{
  "executive_summary": {
    "badge": "Unsafe",
    "security_score": null,
    "view": "composite",
    "aggregate_verdict_withheld": false,
    "aggregate_verdict_withheld_reason": null,
    "scanner_badges": {
      "agentshield": "not_applicable",
      "cisco-skill-scanner": "Caution",
      "agent-audit-kit": "Unsafe",
      "bearer": "Unsafe",
      "nerlo-behavioral": "Verified",
      "nerlo-install-instruction": "Verified",
      "capslock": "not_applicable"
    },
    "finding_counts": {
      "critical": 29,
      "high": 21,
      "medium": 7,
      "low": 5,
      "informational": 4
    },
    "recommendation": "1c-conf-doc is NOT recommended for integration: the scan surfaced 29 critical and 21 high-severity findings. Treat the Per-Scanner Detail section as a remediation worklist and re-scan before reconsidering."
  },
  "source_provenance": {
    "repository_url": "https://github.com/gybson63/1c-conf-doc",
    "commit_sha_scanned": null,
    "license": null,
    "maintainer": null,
    "name": "1c-conf-doc",
    "version": "0.6.0"
  },
  "per_scanner_detail": [
    {
      "scanner_name": "agentshield",
      "scanner_version": "1.4.0",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 0.1841654679737985,
      "status": "not_applicable",
      "examined": {
        "unit": "scan_targets",
        "count": 0
      },
      "metadata": {
        "source": "npm",
        "source_url": "https://www.npmjs.com/package/ecc-agentshield",
        "install_command": "npm install -g ecc-agentshield@1.4.0",
        "scans_performed": []
      },
      "display_score": null,
      "display_badge": "not_applicable"
    },
    {
      "scanner_name": "cisco-skill-scanner",
      "scanner_version": "2.0.11",
      "score": 68.0,
      "scanner_badge": "Caution",
      "findings": [
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/skills/conf-doc-search/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "policy_violation",
          "file_path": "/repo/.",
          "line_number": null,
          "rule_identifier": "EXCESSIVE_FILE_COUNT",
          "title": "Skill package contains many files",
          "description": "Skill package contains 123 files. Large file counts increase attack surface and may indicate bundled dependencies or unnecessary content.",
          "remediation": "Review file inventory and remove unnecessary files."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "obfuscation",
          "file_path": "/repo/.pre-commit-config.yaml",
          "line_number": null,
          "rule_identifier": "HIDDEN_DATA_FILE",
          "title": "Hidden data file detected",
          "description": "Hidden file found: .pre-commit-config.yaml. Hidden files may contain concealed configuration or data that should be reviewed.",
          "remediation": "Move file to a visible location or document its purpose."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "unauthorized_tool_use",
          "file_path": "/repo/repo/AGENTS.md",
          "line_number": null,
          "rule_identifier": "TOOL_ABUSE_UNDECLARED_NETWORK",
          "title": "Undeclared network usage",
          "description": "Skill code uses network libraries but doesn't declare network requirement",
          "remediation": "Declare network usage in compatibility field or remove network calls"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "data_exfiltration",
          "file_path": "/repo/scripts/test_search_roles.py",
          "line_number": 15,
          "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
          "title": "Outbound network request primitives that can transmit data externally",
          "description": "Pattern detected: urllib.request.Request(",
          "remediation": "Ensure network operations are necessary and document allowed destinations"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "data_exfiltration",
          "file_path": "/repo/scripts/test_search_roles.py",
          "line_number": 20,
          "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
          "title": "Outbound network request primitives that can transmit data externally",
          "description": "Pattern detected: urllib.request.urlopen(",
          "remediation": "Ensure network operations are necessary and document allowed destinations"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "data_exfiltration",
          "file_path": "/repo/src/onec_conf_doc/web/static/app.js",
          "line_number": 53,
          "rule_identifier": "DATA_EXFIL_JS_NETWORK",
          "title": "Outbound network request primitives in JavaScript/TypeScript",
          "description": "Pattern detected: fetch(",
          "remediation": "Ensure network operations are necessary and document allowed destinations"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/skills/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/skills/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/docs/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/docs/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        }
      ],
      "execution_duration_seconds": 9.524059329007287,
      "status": "complete",
      "examined": {
        "unit": "skills",
        "count": 4
      },
      "metadata": {
        "source": "pypi",
        "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/",
        "report_type": "cisco-skill-sast",
        "analyzers_used": [
          "bytecode",
          "pipeline",
          "static_analyzer"
        ],
        "skills_scanned": [
          "conf-doc-search",
          "repo",
          "skills",
          "docs"
        ],
        "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt",
        "severity_counts": {
          "low": 5,
          "high": 0,
          "medium": 4,
          "critical": 0,
          "informational": 4
        },
        "artifact_type_policy": "cursor_rule"
      },
      "display_score": 68.0,
      "display_badge": "Caution"
    },
    {
      "scanner_name": "agent-audit-kit",
      "scanner_version": "0.3.26",
      "score": 0.0,
      "scanner_badge": "Unsafe",
      "findings": [
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "mcp-config",
          "file_path": ".cursor/mcp.json",
          "line_number": 4,
          "rule_identifier": "AAK-MCP-002",
          "title": "MCP server command runs with shell expansion",
          "description": "An MCP server command contains shell metacharacters or shell wrappers (sh -c, bash -c). This enables command injection via argument composition.",
          "remediation": "Use direct executable paths without shell wrappers."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "mcp-config",
          "file_path": ".cursor/mcp.json",
          "line_number": 4,
          "rule_identifier": "AAK-MCP-006",
          "title": "MCP server command uses relative path",
          "description": "The command uses a relative path that can be hijacked via PATH manipulation.",
          "remediation": "Use absolute paths for MCP server executables."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "supply-chain",
          "file_path": "pyproject.toml",
          "line_number": null,
          "rule_identifier": "AAK-SUPPLY-004",
          "title": "No lockfile present",
          "description": "A package manifest exists but no lockfile was found. Without lockfiles, dependency versions float and can be silently updated.",
          "remediation": "Generate and commit lockfile."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "AGENTS.md",
          "line_number": 7,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "AGENTS.md",
          "line_number": 7,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "AGENTS.md",
          "line_number": 11,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "AGENTS.md",
          "line_number": 11,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "AGENTS.md",
