{
  "executive_summary": {
    "badge": "Unsafe",
    "security_score": 89.33,
    "view": "composite",
    "aggregate_verdict_withheld": false,
    "aggregate_verdict_withheld_reason": null,
    "scanner_badges": {
      "agentshield": "not_applicable",
      "cisco-skill-scanner": "Unsafe",
      "agent-audit-kit": "Caution",
      "bearer": "not_applicable",
      "nerlo-behavioral": "not_applicable",
      "nerlo-install-instruction": "Verified",
      "capslock": "not_applicable",
      "trivy": "Verified",
      "osv-scanner": "not_applicable",
      "trivy_image": "not_applicable",
      "govulncheck": "not_applicable"
    },
    "finding_counts": {
      "critical": 0,
      "high": 1,
      "medium": 5,
      "low": 9,
      "informational": 10
    },
    "recommendation": "100rebuild is NOT recommended for integration: the scan surfaced 0 critical and 1 high-severity findings. Treat the Per-Scanner Detail section as a remediation worklist and re-scan before reconsidering."
  },
  "source_provenance": {
    "repository_url": "https://github.com/khamarithompson/100rebuild",
    "commit_sha_scanned": null,
    "license": null,
    "maintainer": null,
    "name": "100rebuild",
    "version": null
  },
  "per_scanner_detail": [
    {
      "scanner_name": "agentshield",
      "scanner_version": "1.4.0",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 0.14081126399105415,
      "status": "not_applicable",
      "examined": {
        "unit": "scan_targets",
        "count": 0
      },
      "metadata": {
        "source": "npm",
        "source_url": "https://www.npmjs.com/package/ecc-agentshield",
        "install_command": "npm install -g ecc-agentshield@1.4.0",
        "scans_performed": []
      },
      "display_score": null,
      "display_badge": "not_applicable"
    },
    {
      "scanner_name": "cisco-skill-scanner",
      "scanner_version": "2.0.11",
      "score": 52.0,
      "scanner_badge": "Unsafe",
      "findings": [
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "policy_violation",
          "file_path": "/repo/.",
          "line_number": null,
          "rule_identifier": "EXCESSIVE_FILE_COUNT",
          "title": "Skill package contains many files",
          "description": "Skill package contains 330 files. Large file counts increase attack surface and may indicate bundled dependencies or unnecessary content.",
          "remediation": "Review file inventory and remove unnecessary files."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "obfuscation",
          "file_path": "/repo/.swiftpm/xcode/package.xcworkspace/contents.xcworkspacedata",
          "line_number": null,
          "rule_identifier": "HIDDEN_DATA_FILE",
          "title": "Hidden data file detected",
          "description": "Hidden file found: .swiftpm/xcode/package.xcworkspace/contents.xcworkspacedata. Hidden files may contain concealed configuration or data that should be reviewed.",
          "remediation": "Move file to a visible location or document its purpose."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "obfuscation",
          "file_path": "/repo/100DaysRebuild/Core/UI/README.txt",
          "line_number": null,
          "rule_identifier": "FILE_MAGIC_MISMATCH",
          "title": "File extension does not match actual content type",
          "description": "File 'README.txt' extension (.txt) suggests one format but Magika detected a different text format: Markdown document (markdown). This may indicate content obfuscation or a misnamed file.",
          "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "unicode_steganography",
          "file_path": "/repo/AppIcons/Assets.xcassets/AppIcon.appiconset/1024.png",
          "line_number": 0,
          "rule_identifier": "YARA_prompt_injection_unicode_steganography",
          "title": "UNICODE STEGANOGRAPHY detected by YARA",
          "description": "Detects hidden Unicode characters used for invisible prompt injection and steganography: \u202d",
          "remediation": "Review and remove unicode steganography pattern"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "unicode_steganography",
          "file_path": "/repo/AppIcons/playstore.png",
          "line_number": 0,
          "rule_identifier": "YARA_prompt_injection_unicode_steganography",
          "title": "UNICODE STEGANOGRAPHY detected by YARA",
          "description": "Detects hidden Unicode characters used for invisible prompt injection and steganography: \u202d",
          "remediation": "Review and remove unicode steganography pattern"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "obfuscation",
          "file_path": "/repo/testimonials-temp/sarah.jpg",
          "line_number": null,
          "rule_identifier": "FILE_MAGIC_MISMATCH",
          "title": "File extension does not match actual content type",
          "description": "File 'sarah.jpg' extension (.jpg, expected image) does not match its actual content type (Generic text document, text).",
          "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/diagrams/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/diagrams/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "policy_violation",
          "file_path": "/repo/100DaysRebuild/.",
