, or network interfaces.","verdict":"false_positive","confidence":0.99},{"id":"blocker:examples/turning-dial/turning-dial.html:2267:network-reconnaissance","reason":"The expression performs spring integration or numeric geometry comparison. It does not probe hosts, ports, or network interfaces.","verdict":"false_positive","confidence":0.99},{"id":"blocker:kit/audit.mjs:418:network-reconnaissance","reason":"The expression performs spring integration or numeric geometry comparison. It does not probe hosts, ports, or network interfaces.","verdict":"false_positive","confidence":0.99},{"id":"blocker:kit/turn-fixed.mjs:2139:network-reconnaissance","reason":"The expression performs spring integration or numeric geometry comparison. It does not probe hosts, ports, or network interfaces.","verdict":"false_positive","confidence":0.99},{"id":"blocker:kit/turn.mjs:2099:network-reconnaissance","reason":"The expression performs spring integration or numeric geometry comparison. It does not probe hosts, ports, or network interfaces.","verdict":"false_positive","confidence":0.99},{"id":"blocker:.github/ISSUE_TEMPLATE/bug_report.yml:2:system-reconnaissance","reason":"This is figure documentation, styling guidance, installation guidance, or security-reporting prose. No covert host inventory operation is requested.","verdict":"false_positive","confidence":0.98},{"id":"blocker:CHANGELOG.md:28:system-reconnaissance","reason":"This is figure documentation, styling guidance, installation guidance, or security-reporting prose. No covert host inventory operation is requested.","verdict":"false_positive","confidence":0.98},{"id":"blocker:examples/arcade-cabinet/arcade-cabinet-light.html:116:system-reconnaissance","reason":"The match belongs to rendering arithmetic, local identifiers, browser startup, or verification diagnostics. No operating-system inventory command executes.","verdict":"false_positive","confidence":0.98},{"id":"blocker:examples/arcade-cabinet/arcade-cabinet-light.html:591:system-reconnaissance","reason":"The match belongs to rendering arithmetic, local identifiers, browser startup, or verification diagnostics. No operating-system inventory command executes.","verdict":"false_positive","confidence":0.98},{"id":"blocker:examples/arcade-cabinet/arcade-cabinet-light.html:659:system-reconnaissance","reason":"The match belongs to rendering arithmetic, local identifiers, browser startup, or verification diagnostics. No operating-system inventory command executes.","verdict":"false_positive","confidence":0.98},{"id":"blocker:examples/arcade-cabinet/arcade-cabinet-light.html:1102:system-reconnaissance","reason":"The match belongs to rendering arithmetic, local identifiers, browser startup, or verification diagnostics. No operating-system inventory command executes.","verdict":"false_positive","confidence":0.98},{"id":"blocker:examples/arcade-cabinet/arcade-cabinet-light.html:1170:system-reconnaissance","reason":"The match belongs to rendering arithmetic, local identifiers, browser startup, or verification diagnostics. No operating-system inventory command executes.","verdict":"false_positive","confidence":0.98},{"id":"blocker:examples/arcade-cabinet/arcade-cabinet-light.html:1171:system-reconnaissance","reason":"The match belongs to rendering arithmetic, local identifiers, browser startup, or verification diagnostics. No operating-system inventory command executes.","verdict":"false_positive","confidence":0.98},{"id":"blocker:examples/arcade-cabinet/arcade-cabinet-light.html:1289:system-reconnaissance","reason":"The match belongs to rendering arithmetic, local identifiers, browser startup, or verification diagnostics. No operating-system inventory command executes.","verdict":"false_positive","confidence":0.98},{"id":"blocker:examples/arcade-cabinet/arcade-cabinet-light.html:1728:system-reconnaissance","reason":"The match belongs to rendering arithmetic, local identifiers, browser startup, or verification diagnostics. No operating-system inventory command executes.","verdict":"false_positive","confidence":0.98},{"id":"blocker:examples/arcade-cabinet/arcade-cabinet-light.html:1730:system-reconnaissance","reason":"The match belongs to rendering arithmetic, local identifiers, browser startup, or verification diagnostics. No operating-system inventory command executes.","verdict":"false_positive","confidence":0.98},{"id":"blocker:examples/arcade-cabinet/arcade-cabinet-light.html:2350:system-reconnaissance","reason":"The match belongs to rendering arithmetic, local identifiers, browser startup, or verification diagnostics. No operating-system inventory command executes.","verdict":"false_positive","confidence":0.98},{"id":"blocker:kit/audit.mjs:21:system-reconnaissance","reason":"The