<< Back to security report
Repositorymajiayu000/claude-skill-registry →
Commit52372a7 →
VerdictPASS
Score65
DateOct 18, 2026
| Severity | Rule | Message | File:Line |
|---|---|---|---|
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | majiayu000_claude-skill-registry_backend-providers-7ffa8e1f/scripts/backfill_legal_metadata.py:91 → |
| MEDIUM | python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. | majiayu000_claude-skill-registry_backend-providers-7ffa8e1f/scripts/resolve_install_pins.py:32 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | majiayu000_claude-skill-registry_backend-providers-7ffa8e1f/scripts/review_category_plan_with_llm.py:90 → |
| MEDIUM | python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. | majiayu000_claude-skill-registry_backend-providers-7ffa8e1f/scripts/sync_download_support.py:514 → |
| MEDIUM | python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. | majiayu000_claude-skill-registry_backend-providers-7ffa8e1f/scripts/sync_pipeline_support.py:738 → |
| MEDIUM | python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. | majiayu000_claude-skill-registry_backend-providers-7ffa8e1f/scripts/utils.py:326 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | majiayu000_claude-skill-registry_backend-providers-7ffa8e1f/scripts/verify_upstream_assets.py:72 → |