          "line_number": null,
          "rule_identifier": "EXCESSIVE_FILE_COUNT",
          "title": "Skill package contains many files",
          "description": "Skill package contains 256 files. Large file counts increase attack surface and may indicate bundled dependencies or unnecessary content.",
          "remediation": "Review file inventory and remove unnecessary files."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "obfuscation",
          "file_path": "/repo/100DaysRebuild/Core/UI/README.txt",
          "line_number": null,
          "rule_identifier": "FILE_MAGIC_MISMATCH",
          "title": "File extension does not match actual content type",
          "description": "File 'README.txt' extension (.txt) suggests one format but Magika detected a different text format: Markdown document (markdown). This may indicate content obfuscation or a misnamed file.",
          "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/100DaysRebuild/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/100DaysRebuild/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_INVALID_NAME",
          "title": "Skill name does not follow agent skills naming rules",
          "description": "Skill name '100DaysRebuild' is invalid. Agent skills require lowercase letters, numbers, and hyphens only, with a maximum length of 64 characters.",
          "remediation": "Rename the skill to match `[a-z0-9-]{1,64}` (e.g., 'pdf-processing')"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/100DaysRebuild/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/bug_fixes_summary/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/bug_fixes_summary/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_INVALID_NAME",
          "title": "Skill name does not follow agent skills naming rules",
          "description": "Skill name 'bug_fixes_summary' is invalid. Agent skills require lowercase letters, numbers, and hyphens only, with a maximum length of 64 characters.",
          "remediation": "Rename the skill to match `[a-z0-9-]{1,64}` (e.g., 'pdf-processing')"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/bug_fixes_summary/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/app_icon_assets/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/app_icon_assets/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_INVALID_NAME",
          "title": "Skill name does not follow agent skills naming rules",
          "description": "Skill name 'app_icon_assets' is invalid. Agent skills require lowercase letters, numbers, and hyphens only, with a maximum length of 64 characters.",
          "remediation": "Rename the skill to match `[a-z0-9-]{1,64}` (e.g., 'pdf-processing')"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/app_icon_assets/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/100DaysRebuild/Core/DesignSystem/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/100DaysRebuild/Core/DesignSystem/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_INVALID_NAME",
          "title": "Skill name does not follow agent skills naming rules",
          "description": "Skill name 'DesignSystem' is invalid. Agent skills require lowercase letters, numbers, and hyphens only, with a maximum length of 64 characters.",
          "remediation": "Rename the skill to match `[a-z0-9-]{1,64}` (e.g., 'pdf-processing')"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/100DaysRebuild/Core/DesignSystem/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        }
      ],
      "execution_duration_seconds": 10.466973978967872,
      "status": "complete",
      "examined": {
        "unit": "skills",
        "count": 6
      },
      "metadata": {
        "source": "pypi",
        "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/",
        "report_type": "cisco-skill-sast",
        "analyzers_used": [
          "bytecode",
          "pipeline",
          "static_analyzer"
        ],
        "skills_scanned": [
          "repo",
          "diagrams",
          "100DaysRebuild",
          "bug_fixes_summary",
          "app_icon_assets",
          "DesignSystem"
        ],
        "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt",
        "severity_counts": {
          "low": 9,
          "high": 0,
          "medium": 5,
          "critical": 0,
          "informational": 10
        },
        "artifact_type_policy": "cursor_rule"
      },
      "display_score": 52.0,
      "display_badge": "Unsafe"
    },
    {
      "scanner_name": "agent-audit-kit",
      "scanner_version": "0.3.26",
      "score": 84.0,
      "scanner_badge": "Caution",
      "findings": [
        {
          "tool_name": "agent-audit-kit",
          "severity": "high",
          "category": "secret-exposure",
          "file_path": "100DaysRebuild/Features/CheckIn/ViewModels/MilestoneCelebrationViewModel.swift",
          "line_number": 109,
          "rule_identifier": "AAK-SECRET-004",
          "title": "Generic high-entropy secret",
          "description": "A value assigned to a secret-like key has high Shannon entropy, indicating a likely credential or API key.",
          "remediation": "Move to environment variables or secrets manager."
