<< Back to security report
Repositorysickn33/antigravity-awesome-skills →
Commitc91abcf →
VerdictFAIL
Score0
DateSep 4, 2026
| Severity | Rule | Message | File:Line |
|---|---|---|---|
| HIGH | yaml.github-actions.security.run-shell-injection.run-shell-injection | Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". | sickn33/antigravity-awesome-skills/server-management-cba2660a/.github/workflows/ci.yml:52 → |
| HIGH | yaml.github-actions.security.run-shell-injection.run-shell-injection | Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". | sickn33/antigravity-awesome-skills/server-management-cba2660a/.github/workflows/ci.yml:173 → |
| HIGH | yaml.github-actions.security.run-shell-injection.run-shell-injection | Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". | sickn33/antigravity-awesome-skills/server-management-cba2660a/.github/workflows/ci.yml:199 → |
| HIGH | yaml.github-actions.security.run-shell-injection.run-shell-injection | Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". | sickn33/antigravity-awesome-skills/server-management-cba2660a/.github/workflows/ci.yml:294 → |
| HIGH | yaml.github-actions.security.run-shell-injection.run-shell-injection | Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". | sickn33/antigravity-awesome-skills/server-management-cba2660a/.github/workflows/ci.yml:298 → |
| HIGH | yaml.github-actions.security.run-shell-injection.run-shell-injection | Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". | sickn33/antigravity-awesome-skills/server-management-cba2660a/.github/workflows/ci.yml:311 → |
| HIGH | javascript.lang.security.detect-child-process.detect-child-process | Detected calls to child_process from a function argument `cmd`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. | sickn33/antigravity-awesome-skills/server-management-cba2660a/apps/web-app/refresh-skills-plugin.js:371 → |
| MEDIUM | javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag | Cannot determine what 'markerIndex' is and it is used with a '<script>' tag. This could be susceptible to cross-site scripting (XSS). Ensure 'markerIndex' is not externally controlled, or sanitize this data. | sickn33/antigravity-awesome-skills/server-management-cba2660a/apps/web-app/scripts/prerender-routes.js:129 → |
| MEDIUM | javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag | Cannot determine what 'routeFile' is and it is used with a '<script>' tag. This could be susceptible to cross-site scripting (XSS). Ensure 'routeFile' is not externally controlled, or sanitize this data. | sickn33/antigravity-awesome-skills/server-management-cba2660a/apps/web-app/scripts/verify-seo-assets.test.js:868 → |
| MEDIUM | javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag | Cannot determine what 'routeFile' is and it is used with a '<script>' tag. This could be susceptible to cross-site scripting (XSS). Ensure 'routeFile' is not externally controlled, or sanitize this data. | sickn33/antigravity-awesome-skills/server-management-cba2660a/apps/web-app/scripts/verify-seo-assets.test.js:910 → |
| HIGH | javascript.lang.security.detect-child-process.detect-child-process | Detected calls to child_process from a function argument `cmd`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. | sickn33/antigravity-awesome-skills/server-management-cba2660a/plugins/agentic-awesome-skills-claude/skills/competitor-analysis/scripts/capture_screenshots.mjs:91 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | sickn33/antigravity-awesome-skills/server-management-cba2660a/plugins/agentic-awesome-skills-claude/skills/find-complementary-founders/scripts/github_thread.py:206 → |
| MEDIUM | python.lang.security.audit.httpsconnection-detected.httpsconnection-detected | The HTTPSConnection API has changed frequently with minor releases of Python. Ensure you are using the API for your version of Python securely. For example, Python 3 versions prior to 3.4.3 will not verify SSL certificates by default. See https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection for more information. | sickn33/antigravity-awesome-skills/server-management-cba2660a/plugins/agentic-awesome-skills-claude/skills/find-complementary-founders/scripts/moltbook_publish.py:526 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | sickn33/antigravity-awesome-skills/server-management-cba2660a/plugins/agentic-awesome-skills-claude/skills/find-complementary-founders/scripts/verify_github_submission.py:131 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | sickn33/antigravity-awesome-skills/server-management-cba2660a/plugins/agentic-awesome-skills-claude/skills/gemini-omni-flash-api/scripts/video/generate_video.py:203 → |
