All issues

JSON report has `pattern: null` and `finding: null` for MCP analyzer findings (RP1, LP3), so JSON consumers can't tell what matched

#640

· JayOfTheKeyboard opened

on Sep 26, 2026

RP1 `npx` pattern matches across line breaks, so a line ending in "npx" plus the next word becomes a command

#639

· JayOfTheKeyboard opened

on Sep 26, 2026

SC2 flags `curl ... | python3 -c '<script>'` and `| python3 -m json.tool` as remote code execution (HIGH)

#638

· JayOfTheKeyboard opened

on Sep 26, 2026

skillspector baseline leaves duplicate occurrences of a finding unsuppressed

#633

· Skeptomenos opened

on Sep 24, 2026

skillspector baseline only suppresses the first occurrence of a repeated finding

#630

· willryker opened

on Sep 24, 2026

Hooks declared in plugin.json are not analyzed, so a plugin with a prompt-exfiltration hook scans SAFE

#629

· willryker opened

on Sep 24, 2026

static_patterns_tool_misuse: common bash idioms trigger `static_parse_limit`, forcing partial scans and a HIGH AE1 finding

#628

· raphabruno7 opened

on Sep 24, 2026

SARIF: CRITICAL and HIGH are indistinguishable (no security-severity), and --recursive result URIs lack the skill directory

#620

· suleimanmahmoud opened

on Sep 23, 2026

Static scan misses destructive folder commands and natural-language deletion instructions

#618

· mohgupta-ship-it opened

on Sep 23, 2026

OpenCode 1.18.32 Pin Re-verification (`opencode_cli`)

#612

· Yoseph-Zuskin opened

on Sep 23, 2026

TT3–TT6 behavioral taint tracking silently drops flows nested two+ AST levels below their sink

#610

· udsy19 opened

on Sep 23, 2026

TR1 fires on bounded phrases ending in a discourse word (go there, work now)

#609

· MohammedAlkindi opened

on Sep 23, 2026