        }
      ],
      "execution_duration_seconds": 4.246638419979718,
      "status": "complete",
      "examined": {
        "unit": "files",
        "count": 232
      },
      "metadata": {
        "source": "pypi",
        "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/",
        "report_type": "agent-audit-kit-sast",
        "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt",
        "rules_evaluated": 211,
        "severity_counts": {
          "low": 0,
          "high": 1,
          "medium": 0,
          "critical": 0,
          "informational": 0
        }
      },
      "display_score": 84.0,
      "display_badge": "Caution"
    },
    {
      "scanner_name": "bearer",
      "scanner_version": "2.0.2",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 0.09608848101925105,
      "status": "not_applicable",
      "examined": {
        "unit": "files",
        "count": 0
      },
      "metadata": {
        "source": "github-releases",
        "source_url": "https://github.com/Bearer/bearer",
        "report_type": "security",
        "install_command": "curl -sfL https://raw.githubusercontent.com/Bearer/bearer/main/contrib/install.sh | sh -s -- -b /usr/local/bin \"v2.0.2\"",
        "environment_note": "bearer found no supported-language source files to analyze (see _SUPPORTED_SOURCE_EXTENSIONS); reported not_applicable rather than a clean 100 \u2014 the scanner never ran, so it has no verdict to contribute"
      },
      "display_score": null,
      "display_badge": "not_applicable"
    },
    {
      "scanner_name": "nerlo-behavioral",
      "scanner_version": "0.1.0",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 3.4069214499904774,
      "status": "not_applicable",
      "examined": {
        "unit": "files",
        "count": 0
      },
      "metadata": {
        "source": "nerlo-original",
        "source_url": "https://github.com/nerlo-ai/nerlo",
        "report_type": "nerlo-behavioral",
        "ruleset_path": "/opt/nerlo-rules/exfiltration.yaml",
        "ruleset_paths": [
          "/opt/nerlo-rules/exfiltration.yaml",
          "/opt/nerlo-rules/clipboard_exfiltration.yaml",
          "/opt/nerlo-rules/rce_endpoint.yaml",
          "/opt/nerlo-rules/taint_egress.yaml"
        ],
        "install_command": "pip install 'semgrep==1.97.0'",
        "merged_invocation": true
      },
      "display_score": null,
      "display_badge": "not_applicable"
    },
    {
      "scanner_name": "nerlo-install-instruction",
      "scanner_version": "0.1.0",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 3.407500140951015,
      "status": "complete",
      "examined": {
        "unit": "files",
        "count": 20
      },
      "metadata": {
        "source": "nerlo-original",
        "source_url": "https://github.com/nerlo-ai/nerlo",
        "report_type": "nerlo-install-instruction",
        "ruleset_path": "/opt/nerlo-rules/install_instructions.yaml",
        "ruleset_paths": [
          "/opt/nerlo-rules/install_instructions.yaml",
          "/opt/nerlo-rules/cursor_rules.yaml"
        ],
        "install_command": "pip install 'semgrep==1.97.0'",
        "merged_invocation": true
      },
      "display_score": 100.0,
      "display_badge": "Verified"
    },
    {
      "scanner_name": "capslock",
      "scanner_version": "v0.3.2",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 0.09021342697087675,
      "status": "not_applicable",
      "examined": {
        "unit": "packages",
        "count": 0
      },
      "metadata": {
        "source": "go-module-proxy",
        "source_url": "https://github.com/google/capslock/releases/tag/v0.3.2",
        "report_type": "go-capability",
        "vendor_mode": false,
        "install_command": "GOTOOLCHAIN=local GOFLAGS=-mod=mod GOSUMDB=sum.golang.org GOBIN=/usr/local/bin go install github.com/google/capslock/cmd/capslock@v0.3.2  # github.com/google/capslock v0.3.2 h1:0ZQa9YR8s9ewFu1g5w6Rgd/lW/4dga7qJew3K6Ql7aM=",
        "environment_note": "capslock found no .go files to analyze; reported not_applicable rather than a clean 100 \u2014 the scanner never ran, so it has no verdict to contribute",
        "go_files_present": 0,
        "artifact_type_policy": "cursor_rule",
        "expected_capabilities": null,
        "artifact_type_explicit": true
      },
      "display_score": null,
      "display_badge": "not_applicable"
    },
    {
      "scanner_name": "trivy",
      "scanner_version": "0.71.0",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 0.47921178699471056,
      "status": "complete",
      "examined": {
        "unit": "manifests",