| HIGH | python.lang.security.audit.dangerous-subprocess-use-tainted-env-args.dangerous-subprocess-use-tainted-env-args | Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. | sickn33/antigravity-awesome-skills/server-management-cba2660a/plugins/agentic-awesome-skills-claude/skills/hugging-face-community-evals/scripts/inspect_eval_uv.py:94 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | sickn33/antigravity-awesome-skills/server-management-cba2660a/plugins/agentic-awesome-skills-claude/skills/hugging-face-model-trainer/scripts/dataset_inspector.py:43 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | sickn33/antigravity-awesome-skills/server-management-cba2660a/plugins/agentic-awesome-skills-claude/skills/hugging-face-model-trainer/scripts/hf_benchmarks.py:143 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | sickn33/antigravity-awesome-skills/server-management-cba2660a/plugins/agentic-awesome-skills-claude/skills/hugging-face-vision-trainer/scripts/dataset_inspector.py:45 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | sickn33/antigravity-awesome-skills/server-management-cba2660a/plugins/agentic-awesome-skills-claude/skills/huggingface-tool-builder/references/baseline_hf_api.py:51 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | sickn33/antigravity-awesome-skills/server-management-cba2660a/plugins/agentic-awesome-skills-claude/skills/last30days/scripts/lib/http.py:75 → |
| MEDIUM | python.lang.security.audit.eval-detected.eval-detected | Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources. | sickn33/antigravity-awesome-skills/server-management-cba2660a/plugins/agentic-awesome-skills-claude/skills/loki-mode/benchmarks/results/2026-01-05-00-49-17/humaneval-solutions/160.py:29 → |
| MEDIUM | python.lang.security.audit.eval-detected.eval-detected | Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources. | sickn33/antigravity-awesome-skills/server-management-cba2660a/plugins/agentic-awesome-skills-claude/skills/loki-mode/benchmarks/results/humaneval-loki-solutions/160.py:34 → |
| HIGH | python.lang.security.use-defused-xml.use-defused-xml | The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. | sickn33/antigravity-awesome-skills/server-management-cba2660a/plugins/agentic-awesome-skills-claude/skills/mcp-builder/scripts/evaluation.py:23 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | sickn33/antigravity-awesome-skills/server-management-cba2660a/plugins/agentic-awesome-skills-claude/skills/shopify-development/scripts/shopify_graphql.py:101 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | sickn33/antigravity-awesome-skills/server-management-cba2660a/plugins/agentic-awesome-skills-claude/skills/stability-ai/scripts/generate.py:149 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | sickn33/antigravity-awesome-skills/server-management-cba2660a/plugins/agentic-awesome-skills-claude/skills/survey-generator/build_artifact.py:122 → |
| MEDIUM | python.lang.security.audit.httpsconnection-detected.httpsconnection-detected | The HTTPSConnection API has changed frequently with minor releases of Python. Ensure you are using the API for your version of Python securely. For example, Python 3 versions prior to 3.4.3 will not verify SSL certificates by default. See https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection for more information. | sickn33/antigravity-awesome-skills/server-management-cba2660a/plugins/agentic-awesome-skills-claude/skills/telegram/scripts/send_message.py:59 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | sickn33/antigravity-awesome-skills/server-management-cba2660a/plugins/agentic-awesome-skills-claude/skills/telegram/scripts/test_bot.py:40 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | sickn33/antigravity-awesome-skills/server-management-cba2660a/plugins/agentic-awesome-skills-claude/skills/telegram/scripts/test_bot.py:73 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | sickn33/antigravity-awesome-skills/server-management-cba2660a/plugins/agentic-awesome-skills-claude/skills/telegram/scripts/test_bot.py:98 → |
| HIGH | python.lang.security.audit.subprocess-shell-true.subprocess-shell-true | Found 'subprocess' function 'run' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead. | sickn33/antigravity-awesome-skills/server-management-cba2660a/plugins/agentic-awesome-skills-claude/skills/typescript-expert/scripts/ts_diagnostic.py:16 → |
| MEDIUM | python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host | Running flask app with host 0.0.0.0 could expose the server publicly. | sickn33/antigravity-awesome-skills/server-management-cba2660a/plugins/agentic-awesome-skills-claude/skills/whatsapp-cloud-api/assets/boilerplate/python/app.py:123 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | sickn33/antigravity-awesome-skills/server-management-cba2660a/plugins/agentic-awesome-skills/skills/find-complementary-founders/scripts/github_thread.py:206 → |