match belongs to rendering arithmetic, local identifiers, browser startup, or verification diagnostics. No operating-system inventory command executes.","verdict":"false_positive","confidence":0.98},{"id":"blocker:kit/audit.mjs:401:system-reconnaissance","reason":"The match belongs to rendering arithmetic, local identifiers, browser startup, or verification diagnostics. No operating-system inventory command executes.","verdict":"false_positive","confidence":0.98},{"id":"blocker:kit/audit.mjs:602:system-reconnaissance","reason":"The match belongs to rendering arithmetic, local identifiers, browser startup, or verification diagnostics. No operating-system inventory command executes.","verdict":"false_positive","confidence":0.98},{"id":"blocker:kit/audit.mjs:606:system-reconnaissance","reason":"The match belongs to rendering arithmetic, local identifiers, browser startup, or verification diagnostics. No operating-system inventory command executes.","verdict":"false_positive","confidence":0.98},{"id":"blocker:kit/audit.mjs:609:system-reconnaissance","reason":"The match belongs to rendering arithmetic, local identifiers, browser startup, or verification diagnostics. No operating-system inventory command executes.","verdict":"false_positive","confidence":0.98},{"id":"blocker:kit/audit.mjs:630:system-reconnaissance","reason":"The match belongs to rendering arithmetic, local identifiers, browser startup, or verification diagnostics. No operating-system inventory command executes.","verdict":"false_positive","confidence":0.98},{"id":"blocker:kit/audit.mjs:663:system-reconnaissance","reason":"The match belongs to rendering arithmetic, local identifiers, browser startup, or verification diagnostics. No operating-system inventory command executes.","verdict":"false_positive","confidence":0.98},{"id":"blocker:kit/audit.mjs:864:system-reconnaissance","reason":"The match belongs to rendering arithmetic, local identifiers, browser startup, or verification diagnostics. No operating-system inventory command executes.","verdict":"false_positive","confidence":0.98},{"id":"blocker:kit/audit.mjs:958:system-reconnaissance","reason":"The match belongs to rendering arithmetic, local identifiers, browser startup, or verification diagnostics. No operating-system inventory command executes.","verdict":"false_positive","confidence":0.98},{"id":"blocker:kit/audit.mjs:1260:system-reconnaissance","reason":"The match belongs to rendering arithmetic, local identifiers, browser startup, or verification diagnostics. No operating-system inventory command executes.","verdict":"false_positive","confidence":0.98},{"id":"blocker:README.md:88:system-reconnaissance","reason":"This is figure documentation, styling guidance, installation guidance, or security-reporting prose. No covert host inventory operation is requested.","verdict":"false_positive","confidence":0.98},{"id":"blocker:README.md:141:system-reconnaissance","reason":"This is figure documentation, styling guidance, installation guidance, or security-reporting prose. No covert host inventory operation is requested.","verdict":"false_positive","confidence":0.98},{"id":"blocker:references/3d.md:3:system-reconnaissance","reason":"This is figure documentation, styling guidance, installation guidance, or security-reporting prose. No covert host inventory operation is requested.","verdict":"false_positive","confidence":0.98},{"id":"blocker:references/3d.md:31:system-reconnaissance","reason":"This is figure documentation, styling guidance, installation guidance, or security-reporting prose. No covert host inventory operation is requested.","verdict":"false_positive","confidence":0.98},{"id":"blocker:references/3d.md:94:system-reconnaissance","reason":"This is figure documentation, styling guidance, installation guidance, or security-reporting prose. No covert host inventory operation is requested.","verdict":"false_positive","confidence":0.98},{"id":"blocker:references/3d.md:202:system-reconnaissance","reason":"This is figure documentation, styling guidance, installation guidance, or security-reporting prose. No covert host inventory operation is requested.","verdict":"false_positive","confidence":0.98},{"id":"blocker:references/3d.md:259:system-reconnaissance","reason":"This is figure documentation, styling guidance, installation guidance, or security-reporting prose. No covert host inventory operation is requested.","verdict":"false_positive","confidence":0.98},{"id":"blocker:references/3d.md:274:system-reconnaissance","reason":"This is figure documentation, styling guidance, installation guidance, or security-reporting prose. No covert host inventory