Skip to content

Add SafeSkill security badge (84/100 — Passes with Notes) - #1

Open
OyaAIProd wants to merge 1 commit into
hanlulong:mainfrom
OyaAIProd:safeskill-scan-1774784133606
Open

Add SafeSkill security badge (84/100 — Passes with Notes)#1
OyaAIProd wants to merge 1 commit into
hanlulong:mainfrom
OyaAIProd:safeskill-scan-1774784133606

Conversation

@OyaAIProd

@OyaAIProd OyaAIProd commented Mar 29, 2026

Copy link
Copy Markdown

⚠️ SafeSkill Security Scan Results

Metric Value
Overall Score 84/100 (Passes with Notes)
Code Score 98/100
Content Score 60/100
Findings 58 findings detected (1 critical)
Taint Flows 0
Files Scanned 26
Scan Duration 1.4s

Top Findings

  • 🔴 critical: Data exfiltration pattern detected (data-exfil-pattern): "curl -X POST http://localhost:3001/api/query -H "Content-Type: application/json"" (docs/archive/COMPLEX_QUERY_TEST_SUITE_README.md:352)
  • 🟠 high: References sensitive path: import.meta.env.VITE_SUPABASE_URL (packages/frontend/vite.config.ts:16)
  • 🟠 high: References sensitive path: import.meta.env.VITE_SUPABASE_ANON_KEY (packages/frontend/vite.config.ts:17)
  • 🟠 high: Detected instruction-override attempt: "system:" (docs/analysis/INDICATOR_RESOLUTION_ANALYSIS.md:472)
  • 🟠 high: Context boundary escape detected (fake-turn-marker): "User:" (docs/archive/fixes-nov23/COMTRADE_FIX_SUMMARY.md:51)

View full report on SafeSkill

This PR was automatically generated by SafeSkill — the security scanner for AI tools and MCP servers.

hanlulong added a commit that referenced this pull request Jul 11, 2026
@hanlulong @claude
Providers: IMF multi-country accumulation, CoinGecko honesty,
cc7fca1 
ExchangeRate keyed endpoint, retrieval-layer concurrency

- IMF SDMX multi-country batches accumulate first-success-per-country
  (a 3-country comparison returned after country #1, silently dropping
  the rest); CSV series group by the DSD structure's real dimension ids
  so attribute columns (STATUS) can't fragment a series; DataMapper
  source links use the code's actual dataset anchor, not @weo.
- CoinGecko: the free-tier 365-day history clamp is disclosed via a
  metadata note on both paths, and frequency is derived from the ACTUAL
  point spacing (8-90 day hourly windows were labeled "daily").
- ExchangeRate: the keyed v6 endpoint returns conversion_rates, not
  rates — setting an API key would have hard-broken every spot query.
- Indicator retrieval: FTS query builder strips ALL non-word characters
  (an enumerated escape list let '"2025,"*' through — an FTS5 syntax
  error that killed the whole lexical arm for any punctuated query, seen
  in prod); sqlite connections are per-thread (the shared connection
  corrupted in-flight cursors under concurrent searches, ~40/day
  InterfaceError in prod, silently degrading retrieval).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
hanlulong added a commit that referenced this pull request Jul 11, 2026
@hanlulong @claude
Weighted synonym-blend embedding index — ADOPTED
a327f85 
final = normalize(0.75*name_vec + 0.25*syn_vec) for the ~11K rows with
meaningful synonyms; all other rows byte-identical to the name-only
index. This achieves what the rolled-back text-concatenation rebuild
could not: A/B strictly-improved-or-equal on all ten probes — UNRATE
back to #1 for "unemployment rate", GDPC1 ENTERED the "US GDP" top-6,
M2 entered "M2 money supply", StatsCan's monthly LFS cube rose to #1 —
with zero flagship crowding (name-dominant weighting preserves series
identity; the synonym component only nudges). Adopted via service
restart after A/B review.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
hanlulong added a commit that referenced this pull request Jul 18, 2026
@hanlulong @claude
fix: colloquial headline queries resolve via the canonical arm at BOT…
178abc8 
…H selector seams

'jobs numbers for the US' (battery en-jobs, real-user class): the parse
correctly normalizes to 'nonfarm payrolls', but the chooser's low-overlap
guard (0.00 — colloquialism and canonical term share no tokens BY DESIGN)
fell back to raw text, whose retrieval surfaces Indeed-postings/vacancies
junk with PAYEMS absent — while the canonical term retrieves PAYEMS/PAYNSA
at #1/#2 with 2x the next score. Also: the parse prompt's ambiguity policy
now states colloquial names of headline releases are NOT ambiguous
('jobs numbers' -> nonfarm payrolls; 'inflation print' -> CPI), guardrails
300->305 / 370->380.

Mechanism: new indicator_selector.build_canonical_arm_kwargs — ONE
construction point for the english_terms RRF arm covering both non-English
queries (the original arm) and English colloquialisms with zero content-token
overlap; used by the main resolution AND the prefetch call site. This is the
third mechanism today that existed at one seam and missed the other
(region kwargs, constraint query, now the canonical arm) — each arm/steering
kwarg now has exactly one builder shared by all call sites.