          "line_number": 13,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "AGENTS.md",
          "line_number": 17,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "AGENTS.md",
          "line_number": 19,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "AGENTS.md",
          "line_number": 19,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "AGENTS.md",
          "line_number": 20,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "AGENTS.md",
          "line_number": 20,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "AGENTS.md",
          "line_number": 21,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "AGENTS.md",
          "line_number": 21,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "AGENTS.md",
          "line_number": 23,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "AGENTS.md",
          "line_number": 25,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "AGENTS.md",
          "line_number": 29,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "AGENTS.md",
          "line_number": 33,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "AGENTS.md",
          "line_number": 33,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "AGENTS.md",
          "line_number": 33,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "AGENTS.md",
          "line_number": 37,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "AGENTS.md",
          "line_number": 7,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "AGENTS.md",
          "line_number": 39,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "AGENTS.md",
          "line_number": 7,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "AGENTS.md",
          "line_number": 7,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "AGENTS.md",
          "line_number": 41,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "AGENTS.md",
          "line_number": 41,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "high",
          "category": "agent-config",
          "file_path": "AGENTS.md",
          "line_number": 39,
          "rule_identifier": "AAK-AGENT-002",
          "title": "Agent instructions reference external URLs",
          "description": "Agent instruction files reference external URLs that could serve as C2 channels or data exfiltration endpoints.",
          "remediation": "Remove external URL references from agent instructions."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "high",
          "category": "supply-chain",
          "file_path": "pyproject.toml",
          "line_number": 30,
          "rule_identifier": "AAK-DNS-REBIND-002",
          "title": "Vulnerable MCP SDK version pinned (DNS-rebinding fix missing)",
          "description": "A project dependency manifest (requirements.txt, pyproject.toml, package.json, pom.xml, build.gradle) pins an MCP SDK at a version below the DNS-rebinding fix. Patched versions: Python `mcp` >= 1.23.0, TS `@modelcontextprotocol/sdk` >= 1.21.1, Java `io.modelcontextprotocol.sdk:mcp-core` >= 0.11.0, `@apollo/mcp-server` >= 1.7.0. Even if the project never serves over StreamableHTTP itself, transitive servers built on the SDK inherit the bug.",
          "remediation": "Bump the SDK to the patched version listed in the rule title. If a bump is not yet possible, ensure every transport surface has its own Host-header allow-list (see AAK-DNS-REBIND-001 remediation)."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "supply-chain",
          "file_path": ".github/workflows/release.yml",
          "line_number": 29,
          "rule_identifier": "AAK-GHA-IMMUTABLE-001",
          "title": "Third-party GitHub Action not pinned by full commit SHA",
          "description": "A workflow in `.github/workflows/` uses a third-party Action (`owner/action@ref`) where `ref` is a tag or branch name instead of a 40-character commit SHA. A repo-takeover of the Action's publisher can re-point the tag to a malicious revision \u2014 the downstream repo consuming it will happily run the new code with `GITHUB_TOKEN` and write permissions. GitHub's April 2026 Security Roadmap ships Immutable Actions and makes SHA pinning the default policy.",
          "remediation": "Repin third-party Actions to a 40-character commit SHA and add a `# v1.2.3`-style trailing comment for humans. First-party Actions under `actions/` and `github/` are exempt (they now ship Immutable Actions). Dependabot will auto-bump SHA pins when `update-type: all` is set."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "supply-chain",
          "file_path": "scripts/mcp_smoke_test.py",
          "line_number": 25,
          "rule_identifier": "AAK-MCP-STDIO-CMD-INJ-001",
          "title": "MCP StdioServerParameters built from network-controlled input (Python)",
          "description": "A Python function calls `StdioServerParameters(command=..., args=...)` from `mcp.client.stdio` / `modelcontextprotocol.client` while also reading from a network-controlled source (request body, fetched JSON, environment variable wired to a webhook, untrusted YAML). The OX MCP April-2026 architectural class makes this exploitable: the SDK executes whatever ends up in `command`/`args` verbatim. See AAK-STDIO-001 for the broader sink-pattern detector; this rule is the SDK-named-API config-side coun",
          "remediation": "Never build `StdioServerParameters.command` / `.args` from a network-controlled value. Pin `command` to a constant binary path and validate `args` against an allow-list. If a tenant must pick the server, look the choice up in a server-side allow-list keyed by tenant identity, not by a free-form string in the request."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "supply-chain",
          "file_path": "scripts/mcp_demo.py",
          "line_number": 25,
          "rule_identifier": "AAK-MCP-STDIO-CMD-INJ-001",
          "title": "MCP StdioServerParameters built from network-controlled input (Python)",
          "description": "A Python function calls `StdioServerParameters(command=..., args=...)` from `mcp.client.stdio` / `modelcontextprotocol.client` while also reading from a network-controlled source (request body, fetched JSON, environment variable wired to a webhook, untrusted YAML). The OX MCP April-2026 architectural class makes this exploitable: the SDK executes whatever ends up in `command`/`args` verbatim. See AAK-STDIO-001 for the broader sink-pattern detector; this rule is the SDK-named-API config-side coun",
          "remediation": "Never build `StdioServerParameters.command` / `.args` from a network-controlled value. Pin `command` to a constant binary path and validate `args` against an allow-list. If a tenant must pick the server, look the choice up in a server-side allow-list keyed by tenant identity, not by a free-form string in the request."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "high",
          "category": "taint-analysis",
          "file_path": "src/onec_conf_doc/storage/sqlite.py",
          "line_number": 607,
          "rule_identifier": "AAK-IPI-WILD-CORPUS-001",
          "title": "Indirect-prompt-injection wild payload checked into repo",
          "description": "A source / config file (`.md`, `.txt`, `.yml`, `.yaml`, `.json`, `.py`) embeds a known wild IPI payload from the 2026-04-24 Help Net Security + Infosec Magazine catalogue. Common shapes: ignore-prior + exfil, system-role override, reveal-system-prompt, credential exfil via cURL, tool-call rerouting, delete-repository, admin role escalation, obfuscated prompt break, image-attached IPI, RAG-poisoned document. Refresh the corpus with `aak corpus update --ipi`.",
          "remediation": "Remove the payload from the file. If the file is intentionally an attack-corpus fixture, exclude it via `--ignore-paths`. The real risk is checked-in poisoned templates / system-prompt files / RAG seed corpora \u2014 those need to be sanitized at ingestion time, not at scan time."