        "count": 2
      },
      "metadata": {
        "source": "github-releases",
        "source_url": "https://github.com/aquasecurity/trivy/releases/tag/v0.71.0",
        "report_type": "filesystem-vulnerability",
        "install_command": "curl -sfL -o /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.71.0/trivy_0.71.0_Linux-64bit.deb && echo '<sha256>  /tmp/trivy.deb' | sha256sum -c - && dpkg -i /tmp/trivy.deb",
        "manifests_scanned": [
          "100DaysRebuild.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved",
          "Package.resolved"
        ]
      },
      "display_score": 100.0,
      "display_badge": "Verified"
    },
    {
      "scanner_name": "osv-scanner",
      "scanner_version": "2.3.8",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 0.20997892797458917,
      "status": "not_applicable",
      "examined": {
        "unit": "manifests",
        "count": 0
      },
      "metadata": {
        "source": "github-releases",
        "source_url": "https://github.com/google/osv-scanner/releases/tag/v2.3.8",
        "report_type": "osv-vulnerability",
        "ecosystems_seen": [],
        "install_command": "curl -sfL -o /usr/local/bin/osv-scanner https://github.com/google/osv-scanner/releases/download/v2.3.8/osv-scanner_linux_amd64 && echo '<sha256>  /usr/local/bin/osv-scanner' | sha256sum -c - && chmod +x /usr/local/bin/osv-scanner",
        "manifests_scanned": [],
        "finding_id_aliases": {},
        "cross_scanner_correlation": {
          "only_osv": [],
          "only_trivy": [],
          "intersection_ids": []
        }
      },
      "display_score": null,
      "display_badge": "not_applicable"
    },
    {
      "scanner_name": "trivy_image",
      "scanner_version": "0.71.0",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 3.0360009986907244e-05,
      "status": "not_applicable",
      "examined": {
        "unit": "image_targets",
        "count": 0
      },
      "metadata": {
        "reason": "no OCI image acquired for this artifact"
      },
      "display_score": null,
      "display_badge": "not_applicable"
    },
    {
      "scanner_name": "govulncheck",
      "scanner_version": "v1.6.0",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 0.08706452901242301,
      "status": "not_applicable",
      "examined": {
        "unit": "modules",
        "count": 0
      },
      "metadata": {
        "source": "go-module-proxy",
        "source_url": "https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck",
        "report_type": "go-reachability",
        "vendor_mode": false,
        "go_mod_present": false,
        "install_command": "GOTOOLCHAIN=local GOFLAGS=-mod=mod GOSUMDB=sum.golang.org GOBIN=/usr/local/bin go install golang.org/x/vuln/cmd/govulncheck@v1.6.0  # golang.org/x/vuln v1.6.0 h1:FeMO9Rm/HwyduOztbvKcOw+zvDEPr4I4aQNSfevFcKY=",
        "offline_db_path": "/opt/govulncheck-db",
        "environment_note": "govulncheck found no go.mod, so this tree declares no Go module and no Go dependencies; reported not_applicable rather than a clean 100 \u2014 the scanner never ran, so it has no verdict to contribute"
      },
      "display_score": null,
      "display_badge": "not_applicable"
    }
  ],
  "threat_model": "Threat model synthesis has not yet run for this scan. This section is generated by the registry's LLM pipeline (Req 22.3) and will appear in the next regeneration of this report.",
  "audit_chain": {
    "scan_job_id": "8960516a-e7d6-4a3a-b416-78a86b4b782a",
    "scan_completed_at": "2026-08-12T18:26:59.837728+00:00",
    "scanner_versions": {
      "agentshield": "1.4.0",
      "cisco-skill-scanner": "2.0.11",
      "agent-audit-kit": "0.3.26",
      "bearer": "2.0.2",
      "nerlo-behavioral": "0.1.0",
      "nerlo-install-instruction": "0.1.0",
      "capslock": "v0.3.2",
      "trivy": "0.71.0",
      "osv-scanner": "2.3.8",
      "trivy_image": "0.71.0",
      "govulncheck": "v1.6.0"
    },
    "scanner_base_image": "us-central1-docker.pkg.dev/nerlo-vsk-prod/nerlo/scanner-base@sha256:d5aaefa8b517d1f03832091ab094e20dc73160a07ae1102af1b2e395ce6ce852",
    "ai_decision_log_ids": [
      "2cdeb15c-cce6-4c7f-ab46-4dd8aefab30f",
      "ed2559f7-3782-4bd8-840a-9a61a4a6e98b"
    ],
    "self_attestation_url": "http://localhost:8000/api/v1/registry/self-attestation"
  },
  "appendix": {
    "raw_scanner_reports": [
      {
        "scanner_name": "agentshield",
        "scanner_version": "1.4.0",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 0.14081126399105415,
        "status": "not_applicable",
        "examined": {
          "unit": "scan_targets",
