Issues

• Environment variables in MCP commands are not expanded (${CLAUDE_PLUGIN_ROOT})

  snyk/agent-scan#503 · Filter by author vladimir-trifonov opened on Oct 1, 2026

• codex_app MCP server fails to start due to incorrect relative path resolution

  snyk/agent-scan#502 · Filter by author vladimir-trifonov opened on Oct 1, 2026

• Agent Scan discovers MCP servers from plugin cache/test fixtures

  snyk/agent-scan#501 · Filter by author vladimir-trifonov opened on Oct 1, 2026

• Tool Pinning hashes only the description; the artifact layer moves on 74.6% of releases

  snyk/agent-scan#482 · Filter by author stillmarcus24 opened on Sep 20, 2026
  8

• False positive W007: bmad-customize

  snyk/agent-scan#472 · Filter by author alexeyv opened on Sep 9, 2026

• .pyc files are ignored and may bypass malicious code detection

  snyk/agent-scan#462 · Filter by author 2002lcy0401 opened on Sep 3, 2026

• Skill scan misses malicious __pycache__ / .pyc bytecode (reports safe)

  snyk/agent-scan#421 · Filter by author nedlir opened on Aug 9, 2026
  1

• W008 false positive: redaction marker treated as proof of a secret (v0.5.16)

  snyk/agent-scan#412 · Filter by author sgaabdu4 opened on Aug 4, 2026
  1

• Enable the tool to scan subagents

  snyk/agent-scan#405 · Filter by author pggolub opened on Jul 17, 2026
  1

• False positives for repository documentation read by default agent workflows

  snyk/agent-scan#392 · Filter by author orassayag opened on Jul 7, 2026
  4