        }
      ],
      "execution_duration_seconds": 3.710979857016355,
      "status": "complete",
      "examined": {
        "unit": "files",
        "count": 111
      },
      "metadata": {
        "source": "pypi",
        "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/",
        "report_type": "agent-audit-kit-sast",
        "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt",
        "rules_evaluated": 211,
        "severity_counts": {
          "low": 0,
          "high": 3,
          "medium": 3,
          "critical": 28,
          "informational": 0
        }
      },
      "display_score": 0.0,
      "display_badge": "Unsafe"
    },
    {
      "scanner_name": "bearer",
      "scanner_version": "2.0.2",
      "score": 0.0,
      "scanner_badge": "Unsafe",
      "findings": [
        {
          "tool_name": "bearer",
          "severity": "critical",
          "category": null,
          "file_path": "/repo/src/onec_conf_doc/export_slot.py",
          "line_number": 144,
          "rule_identifier": null,
          "title": "Unsanitized user input in OS command",
          "description": "## Description\n\nDirectly incorporating external or user-defined input into an OS command exposes the system to possible command injection attacks. This vulnerability allows attackers to execute unauthorized commands on the operating system, potentially leading to a compromise of system integrity.\n\n## Remediations\n\n- **Do not** use OS commands that include dynamic input directly. Instead, explore safer alternatives such as libraries or built-in functions that achieve the same goal without executi",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "high",
          "category": null,
          "file_path": "/repo/src/onec_conf_doc/web/static/app.js",
          "line_number": 211,
          "rule_identifier": null,
          "title": "Unsanitized user input in dynamic HTML insertion (XSS)",
          "description": "## Description\n\nUnsanitized user input in dynamic HTML insertion can lead to Cross-Site Scripting (XSS) attacks. This vulnerability arises when user-provided data is directly inserted into the DOM without proper sanitization, potentially allowing attackers to execute malicious scripts.\n\n## Remediations\n\n- **Do** use an HTML sanitization library to clean user input before inserting it into the HTML. This step helps prevent XSS attacks by removing or neutralizing any potentially harmful scripts.\n ",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "high",
          "category": null,
          "file_path": "/repo/src/onec_conf_doc/web/static/app.js",
          "line_number": 250,
          "rule_identifier": null,
          "title": "Unsanitized user input in dynamic HTML insertion (XSS)",
          "description": "## Description\n\nUnsanitized user input in dynamic HTML insertion can lead to Cross-Site Scripting (XSS) attacks. This vulnerability arises when user-provided data is directly inserted into the DOM without proper sanitization, potentially allowing attackers to execute malicious scripts.\n\n## Remediations\n\n- **Do** use an HTML sanitization library to clean user input before inserting it into the HTML. This step helps prevent XSS attacks by removing or neutralizing any potentially harmful scripts.\n ",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "high",
          "category": null,
          "file_path": "/repo/src/onec_conf_doc/web/static/app.js",
          "line_number": 319,
          "rule_identifier": null,
          "title": "Unsanitized user input in dynamic HTML insertion (XSS)",
          "description": "## Description\n\nUnsanitized user input in dynamic HTML insertion can lead to Cross-Site Scripting (XSS) attacks. This vulnerability arises when user-provided data is directly inserted into the DOM without proper sanitization, potentially allowing attackers to execute malicious scripts.\n\n## Remediations\n\n- **Do** use an HTML sanitization library to clean user input before inserting it into the HTML. This step helps prevent XSS attacks by removing or neutralizing any potentially harmful scripts.\n ",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "high",
          "category": null,
          "file_path": "/repo/src/onec_conf_doc/web/static/app.js",
          "line_number": 328,
          "rule_identifier": null,
          "title": "Unsanitized user input in dynamic HTML insertion (XSS)",
          "description": "## Description\n\nUnsanitized user input in dynamic HTML insertion can lead to Cross-Site Scripting (XSS) attacks. This vulnerability arises when user-provided data is directly inserted into the DOM without proper sanitization, potentially allowing attackers to execute malicious scripts.\n\n## Remediations\n\n- **Do** use an HTML sanitization library to clean user input before inserting it into the HTML. This step helps prevent XSS attacks by removing or neutralizing any potentially harmful scripts.\n ",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "high",
          "category": null,
          "file_path": "/repo/src/onec_conf_doc/web/static/app.js",
          "line_number": 659,
          "rule_identifier": null,
          "title": "Unsanitized user input in dynamic HTML insertion (XSS)",
          "description": "## Description\n\nUnsanitized user input in dynamic HTML insertion can lead to Cross-Site Scripting (XSS) attacks. This vulnerability arises when user-provided data is directly inserted into the DOM without proper sanitization, potentially allowing attackers to execute malicious scripts.\n\n## Remediations\n\n- **Do** use an HTML sanitization library to clean user input before inserting it into the HTML. This step helps prevent XSS attacks by removing or neutralizing any potentially harmful scripts.\n ",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "high",
          "category": null,
          "file_path": "/repo/src/onec_conf_doc/web/static/app.js",
          "line_number": 785,
          "rule_identifier": null,
          "title": "Unsanitized user input in dynamic HTML insertion (XSS)",
          "description": "## Description\n\nUnsanitized user input in dynamic HTML insertion can lead to Cross-Site Scripting (XSS) attacks. This vulnerability arises when user-provided data is directly inserted into the DOM without proper sanitization, potentially allowing attackers to execute malicious scripts.\n\n## Remediations\n\n- **Do** use an HTML sanitization library to clean user input before inserting it into the HTML. This step helps prevent XSS attacks by removing or neutralizing any potentially harmful scripts.\n ",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "high",
          "category": null,
          "file_path": "/repo/src/onec_conf_doc/web/static/app.js",
          "line_number": 916,
          "rule_identifier": null,
          "title": "Unsanitized user input in dynamic HTML insertion (XSS)",
          "description": "## Description\n\nUnsanitized user input in dynamic HTML insertion can lead to Cross-Site Scripting (XSS) attacks. This vulnerability arises when user-provided data is directly inserted into the DOM without proper sanitization, potentially allowing attackers to execute malicious scripts.\n\n## Remediations\n\n- **Do** use an HTML sanitization library to clean user input before inserting it into the HTML. This step helps prevent XSS attacks by removing or neutralizing any potentially harmful scripts.\n ",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "high",
          "category": null,
          "file_path": "/repo/src/onec_conf_doc/web/static/app.js",
          "line_number": 1520,
          "rule_identifier": null,
          "title": "Unsanitized user input in dynamic HTML insertion (XSS)",
          "description": "## Description\n\nUnsanitized user input in dynamic HTML insertion can lead to Cross-Site Scripting (XSS) attacks. This vulnerability arises when user-provided data is directly inserted into the DOM without proper sanitization, potentially allowing attackers to execute malicious scripts.\n\n## Remediations\n\n- **Do** use an HTML sanitization library to clean user input before inserting it into the HTML. This step helps prevent XSS attacks by removing or neutralizing any potentially harmful scripts.\n ",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "high",
          "category": null,
          "file_path": "/repo/src/onec_conf_doc/web/static/app.js",
          "line_number": 1626,
          "rule_identifier": null,
          "title": "Unsanitized user input in dynamic HTML insertion (XSS)",