          "count": 0
        },
        "metadata": {
          "source": "npm",
          "source_url": "https://www.npmjs.com/package/ecc-agentshield",
          "install_command": "npm install -g ecc-agentshield@1.4.0",
          "scans_performed": []
        },
        "display_score": null,
        "display_badge": "not_applicable"
      },
      {
        "scanner_name": "cisco-skill-scanner",
        "scanner_version": "2.0.11",
        "score": 52.0,
        "scanner_badge": "Unsafe",
        "findings": [
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "policy_violation",
            "file_path": "/repo/.",
            "line_number": null,
            "rule_identifier": "EXCESSIVE_FILE_COUNT",
            "title": "Skill package contains many files",
            "description": "Skill package contains 330 files. Large file counts increase attack surface and may indicate bundled dependencies or unnecessary content.",
            "remediation": "Review file inventory and remove unnecessary files."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "obfuscation",
            "file_path": "/repo/.swiftpm/xcode/package.xcworkspace/contents.xcworkspacedata",
            "line_number": null,
            "rule_identifier": "HIDDEN_DATA_FILE",
            "title": "Hidden data file detected",
            "description": "Hidden file found: .swiftpm/xcode/package.xcworkspace/contents.xcworkspacedata. Hidden files may contain concealed configuration or data that should be reviewed.",
            "remediation": "Move file to a visible location or document its purpose."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "obfuscation",
            "file_path": "/repo/100DaysRebuild/Core/UI/README.txt",
            "line_number": null,
            "rule_identifier": "FILE_MAGIC_MISMATCH",
            "title": "File extension does not match actual content type",
            "description": "File 'README.txt' extension (.txt) suggests one format but Magika detected a different text format: Markdown document (markdown). This may indicate content obfuscation or a misnamed file.",
            "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "unicode_steganography",
            "file_path": "/repo/AppIcons/Assets.xcassets/AppIcon.appiconset/1024.png",
            "line_number": 0,
            "rule_identifier": "YARA_prompt_injection_unicode_steganography",
            "title": "UNICODE STEGANOGRAPHY detected by YARA",
            "description": "Detects hidden Unicode characters used for invisible prompt injection and steganography: \u202d",
            "remediation": "Review and remove unicode steganography pattern"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "unicode_steganography",
            "file_path": "/repo/AppIcons/playstore.png",
            "line_number": 0,
            "rule_identifier": "YARA_prompt_injection_unicode_steganography",
            "title": "UNICODE STEGANOGRAPHY detected by YARA",
            "description": "Detects hidden Unicode characters used for invisible prompt injection and steganography: \u202d",
            "remediation": "Review and remove unicode steganography pattern"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "obfuscation",
            "file_path": "/repo/testimonials-temp/sarah.jpg",
            "line_number": null,
            "rule_identifier": "FILE_MAGIC_MISMATCH",
            "title": "File extension does not match actual content type",
            "description": "File 'sarah.jpg' extension (.jpg, expected image) does not match its actual content type (Generic text document, text).",
            "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/diagrams/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/diagrams/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "policy_violation",
            "file_path": "/repo/100DaysRebuild/.",
            "line_number": null,
            "rule_identifier": "EXCESSIVE_FILE_COUNT",
            "title": "Skill package contains many files",
            "description": "Skill package contains 256 files. Large file counts increase attack surface and may indicate bundled dependencies or unnecessary content.",
            "remediation": "Review file inventory and remove unnecessary files."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "obfuscation",
            "file_path": "/repo/100DaysRebuild/Core/UI/README.txt",
            "line_number": null,
            "rule_identifier": "FILE_MAGIC_MISMATCH",
            "title": "File extension does not match actual content type",
