MCP Scanner
ScanLeaderboardDocsSign in
Home/anthropics/claude-code/Results

This repository may not be an MCP server

We could not detect MCP SDK imports or tool registrations.

0F

claude-code

anthropics/claude-code

60 files · 102 findings

Share GitHub SARIF JSON
9 critical25 high7 medium61 low
Tool Poisoning2 issues
Command Injection8 issues
Path Traversalclean
SSRFclean
Credential Theft4 issues
Excessive Permissions1 issue
Missing Auth6 issues
Excessive Permissions1

sudo command usage

high

Using sudo in scripts escalates privileges and may allow unintended system-wide modifications.

.devcontainer/devcontainer.json:55
"postStartCommand": "sudo /usr/local/bin/init-firewall.sh",
How to fix

Remove sudo usage. Run processes with the minimum required privileges.

Data Exfiltration2

Clipboard or screenshot access for exfiltration

high

Accessing clipboard contents or taking screenshots may be used to capture and exfiltrate sensitive data.

.github/ISSUE_TEMPLATE/bug_report.yml:186
placeholder: Any additional context, screenshots, or information...
How to fix

Remove clipboard/screenshot access unless explicitly required by the tool's stated purpose.

Supply Chain15

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/auto-close-duplicates.yml:18
uses: actions/checkout@v4
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

Logging Deficiency64

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

.github/workflows/lock-closed-issues.yml:83
console.log(`Locked issue #${issue.number}: ${issue.title}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Tool Poisoning2

HTML comment injection in tool description

critical

HTML comments in tool descriptions may contain hidden instructions intended to influence LLM reasoning.

.github/workflows/non-write-users-check.yml:31
| grep -c "<!-- non-write-users-check -->" || true)
How to fix

Remove HTML comments from description strings. Use source code comments instead.

Missing Auth6

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

plugins/plugin-dev/skills/mcp-integration/examples/http-server.json:7
"Authorization": "Bearer ${API_TOKEN}",
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Command Injection8

exec/execSync with string interpolation

critical

Using exec or execSync with template literals or string concatenation allows attackers to inject arbitrary shell commands.

plugins/security-guidance/hooks/security_reminder_hook.py:77
exec(`command ${userInput}`)
How to fix

Replace exec/execSync with execFile or spawn with explicit argument arrays instead of string interpolation.

Credential Theft4

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

scripts/auto-close-duplicates.ts:102
const token = process.env.GITHUB_TOKEN;
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Supply Chain
15 issues
Rug Pullclean
Data Exfiltration2 issues
Insecure Communicationclean
Excessive Data Exposureclean
Logging Deficiency64 issues
Runtime Tool Poisoningclean
Shadow MCP Serverclean

Writing session data to external storage

high

Sending conversation, prompt, or session data to external storage services may leak sensitive user interactions.

plugins/security-guidance/hooks/security_reminder_hook.py:22
f.write(f"[{timestamp}] {message}\n")
How to fix

Do not write session or conversation data to external storage. Keep user interaction data within the authorized session boundary.

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/auto-close-duplicates.yml:21
uses: oven-sh/setup-bun@v2
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/backfill-duplicate-comments.yml:32
uses: actions/checkout@v4
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/backfill-duplicate-comments.yml:35
uses: oven-sh/setup-bun@v2
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/claude-dedupe-issues.yml:23
uses: actions/checkout@v4
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/claude-dedupe-issues.yml:26
uses: anthropics/claude-code-action@v1
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/claude-issue-triage.yml:24
uses: actions/checkout@v4
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/claude-issue-triage.yml:28
uses: anthropics/claude-code-action@v1
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/claude.yml:34
uses: anthropics/claude-code-action@v1
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/issue-lifecycle-comment.yml:15
uses: actions/checkout@v4
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/issue-lifecycle-comment.yml:18
uses: oven-sh/setup-bun@v2
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/lock-closed-issues.yml:20
uses: actions/github-script@v7
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/remove-autoclose-label.yml:20
uses: actions/github-script@v7
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/sweep.yml:19
uses: actions/checkout@v4
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/sweep.yml:22
uses: oven-sh/setup-bun@v2
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

.github/workflows/lock-closed-issues.yml:92
console.log(`Total issues locked: ${totalLocked}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

.github/workflows/remove-autoclose-label.yml:23
console.log(`Removing autoclose label from issue #${context.issue.number} due to new comment from ${context.payload.comment.user.login}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

.github/workflows/remove-autoclose-label.yml:34
console.log(`Successfully removed autoclose label from issue #${context.issue.number}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

