← Scan another repo

github.com/JuliusBrussee/caveman

@ 7066cc815414

Submitted 8/4/2026, 10:25:54 AM · Status: ok

Risk grade
B
26 / 100
Findings
3
0 critical2 high1 medium0 low0 info0 on CISA KEV0ATT&CK
Showing 3 of 3 findings

Findings

  • Dynamic code execution via eval()/new Function() — arbitrary-code-execution risk if any operand is attacker-influenced. Avoid; parse explicitly. (Apache-2.0.)
    Dynamic code execution via eval()/new Function() — arbitrary-code-execution risk if any operand is attacker-influenced. Avoid; parse explicitly. (Apache-2.0.)
    semgrepsrc/plugins/opencode/plugin.js:70
  • Dynamic code execution via eval()/new Function() — arbitrary-code-execution risk if any operand is attacker-influenced. Avoid; parse explicitly. (Apache-2.0.)
    Dynamic code execution via eval()/new Function() — arbitrary-code-execution risk if any operand is attacker-influenced. Avoid; parse explicitly. (Apache-2.0.)
    semgrepsrc/plugins/opencode/plugin.js:88
  • Ensure top-level permissions are not set to write-all
    Ensure top-level permissions are not set to write-all on on(Sync SKILL.md and rules)
    checkov.github/workflows/sync-skill.yml:20

This report is public.