analyze-codelisted

# Code Analysis (Zoom In) Perform a code-level quality analysis of this project. Follow the procedural workflow below; use the rubric sections as reference when interpreting findings. ## Ground Rules - Assessment only: no code changes, pushes, workflow/release triggers - No side effects: no installs/config edits/machine mutation; no paid API calls (mock or skip); dry-run or mock anything that publishes/deploys; verify commands exist and are spelled correctly, not their effect - Reproduce before reporting: every finding needs repro or concrete trace, a file:line reference, and a concrete fix - Probe validation gaps: construct an invalid state locally, check tooling/CI catches it ## Repo Shape Emphasize different risk categories depending on what the repo is: | Shape | Emphasize | | --- | --- | | App/service | authZ per route (ownership on account-scoped routes), auth token lifecycle (expiry/single-use/timing/enumeration), quota races, SSRF in fetchers/ingestion, prompt injection from untrusted content reaching an LLM, SQLi, CORS/rate limits | | CI library/actions | script injection (untrusted context in `run:`), SHA pinning, egress, permission ceilings — a bad action ships unsafe CI to every consumer | | Content/docs site | XSS (`set:html` / `innerHTML`, export paths), command validity in guides, currency of claims, link rot | | Package index/tap | artifact checksum re-verification vs upstream, update-automation payload trust (dispatch payload -> file rewrite = R