.github/workflows/remove-autoclose-label.yml:38
console.log(`Autoclose label was already removed from issue #${context.issue.number}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

plugins/security-guidance/hooks/security_reminder_hook.py:24
# Silently ignore logging errors to avoid disrupting the hook
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Sensitive data in log output

high

Detected console logging statements that reference sensitive fields such as password, secret, token, or API keys. Logging sensitive data can expose credentials in log files, monitoring systems, and log aggregation services.

scripts/auto-close-duplicates.ts:106
console.log("[DEBUG] GitHub token found");
How to fix

Remove sensitive data from log statements. If you must reference sensitive fields, redact or mask them before logging.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/auto-close-duplicates.ts:100
console.log("[DEBUG] Starting auto-close duplicates script");
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/auto-close-duplicates.ts:106
console.log("[DEBUG] GitHub token found");
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/auto-close-duplicates.ts:110
console.log(`[DEBUG] Repository: ${owner}/${repo}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/auto-close-duplicates.ts:114
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/auto-close-duplicates.ts:118
console.log("[DEBUG] Fetching open issues created more than 3 days ago...");
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/auto-close-duplicates.ts:144
console.log(`[DEBUG] Found ${issues.length} open issues`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/auto-close-duplicates.ts:151
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/auto-close-duplicates.ts:155
console.log(`[DEBUG] Fetching comments for issue #${issue.number}...`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/auto-close-duplicates.ts:160
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/auto-close-duplicates.ts:170
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/auto-close-duplicates.ts:175
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/auto-close-duplicates.ts:183
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/auto-close-duplicates.ts:190
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/auto-close-duplicates.ts:195
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/auto-close-duplicates.ts:206
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/auto-close-duplicates.ts:211
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/auto-close-duplicates.ts:217
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/auto-close-duplicates.ts:224
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/auto-close-duplicates.ts:232
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/auto-close-duplicates.ts:237
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/auto-close-duplicates.ts:245
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/auto-close-duplicates.ts:255
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/auto-close-duplicates.ts:259
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/auto-close-duplicates.ts:269
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Sensitive data in log output

high

Detected console logging statements that reference sensitive fields such as password, secret, token, or API keys. Logging sensitive data can expose credentials in log files, monitoring systems, and log aggregation services.

scripts/backfill-duplicate-comments.ts:87
console.log("[DEBUG] GitHub token found");
How to fix

Remove sensitive data from log statements. If you must reference sensitive fields, redact or mask them before logging.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/backfill-duplicate-comments.ts:55
console.log(`[DRY RUN] Would trigger dedupe workflow for issue #${issueNumber}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/backfill-duplicate-comments.ts:73
console.log("[DEBUG] Starting backfill duplicate comments script");
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/backfill-duplicate-comments.ts:87
console.log("[DEBUG] GitHub token found");
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/backfill-duplicate-comments.ts:95
console.log(`[DEBUG] Repository: ${owner}/${repo}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/backfill-duplicate-comments.ts:96
console.log(`[DEBUG] Dry run mode: ${dryRun}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/backfill-duplicate-comments.ts:97
console.log(`[DEBUG] Looking at issues between #${minIssueNumber} and #${maxIssueNumber}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/backfill-duplicate-comments.ts:99
console.log(`[DEBUG] Fetching issues between #${minIssueNumber} and #${maxIssueNumber}...`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/backfill-duplicate-comments.ts:122
console.log(`[DEBUG] Oldest issue in page #${page} is #${oldestIssueInPage.number}, continuing...`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/backfill-duplicate-comments.ts:124
console.log(`[DEBUG] Oldest issue in page #${page} is #${oldestIssueInPage.number}, below minimum, stopping`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/backfill-duplicate-comments.ts:127
console.log(`[DEBUG] No issues in page #${page} are in range #${minIssueNumber}-#${maxIssueNumber}, continuing...`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/backfill-duplicate-comments.ts:134
console.log("[DEBUG] Reached page limit, stopping pagination");
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/backfill-duplicate-comments.ts:139
console.log(`[DEBUG] Found ${allIssues.length} issues between #${minIssueNumber} and #${maxIssueNumber}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/backfill-duplicate-comments.ts:147
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/backfill-duplicate-comments.ts:151
console.log(`[DEBUG] Fetching comments for issue #${issue.number}...`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/backfill-duplicate-comments.ts:156
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/backfill-duplicate-comments.ts:168
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/backfill-duplicate-comments.ts:174
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/backfill-duplicate-comments.ts:184
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/backfill-duplicate-comments.ts:190
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/backfill-duplicate-comments.ts:205
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/lifecycle-comment.ts:21
console.log(`No lifecycle entry for label "${label}", skipping`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/lifecycle-comment.ts:30
console.log(`Would comment on #${issueNumber} for label "${label}":\n\n${body}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/lifecycle-comment.ts:53
console.log(`Commented on #${issueNumber} for label "${label}"`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/sweep.ts:52
console.log(`\n=== marking stale (${staleDays}d inactive) ===`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/sweep.ts:80
console.log(`#${issue.number}: would label stale (${age}d inactive) — ${issue.title}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/sweep.ts:83
console.log(`#${issue.number}: labeled stale — ${issue.title}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/sweep.ts:98
console.log(`\n=== ${label} (${days}d timeout) ===`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/sweep.ts:134
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/sweep.ts:142
console.log(`#${issue.number}: would close (${label}, ${age}d old) — ${issue.title}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/sweep.ts:146
console.log(`#${issue.number}: closed (${label})`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/sweep.ts:163
if (DRY_RUN) console.log("DRY RUN — no changes will be made\n");
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/sweep.ts:168
console.log(`\nDone: ${labeled} ${DRY_RUN ? "would be labeled" : "labeled"} stale, ${closed} ${DRY_RUN ? "would be closed" : "closed"}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

