<< Back to security report
Repositorymajiayu000/claude-skill-registry →
Commit597f841 →
VerdictPASS
Score70
DateOct 15, 2026
| Severity | Rule | Message | File:Line |
|---|---|---|---|
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | majiayu000_claude-skill-registry_goals-460d4169/scripts/backfill_legal_metadata.py:91 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | majiayu000_claude-skill-registry_goals-460d4169/scripts/review_category_plan_with_llm.py:90 → |
| MEDIUM | python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. | majiayu000_claude-skill-registry_goals-460d4169/scripts/sync_download_support.py:456 → |
| MEDIUM | python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. | majiayu000_claude-skill-registry_goals-460d4169/scripts/sync_pipeline_support.py:738 → |
| MEDIUM | python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. | majiayu000_claude-skill-registry_goals-460d4169/scripts/utils.py:326 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | majiayu000_claude-skill-registry_goals-460d4169/scripts/verify_upstream_assets.py:67 → |