security: 39 Critical/High panic-attack findings need human triage (Track C)

[hyperpolymath]

panic-attack estate sweep — Track C tracking issue

panic-attack assail flagged the findings below in this repo on 2026-05-26. They are aggregated here for human triage rather than as individual PRs because each requires judgement (supply-chain pin choice, schema-design call, mutation-test gap, etc.).

PA001/PA007 UnsafeCode/UnsafeFFI findings are NOT in this list. Findings already suppressed in audits/assail-classifications.a2ml are also excluded.

Estate tracker: hyperpolymath/panic-attack#32.

CommandInjection (6 findings)

file:line list

Critical  rhodium-standard-repositories/satellites/palimpsest-license/bof-meetings/presentations/demo-http-headers.sh:?  eval usage in rhodium-standard-repositories/satellites/palimpsest-license/bof-meetings/presentations/demo-http-headers.sh
Critical  rhodium-standard-repositories/satellites/palimpsest-license/bof-meetings/presentations/demo-dns-discovery.sh:?  eval usage in rhodium-standard-repositories/satellites/palimpsest-license/bof-meetings/presentations/demo-dns-discovery.sh
Critical  k9-svc/benchmarks/k9-bench.sh:?  eval usage in k9-svc/benchmarks/k9-bench.sh
Critical  a2ml/benchmarks/parser-bench.sh:?  eval usage in a2ml/benchmarks/parser-bench.sh
High  a2ml/pandoc/a2ml-filter.lua:?  os.execute/io.popen in a2ml/pandoc/a2ml-filter.lua

### `DynamicCodeExecution` (2 findings)

file:line list

High  avow-protocol/public/demo.js:?  DOM manipulation (innerHTML/document.write) in avow-protocol/public/demo.js

### `SupplyChain` (16 findings)

file:line list

High  rhodium-standard-repositories/examples/rhodium-minimal/flake.nix:?  flake.nix declares inputs without narHash, rev pinning, or sibling flake.lock — dependency revision is unpinned in rhodium-standar
High  flake.nix:?  flake.nix declares inputs without narHash, rev pinning, or sibling flake.lock — dependency revision is unpinned in flake.nix
High  k9-svc/flake.nix:?  flake.nix declares inputs without narHash, rev pinning, or sibling flake.lock — dependency revision is unpinned in k9-svc/flake.ni
High  k9-svc/actions/validate/flake.nix:?  flake.nix declares inputs without narHash, rev pinning, or sibling flake.lock — dependency revision is unpinned in k9-svc/actions/
High  k9-svc/editors/vscode/flake.nix:?  flake.nix declares inputs without narHash, rev pinning, or sibling flake.lock — dependency revision is unpinned in k9-svc/editors/
High  k9-svc/pandoc/flake.nix:?  flake.nix declares inputs without narHash, rev pinning, or sibling flake.lock — dependency revision is unpinned in k9-svc/pandoc/f
High  k9-svc/bindings/deno/flake.nix:?  flake.nix declares inputs without narHash, rev pinning, or sibling flake.lock — dependency revision is unpinned in k9-svc/bindings
High  k9-svc/bindings/rust/flake.nix:?  flake.nix declares inputs without narHash, rev pinning, or sibling flake.lock — dependency revision is unpinned in k9-svc/bindings
High  k9-svc/bindings/haskell/flake.nix:?  flake.nix declares inputs without narHash, rev pinning, or sibling flake.lock — dependency revision is unpinned in k9-svc/bindings
High  a2ml/actions/validate/flake.nix:?  flake.nix declares inputs without narHash, rev pinning, or sibling flake.lock — dependency revision is unpinned in a2ml/actions/va
High  a2ml/editors/vscode/flake.nix:?  flake.nix declares inputs without narHash, rev pinning, or sibling flake.lock — dependency revision is unpinned in a2ml/editors/vs
High  a2ml/pandoc/flake.nix:?  flake.nix declares inputs without narHash, rev pinning, or sibling flake.lock — dependency revision is unpinned in a2ml/pandoc/fla
High  a2ml/bindings/deno/flake.nix:?  flake.nix declares inputs without narHash, rev pinning, or sibling flake.lock — dependency revision is unpinned in a2ml/bindings/d
High  a2ml/bindings/rust/flake.nix:?  flake.nix declares inputs without narHash, rev pinning, or sibling flake.lock — dependency revision is unpinned in a2ml/bindings/r
High  a2ml/bindings/haskell/flake.nix:?  flake.nix declares inputs without narHash, rev pinning, or sibling flake.lock — dependency revision is unpinned in a2ml/bindings/h

### `UnboundedAllocation` (15 findings)

file:line list

Critical  rhodium-standard-repositories/satellites/rsr-certifier/engine/src/compliance/bronze.rs:?  Potential unbounded allocation pattern detected in rhodium-standard-repositories/satellites/rsr-certifier/engine/src/compliance/br
Critical  rhodium-standard-repositories/satellites/rsr-certifier/engine/src/compliance/gold.rs:?  Potential unbounded allocation pattern detected in rhodium-standard-repositories/satellites/rsr-certifier/engine/src/compliance/go
Critical  rhodium-standard-repositories/satellites/rsr-certifier/engine/src/compliance/silver.rs:?  Potential unbounded allocation pattern detected in rhodium-standard-repositories/satellites/rsr-certifier/engine/src/compliance/si
Critical  0-ai-gatekeeper-protocol/repo-guardian-fs/src/manifest.rs:?  Potential unbounded allocation pattern detected in 0-ai-gatekeeper-protocol/repo-guardian-fs/src/manifest.rs
Critical  inline-annotations/extractor/src/main.rs:?  Potential unbounded allocation pattern detected in inline-annotations/extractor/src/main.rs
Critical  groove-protocol/cli/src/probe.rs:?  Potential unbounded allocation pattern detected in groove-protocol/cli/src/probe.rs
Critical  groove-protocol/cli/src/validate.rs:?  Potential unbounded allocation pattern detected in groove-protocol/cli/src/validate.rs
Critical  groove-protocol/cli/src/detect.rs:?  Potential unbounded allocation pattern detected in groove-protocol/cli/src/detect.rs
Critical  k9-svc/tools/src/k9-validate/src/main.rs:?  Potential unbounded allocation pattern detected in k9-svc/tools/src/k9-validate/src/main.rs
Critical  k9-svc/tools/src/k9-sign/src/main.rs:?  Potential unbounded allocation pattern detected in k9-svc/tools/src/k9-sign/src/main.rs
Critical  k9-svc/k9-sign/src/main.rs:?  Potential unbounded allocation pattern detected in k9-svc/k9-sign/src/main.rs
Critical  k9-svc/bindings/rust/src/parser.rs:?  Potential unbounded allocation pattern detected in k9-svc/bindings/rust/src/parser.rs
Critical  hooks/playbook-to-recipe/src/main.rs:?  Potential unbounded allocation pattern detected in hooks/playbook-to-recipe/src/main.rs
Critical  k9-coordination-protocol/tools/k9-init/src/main.rs:?  Potential unbounded allocation pattern detected in k9-coordination-protocol/tools/k9-init/src/main.rs

---

🤖 Discovered during the panic-attack estate sweep (2026-05-26). See hyperpolymath/panic-attack#32 for campaign tracker.

[hyperpolymath]

Cross-link (2026-05-31): this per-repo Track C issue is rolled up alongside 48 other repos in the new estate-wide navigational tracker at standards#313. The per-repo issue (here) remains canonical for the standards-specific 39 findings; #313 provides the prioritization view (standards lands in the top-10 at #5 by finding count).

Leaving open — closes when the 39 findings are triaged.