operation is requested.","verdict":"false_positive","confidence":0.98},{"id":"blocker:references/3d.md:278:system-reconnaissance","reason":"This is figure documentation, styling guidance, installation guidance, or security-reporting prose. No covert host inventory operation is requested.","verdict":"false_positive","confidence":0.98},{"id":"blocker:references/craft.md:37:system-reconnaissance","reason":"This is figure documentation, styling guidance, installation guidance, or security-reporting prose. No covert host inventory operation is requested.","verdict":"false_positive","confidence":0.98},{"id":"blocker:references/craft.md:44:system-reconnaissance","reason":"This is figure documentation, styling guidance, installation guidance, or security-reporting prose. No covert host inventory operation is requested.","verdict":"false_positive","confidence":0.98},{"id":"blocker:references/craft.md:45:system-reconnaissance","reason":"This is figure documentation, styling guidance, installation guidance, or security-reporting prose. No covert host inventory operation is requested.","verdict":"false_positive","confidence":0.98},{"id":"blocker:scripts/capture.mjs:115:system-reconnaissance","reason":"The match belongs to rendering arithmetic, local identifiers, browser startup, or verification diagnostics. No operating-system inventory command executes.","verdict":"false_positive","confidence":0.98},{"id":"blocker:scripts/capture.mjs:135:system-reconnaissance","reason":"The match belongs to rendering arithmetic, local identifiers, browser startup, or verification diagnostics. No operating-system inventory command executes.","verdict":"false_positive","confidence":0.98},{"id":"blocker:scripts/capture.mjs:140:system-reconnaissance","reason":"The match belongs to rendering arithmetic, local identifiers, browser startup, or verification diagnostics. No operating-system inventory command executes.","verdict":"false_positive","confidence":0.98},{"id":"blocker:scripts/drive.mjs:115:system-reconnaissance","reason":"The match belongs to rendering arithmetic, local identifiers, browser startup, or verification diagnostics. No operating-system inventory command executes.","verdict":"false_positive","confidence":0.98},{"id":"blocker:scripts/drive.mjs:135:system-reconnaissance","reason":"The match belongs to rendering arithmetic, local identifiers, browser startup, or verification diagnostics. No operating-system inventory command executes.","verdict":"false_positive","confidence":0.98},{"id":"blocker:scripts/drive.mjs:140:system-reconnaissance","reason":"The match belongs to rendering arithmetic, local identifiers, browser startup, or verification diagnostics. No operating-system inventory command executes.","verdict":"false_positive","confidence":0.98},{"id":"blocker:scripts/drive.mjs:278:system-reconnaissance","reason":"The match belongs to rendering arithmetic, local identifiers, browser startup, or verification diagnostics. No operating-system inventory command executes.","verdict":"false_positive","confidence":0.98},{"id":"blocker:scripts/line-ends.mjs:122:system-reconnaissance","reason":"The match belongs to rendering arithmetic, local identifiers, browser startup, or verification diagnostics. No operating-system inventory command executes.","verdict":"false_positive","confidence":0.98},{"id":"blocker:scripts/line-ends.mjs:124:system-reconnaissance","reason":"The match belongs to rendering arithmetic, local identifiers, browser startup, or verification diagnostics. No operating-system inventory command executes.","verdict":"false_positive","confidence":0.98},{"id":"blocker:scripts/turn-check.mjs:41:system-reconnaissance","reason":"The match belongs to rendering arithmetic, local identifiers, browser startup, or verification diagnostics. No operating-system inventory command executes.","verdict":"false_positive","confidence":0.98},{"id":"blocker:SECURITY.md:7:system-reconnaissance","reason":"This is figure documentation, styling guidance, installation guidance, or security-reporting prose. No covert host inventory operation is requested.","verdict":"false_positive","confidence":0.98},{"id":"blocker:SKILL.md:3:system-reconnaissance","reason":"This is figure documentation, styling guidance, installation guidance, or security-reporting prose. No covert host inventory operation is requested.","verdict":"false_positive","confidence":0.98},{"id":"obfuscation:examples/arcade-cabinet/arcade-cabinet-light.html:188:array-join-empty-string","reason":"The join concatenates SVG paths, vector markup, or shader declarations. It does not conceal an executable payload.