| MEDIUM | python.lang.security.audit.httpsconnection-detected.httpsconnection-detected | The HTTPSConnection API has changed frequently with minor releases of Python. Ensure you are using the API for your version of Python securely. For example, Python 3 versions prior to 3.4.3 will not verify SSL certificates by default. See https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection for more information. | sickn33/antigravity-awesome-skills/server-management-cba2660a/plugins/agentic-awesome-skills/skills/find-complementary-founders/scripts/moltbook_publish.py:526 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | sickn33/antigravity-awesome-skills/server-management-cba2660a/plugins/agentic-awesome-skills/skills/find-complementary-founders/scripts/verify_github_submission.py:131 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | sickn33/antigravity-awesome-skills/server-management-cba2660a/plugins/agentic-awesome-skills/skills/gemini-omni-flash-api/scripts/video/generate_video.py:203 → |
| HIGH | python.lang.security.audit.dangerous-subprocess-use-tainted-env-args.dangerous-subprocess-use-tainted-env-args | Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. | sickn33/antigravity-awesome-skills/server-management-cba2660a/plugins/agentic-awesome-skills/skills/hugging-face-community-evals/scripts/inspect_eval_uv.py:94 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | sickn33/antigravity-awesome-skills/server-management-cba2660a/plugins/agentic-awesome-skills/skills/hugging-face-model-trainer/scripts/dataset_inspector.py:43 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | sickn33/antigravity-awesome-skills/server-management-cba2660a/plugins/agentic-awesome-skills/skills/hugging-face-model-trainer/scripts/hf_benchmarks.py:143 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | sickn33/antigravity-awesome-skills/server-management-cba2660a/plugins/agentic-awesome-skills/skills/hugging-face-vision-trainer/scripts/dataset_inspector.py:45 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | sickn33/antigravity-awesome-skills/server-management-cba2660a/plugins/agentic-awesome-skills/skills/huggingface-tool-builder/references/baseline_hf_api.py:51 → |
| HIGH | python.lang.security.use-defused-xml.use-defused-xml | The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. | sickn33/antigravity-awesome-skills/server-management-cba2660a/plugins/agentic-awesome-skills/skills/mcp-builder/scripts/evaluation.py:23 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | sickn33/antigravity-awesome-skills/server-management-cba2660a/plugins/agentic-awesome-skills/skills/shopify-development/scripts/shopify_graphql.py:101 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | sickn33/antigravity-awesome-skills/server-management-cba2660a/plugins/agentic-awesome-skills/skills/stability-ai/scripts/generate.py:149 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | sickn33/antigravity-awesome-skills/server-management-cba2660a/plugins/agentic-awesome-skills/skills/survey-generator/build_artifact.py:122 → |
| MEDIUM | python.lang.security.audit.httpsconnection-detected.httpsconnection-detected | The HTTPSConnection API has changed frequently with minor releases of Python. Ensure you are using the API for your version of Python securely. For example, Python 3 versions prior to 3.4.3 will not verify SSL certificates by default. See https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection for more information. | sickn33/antigravity-awesome-skills/server-management-cba2660a/plugins/agentic-awesome-skills/skills/telegram/scripts/send_message.py:59 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | sickn33/antigravity-awesome-skills/server-management-cba2660a/plugins/agentic-awesome-skills/skills/telegram/scripts/test_bot.py:40 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | sickn33/antigravity-awesome-skills/server-management-cba2660a/plugins/agentic-awesome-skills/skills/telegram/scripts/test_bot.py:73 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | sickn33/antigravity-awesome-skills/server-management-cba2660a/plugins/agentic-awesome-skills/skills/telegram/scripts/test_bot.py:98 → |
| HIGH | python.lang.security.audit.subprocess-shell-true.subprocess-shell-true | Found 'subprocess' function 'run' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead. | sickn33/antigravity-awesome-skills/server-management-cba2660a/plugins/agentic-awesome-skills/skills/typescript-expert/scripts/ts_diagnostic.py:16 → |
| MEDIUM | python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host | Running flask app with host 0.0.0.0 could expose the server publicly. | sickn33/antigravity-awesome-skills/server-management-cba2660a/plugins/agentic-awesome-skills/skills/whatsapp-cloud-api/assets/boilerplate/python/app.py:123 → |
| HIGH | python.lang.security.use-defused-xml.use-defused-xml | The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. | sickn33/antigravity-awesome-skills/server-management-cba2660a/plugins/agentic-bundle-aas-agent-mcp-builder/skills/mcp-builder/scripts/evaluation.py:23 → |
| HIGH | python.lang.security.use-defused-xml.use-defused-xml | The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. | sickn33/antigravity-awesome-skills/server-management-cba2660a/plugins/agentic-bundle-aas-automation-builder/skills/mcp-builder/scripts/evaluation.py:23 → |