          "description": "## Description\n\nUnsanitized user input in dynamic HTML insertion can lead to Cross-Site Scripting (XSS) attacks. This vulnerability arises when user-provided data is directly inserted into the DOM without proper sanitization, potentially allowing attackers to execute malicious scripts.\n\n## Remediations\n\n- **Do** use an HTML sanitization library to clean user input before inserting it into the HTML. This step helps prevent XSS attacks by removing or neutralizing any potentially harmful scripts.\n ",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "high",
          "category": null,
          "file_path": "/repo/src/onec_conf_doc/web/static/app.js",
          "line_number": 1664,
          "rule_identifier": null,
          "title": "Unsanitized user input in dynamic HTML insertion (XSS)",
          "description": "## Description\n\nUnsanitized user input in dynamic HTML insertion can lead to Cross-Site Scripting (XSS) attacks. This vulnerability arises when user-provided data is directly inserted into the DOM without proper sanitization, potentially allowing attackers to execute malicious scripts.\n\n## Remediations\n\n- **Do** use an HTML sanitization library to clean user input before inserting it into the HTML. This step helps prevent XSS attacks by removing or neutralizing any potentially harmful scripts.\n ",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "high",
          "category": null,
          "file_path": "/repo/src/onec_conf_doc/web/static/app.js",
          "line_number": 1689,
          "rule_identifier": null,
          "title": "Unsanitized user input in dynamic HTML insertion (XSS)",
          "description": "## Description\n\nUnsanitized user input in dynamic HTML insertion can lead to Cross-Site Scripting (XSS) attacks. This vulnerability arises when user-provided data is directly inserted into the DOM without proper sanitization, potentially allowing attackers to execute malicious scripts.\n\n## Remediations\n\n- **Do** use an HTML sanitization library to clean user input before inserting it into the HTML. This step helps prevent XSS attacks by removing or neutralizing any potentially harmful scripts.\n ",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "high",
          "category": null,
          "file_path": "/repo/src/onec_conf_doc/web/static/app.js",
          "line_number": 1749,
          "rule_identifier": null,
          "title": "Usage of manual HTML sanitization (XSS)",
          "description": "## Description\n\nManually sanitizing HTML is prone to mistakes and can lead to Cross-Site Scripting (XSS) vulnerabilities. This occurs when user input is not properly sanitized, allowing attackers to inject malicious scripts into web pages viewed by other users.\n\n## Remediations\n\n- **Do not** manually escape HTML to sanitize user input. This method is unreliable and can easily miss certain exploits.\n  ```javascript\n  const sanitizedUserInput = user.Input\n    .replaceAll('<', '&lt;')\n    .replaceA",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "high",
          "category": null,
          "file_path": "/repo/src/onec_conf_doc/export_slot.py",
          "line_number": 151,
          "rule_identifier": null,
          "title": "Unsanitized dynamic input in file path",
          "description": "## Description\n\nUsing unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.\n\n## Remediations\n\n- **Do not** directly use external input to construct file paths. This can lead to unauthorized file access.\n- **Do** use a safelist to define accessible paths or directories. Only al",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "high",
          "category": null,
          "file_path": "/repo/src/onec_conf_doc/export_slot.py",
          "line_number": 168,
          "rule_identifier": null,
          "title": "Unsanitized dynamic input in file path",
          "description": "## Description\n\nUsing unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.\n\n## Remediations\n\n- **Do not** directly use external input to construct file paths. This can lead to unauthorized file access.\n- **Do** use a safelist to define accessible paths or directories. Only al",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "high",
          "category": null,
          "file_path": "/repo/src/onec_conf_doc/export_slot.py",
          "line_number": 179,
          "rule_identifier": null,
          "title": "Unsanitized dynamic input in file path",
          "description": "## Description\n\nUsing unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.\n\n## Remediations\n\n- **Do not** directly use external input to construct file paths. This can lead to unauthorized file access.\n- **Do** use a safelist to define accessible paths or directories. Only al",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "high",
          "category": null,
          "file_path": "/repo/src/onec_conf_doc/rag/faiss_index.py",
          "line_number": 25,
          "rule_identifier": null,
          "title": "Unsanitized dynamic input in file path",
          "description": "## Description\n\nUsing unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.\n\n## Remediations\n\n- **Do not** directly use external input to construct file paths. This can lead to unauthorized file access.\n- **Do** use a safelist to define accessible paths or directories. Only al",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "high",
          "category": null,
          "file_path": "/repo/src/onec_conf_doc/rag/faiss_index.py",
          "line_number": 35,
          "rule_identifier": null,
          "title": "Unsanitized dynamic input in file path",
          "description": "## Description\n\nUsing unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.\n\n## Remediations\n\n- **Do not** directly use external input to construct file paths. This can lead to unauthorized file access.\n- **Do** use a safelist to define accessible paths or directories. Only al",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "high",
          "category": null,
          "file_path": "/repo/src/onec_conf_doc/rag/pipeline.py",
          "line_number": 773,
          "rule_identifier": null,
          "title": "Unsanitized dynamic input in file path",
          "description": "## Description\n\nUsing unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.\n\n## Remediations\n\n- **Do not** directly use external input to construct file paths. This can lead to unauthorized file access.\n- **Do** use a safelist to define accessible paths or directories. Only al",
          "remediation": null
        }
      ],
      "execution_duration_seconds": 21.92036911699688,
      "status": "complete",
      "examined": {
        "unit": "files",
        "count": 81
      },
      "metadata": {
        "source": "github-releases",
        "source_url": "https://github.com/Bearer/bearer",
        "report_type": "security",
        "rules_loaded": 554,
        "install_command": "curl -sfL https://raw.githubusercontent.com/Bearer/bearer/main/contrib/install.sh | sh -s -- -b /usr/local/bin \"v2.0.2\"",
        "severity_counts": {
          "low": 0,
          "high": 18,
          "medium": 0,
          "critical": 1,
          "informational": 0
        }
      },
      "display_score": 0.0,
      "display_badge": "Unsafe"
    },
    {
      "scanner_name": "nerlo-behavioral",
      "scanner_version": "0.1.0",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 4.427914105006494,
      "status": "complete",
      "examined": {
        "unit": "files",
        "count": 59
      },
      "metadata": {
        "source": "nerlo-original",
        "source_url": "https://github.com/nerlo-ai/nerlo",
        "report_type": "nerlo-behavioral",
        "ruleset_path": "/opt/nerlo-rules/exfiltration.yaml",
        "ruleset_paths": [
          "/opt/nerlo-rules/exfiltration.yaml",
          "/opt/nerlo-rules/clipboard_exfiltration.yaml",
          "/opt/nerlo-rules/rce_endpoint.yaml",
          "/opt/nerlo-rules/taint_egress.yaml"
        ],
        "install_command": "pip install 'semgrep==1.97.0'",
        "merged_invocation": true
      },
      "display_score": 100.0,
      "display_badge": "Verified"
    },
    {
      "scanner_name": "nerlo-install-instruction",
      "scanner_version": "0.1.0",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 4.431121122033801,
      "status": "complete",
      "examined": {
        "unit": "files",
        "count": 12
      },
      "metadata": {
        "source": "nerlo-original",
        "source_url": "https://github.com/nerlo-ai/nerlo",
        "report_type": "nerlo-install-instruction",
        "ruleset_path": "/opt/nerlo-rules/install_instructions.yaml",
        "ruleset_paths": [
          "/opt/nerlo-rules/install_instructions.yaml",
          "/opt/nerlo-rules/cursor_rules.yaml"