            "description": "File 'README.txt' extension (.txt) suggests one format but Magika detected a different text format: Markdown document (markdown). This may indicate content obfuscation or a misnamed file.",
            "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/100DaysRebuild/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/100DaysRebuild/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_INVALID_NAME",
            "title": "Skill name does not follow agent skills naming rules",
            "description": "Skill name '100DaysRebuild' is invalid. Agent skills require lowercase letters, numbers, and hyphens only, with a maximum length of 64 characters.",
            "remediation": "Rename the skill to match `[a-z0-9-]{1,64}` (e.g., 'pdf-processing')"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/100DaysRebuild/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/bug_fixes_summary/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/bug_fixes_summary/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_INVALID_NAME",
            "title": "Skill name does not follow agent skills naming rules",
            "description": "Skill name 'bug_fixes_summary' is invalid. Agent skills require lowercase letters, numbers, and hyphens only, with a maximum length of 64 characters.",
            "remediation": "Rename the skill to match `[a-z0-9-]{1,64}` (e.g., 'pdf-processing')"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/bug_fixes_summary/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/app_icon_assets/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/app_icon_assets/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_INVALID_NAME",
            "title": "Skill name does not follow agent skills naming rules",
            "description": "Skill name 'app_icon_assets' is invalid. Agent skills require lowercase letters, numbers, and hyphens only, with a maximum length of 64 characters.",
            "remediation": "Rename the skill to match `[a-z0-9-]{1,64}` (e.g., 'pdf-processing')"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/app_icon_assets/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/100DaysRebuild/Core/DesignSystem/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/100DaysRebuild/Core/DesignSystem/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_INVALID_NAME",
            "title": "Skill name does not follow agent skills naming rules",
            "description": "Skill name 'DesignSystem' is invalid. Agent skills require lowercase letters, numbers, and hyphens only, with a maximum length of 64 characters.",
            "remediation": "Rename the skill to match `[a-z0-9-]{1,64}` (e.g., 'pdf-processing')"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/100DaysRebuild/Core/DesignSystem/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          }
        ],
        "execution_duration_seconds": 10.466973978967872,
        "status": "complete",
        "examined": {
          "unit": "skills",
          "count": 6
        },
        "metadata": {
          "source": "pypi",
          "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/",
          "report_type": "cisco-skill-sast",
          "analyzers_used": [
            "bytecode",
            "pipeline",
            "static_analyzer"
          ],
          "skills_scanned": [
            "repo",
            "diagrams",
            "100DaysRebuild",
            "bug_fixes_summary",
            "app_icon_assets",
            "DesignSystem"
          ],
          "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt",
          "severity_counts": {
            "low": 9,
            "high": 0,
            "medium": 5,
            "critical": 0,
            "informational": 10
          },
          "artifact_type_policy": "cursor_rule"
        },
        "display_score": 52.0,
        "display_badge": "Unsafe"
      },
      {
        "scanner_name": "agent-audit-kit",
        "scanner_version": "0.3.26",
        "score": 84.0,
        "scanner_badge": "Caution",
        "findings": [
          {
            "tool_name": "agent-audit-kit",
            "severity": "high",
            "category": "secret-exposure",
            "file_path": "100DaysRebuild/Features/CheckIn/ViewModels/MilestoneCelebrationViewModel.swift",
            "line_number": 109,
            "rule_identifier": "AAK-SECRET-004",
            "title": "Generic high-entropy secret",
            "description": "A value assigned to a secret-like key has high Shannon entropy, indicating a likely credential or API key.",
            "remediation": "Move to environment variables or secrets manager."