| HIGH | python.lang.security.use-defused-xml.use-defused-xml | The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. | sickn33/antigravity-awesome-skills/server-management-cba2660a/plugins/agentic-bundle-agent-architect/skills/mcp-builder/scripts/evaluation.py:23 → |
| HIGH | python.lang.security.use-defused-xml.use-defused-xml | The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. | sickn33/antigravity-awesome-skills/server-management-cba2660a/plugins/agentic-bundle-automation-builder/skills/mcp-builder/scripts/evaluation.py:23 → |
| HIGH | python.lang.security.audit.subprocess-shell-true.subprocess-shell-true | Found 'subprocess' function 'run' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead. | sickn33/antigravity-awesome-skills/server-management-cba2660a/plugins/agentic-bundle-typescript-javascript/skills/typescript-expert/scripts/ts_diagnostic.py:16 → |
| HIGH | javascript.lang.security.detect-child-process.detect-child-process | Detected calls to child_process from a function argument `cmd`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. | sickn33/antigravity-awesome-skills/server-management-cba2660a/skills/competitor-analysis/scripts/capture_screenshots.mjs:91 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | sickn33/antigravity-awesome-skills/server-management-cba2660a/skills/find-complementary-founders/scripts/github_thread.py:206 → |
| MEDIUM | python.lang.security.audit.httpsconnection-detected.httpsconnection-detected | The HTTPSConnection API has changed frequently with minor releases of Python. Ensure you are using the API for your version of Python securely. For example, Python 3 versions prior to 3.4.3 will not verify SSL certificates by default. See https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection for more information. | sickn33/antigravity-awesome-skills/server-management-cba2660a/skills/find-complementary-founders/scripts/moltbook_publish.py:526 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | sickn33/antigravity-awesome-skills/server-management-cba2660a/skills/find-complementary-founders/scripts/verify_github_submission.py:131 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | sickn33/antigravity-awesome-skills/server-management-cba2660a/skills/gemini-omni-flash-api/scripts/video/generate_video.py:203 → |
| HIGH | python.lang.security.audit.dangerous-subprocess-use-tainted-env-args.dangerous-subprocess-use-tainted-env-args | Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. | sickn33/antigravity-awesome-skills/server-management-cba2660a/skills/hugging-face-community-evals/scripts/inspect_eval_uv.py:94 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | sickn33/antigravity-awesome-skills/server-management-cba2660a/skills/hugging-face-model-trainer/scripts/dataset_inspector.py:43 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | sickn33/antigravity-awesome-skills/server-management-cba2660a/skills/hugging-face-model-trainer/scripts/hf_benchmarks.py:143 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | sickn33/antigravity-awesome-skills/server-management-cba2660a/skills/hugging-face-vision-trainer/scripts/dataset_inspector.py:45 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | sickn33/antigravity-awesome-skills/server-management-cba2660a/skills/huggingface-tool-builder/references/baseline_hf_api.py:51 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | sickn33/antigravity-awesome-skills/server-management-cba2660a/skills/last30days/scripts/lib/http.py:75 → |
| MEDIUM | python.lang.security.audit.eval-detected.eval-detected | Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources. | sickn33/antigravity-awesome-skills/server-management-cba2660a/skills/loki-mode/benchmarks/results/2026-01-05-00-49-17/humaneval-solutions/160.py:29 → |
| MEDIUM | python.lang.security.audit.eval-detected.eval-detected | Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources. | sickn33/antigravity-awesome-skills/server-management-cba2660a/skills/loki-mode/benchmarks/results/humaneval-loki-solutions/160.py:34 → |
| HIGH | python.lang.security.use-defused-xml.use-defused-xml | The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. | sickn33/antigravity-awesome-skills/server-management-cba2660a/skills/mcp-builder/scripts/evaluation.py:23 → |
| HIGH | python.lang.security.audit.dangerous-os-exec-tainted-env-args.dangerous-os-exec-tainted-env-args | Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. | sickn33/antigravity-awesome-skills/server-management-cba2660a/skills/notebooklm/scripts/run.py:107 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | sickn33/antigravity-awesome-skills/server-management-cba2660a/skills/shopify-development/scripts/shopify_graphql.py:101 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | sickn33/antigravity-awesome-skills/server-management-cba2660a/skills/stability-ai/scripts/generate.py:149 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | sickn33/antigravity-awesome-skills/server-management-cba2660a/skills/survey-generator/build_artifact.py:122 → |
