<< Back to security report
Repositoryhtlin222/dotfiles →
Commit6eca7c2 →
VerdictFAIL
Score0
DateMay 23, 2026
| Severity | Rule | Message | File:Line |
|---|---|---|---|
| MEDIUM | go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5 | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. | htlin222/dotfiles/harsh-2-4bf5986c/claude.symlink/go-tools/internal/hooks/userprompt/hook.go:440 → |
| MEDIUM | go.lang.security.audit.unsafe.use-of-unsafe-block | Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you're doing. | htlin222/dotfiles/harsh-2-4bf5986c/claude.symlink/go-tools/internal/statusline/im_darwin.go:78 → |
| MEDIUM | go.lang.security.audit.unsafe.use-of-unsafe-block | Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you're doing. | htlin222/dotfiles/harsh-2-4bf5986c/claude.symlink/go-tools/internal/statusline/im_darwin.go:85 → |
| MEDIUM | go.lang.security.bad_tmp.bad-tmp-file-creation | File creation in shared tmp directory without using `io.CreateTemp`. | htlin222/dotfiles/harsh-2-4bf5986c/claude.symlink/go-tools/internal/statusline/joke.go:106 → |
| MEDIUM | go.lang.security.audit.unsafe.use-of-unsafe-block | Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you're doing. | htlin222/dotfiles/harsh-2-4bf5986c/claude.symlink/go-tools/internal/statusline/render.go:31 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | htlin222/dotfiles/harsh-2-4bf5986c/claude.symlink/skills/todoist/scripts/todoist.py:55 → |
| HIGH | python.lang.security.audit.subprocess-shell-true.subprocess-shell-true | Found 'subprocess' function 'run' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead. | htlin222/dotfiles/harsh-2-4bf5986c/pyscripts.symlink/cliptoRLQ.py:35 → |
| HIGH | python.lang.security.audit.subprocess-shell-true.subprocess-shell-true | Found 'subprocess' function 'run' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead. | htlin222/dotfiles/harsh-2-4bf5986c/pyscripts.symlink/cliptoimgur.py:34 → |
| HIGH | python.lang.security.audit.subprocess-shell-true.subprocess-shell-true | Found 'subprocess' function 'run' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead. | htlin222/dotfiles/harsh-2-4bf5986c/pyscripts.symlink/cliptosn.py:36 → |
| HIGH | python.lang.security.audit.subprocess-shell-true.subprocess-shell-true | Found 'subprocess' function 'run' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead. | htlin222/dotfiles/harsh-2-4bf5986c/pyscripts.symlink/post-og.py:42 → |
| HIGH | python.lang.security.audit.subprocess-shell-true.subprocess-shell-true | Found 'subprocess' function 'run' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead. | htlin222/dotfiles/harsh-2-4bf5986c/pyscripts.symlink/save_clipboard_image.py:42 → |
| HIGH | python.lang.security.audit.subprocess-shell-true.subprocess-shell-true | Found 'subprocess' function 'run' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead. | htlin222/dotfiles/harsh-2-4bf5986c/pyscripts.symlink/sn_to_anki.py:49 → |
| HIGH | python.lang.security.audit.subprocess-shell-true.subprocess-shell-true | Found 'subprocess' function 'run' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead. | htlin222/dotfiles/harsh-2-4bf5986c/pyscripts.symlink/trans_doi_to_bib.py:28 → |