HTML comment injection in tool description

critical

HTML comments in tool descriptions may contain hidden instructions intended to influence LLM reasoning.

.github/workflows/non-write-users-check.yml:37
gh pr comment "$PR_NUMBER" -R "$REPO" --body '<!-- non-write-users-check -->
How to fix

Remove HTML comments from description strings. Use source code comments instead.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

plugins/plugin-dev/skills/mcp-integration/examples/http-server.json:16
"Authorization": "Bearer ${API_TOKEN}",
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

scripts/auto-close-duplicates.ts:32
Authorization: `Bearer ${token}`,
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

scripts/backfill-duplicate-comments.ts:30
Authorization: `Bearer ${token}`,
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

scripts/lifecycle-comment.ts:39
Authorization: `Bearer ${token}`,
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

scripts/sweep.ts:26
Authorization: `Bearer ${token}`,
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

eval() usage detected

critical

eval() executes arbitrary code and should never be used with untrusted input. It enables full code injection.

plugins/security-guidance/hooks/security_reminder_hook.py:98
"substrings": ["eval("],
How to fix

Remove eval() usage. Use JSON.parse for data or a sandboxed interpreter for dynamic code.

Python exec() call

critical

Python's exec() function executes arbitrary code strings and is a vector for code injection.

plugins/security-guidance/hooks/security_reminder_hook.py:71
"substrings": ["child_process.exec", "exec(", "execSync("],
How to fix

Remove exec() calls. Use ast.literal_eval for safe expression evaluation.

Python exec() call

critical

Python's exec() function executes arbitrary code strings and is a vector for code injection.

plugins/security-guidance/hooks/security_reminder_hook.py:77
exec(`command ${userInput}`)
How to fix

Remove exec() calls. Use ast.literal_eval for safe expression evaluation.

Python exec() call

critical

Python's exec() function executes arbitrary code strings and is a vector for code injection.

plugins/security-guidance/hooks/security_reminder_hook.py:84
- Uses execFile instead of exec (prevents shell injection)
How to fix

Remove exec() calls. Use ast.literal_eval for safe expression evaluation.

new Function() constructor

critical

The Function constructor creates functions from strings, equivalent to eval() and equally dangerous with untrusted input.

plugins/security-guidance/hooks/security_reminder_hook.py:94
"reminder": "⚠️ Security Warning: Using new Function() with dynamic strings can lead to code injection vulnerabilities. Consider alternative approaches that don't evaluate arbitrary code. Only use new Function() if you truly need to evaluate arbitrary dynamic code.",
How to fix

Replace new Function() with a safe alternative. Avoid constructing functions from strings.

new Function() constructor

critical

The Function constructor creates functions from strings, equivalent to eval() and equally dangerous with untrusted input.

plugins/security-guidance/hooks/security_reminder_hook.py:94
"reminder": "⚠️ Security Warning: Using new Function() with dynamic strings can lead to code injection vulnerabilities. Consider alternative approaches that don't evaluate arbitrary code. Only use new Function() if you truly need to evaluate arbitrary dynamic code.",
How to fix

Replace new Function() with a safe alternative. Avoid constructing functions from strings.

Template literal in shell command construction

high

Building shell commands with template literals allows injection via interpolated values.

plugins/security-guidance/hooks/security_reminder_hook.py:77
exec(`command ${userInput}`)
How to fix

Use parameterized command execution instead of template literals.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

scripts/backfill-duplicate-comments.ts:75
const token = process.env.GITHUB_TOKEN;
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

scripts/lifecycle-comment.ts:9
const token = process.env.GITHUB_TOKEN;
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

scripts/sweep.ts:20
const token = process.env.GITHUB_TOKEN;
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.