          }
        ],
        "execution_duration_seconds": 4.246638419979718,
        "status": "complete",
        "examined": {
          "unit": "files",
          "count": 232
        },
        "metadata": {
          "source": "pypi",
          "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/",
          "report_type": "agent-audit-kit-sast",
          "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt",
          "rules_evaluated": 211,
          "severity_counts": {
            "low": 0,
            "high": 1,
            "medium": 0,
            "critical": 0,
            "informational": 0
          }
        },
        "display_score": 84.0,
        "display_badge": "Caution"
      },
      {
        "scanner_name": "bearer",
        "scanner_version": "2.0.2",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 0.09608848101925105,
        "status": "not_applicable",
        "examined": {
          "unit": "files",
          "count": 0
        },
        "metadata": {
          "source": "github-releases",
          "source_url": "https://github.com/Bearer/bearer",
          "report_type": "security",
          "install_command": "curl -sfL https://raw.githubusercontent.com/Bearer/bearer/main/contrib/install.sh | sh -s -- -b /usr/local/bin \"v2.0.2\"",
          "environment_note": "bearer found no supported-language source files to analyze (see _SUPPORTED_SOURCE_EXTENSIONS); reported not_applicable rather than a clean 100 \u2014 the scanner never ran, so it has no verdict to contribute"
        },
        "display_score": null,
        "display_badge": "not_applicable"
      },
      {
        "scanner_name": "nerlo-behavioral",
        "scanner_version": "0.1.0",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 3.4069214499904774,
        "status": "not_applicable",
        "examined": {
          "unit": "files",
          "count": 0
        },
        "metadata": {
          "source": "nerlo-original",
          "source_url": "https://github.com/nerlo-ai/nerlo",
          "report_type": "nerlo-behavioral",
          "ruleset_path": "/opt/nerlo-rules/exfiltration.yaml",
          "ruleset_paths": [
            "/opt/nerlo-rules/exfiltration.yaml",
            "/opt/nerlo-rules/clipboard_exfiltration.yaml",
            "/opt/nerlo-rules/rce_endpoint.yaml",
            "/opt/nerlo-rules/taint_egress.yaml"
          ],
          "install_command": "pip install 'semgrep==1.97.0'",
          "merged_invocation": true
        },
        "display_score": null,
        "display_badge": "not_applicable"
      },
      {
        "scanner_name": "nerlo-install-instruction",
        "scanner_version": "0.1.0",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 3.407500140951015,
        "status": "complete",
        "examined": {
          "unit": "files",
          "count": 20
        },
        "metadata": {
          "source": "nerlo-original",
          "source_url": "https://github.com/nerlo-ai/nerlo",
          "report_type": "nerlo-install-instruction",
          "ruleset_path": "/opt/nerlo-rules/install_instructions.yaml",
          "ruleset_paths": [
            "/opt/nerlo-rules/install_instructions.yaml",
            "/opt/nerlo-rules/cursor_rules.yaml"
          ],
          "install_command": "pip install 'semgrep==1.97.0'",
          "merged_invocation": true
        },
        "display_score": 100.0,
        "display_badge": "Verified"
      },
      {
        "scanner_name": "capslock",
        "scanner_version": "v0.3.2",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 0.09021342697087675,
        "status": "not_applicable",
        "examined": {
          "unit": "packages",
          "count": 0
        },
        "metadata": {
          "source": "go-module-proxy",
          "source_url": "https://github.com/google/capslock/releases/tag/v0.3.2",
          "report_type": "go-capability",
          "vendor_mode": false,
          "install_command": "GOTOOLCHAIN=local GOFLAGS=-mod=mod GOSUMDB=sum.golang.org GOBIN=/usr/local/bin go install github.com/google/capslock/cmd/capslock@v0.3.2  # github.com/google/capslock v0.3.2 h1:0ZQa9YR8s9ewFu1g5w6Rgd/lW/4dga7qJew3K6Ql7aM=",