| MEDIUM | python.lang.security.audit.httpsconnection-detected.httpsconnection-detected | The HTTPSConnection API has changed frequently with minor releases of Python. Ensure you are using the API for your version of Python securely. For example, Python 3 versions prior to 3.4.3 will not verify SSL certificates by default. See https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection for more information. | sickn33/antigravity-awesome-skills/server-management-cba2660a/skills/telegram/scripts/send_message.py:59 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | sickn33/antigravity-awesome-skills/server-management-cba2660a/skills/telegram/scripts/test_bot.py:40 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | sickn33/antigravity-awesome-skills/server-management-cba2660a/skills/telegram/scripts/test_bot.py:73 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | sickn33/antigravity-awesome-skills/server-management-cba2660a/skills/telegram/scripts/test_bot.py:98 → |
| HIGH | python.lang.security.audit.subprocess-shell-true.subprocess-shell-true | Found 'subprocess' function 'run' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead. | sickn33/antigravity-awesome-skills/server-management-cba2660a/skills/typescript-expert/scripts/ts_diagnostic.py:16 → |
| MEDIUM | python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host | Running flask app with host 0.0.0.0 could expose the server publicly. | sickn33/antigravity-awesome-skills/server-management-cba2660a/skills/whatsapp-cloud-api/assets/boilerplate/python/app.py:123 → |
| HIGH | javascript.lang.security.detect-child-process.detect-child-process | Detected calls to child_process from a function argument `cmd`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. | sickn33/antigravity-awesome-skills/server-management-cba2660a/tools/bin/install.js:971 → |
| HIGH | javascript.lang.security.detect-child-process.detect-child-process | Detected calls to child_process from a function argument `command`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. | sickn33/antigravity-awesome-skills/server-management-cba2660a/tools/lib/git-blob-sizes.js:6 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | sickn33/antigravity-awesome-skills/server-management-cba2660a/tools/scripts/analyze_voltagent_repo.py:106 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | sickn33/antigravity-awesome-skills/server-management-cba2660a/tools/scripts/convert_html_to_markdown.py:183 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | sickn33/antigravity-awesome-skills/server-management-cba2660a/tools/scripts/implement_voltagent_skills.py:36 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | sickn33/antigravity-awesome-skills/server-management-cba2660a/tools/scripts/implement_voltagent_skills.py:72 → |
| HIGH | javascript.lang.security.detect-child-process.detect-child-process | Detected calls to child_process from a function argument `command`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. | sickn33/antigravity-awesome-skills/server-management-cba2660a/tools/scripts/merge_batch.cjs:118 → |
| HIGH | javascript.lang.security.detect-child-process.detect-child-process | Detected calls to child_process from a function argument `command`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. | sickn33/antigravity-awesome-skills/server-management-cba2660a/tools/scripts/merge_batch.cjs:142 → |
| HIGH | javascript.lang.security.detect-child-process.detect-child-process | Detected calls to child_process from a function argument `command`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. | sickn33/antigravity-awesome-skills/server-management-cba2660a/tools/scripts/pr_preflight.cjs:111 → |
| HIGH | javascript.lang.security.detect-child-process.detect-child-process | Detected calls to child_process from a function argument `command`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. | sickn33/antigravity-awesome-skills/server-management-cba2660a/tools/scripts/release_workflow.js:23 → |
| HIGH | javascript.lang.security.detect-child-process.detect-child-process | Detected calls to child_process from a function argument `cmd`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. | sickn33/antigravity-awesome-skills/server-management-cba2660a/tools/scripts/restore_vibeship_skills.js:36 → |
| HIGH | javascript.lang.security.detect-child-process.detect-child-process | Detected calls to child_process from a function argument `command`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. | sickn33/antigravity-awesome-skills/server-management-cba2660a/tools/scripts/run_actionlint.js:51 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | sickn33/antigravity-awesome-skills/server-management-cba2660a/tools/scripts/update_readme.py:141 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | sickn33/antigravity-awesome-skills/server-management-cba2660a/tools/scripts/validate_voltagent_sources.py:25 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | sickn33/antigravity-awesome-skills/server-management-cba2660a/tools/scripts/validate_voltagent_sources.py:94 → |