All issues

[BUG] skillspector[mcp] resolves to mcp 2.x, which removed mcp.server.fastmcp — server fails to start with a misleading "requires the optional 'mcp' dependency" error

#333

· tohir-dev opened

on Aug 2, 2026

E2 "Env Variable Harvesting" matches one spelling, so whitespace alone flips DO_NOT_INSTALL to SAFE

#329

· shi-eric opened

on Aug 1, 2026

Space-separated `allowed-tools` is parsed as a single tool name, so LP1 fires on fully-declared skills

#327

· shi-eric opened

on Jul 31, 2026

[Feature] Expose the file surface a finding landed on (code / instructions / docs / tests / config)

#326

· Mark2Mac opened

on Jul 31, 2026

OpenAI fallback graph uses active-provider model IDs

#324

· jstar0 opened

on Jul 31, 2026

[BUG] SC4 has no notion of version ranges: "^1.8.3" becomes an exact pin, and an unversioned dep gets the package's worst-ever advisory as CRITICAL

#318

· Mark2Mac opened

on Jul 30, 2026

claude_cli provider: concurrent temp-file collision on Windows drops most files from LLM analysis ([WinError 32])

#315

· viniciusdeoliveiramed opened

on Jul 29, 2026

tests\unit\test_patterns.py identified as threat

#314

· mdeweerd opened

on Jul 28, 2026

LP3 remediation advises adding a `permissions` field that Claude Code's SKILL.md schema does not have

#313

· RichCorbett opened

on Jul 28, 2026

EA3 flags Apache-2.0 LICENSE boilerplate as scope creep (fires on 814/817 skills in one corpus)

#312

· RichCorbett opened

on Jul 28, 2026

[BUG] OpenAI-compatible provider + Gemini: report issues have null 'finding' and 'category' (explanation/severity OK)

#304

· Mark2Mac opened

on Jul 23, 2026

[BUG] Rate-limited providers silently lose analyzer coverage: max_concurrency=10 hardcoded, 429 batches dropped without retry, partial LLM pass not flagged

#303

· Mark2Mac opened

on Jul 23, 2026