          "environment_note": "capslock found no .go files to analyze; reported not_applicable rather than a clean 100 \u2014 the scanner never ran, so it has no verdict to contribute",
          "go_files_present": 0,
          "artifact_type_policy": "cursor_rule",
          "expected_capabilities": null,
          "artifact_type_explicit": true
        },
        "display_score": null,
        "display_badge": "not_applicable"
      },
      {
        "scanner_name": "trivy",
        "scanner_version": "0.71.0",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 0.47921178699471056,
        "status": "complete",
        "examined": {
          "unit": "manifests",
          "count": 2
        },
        "metadata": {
          "source": "github-releases",
          "source_url": "https://github.com/aquasecurity/trivy/releases/tag/v0.71.0",
          "report_type": "filesystem-vulnerability",
          "install_command": "curl -sfL -o /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.71.0/trivy_0.71.0_Linux-64bit.deb && echo '<sha256>  /tmp/trivy.deb' | sha256sum -c - && dpkg -i /tmp/trivy.deb",
          "manifests_scanned": [
            "100DaysRebuild.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved",
            "Package.resolved"
          ]
        },
        "display_score": 100.0,
        "display_badge": "Verified"
      },
      {
        "scanner_name": "osv-scanner",
        "scanner_version": "2.3.8",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 0.20997892797458917,
        "status": "not_applicable",
        "examined": {
          "unit": "manifests",
          "count": 0
        },
        "metadata": {
          "source": "github-releases",
          "source_url": "https://github.com/google/osv-scanner/releases/tag/v2.3.8",
          "report_type": "osv-vulnerability",
          "ecosystems_seen": [],
          "install_command": "curl -sfL -o /usr/local/bin/osv-scanner https://github.com/google/osv-scanner/releases/download/v2.3.8/osv-scanner_linux_amd64 && echo '<sha256>  /usr/local/bin/osv-scanner' | sha256sum -c - && chmod +x /usr/local/bin/osv-scanner",
          "manifests_scanned": [],
          "finding_id_aliases": {},
          "cross_scanner_correlation": {
            "only_osv": [],
            "only_trivy": [],
            "intersection_ids": []
          }
        },
        "display_score": null,
        "display_badge": "not_applicable"
      },
      {
        "scanner_name": "trivy_image",
        "scanner_version": "0.71.0",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 3.0360009986907244e-05,
        "status": "not_applicable",
        "examined": {
          "unit": "image_targets",
          "count": 0
        },
        "metadata": {
          "reason": "no OCI image acquired for this artifact"
        },
        "display_score": null,
        "display_badge": "not_applicable"
      },
      {
        "scanner_name": "govulncheck",
        "scanner_version": "v1.6.0",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 0.08706452901242301,
        "status": "not_applicable",
        "examined": {
          "unit": "modules",
          "count": 0
        },
        "metadata": {
          "source": "go-module-proxy",
          "source_url": "https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck",
          "report_type": "go-reachability",
          "vendor_mode": false,
          "go_mod_present": false,
          "install_command": "GOTOOLCHAIN=local GOFLAGS=-mod=mod GOSUMDB=sum.golang.org GOBIN=/usr/local/bin go install golang.org/x/vuln/cmd/govulncheck@v1.6.0  # golang.org/x/vuln v1.6.0 h1:FeMO9Rm/HwyduOztbvKcOw+zvDEPr4I4aQNSfevFcKY=",
          "offline_db_path": "/opt/govulncheck-db",
          "environment_note": "govulncheck found no go.mod, so this tree declares no Go module and no Go dependencies; reported not_applicable rather than a clean 100 \u2014 the scanner never ran, so it has no verdict to contribute"
        },
        "display_score": null,
        "display_badge": "not_applicable"
      }
    ]
  },
  "report": {
    "report_id": "d4e89e19-72ca-45b2-8d86-4f27525a8b8f",
    "format": "json",
    "generated_at": "2026-08-12T20:05:36.521162+00:00",
    "scanner_filter": null,
    "signature": null
  }
}