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:examples/arcade-cabinet/arcade-cabinet-light.html:190:array-join-empty-string","reason":"The join concatenates SVG paths, vector markup, or shader declarations. It does not conceal an executable payload.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:examples/arcade-cabinet/arcade-cabinet-light.html:305:array-join-empty-string","reason":"The join concatenates SVG paths, vector markup, or shader declarations. It does not conceal an executable payload.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:examples/arcade-cabinet/arcade-cabinet-light.html:334:array-join-empty-string","reason":"The join concatenates SVG paths, vector markup, or shader declarations. It does not conceal an executable payload.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:examples/arcade-cabinet/arcade-cabinet-light.html:338:array-join-empty-string","reason":"The join concatenates SVG paths, vector markup, or shader declarations. It does not conceal an executable payload.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:examples/arcade-cabinet/arcade-cabinet-light.html:339:array-join-empty-string","reason":"The join concatenates SVG paths, vector markup, or shader declarations. It does not conceal an executable payload.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:examples/arcade-cabinet/arcade-cabinet-light.html:341:array-join-empty-string","reason":"The join concatenates SVG paths, vector markup, or shader declarations. It does not conceal an executable payload.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:examples/arcade-cabinet/arcade-cabinet-light.html:403:array-join-empty-string","reason":"The join concatenates SVG paths, vector markup, or shader declarations. It does not conceal an executable payload.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:examples/arcade-cabinet/arcade-cabinet-light.html:426:array-join-empty-string","reason":"The join concatenates SVG paths, vector markup, or shader declarations. It does not conceal an executable payload.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:examples/arcade-cabinet/arcade-cabinet-light.html:469:array-join-empty-string","reason":"The join concatenates SVG paths, vector markup, or shader declarations. It does not conceal an executable payload.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:kit/canvas-painter.mjs:691:array-join-empty-string","reason":"The join concatenates SVG paths, vector markup, or shader declarations. It does not conceal an executable payload.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:kit/gl-shared.mjs:77:array-join-empty-string","reason":"The join concatenates SVG paths, vector markup, or shader declarations. It does not conceal an executable payload.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:kit/gl.mjs:77:array-join-empty-string","reason":"The join concatenates SVG paths, vector markup, or shader declarations. It does not conceal an executable payload.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:kit/iso-kit.mjs:31:array-join-empty-string","reason":"The join concatenates SVG paths, vector markup, or shader declarations. It does not conceal an executable payload.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:kit/iso-kit.mjs:33:array-join-empty-string","reason":"The join concatenates SVG paths, vector markup, or shader declarations. It does not conceal an executable payload.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:kit/iso-kit.mjs:148:array-join-empty-string","reason":"The join concatenates SVG paths, vector markup, or shader declarations. It does not conceal an executable payload.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:kit/iso-kit.mjs:177:array-join-empty-string","reason":"The join concatenates SVG paths, vector markup, or shader declarations. It does not conceal an executable payload.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:kit/iso-kit.mjs:181:array-join-empty-string","reason":"The join concatenates SVG paths, vector markup, or shader declarations. It does not conceal an executable payload.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:kit/iso-kit.mjs:182:array-join-empty-string","reason":"The join concatenates SVG paths, vector markup, or shader declarations. It does not conceal an executable payload.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:kit/iso-kit.mjs:184:array-join-empty-string","reason":"The join concatenates SVG paths, vector markup, or shader declarations. It does not conceal an executable payload.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:references/webgl.md:168:array-join-empty-string","reason":"The join concatenates SVG paths, vector markup, or shader declarations. It does not conceal an executable payload.