        ],
        "install_command": "pip install 'semgrep==1.97.0'",
        "merged_invocation": true
      },
      "display_score": 100.0,
      "display_badge": "Verified"
    },
    {
      "scanner_name": "capslock",
      "scanner_version": "v0.3.2",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 0.08583467896096408,
      "status": "not_applicable",
      "examined": {
        "unit": "packages",
        "count": 0
      },
      "metadata": {
        "source": "go-module-proxy",
        "source_url": "https://github.com/google/capslock/releases/tag/v0.3.2",
        "report_type": "go-capability",
        "vendor_mode": false,
        "install_command": "GOTOOLCHAIN=local GOFLAGS=-mod=mod GOSUMDB=sum.golang.org GOBIN=/usr/local/bin go install github.com/google/capslock/cmd/capslock@v0.3.2  # github.com/google/capslock v0.3.2 h1:0ZQa9YR8s9ewFu1g5w6Rgd/lW/4dga7qJew3K6Ql7aM=",
        "environment_note": "capslock found no .go files to analyze; reported not_applicable rather than a clean 100 \u2014 the scanner never ran, so it has no verdict to contribute",
        "go_files_present": 0,
        "artifact_type_policy": "cursor_rule",
        "expected_capabilities": null,
        "artifact_type_explicit": true
      },
      "display_score": null,
      "display_badge": "not_applicable"
    }
  ],
  "threat_model": "Threat model synthesis has not yet run for this scan. This section is generated by the registry's LLM pipeline (Req 22.3) and will appear in the next regeneration of this report.",
  "audit_chain": {
    "scan_job_id": "9763eb98-7c64-4e35-b47e-e28eb062b224",
    "scan_completed_at": "2026-08-12T13:26:25.814893+00:00",
    "scanner_versions": {
      "agentshield": "1.4.0",
      "cisco-skill-scanner": "2.0.11",
      "agent-audit-kit": "0.3.26",
      "bearer": "2.0.2",
      "nerlo-behavioral": "0.1.0",
      "nerlo-install-instruction": "0.1.0",
      "capslock": "v0.3.2"
    },
    "scanner_base_image": "us-central1-docker.pkg.dev/nerlo-vsk-prod/nerlo/scanner-base@sha256:d5aaefa8b517d1f03832091ab094e20dc73160a07ae1102af1b2e395ce6ce852",
    "ai_decision_log_ids": [
      "3e9a8388-5441-43ee-b556-b99b2f02615a"
    ],
    "self_attestation_url": "http://localhost:8000/api/v1/registry/self-attestation"
  },
  "appendix": {
    "raw_scanner_reports": [
      {
        "scanner_name": "agentshield",
        "scanner_version": "1.4.0",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 0.1841654679737985,
        "status": "not_applicable",
        "examined": {
          "unit": "scan_targets",
          "count": 0
        },
        "metadata": {
          "source": "npm",
          "source_url": "https://www.npmjs.com/package/ecc-agentshield",
          "install_command": "npm install -g ecc-agentshield@1.4.0",
          "scans_performed": []
        },
        "display_score": null,
        "display_badge": "not_applicable"
      },
      {
        "scanner_name": "cisco-skill-scanner",
        "scanner_version": "2.0.11",
        "score": 68.0,
        "scanner_badge": "Caution",
        "findings": [
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/skills/conf-doc-search/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "policy_violation",
            "file_path": "/repo/.",
            "line_number": null,
            "rule_identifier": "EXCESSIVE_FILE_COUNT",
            "title": "Skill package contains many files",
            "description": "Skill package contains 123 files. Large file counts increase attack surface and may indicate bundled dependencies or unnecessary content.",
            "remediation": "Review file inventory and remove unnecessary files."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "obfuscation",
            "file_path": "/repo/.pre-commit-config.yaml",
            "line_number": null,
            "rule_identifier": "HIDDEN_DATA_FILE",
            "title": "Hidden data file detected",
            "description": "Hidden file found: .pre-commit-config.yaml. Hidden files may contain concealed configuration or data that should be reviewed.",
            "remediation": "Move file to a visible location or document its purpose."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "unauthorized_tool_use",
            "file_path": "/repo/repo/AGENTS.md",
            "line_number": null,
            "rule_identifier": "TOOL_ABUSE_UNDECLARED_NETWORK",
            "title": "Undeclared network usage",
            "description": "Skill code uses network libraries but doesn't declare network requirement",
            "remediation": "Declare network usage in compatibility field or remove network calls"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "data_exfiltration",
            "file_path": "/repo/scripts/test_search_roles.py",
            "line_number": 15,
            "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
            "title": "Outbound network request primitives that can transmit data externally",
            "description": "Pattern detected: urllib.request.Request(",
            "remediation": "Ensure network operations are necessary and document allowed destinations"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "data_exfiltration",
            "file_path": "/repo/scripts/test_search_roles.py",
            "line_number": 20,
            "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
            "title": "Outbound network request primitives that can transmit data externally",
            "description": "Pattern detected: urllib.request.urlopen(",
            "remediation": "Ensure network operations are necessary and document allowed destinations"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "data_exfiltration",
            "file_path": "/repo/src/onec_conf_doc/web/static/app.js",
            "line_number": 53,
            "rule_identifier": "DATA_EXFIL_JS_NETWORK",
            "title": "Outbound network request primitives in JavaScript/TypeScript",
            "description": "Pattern detected: fetch(",
            "remediation": "Ensure network operations are necessary and document allowed destinations"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/skills/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/skills/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/docs/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/docs/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          }
        ],
        "execution_duration_seconds": 9.524059329007287,
        "status": "complete",
        "examined": {
          "unit": "skills",
          "count": 4
        },
        "metadata": {
          "source": "pypi",
          "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/",
          "report_type": "cisco-skill-sast",
          "analyzers_used": [
            "bytecode",
            "pipeline",
            "static_analyzer"
          ],
          "skills_scanned": [
            "conf-doc-search",
            "repo",
            "skills",
            "docs"
          ],
          "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt",
          "severity_counts": {
            "low": 5,
            "high": 0,
            "medium": 4,
            "critical": 0,
            "informational": 4
          },
          "artifact_type_policy": "cursor_rule"
        },
        "display_score": 68.0,
        "display_badge": "Caution"
      },
      {
        "scanner_name": "agent-audit-kit",
        "scanner_version": "0.3.26",
        "score": 0.0,
        "scanner_badge": "Unsafe",
        "findings": [
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "mcp-config",
            "file_path": ".cursor/mcp.json",
            "line_number": 4,
            "rule_identifier": "AAK-MCP-002",
            "title": "MCP server command runs with shell expansion",
            "description": "An MCP server command contains shell metacharacters or shell wrappers (sh -c, bash -c). This enables command injection via argument composition.",
            "remediation": "Use direct executable paths without shell wrappers."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "mcp-config",
            "file_path": ".cursor/mcp.json",
            "line_number": 4,
            "rule_identifier": "AAK-MCP-006",
            "title": "MCP server command uses relative path",
            "description": "The command uses a relative path that can be hijacked via PATH manipulation.",
            "remediation": "Use absolute paths for MCP server executables."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "supply-chain",
            "file_path": "pyproject.toml",
            "line_number": null,
            "rule_identifier": "AAK-SUPPLY-004",
            "title": "No lockfile present",
