Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/claim/README.md">

<violation number="1" location="src/claim/README.md:153">
P2: The new log example references `https_proxy`, but the existing proxy configuration docs state only `http_proxy` is used when `proxy = env`. This inconsistency can mislead users about which env var is supported.</violation>

<violation number="2" location="src/claim/README.md:248">
P2: The list of supported proxy types now includes HTTPS proxies, but earlier documentation in this file says secure proxy connections are not supported. This is contradictory and can mislead users into configuring an unsupported proxy type.</violation>
</file>

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="netdata_tester/reporters.py">

<violation number="1" location="netdata_tester/reporters.py:94">
P1: JSONFormatter.format returns a dict, but report outputs are written as strings. When `json` is selected, `write(report)` will raise a TypeError. Serialize the dict to JSON before returning.</violation>

<violation number="2" location="netdata_tester/reporters.py:173">
P2: JUnit XML currently adds a `<failure>` element for skipped and error statuses. That makes skipped tests look like failures and loses error semantics. Only FAIL should add `<failure>`, and ERROR should use `<error>`.</violation>

<violation number="3" location="netdata_tester/reporters.py:254">
P2: export_to_file can crash on unknown formats because `FORMATTERS.get(...)` has no default before calling `()`. Provide a fallback formatter to avoid a TypeError.</violation>
</file>

<file name="netdata_tester/source_verifier.py">

<violation number="1" location="netdata_tester/source_verifier.py:143">
P2: The `=` guard makes the Go config option matcher impossible to satisfy, so config options in Go files won’t be indexed. Drop the `=` check so colon-based struct literals are captured.</violation>
</file>

<file name="netdata_tester/managers.py">

<violation number="1" location="netdata_tester/managers.py:204">
P1: Shell command construction interpolates unsanitized key/value into a single-quoted echo and leaves file_path unquoted, allowing command injection or broken writes when values contain quotes/whitespace. Use proper shell escaping (e.g., shlex.quote) or upload the content via a safe channel (scp/sftp).</violation>

<violation number="2" location="netdata_tester/managers.py:424">
P2: Here-doc writes raw content into the SSH command; if the content contains a line equal to `EOF` the write truncates. Use a safer transfer (e.g., base64 encode/decode or SCP/SFTP) instead of embedding raw content in the command.</violation>
</file>

<file name="netdata_tester/github.py">

<violation number="1" location="netdata_tester/github.py:58">
P0: **Security: SSL certificate verification is completely disabled.** This makes all GitHub API requests (which include the Bearer token in the `Authorization` header) vulnerable to man-in-the-middle attacks. An attacker on the network could intercept the GitHub token or tamper with API responses.

Remove the custom SSL context entirely — `urllib.request.urlopen` uses secure defaults. If you need to handle corporate proxy/CA issues, load the appropriate CA bundle instead of disabling verification.</violation>

<violation number="2" location="netdata_tester/github.py:182">
P2: Mutable default argument `[".md", ".mdx"]` is shared across all calls. If the list is ever mutated, subsequent calls will see the modified value. Use `None` and assign inside the function body.</violation>

<violation number="3" location="netdata_tester/github.py:241">
P2: The `break` on `line.startswith("---")` will prematurely stop processing the patch when encountering a deleted line whose content starts with `--` (e.g., a markdown frontmatter `---` delimiter appears as `----` in the diff, and `"----".startswith("---")` is `True`). This truncates the extracted content. Remove this break or use a more precise condition.</violation>

<violation number="4" location="netdata_tester/github.py:279">
P2: `self.client` is reassigned here, permanently changing the instance's GitHub client configuration. After calling `compare_docs_with_source(remote_owner='other')`, subsequent calls like `fetch_pr_documentation()` will unexpectedly target the wrong repository. Use a local variable instead.</violation>
</file>

<file name="netdata_tester/parser.py">

<violation number="1" location="netdata_tester/parser.py:181">
P2: Code-block claims drop the originating file path (`file_path=""`), so downstream consumers cannot trace which document the claim came from. Consider threading the source name into code block extraction and setting file_path accordingly.</violation>

<violation number="2" location="netdata_tester/parser.py:309">
P2: The file-path regex misses the standard "~/.netdata" path because it looks for "~.netdata" (no slash). This prevents path extraction from claims that use the documented format.</violation>
</file>

<file name="netdata_tester/executors.py">

<violation number="1" location="netdata_tester/executors.py:133">
P1: execute_claim returns None for SKIP claims, so callers expecting a TestResult may crash when they access result.status. Return the populated TestResult instead.</violation>

<violation number="2" location="netdata_tester/executors.py:206">
P2: Unreachable return references undefined `results` in _health_degraded. Remove the stray return to avoid dead code and future NameError risks.</violation>
</file>

<file name="netdata_tester/cli.py">

<violation number="1" location="netdata_tester/cli.py:134">
P3: `--parallel` is defined but never used, so it has no effect. Either wire it into the executor’s concurrency handling or remove the option to avoid a misleading CLI flag.</violation>

<violation number="2" location="netdata_tester/cli.py:143">
P2: The --auto-recovery option is documented as enabled by default, but `action="store_true"` makes the default False, disabling crash recovery unless the flag is provided. Align the flag behavior with the documented default (e.g., use a `--no-auto-recovery` flag with `store_false` and default True, or fix the help text).</violation>
</file>

<file name="netdata_tester/utils.py">

<violation number="1" location="netdata_tester/utils.py:36">
P2: Avoid hardcoded default credentials in VMConfig. Defaulting to a real password can leak secrets and encourages running tests with an embedded password. Load from environment/config and require explicit user input instead.</violation>

<violation number="2" location="netdata_tester/utils.py:169">
P1: TLS verification is disabled for all HTTPS requests. This makes test traffic vulnerable to MITM and can hide certificate issues. Keep default verification unless explicitly running in an insecure mode.</violation>
</file>