Back to Code Review Pipeline

Security Report

Code Review Pipeline

Pass
Version v1.1.26 Scanned 2 July 2026 at 19:34 Scanner v3.3.0

Summary

Detected

  • Services: llm-service
  • Permissions: filesystem:read, network:ollama.com
  • Data Handling: pii

Undeclared

All items declared

Warnings

No warnings

Findings (7)

Credentials

info env:GITHUB_TOKEN undeclared
credential-env-var
services/github-mcp.md:44

"{GITHUB_TOKEN}"

This file references the environment variable GITHUB_TOKEN. If this is a credential (API key, token, secret), declare it in requires.data_handling.

Permissions

info filesystem:read declared
mcp-file-read
services/github-mcp.md:59

"get_file_contents"

This content references filesystem read access. If intentional, declare filesystem:read in requires.permissions.

info network:ollama.com declared
external-url
services/ollama-local.md:19

"https://ollama.com"

Wrap reference URLs in backticks (`url`) or a blockquote (> line) to mark them as illustrative content

Services

info llm-service declared
frontmatter-service-connection
skills/security-scanning.md:1

"connection: llm-service (runs_on)"

This node depends on the "llm-service" service. Declare it in requires.services so users know what external services are needed.

info llm-service declared
frontmatter-service-connection
skills/style-checking.md:1

"connection: llm-service (runs_on)"

This node depends on the "llm-service" service. Declare it in requires.services so users know what external services are needed.

info llm-service declared
frontmatter-service-connection
workflows/pr-review-pipeline.md:1

"connection: llm-service (runs_on)"

This node depends on the "llm-service" service. Declare it in requires.services so users know what external services are needed.

Data Handling

info pii declared
pii-explicit-mention
skills/security-scanning.md:50

"PII"

This content handles personally identifiable information (names, emails, addresses). Declare pii in requires.data_handling so users are informed before import.

Send feedback

Sign in to send feedback — it lets us follow up and keeps the tracker free of spam.