            "description": "A package manifest exists but no lockfile was found. Without lockfiles, dependency versions float and can be silently updated.",
            "remediation": "Generate and commit lockfile."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "AGENTS.md",
            "line_number": 7,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "AGENTS.md",
            "line_number": 7,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "AGENTS.md",
            "line_number": 11,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "AGENTS.md",
            "line_number": 11,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "AGENTS.md",
            "line_number": 13,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "AGENTS.md",
            "line_number": 17,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "AGENTS.md",
            "line_number": 19,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "AGENTS.md",
            "line_number": 19,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "AGENTS.md",
            "line_number": 20,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "AGENTS.md",
            "line_number": 20,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "AGENTS.md",
            "line_number": 21,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "AGENTS.md",
            "line_number": 21,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "AGENTS.md",
            "line_number": 23,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "AGENTS.md",
            "line_number": 25,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "AGENTS.md",
            "line_number": 29,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "AGENTS.md",
            "line_number": 33,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "AGENTS.md",
            "line_number": 33,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "AGENTS.md",
            "line_number": 33,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "AGENTS.md",
            "line_number": 37,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "AGENTS.md",
            "line_number": 7,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "AGENTS.md",
            "line_number": 39,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "AGENTS.md",
            "line_number": 7,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "AGENTS.md",
            "line_number": 7,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "AGENTS.md",
            "line_number": 41,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "AGENTS.md",
            "line_number": 41,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "high",
            "category": "agent-config",
            "file_path": "AGENTS.md",
            "line_number": 39,
            "rule_identifier": "AAK-AGENT-002",
            "title": "Agent instructions reference external URLs",
            "description": "Agent instruction files reference external URLs that could serve as C2 channels or data exfiltration endpoints.",
            "remediation": "Remove external URL references from agent instructions."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "high",
            "category": "supply-chain",
            "file_path": "pyproject.toml",
            "line_number": 30,
            "rule_identifier": "AAK-DNS-REBIND-002",
            "title": "Vulnerable MCP SDK version pinned (DNS-rebinding fix missing)",
            "description": "A project dependency manifest (requirements.txt, pyproject.toml, package.json, pom.xml, build.gradle) pins an MCP SDK at a version below the DNS-rebinding fix. Patched versions: Python `mcp` >= 1.23.0, TS `@modelcontextprotocol/sdk` >= 1.21.1, Java `io.modelcontextprotocol.sdk:mcp-core` >= 0.11.0, `@apollo/mcp-server` >= 1.7.0. Even if the project never serves over StreamableHTTP itself, transitive servers built on the SDK inherit the bug.",
            "remediation": "Bump the SDK to the patched version listed in the rule title. If a bump is not yet possible, ensure every transport surface has its own Host-header allow-list (see AAK-DNS-REBIND-001 remediation)."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "supply-chain",
            "file_path": ".github/workflows/release.yml",
            "line_number": 29,
            "rule_identifier": "AAK-GHA-IMMUTABLE-001",
            "title": "Third-party GitHub Action not pinned by full commit SHA",
            "description": "A workflow in `.github/workflows/` uses a third-party Action (`owner/action@ref`) where `ref` is a tag or branch name instead of a 40-character commit SHA. A repo-takeover of the Action's publisher can re-point the tag to a malicious revision \u2014 the downstream repo consuming it will happily run the new code with `GITHUB_TOKEN` and write permissions. GitHub's April 2026 Security Roadmap ships Immutable Actions and makes SHA pinning the default policy.",
            "remediation": "Repin third-party Actions to a 40-character commit SHA and add a `# v1.2.3`-style trailing comment for humans. First-party Actions under `actions/` and `github/` are exempt (they now ship Immutable Actions). Dependabot will auto-bump SHA pins when `update-type: all` is set."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "supply-chain",
            "file_path": "scripts/mcp_smoke_test.py",
            "line_number": 25,
            "rule_identifier": "AAK-MCP-STDIO-CMD-INJ-001",
            "title": "MCP StdioServerParameters built from network-controlled input (Python)",
            "description": "A Python function calls `StdioServerParameters(command=..., args=...)` from `mcp.client.stdio` / `modelcontextprotocol.client` while also reading from a network-controlled source (request body, fetched JSON, environment variable wired to a webhook, untrusted YAML). The OX MCP April-2026 architectural class makes this exploitable: the SDK executes whatever ends up in `command`/`args` verbatim. See AAK-STDIO-001 for the broader sink-pattern detector; this rule is the SDK-named-API config-side coun",
            "remediation": "Never build `StdioServerParameters.command` / `.args` from a network-controlled value. Pin `command` to a constant binary path and validate `args` against an allow-list. If a tenant must pick the server, look the choice up in a server-side allow-list keyed by tenant identity, not by a free-form string in the request."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "supply-chain",
            "file_path": "scripts/mcp_demo.py",
            "line_number": 25,
            "rule_identifier": "AAK-MCP-STDIO-CMD-INJ-001",
            "title": "MCP StdioServerParameters built from network-controlled input (Python)",
            "description": "A Python function calls `StdioServerParameters(command=..., args=...)` from `mcp.client.stdio` / `modelcontextprotocol.client` while also reading from a network-controlled source (request body, fetched JSON, environment variable wired to a webhook, untrusted YAML). The OX MCP April-2026 architectural class makes this exploitable: the SDK executes whatever ends up in `command`/`args` verbatim. See AAK-STDIO-001 for the broader sink-pattern detector; this rule is the SDK-named-API config-side coun",
            "remediation": "Never build `StdioServerParameters.command` / `.args` from a network-controlled value. Pin `command` to a constant binary path and validate `args` against an allow-list. If a tenant must pick the server, look the choice up in a server-side allow-list keyed by tenant identity, not by a free-form string in the request."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "high",
            "category": "taint-analysis",
            "file_path": "src/onec_conf_doc/storage/sqlite.py",
            "line_number": 607,
            "rule_identifier": "AAK-IPI-WILD-CORPUS-001",
            "title": "Indirect-prompt-injection wild payload checked into repo",
            "description": "A source / config file (`.md`, `.txt`, `.yml`, `.yaml`, `.json`, `.py`) embeds a known wild IPI payload from the 2026-04-24 Help Net Security + Infosec Magazine catalogue. Common shapes: ignore-prior + exfil, system-role override, reveal-system-prompt, credential exfil via cURL, tool-call rerouting, delete-repository, admin role escalation, obfuscated prompt break, image-attached IPI, RAG-poisoned document. Refresh the corpus with `aak corpus update --ipi`.",
            "remediation": "Remove the payload from the file. If the file is intentionally an attack-corpus fixture, exclude it via `--ignore-paths`. The real risk is checked-in poisoned templates / system-prompt files / RAG seed corpora \u2014 those need to be sanitized at ingestion time, not at scan time."