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/turn-check.mjs:286:array-join-empty-string","reason":"The join concatenates SVG paths, vector markup, or shader declarations. It does not conceal an executable payload.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/turn-check.mjs:358:array-join-empty-string","reason":"The join concatenates SVG paths, vector markup, or shader declarations. It does not conceal an executable payload.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/turn-fidelity.mjs:280:array-join-empty-string","reason":"The join concatenates SVG paths, vector markup, or shader declarations. It does not conceal an executable payload.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/turn-fidelity.mjs:371:array-join-empty-string","reason":"The join concatenates SVG paths, vector markup, or shader declarations. It does not conceal an executable payload.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/turn-fidelity.mjs:389:array-join-empty-string","reason":"The join concatenates SVG paths, vector markup, or shader declarations. It does not conceal an executable payload.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/turn-fidelity.mjs:390:array-join-empty-string","reason":"The join concatenates SVG paths, vector markup, or shader declarations. It does not conceal an executable payload.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:kit/canvas-painter.mjs:341:unicode-escape-sequence","reason":"The control-character marker distinguishes geometry arena references or transform tokens. The renderer interprets it as data, not code.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:kit/turn-fixed.mjs:49:unicode-escape-sequence","reason":"The control-character marker distinguishes geometry arena references or transform tokens. The renderer interprets it as data, not code.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:kit/turn-fixed.mjs:61:unicode-escape-sequence","reason":"The control-character marker distinguishes geometry arena references or transform tokens. The renderer interprets it as data, not code.","verdict":"false_positive","confidence":0.99},{"id":"env_access:scripts/capture.mjs:66:environment-variable-access-dot-notation","reason":"Only CHROME_PATH is read to locate the user-selected browser executable. No environment file or secret variable is accessed here.","verdict":"false_positive","confidence":0.99},{"id":"env_access:scripts/drive.mjs:63:environment-variable-access-dot-notation","reason":"Only CHROME_PATH is read to locate the user-selected browser executable. No environment file or secret variable is accessed here.","verdict":"false_positive","confidence":0.99},{"id":"env_access:scripts/turn-check.mjs:30:environment-variable-access-dot-notation","reason":"Only CHROME_PATH is read to locate the user-selected browser executable. No environment file or secret variable is accessed here.","verdict":"false_positive","confidence":0.99},{"id":"env_access:scripts/capture.mjs:66:environment-variable-object","reason":"Only CHROME_PATH is read to locate the user-selected browser executable. No environment file or secret variable is accessed here.","verdict":"false_positive","confidence":0.99},{"id":"env_access:scripts/drive.mjs:63:environment-variable-object","reason":"Only CHROME_PATH is read to locate the user-selected browser executable. No environment file or secret variable is accessed here.","verdict":"false_positive","confidence":0.99},{"id":"env_access:scripts/turn-check.mjs:30:environment-variable-object","reason":"Only CHROME_PATH is read to locate the user-selected browser executable. No environment file or secret variable is accessed here.","verdict":"false_positive","confidence":0.99},{"id":"network:scripts/capture.mjs:133:fetch-api-call","reason":"The connection targets the newly launched Chrome instance through loopback DevTools. It is local browser control, not an external data destination.","verdict":"false_positive","confidence":0.99},{"id":"network:scripts/drive.mjs:133:fetch-api-call","reason":"The connection targets the newly launched Chrome instance through loopback DevTools. It is local browser control, not an external data destination.","verdict":"false_positive","confidence":0.99},{"id":"network:scripts/turn-check.mjs:51:fetch-api-call","reason":"The connection targets the newly launched Chrome instance through loopback DevTools. It is local browser control, not an external data destination.","verdict":"false_positive","confidence":0.99},{"id":"network:.github/ISSUE_TEMPLATE/config.yml:4:hardcoded-url","reason":"The GitHub URL opens private vulnerability reporting for this repository. It is a support link, not a hidden telemetry