Live: 6/6 runs serve PAYNSA 'All Employees, Total Nonfarm' (159,830k,
2026-06) — was: deterministic clarification, then vacancy-series wrong data.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X8JXbaNcJBmSZhPbtkQvBd
hanlulong added a commit that referenced this pull request Jul 18, 2026
@hanlulong @claude
feat: frequency markers + recency-window extractor fix + country-qual…
d155f05 
…ified retrieval + popularity at the FTS cut

Cycle bundle (each piece unit-verified; battery is the arbiter):
- _extract_requested_frequencies: recency windows ('past year', 'last 3
  months') are TIME RANGES, not frequency requests — they made the annual
  WB-mirror 'match the requested frequency' alongside monthly.
- _llm_pick candidates now carry per-candidate frequency markers
  (MATCHES/does NOT match requested frequency) — the [covers X] pattern the
  adjudicator follows more reliably than prose.
- PROVIDER_HOME_COUNTRY + country_qualified_indicator_text at the selector-
  text chokepoint: FRED international series are country-TITLED; 'CPI
  inflation'+country=India retrieved zero Indian series, 'CPI inflation
  India' ranks the monthly Indian CPI #1.
- FRED synonym enrichment extended to popularity>=30 (922 rows) + index
  re-blend (A/B clean). SIDE EFFECT CAUGHT: enriched mid-popularity rows
  crowded shared vocabulary and bm25 alone dropped FLAGSHIPS out of the FTS
  top-k cut (PAYNSA/PAYEMS vanished for 'nonfarm payrolls'). Popularity now
  joins the ORDER at the cut itself (bm25 - popularity*0.2, swept 0.08/0.2/
  0.4 empirically) — flagships recovered (GDP #1, UNRATE #1, PAYEMS top-4)
  while text relevance still leads.
Residual (recorded): adjudicator adherence over the noisier enriched
candidate sets still flips en-jobs/India — next: an explicit per-candidate
OFFICIAL-HEADLINE marker (popularity-derived), the annotation pattern again.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X8JXbaNcJBmSZhPbtkQvBd
hanlulong added a commit that referenced this pull request Jul 19, 2026
@hanlulong
feat: ChinaMacro provider — live extraction of fresh Chinese headline…
f40ed5c 
… macro (user-approved)

Closes the #1 real-user coverage gap (~450 q/5d): Chinese high-frequency
data no existing provider carries at official cadence. 14 series: NBS
mfg/non-mfg PMI, M2/M1 growth + M2 level, new RMB loans, fresh CPI/PPI,
retail, industrial production, FAI, quarterly GDP growth, daily 10Y CGB
yield, social-financing increment.

Two-tier, registry-driven (no per-series code branches):
- LIVE: vendored public JSON endpoints, all curl-verified from this host —
  EastMoney datacenter (official NBS/PBoC figures, fresh to June 2026,
  13-20yr history), EastMoney treasury report (daily yields to T-1,
  cross-checked vs ChinaBond official within 1bp), MOFCOM shrzgm (official,
  ~2-3mo lag disclosed). Deliberately NOT scraping NBS (WAF-blocks
  datacenter IPs) or PBoC (robots.txt disallows bots); akshare rejected as
  a dependency — endpoints vendored, its repo watched for drift.
- CSV fallback: dated curated snapshot (3,001 obs), seeded from live and
  spot-verified against NBS press releases (PMI 50.3, CPI +1.0, PPI +4.1,
  M2 +8.0 — all match). Schema drift or live failure falls back with
  provenance disclosed in metadata; misparsed values are never served.

Wiring: dispatch (params-first precedence), router fallbacks
CHINAMACRO→FRED/WB, geography-encoded set, provider matrix entry + China
routing rule (prefer over FRED's ~14-month-lagged mirrors), indicators.db
catalog rows with zh+en synonyms (FTS-discoverable: 社融/制造业PMI resolve).
Also in the same rules hunk: government fiscal ratios are IMF-first for all
countries (debt-to-GDP routing variance fix).

Tooling: record_chinamacro_fixtures.py (recorded real payloads for offline
tests), load_chinamacro_catalog.py (idempotent upsert),
refresh_chinamacro.py (--seed / --verify-live diff / --staleness) for the
quarterly maintenance loop. Tests: 22 offline against recorded payloads
incl. drift-fallback and dispatch precedence. Docs + landing page updated
to 11 providers.
hanlulong added a commit that referenced this pull request Jul 20, 2026
@hanlulong
feat: generic append-missing-rows tool for the embedding name base (+…
2a73c63 
…numpy tmp-name fix)

Any db row added after the name-vector base was built is invisible to the
embedding retrieval arm until appended — the run found 514 such rows (493
CoinGecko, 14 ChinaMacro, 6 FRED, 1 Comtrade); base now 330,064. Atomic
write with a dated safety copy; idempotent. Gotcha fixed: np.savez_compressed
appends .npz to temp names, so the atomic-replace source must already end in
.npz. Re-blend A/B was clean with improvements (M2SL and UNRATE now rank #1
for their probes); adopted via restart, flagships verified live.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@OyaAIProd