          }
        ],
        "execution_duration_seconds": 3.710979857016355,
        "status": "complete",
        "examined": {
          "unit": "files",
          "count": 111
        },
        "metadata": {
          "source": "pypi",
          "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/",
          "report_type": "agent-audit-kit-sast",
          "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt",
          "rules_evaluated": 211,
          "severity_counts": {
            "low": 0,
            "high": 3,
            "medium": 3,
            "critical": 28,
            "informational": 0
          }
        },
        "display_score": 0.0,
        "display_badge": "Unsafe"
      },
      {
        "scanner_name": "bearer",
        "scanner_version": "2.0.2",
        "score": 0.0,
        "scanner_badge": "Unsafe",
        "findings": [
          {
            "tool_name": "bearer",
            "severity": "critical",
            "category": null,
            "file_path": "/repo/src/onec_conf_doc/export_slot.py",
            "line_number": 144,
            "rule_identifier": null,
            "title": "Unsanitized user input in OS command",
            "description": "## Description\n\nDirectly incorporating external or user-defined input into an OS command exposes the system to possible command injection attacks. This vulnerability allows attackers to execute unauthorized commands on the operating system, potentially leading to a compromise of system integrity.\n\n## Remediations\n\n- **Do not** use OS commands that include dynamic input directly. Instead, explore safer alternatives such as libraries or built-in functions that achieve the same goal without executi",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "high",
            "category": null,
            "file_path": "/repo/src/onec_conf_doc/web/static/app.js",
            "line_number": 211,
            "rule_identifier": null,
            "title": "Unsanitized user input in dynamic HTML insertion (XSS)",
            "description": "## Description\n\nUnsanitized user input in dynamic HTML insertion can lead to Cross-Site Scripting (XSS) attacks. This vulnerability arises when user-provided data is directly inserted into the DOM without proper sanitization, potentially allowing attackers to execute malicious scripts.\n\n## Remediations\n\n- **Do** use an HTML sanitization library to clean user input before inserting it into the HTML. This step helps prevent XSS attacks by removing or neutralizing any potentially harmful scripts.\n ",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "high",
            "category": null,
            "file_path": "/repo/src/onec_conf_doc/web/static/app.js",
            "line_number": 250,
            "rule_identifier": null,
            "title": "Unsanitized user input in dynamic HTML insertion (XSS)",
            "description": "## Description\n\nUnsanitized user input in dynamic HTML insertion can lead to Cross-Site Scripting (XSS) attacks. This vulnerability arises when user-provided data is directly inserted into the DOM without proper sanitization, potentially allowing attackers to execute malicious scripts.\n\n## Remediations\n\n- **Do** use an HTML sanitization library to clean user input before inserting it into the HTML. This step helps prevent XSS attacks by removing or neutralizing any potentially harmful scripts.\n ",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "high",
            "category": null,
            "file_path": "/repo/src/onec_conf_doc/web/static/app.js",
            "line_number": 319,
            "rule_identifier": null,
            "title": "Unsanitized user input in dynamic HTML insertion (XSS)",
            "description": "## Description\n\nUnsanitized user input in dynamic HTML insertion can lead to Cross-Site Scripting (XSS) attacks. This vulnerability arises when user-provided data is directly inserted into the DOM without proper sanitization, potentially allowing attackers to execute malicious scripts.\n\n## Remediations\n\n- **Do** use an HTML sanitization library to clean user input before inserting it into the HTML. This step helps prevent XSS attacks by removing or neutralizing any potentially harmful scripts.\n ",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "high",
            "category": null,
            "file_path": "/repo/src/onec_conf_doc/web/static/app.js",
            "line_number": 328,
            "rule_identifier": null,
            "title": "Unsanitized user input in dynamic HTML insertion (XSS)",
            "description": "## Description\n\nUnsanitized user input in dynamic HTML insertion can lead to Cross-Site Scripting (XSS) attacks. This vulnerability arises when user-provided data is directly inserted into the DOM without proper sanitization, potentially allowing attackers to execute malicious scripts.\n\n## Remediations\n\n- **Do** use an HTML sanitization library to clean user input before inserting it into the HTML. This step helps prevent XSS attacks by removing or neutralizing any potentially harmful scripts.\n ",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "high",
            "category": null,
            "file_path": "/repo/src/onec_conf_doc/web/static/app.js",
            "line_number": 659,
            "rule_identifier": null,
            "title": "Unsanitized user input in dynamic HTML insertion (XSS)",
            "description": "## Description\n\nUnsanitized user input in dynamic HTML insertion can lead to Cross-Site Scripting (XSS) attacks. This vulnerability arises when user-provided data is directly inserted into the DOM without proper sanitization, potentially allowing attackers to execute malicious scripts.\n\n## Remediations\n\n- **Do** use an HTML sanitization library to clean user input before inserting it into the HTML. This step helps prevent XSS attacks by removing or neutralizing any potentially harmful scripts.\n ",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "high",
            "category": null,
            "file_path": "/repo/src/onec_conf_doc/web/static/app.js",
            "line_number": 785,
            "rule_identifier": null,
            "title": "Unsanitized user input in dynamic HTML insertion (XSS)",
            "description": "## Description\n\nUnsanitized user input in dynamic HTML insertion can lead to Cross-Site Scripting (XSS) attacks. This vulnerability arises when user-provided data is directly inserted into the DOM without proper sanitization, potentially allowing attackers to execute malicious scripts.\n\n## Remediations\n\n- **Do** use an HTML sanitization library to clean user input before inserting it into the HTML. This step helps prevent XSS attacks by removing or neutralizing any potentially harmful scripts.\n ",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "high",
            "category": null,
            "file_path": "/repo/src/onec_conf_doc/web/static/app.js",
            "line_number": 916,
            "rule_identifier": null,
            "title": "Unsanitized user input in dynamic HTML insertion (XSS)",
            "description": "## Description\n\nUnsanitized user input in dynamic HTML insertion can lead to Cross-Site Scripting (XSS) attacks. This vulnerability arises when user-provided data is directly inserted into the DOM without proper sanitization, potentially allowing attackers to execute malicious scripts.\n\n## Remediations\n\n- **Do** use an HTML sanitization library to clean user input before inserting it into the HTML. This step helps prevent XSS attacks by removing or neutralizing any potentially harmful scripts.\n ",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "high",
            "category": null,
            "file_path": "/repo/src/onec_conf_doc/web/static/app.js",
            "line_number": 1520,
            "rule_identifier": null,
            "title": "Unsanitized user input in dynamic HTML insertion (XSS)",
            "description": "## Description\n\nUnsanitized user input in dynamic HTML insertion can lead to Cross-Site Scripting (XSS) attacks. This vulnerability arises when user-provided data is directly inserted into the DOM without proper sanitization, potentially allowing attackers to execute malicious scripts.\n\n## Remediations\n\n- **Do** use an HTML sanitization library to clean user input before inserting it into the HTML. This step helps prevent XSS attacks by removing or neutralizing any potentially harmful scripts.\n ",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "high",
            "category": null,
            "file_path": "/repo/src/onec_conf_doc/web/static/app.js",
            "line_number": 1626,
            "rule_identifier": null,
            "title": "Unsanitized user input in dynamic HTML insertion (XSS)",
            "description": "## Description\n\nUnsanitized user input in dynamic HTML insertion can lead to Cross-Site Scripting (XSS) attacks. This vulnerability arises when user-provided data is directly inserted into the DOM without proper sanitization, potentially allowing attackers to execute malicious scripts.\n\n## Remediations\n\n- **Do** use an HTML sanitization library to clean user input before inserting it into the HTML. This step helps prevent XSS attacks by removing or neutralizing any potentially harmful scripts.\n ",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "high",
            "category": null,
            "file_path": "/repo/src/onec_conf_doc/web/static/app.js",
            "line_number": 1664,
            "rule_identifier": null,
            "title": "Unsanitized user input in dynamic HTML insertion (XSS)",
