security: 39 Critical/High panic-attack findings need human triage (Track C)

[hyperpolymath]

panic-attack estate sweep — Track C tracking issue

panic-attack assail flagged the findings below in this repo on 2026-05-26. They are aggregated here for human triage rather than as individual PRs because each requires judgement (supply-chain pin choice, schema-design call, mutation-test gap, etc.).

PA001/PA007 UnsafeCode/UnsafeFFI findings are NOT in this list. Findings already suppressed in audits/assail-classifications.a2ml are also excluded.

Estate tracker: hyperpolymath/panic-attack#32.

CommandInjection (6 findings)

file:line list

Critical rhodium-standard-repositories/satellites/palimpsest-license/bof-meetings/presentations/demo-http-headers.sh:? eval usage in rhodium-standard-repositories/satellites/palimpsest-license/bof-meetings/presentations/demo-http-headers.sh
Critical rhodium-standard-repositories/satellites/palimpsest-license/bof-meetings/presentations/demo-dns-discovery.sh:? eval usage in rhodium-standard-repositories/satellites/palimpsest-license/bof-meetings/presentations/demo-dns-discovery.sh
Critical k9-svc/benchmarks/k9-bench.sh:? eval usage in k9-svc/benchmarks/k9-bench.sh
Critical a2ml/benchmarks/parser-bench.sh:? eval usage in a2ml/benchmarks/parser-bench.sh
High a2ml/pandoc/a2ml-filter.lua:? os.execute/io.popen in a2ml/pandoc/a2ml-filter.lua

### `DynamicCodeExecution` (2 findings)

file:line list

High avow-protocol/public/demo.js:? DOM manipulation (innerHTML/document.write) in avow-protocol/public/demo.js

### `SupplyChain` (16 findings)

file:line list

High rhodium-standard-repositories/examples/rhodium-minimal/flake.nix:? flake.nix declares inputs without narHash, rev pinning, or sibling flake.lock — dependency revision is unpinned in rhodium-standar
High flake.nix:? flake.nix declares inputs without narHash, rev pinning, or sibling flake.lock — dependency revision is unpinned in flake.nix
High k9-svc/flake.nix:? flake.nix declares inputs without narHash, rev pinning, or sibling flake.lock — dependency revision is unpinned in k9-svc/flake.ni
High k9-svc/actions/validate/flake.nix:? flake.nix declares inputs without narHash, rev pinning, or sibling flake.lock — dependency revision is unpinned in k9-svc/actions/
High k9-svc/editors/vscode/flake.nix:? flake.nix declares inputs without narHash, rev pinning, or sibling flake.lock — dependency revision is unpinned in k9-svc/editors/
High k9-svc/pandoc/flake.nix:? flake.nix declares inputs without narHash, rev pinning, or sibling flake.lock — dependency revision is unpinned in k9-svc/pandoc/f
High k9-svc/bindings/deno/flake.nix:? flake.nix declares inputs without narHash, rev pinning, or sibling flake.lock — dependency revision is unpinned in k9-svc/bindings
High k9-svc/bindings/rust/flake.nix:? flake.nix declares inputs without narHash, rev pinning, or sibling flake.lock — dependency revision is unpinned in k9-svc/bindings
High k9-svc/bindings/haskell/flake.nix:? flake.nix declares inputs without narHash, rev pinning, or sibling flake.lock — dependency revision is unpinned in k9-svc/bindings
High a2ml/actions/validate/flake.nix:? flake.nix declares inputs without narHash, rev pinning, or sibling flake.lock — dependency revision is unpinned in a2ml/actions/va
High a2ml/editors/vscode/flake.nix:? flake.nix declares inputs without narHash, rev pinning, or sibling flake.lock — dependency revision is unpinned in a2ml/editors/vs
High a2ml/pandoc/flake.nix:? flake.nix declares inputs without narHash, rev pinning, or sibling flake.lock — dependency revision is unpinned in a2ml/pandoc/fla
High a2ml/bindings/deno/flake.nix:? flake.nix declares inputs without narHash, rev pinning, or sibling flake.lock — dependency revision is unpinned in a2ml/bindings/d
High a2ml/bindings/rust/flake.nix:? flake.nix declares inputs without narHash, rev pinning, or sibling flake.lock — dependency revision is unpinned in a2ml/bindings/r
High a2ml/bindings/haskell/flake.nix:? flake.nix declares inputs without narHash, rev pinning, or sibling flake.lock — dependency revision is unpinned in a2ml/bindings/h

### `UnboundedAllocation` (15 findings)

file:line list

Critical rhodium-standard-repositories/satellites/rsr-certifier/engine/src/compliance/bronze.rs:? Potential unbounded allocation pattern detected in rhodium-standard-repositories/satellites/rsr-certifier/engine/src/compliance/br
Critical rhodium-standard-repositories/satellites/rsr-certifier/engine/src/compliance/gold.rs:? Potential unbounded allocation pattern detected in rhodium-standard-repositories/satellites/rsr-certifier/engine/src/compliance/go
Critical rhodium-standard-repositories/satellites/rsr-certifier/engine/src/compliance/silver.rs:? Potential unbounded allocation pattern detected in rhodium-standard-repositories/satellites/rsr-certifier/engine/src/compliance/si
Critical 0-ai-gatekeeper-protocol/repo-guardian-fs/src/manifest.rs:? Potential unbounded allocation pattern detected in 0-ai-gatekeeper-protocol/repo-guardian-fs/src/manifest.rs
Critical inline-annotations/extractor/src/main.rs:? Potential unbounded allocation pattern detected in inline-annotations/extractor/src/main.rs
Critical groove-protocol/cli/src/probe.rs:? Potential unbounded allocation pattern detected in groove-protocol/cli/src/probe.rs
Critical groove-protocol/cli/src/validate.rs:? Potential unbounded allocation pattern detected in groove-protocol/cli/src/validate.rs
Critical groove-protocol/cli/src/detect.rs:? Potential unbounded allocation pattern detected in groove-protocol/cli/src/detect.rs
Critical k9-svc/tools/src/k9-validate/src/main.rs:? Potential unbounded allocation pattern detected in k9-svc/tools/src/k9-validate/src/main.rs
Critical k9-svc/tools/src/k9-sign/src/main.rs:? Potential unbounded allocation pattern detected in k9-svc/tools/src/k9-sign/src/main.rs
Critical k9-svc/k9-sign/src/main.rs:? Potential unbounded allocation pattern detected in k9-svc/k9-sign/src/main.rs
Critical k9-svc/bindings/rust/src/parser.rs:? Potential unbounded allocation pattern detected in k9-svc/bindings/rust/src/parser.rs
Critical hooks/playbook-to-recipe/src/main.rs:? Potential unbounded allocation pattern detected in hooks/playbook-to-recipe/src/main.rs
Critical k9-coordination-protocol/tools/k9-init/src/main.rs:? Potential unbounded allocation pattern detected in k9-coordination-protocol/tools/k9-init/src/main.rs

---

🤖 Discovered during the panic-attack estate sweep (2026-05-26). See hyperpolymath/panic-attack#32 for campaign tracker.

[hyperpolymath]

Cross-link (2026-05-31): this per-repo Track C issue is rolled up alongside 48 other repos in the new estate-wide navigational tracker at standards#313. The per-repo issue (here) remains canonical for the standards-specific 39 findings; #313 provides the prioritization view (standards lands in the top-10 at #5 by finding count).

Leaving open — closes when the 39 findings are triaged.