MalDet · Static Security Report
This repository has a medium vulnerability score of 33, which means there are some insecure coding patterns that an attacker could exploit if they gain access to the code. However, the scan found no signs of malicious intent or hidden malware, so the code is not actively dangerous on its own. The main issues are standard mistakes like using non-static commands in IO.popen and system, which can be exploited if user data isn't properly validated before running them. There are also some configuration gaps, such as missing a cooldown period for Dependabot updates and the use of mutable GitHub Actions tags that could theoretically lead to supply-chain attacks. While these findings look like ordinary insecure coding rather than malicious intent, they do not make the code safe to use without further review and fixes.
Written by a language model running locally on the scanning machine, from the findings in this report. The risk levels above and below were decided by the scoring model, not by this summary.
MalDet scores two different questions separately, because they call for different responses: code can be badly written without being hostile, and hostile code is not always badly written.
| Detector | Looks for | High | Medium | Low | Total |
|---|---|---|---|---|---|
| semgrep | Insecure coding patterns across many languages | 0 | 18 | 0 | 18 |
| yara | Signatures of malicious behaviour in source files | 0 | 0 | 1 | 1 |
18 of 19 findings were rated more likely genuine than noise by the classifier.
Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.
| Severity | Detector | Finding | Seen | Example location |
|---|---|---|---|---|
| medium | semgrep | Detected non-static command inside IO.popen. Audit the input to 'IO.popen'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. | 1 | /spec/spec_helper.rb:47 |
| medium | semgrep | Detected non-static command inside system. Audit the input to 'system'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. | 1 | /build_config.rb:20 |
| medium | semgrep | This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a `cooldown` block with `default-days: 7` to each `package-ecosystem` entry under `updates` to wait 7 days before proposing updates to newly published package versions. Reference: | 1 | /.github/dependabot.yml:3 |
| medium | semgrep | Detected manual creation of an ERB template. Manual creation of templates may expose your application to server-side template injection (SSTI) or cross-site scripting (XSS) attacks if user input is used to create the template. Instead, create a '.erb' template file and use 'render'. | 1 | /mrblib/mitamae/resource_executor/template.rb:52 |
| medium | semgrep | GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: ac | 14 | /.github/workflows/build.yml:21 |
| low | yara | YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version | 1 | /README.md |