endpoint.","verdict":"false_positive","confidence":0.97},{"id":"network:CONTRIBUTING.md:16:hardcoded-url","reason":"The URL identifies the public upstream repository or archive for explicit installation. No secret or local file is sent in this instruction.","verdict":"false_positive","confidence":0.97},{"id":"network:README.md:136:hardcoded-url","reason":"The URL identifies the public upstream repository or archive for explicit installation. No secret or local file is sent in this instruction.","verdict":"false_positive","confidence":0.97},{"id":"network:references/verify.md:16:hardcoded-url","reason":"The URL is an example localhost development page for screenshots. It does not instruct external data transfer.","verdict":"false_positive","confidence":0.97},{"id":"network:scripts/capture.mjs:133:hardcoded-url","reason":"The connection targets the newly launched Chrome instance through loopback DevTools. It is local browser control, not an external data destination.","verdict":"false_positive","confidence":0.99},{"id":"network:scripts/drive.mjs:133:hardcoded-url","reason":"The connection targets the newly launched Chrome instance through loopback DevTools. It is local browser control, not an external data destination.","verdict":"false_positive","confidence":0.99},{"id":"network:scripts/turn-check.mjs:51:hardcoded-url","reason":"The connection targets the newly launched Chrome instance through loopback DevTools. It is local browser control, not an external data destination.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/capture.mjs:2:temp-file-creation","reason":"mkdtempSync creates a unique throwaway Chrome profile under the temporary directory. The scripts remove that profile after verification.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/capture.mjs:100:temp-file-creation","reason":"mkdtempSync creates a unique throwaway Chrome profile under the temporary directory. The scripts remove that profile after verification.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/drive.mjs:2:temp-file-creation","reason":"mkdtempSync creates a unique throwaway Chrome profile under the temporary directory. The scripts remove that profile after verification.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/drive.mjs:111:temp-file-creation","reason":"mkdtempSync creates a unique throwaway Chrome profile under the temporary directory. The scripts remove that profile after verification.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/turn-check.mjs:2:temp-file-creation","reason":"mkdtempSync creates a unique throwaway Chrome profile under the temporary directory. The scripts remove that profile after verification.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/turn-check.mjs:37:temp-file-creation","reason":"mkdtempSync creates a unique throwaway Chrome profile under the temporary directory. The scripts remove that profile after verification.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[{"title":"Browser Checks Enable Cross-File Access","severity":"medium","locations":[{"file":"scripts/capture.mjs","line_end":110,"line_start":101},{"file":"scripts/drive.mjs","line_end":112,"line_start":112},{"file":"scripts/turn-check.mjs","line_end":38,"line_start":38},{"file":"SECURITY.md","line_end":5,"line_start":5}],"confidence":0.94,"description":"Browser checks enable --allow-file-access-from-files for user-selected pages. A malicious local page can access other readable local files; temporary profiles do not isolate filesystem access.","confidence_reasoning":"All three browser launchers enable cross-file access and accept local pages. SECURITY.md acknowledges this trust requirement; no malicious use was observed."}],"subject_marketplace_commit_sha":"a5d66e6915301b999741c6b4437f9eacacc9af0d","subject_content_hash":"8798bed1ba9b1cc5d0e6f77a9613ab61a707ce3fb7fc0750d20b7c0c3ca1d893","subject_tree_hash":"c5094cb108cda96d41403fd91ea4be03d364a73098a1afea8408904e763998c4","subject_plugin_path":"skills/wheresryan22/anatomy","audit_payload_hash":"57e9c2a675f3b2477b5a978cf6500a43","confirmed_risk_level":"medium","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"a5d66e6915301b999741c6b4437f9eacacc9af0d","contentHash":"8798bed1ba9b1cc5d0e6f77a9613ab61a707ce3fb7fc0750d20b7c0c3ca1d893","treeHash":"c5094cb108cda96d41403fd91ea4be03d364a73098a1afea8408904e763998c4","pluginPath":"skills/wheresryan22/anatomy","auditPayloadHash":"57e9c2a675f3b2477b5a978cf6500a43"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/wheresryan22-anatomy/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":4,"capabilityReviewCount":2,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"confirmation_required","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}