            "description": "## Description\n\nUnsanitized user input in dynamic HTML insertion can lead to Cross-Site Scripting (XSS) attacks. This vulnerability arises when user-provided data is directly inserted into the DOM without proper sanitization, potentially allowing attackers to execute malicious scripts.\n\n## Remediations\n\n- **Do** use an HTML sanitization library to clean user input before inserting it into the HTML. This step helps prevent XSS attacks by removing or neutralizing any potentially harmful scripts.\n ",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "high",
            "category": null,
            "file_path": "/repo/src/onec_conf_doc/web/static/app.js",
            "line_number": 1689,
            "rule_identifier": null,
            "title": "Unsanitized user input in dynamic HTML insertion (XSS)",
            "description": "## Description\n\nUnsanitized user input in dynamic HTML insertion can lead to Cross-Site Scripting (XSS) attacks. This vulnerability arises when user-provided data is directly inserted into the DOM without proper sanitization, potentially allowing attackers to execute malicious scripts.\n\n## Remediations\n\n- **Do** use an HTML sanitization library to clean user input before inserting it into the HTML. This step helps prevent XSS attacks by removing or neutralizing any potentially harmful scripts.\n ",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "high",
            "category": null,
            "file_path": "/repo/src/onec_conf_doc/web/static/app.js",
            "line_number": 1749,
            "rule_identifier": null,
            "title": "Usage of manual HTML sanitization (XSS)",
            "description": "## Description\n\nManually sanitizing HTML is prone to mistakes and can lead to Cross-Site Scripting (XSS) vulnerabilities. This occurs when user input is not properly sanitized, allowing attackers to inject malicious scripts into web pages viewed by other users.\n\n## Remediations\n\n- **Do not** manually escape HTML to sanitize user input. This method is unreliable and can easily miss certain exploits.\n  ```javascript\n  const sanitizedUserInput = user.Input\n    .replaceAll('<', '&lt;')\n    .replaceA",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "high",
            "category": null,
            "file_path": "/repo/src/onec_conf_doc/export_slot.py",
            "line_number": 151,
            "rule_identifier": null,
            "title": "Unsanitized dynamic input in file path",
            "description": "## Description\n\nUsing unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.\n\n## Remediations\n\n- **Do not** directly use external input to construct file paths. This can lead to unauthorized file access.\n- **Do** use a safelist to define accessible paths or directories. Only al",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "high",
            "category": null,
            "file_path": "/repo/src/onec_conf_doc/export_slot.py",
            "line_number": 168,
            "rule_identifier": null,
            "title": "Unsanitized dynamic input in file path",
            "description": "## Description\n\nUsing unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.\n\n## Remediations\n\n- **Do not** directly use external input to construct file paths. This can lead to unauthorized file access.\n- **Do** use a safelist to define accessible paths or directories. Only al",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "high",
            "category": null,
            "file_path": "/repo/src/onec_conf_doc/export_slot.py",
            "line_number": 179,
            "rule_identifier": null,
            "title": "Unsanitized dynamic input in file path",
            "description": "## Description\n\nUsing unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.\n\n## Remediations\n\n- **Do not** directly use external input to construct file paths. This can lead to unauthorized file access.\n- **Do** use a safelist to define accessible paths or directories. Only al",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "high",
            "category": null,
            "file_path": "/repo/src/onec_conf_doc/rag/faiss_index.py",
            "line_number": 25,
            "rule_identifier": null,
            "title": "Unsanitized dynamic input in file path",
            "description": "## Description\n\nUsing unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.\n\n## Remediations\n\n- **Do not** directly use external input to construct file paths. This can lead to unauthorized file access.\n- **Do** use a safelist to define accessible paths or directories. Only al",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "high",
            "category": null,
            "file_path": "/repo/src/onec_conf_doc/rag/faiss_index.py",
            "line_number": 35,
            "rule_identifier": null,
            "title": "Unsanitized dynamic input in file path",
            "description": "## Description\n\nUsing unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.\n\n## Remediations\n\n- **Do not** directly use external input to construct file paths. This can lead to unauthorized file access.\n- **Do** use a safelist to define accessible paths or directories. Only al",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "high",
            "category": null,
            "file_path": "/repo/src/onec_conf_doc/rag/pipeline.py",
            "line_number": 773,
            "rule_identifier": null,
            "title": "Unsanitized dynamic input in file path",
            "description": "## Description\n\nUsing unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.\n\n## Remediations\n\n- **Do not** directly use external input to construct file paths. This can lead to unauthorized file access.\n- **Do** use a safelist to define accessible paths or directories. Only al",
            "remediation": null
          }
        ],
        "execution_duration_seconds": 21.92036911699688,
        "status": "complete",
        "examined": {
          "unit": "files",
          "count": 81
        },
        "metadata": {
          "source": "github-releases",
          "source_url": "https://github.com/Bearer/bearer",
          "report_type": "security",
          "rules_loaded": 554,
          "install_command": "curl -sfL https://raw.githubusercontent.com/Bearer/bearer/main/contrib/install.sh | sh -s -- -b /usr/local/bin \"v2.0.2\"",
          "severity_counts": {
            "low": 0,
            "high": 18,
            "medium": 0,
            "critical": 1,
            "informational": 0
          }
        },
        "display_score": 0.0,
        "display_badge": "Unsafe"
      },
      {
        "scanner_name": "nerlo-behavioral",
        "scanner_version": "0.1.0",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 4.427914105006494,
        "status": "complete",
        "examined": {
          "unit": "files",
          "count": 59
        },
        "metadata": {
          "source": "nerlo-original",
          "source_url": "https://github.com/nerlo-ai/nerlo",
          "report_type": "nerlo-behavioral",
          "ruleset_path": "/opt/nerlo-rules/exfiltration.yaml",
          "ruleset_paths": [
            "/opt/nerlo-rules/exfiltration.yaml",
            "/opt/nerlo-rules/clipboard_exfiltration.yaml",
            "/opt/nerlo-rules/rce_endpoint.yaml",
            "/opt/nerlo-rules/taint_egress.yaml"
          ],
          "install_command": "pip install 'semgrep==1.97.0'",
          "merged_invocation": true
        },
        "display_score": 100.0,
        "display_badge": "Verified"
      },
      {
        "scanner_name": "nerlo-install-instruction",
        "scanner_version": "0.1.0",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 4.431121122033801,
        "status": "complete",
        "examined": {
          "unit": "files",
          "count": 12
        },
        "metadata": {
          "source": "nerlo-original",
          "source_url": "https://github.com/nerlo-ai/nerlo",
          "report_type": "nerlo-install-instruction",
          "ruleset_path": "/opt/nerlo-rules/install_instructions.yaml",
          "ruleset_paths": [
            "/opt/nerlo-rules/install_instructions.yaml",
            "/opt/nerlo-rules/cursor_rules.yaml"
          ],
          "install_command": "pip install 'semgrep==1.97.0'",
          "merged_invocation": true
        },
        "display_score": 100.0,
        "display_badge": "Verified"
      },
      {
        "scanner_name": "capslock",
        "scanner_version": "v0.3.2",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 0.08583467896096408,
        "status": "not_applicable",
        "examined": {
          "unit": "packages",
          "count": 0
        },
        "metadata": {
          "source": "go-module-proxy",
          "source_url": "https://github.com/google/capslock/releases/tag/v0.3.2",
          "report_type": "go-capability",
          "vendor_mode": false,
          "install_command": "GOTOOLCHAIN=local GOFLAGS=-mod=mod GOSUMDB=sum.golang.org GOBIN=/usr/local/bin go install github.com/google/capslock/cmd/capslock@v0.3.2  # github.com/google/capslock v0.3.2 h1:0ZQa9YR8s9ewFu1g5w6Rgd/lW/4dga7qJew3K6Ql7aM=",
          "environment_note": "capslock found no .go files to analyze; reported not_applicable rather than a clean 100 \u2014 the scanner never ran, so it has no verdict to contribute",
          "go_files_present": 0,
          "artifact_type_policy": "cursor_rule",
          "expected_capabilities": null,
          "artifact_type_explicit": true
        },
        "display_score": null,
        "display_badge": "not_applicable"
      }
    ]
  },
  "report": {
    "report_id": "9de23bea-4e28-49c0-824b-4cceab20edc8",
    "format": "json",
    "generated_at": "2026-08-12T17:12:26.744414+00:00",
    "scanner_filter": null,
    "signature": null
  }
}