{
  "executive_summary": {
    "badge": "Unsafe",
    "security_score": 80.75,
    "view": "composite",
    "aggregate_verdict_withheld": false,
    "aggregate_verdict_withheld_reason": null,
    "scanner_badges": {
      "agentshield": "unavailable",
      "cisco-skill-scanner": "Unsafe",
      "agent-audit-kit": "Verified",
      "nerlo-behavioral": "Verified",
      "nerlo-install-instruction": "Unsafe",
      "nerlo-multi-source": "unavailable",
      "trivy": "unavailable",
      "osv-scanner": "Verified"
    },
    "finding_counts": {
      "critical": 0,
      "high": 1,
      "medium": 20,
      "low": 6,
      "informational": 2
    },
    "recommendation": "ai-sdk-cpp is NOT recommended for integration: the scan surfaced 0 critical and 1 high-severity findings. Treat the Per-Scanner Detail section as a remediation worklist and re-scan before reconsidering."
  },
  "source_provenance": {
    "repository_url": "https://github.com/clickhouse/ai-sdk-cpp",
    "commit_sha_scanned": null,
    "license": null,
    "maintainer": null,
    "name": "ai-sdk-cpp",
    "version": null
  },
  "per_scanner_detail": [
    {
      "scanner_name": "agentshield",
      "scanner_version": "1.4.0",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 0.34604762800154276,
      "status": "not_applicable",
      "examined": null,
      "metadata": {
        "source": "npm",
        "source_url": "https://www.npmjs.com/package/ecc-agentshield",
        "install_command": "npm install -g ecc-agentshield@1.4.0",
        "scans_performed": []
      },
      "display_score": null,
      "display_badge": "unavailable"
    },
    {
      "scanner_name": "cisco-skill-scanner",
      "scanner_version": "2.0.11",
      "score": 2.0,
      "scanner_badge": "Unsafe",
      "findings": [
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "policy_violation",
          "file_path": "/repo/.",
          "line_number": null,
          "rule_identifier": "EXCESSIVE_FILE_COUNT",
          "title": "Skill package contains many files",
          "description": "Skill package contains 191 files. Large file counts increase attack surface and may indicate bundled dependencies or unnecessary content.",
          "remediation": "Review file inventory and remove unnecessary files."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "obfuscation",
          "file_path": "/repo/.env.local.example",
          "line_number": null,
          "rule_identifier": "HIDDEN_DATA_FILE",
          "title": "Hidden data file detected",
          "description": "Hidden file found: .env.local.example. Hidden files may contain concealed configuration or data that should be reviewed.",
          "remediation": "Move file to a visible location or document its purpose."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "obfuscation",
          "file_path": "/repo/CMakeLists.txt",
          "line_number": null,
          "rule_identifier": "FILE_MAGIC_MISMATCH",
          "title": "File extension does not match actual content type",
          "description": "File 'CMakeLists.txt' extension (.txt) suggests one format but Magika detected a different text format: CMake build file (cmake). This may indicate content obfuscation or a misnamed file.",
          "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "command_injection",
          "file_path": "/repo/DEVELOPMENT.md",
          "line_number": 2,
          "rule_identifier": "PIPELINE_TAINT_FLOW",
          "title": "Dangerous data flow in command pipeline",
          "description": "Pipeline downloads data from the network and executes it: `curl -LsSf https://astral.sh/uv/install.sh | sh`. This is a remote code execution pattern. (Note: uses a well-known installer URL - likely a standard installation command.)",
          "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "command_injection",
          "file_path": "/repo/SKILL.md",
          "line_number": 2,
          "rule_identifier": "PIPELINE_TAINT_FLOW",
          "title": "Dangerous data flow in command pipeline",
          "description": "Pipeline downloads data from the network and executes it: `curl -LsSf https://astral.sh/uv/install.sh | sh`. This is a remote code execution pattern. (Note: uses a well-known installer URL - likely a standard installation command.)",
          "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "obfuscation",
          "file_path": "/repo/examples/CMakeLists.txt",
          "line_number": null,
          "rule_identifier": "FILE_MAGIC_MISMATCH",
          "title": "File extension does not match actual content type",
          "description": "File 'CMakeLists.txt' extension (.txt) suggests one format but Magika detected a different text format: CMake build file (cmake). This may indicate content obfuscation or a misnamed file.",
          "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "obfuscation",
          "file_path": "/repo/examples/components/all/CMakeLists.txt",
          "line_number": null,
          "rule_identifier": "FILE_MAGIC_MISMATCH",
          "title": "File extension does not match actual content type",
          "description": "File 'CMakeLists.txt' extension (.txt) suggests one format but Magika detected a different text format: CMake build file (cmake). This may indicate content obfuscation or a misnamed file.",
          "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "obfuscation",
          "file_path": "/repo/examples/components/anthropic/CMakeLists.txt",
          "line_number": null,
          "rule_identifier": "FILE_MAGIC_MISMATCH",
          "title": "File extension does not match actual content type",
          "description": "File 'CMakeLists.txt' extension (.txt) suggests one format but Magika detected a different text format: CMake build file (cmake). This may indicate content obfuscation or a misnamed file.",
          "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "obfuscation",
          "file_path": "/repo/examples/components/openai/CMakeLists.txt",
          "line_number": null,
          "rule_identifier": "FILE_MAGIC_MISMATCH",
          "title": "File extension does not match actual content type",
          "description": "File 'CMakeLists.txt' extension (.txt) suggests one format but Magika detected a different text format: CMake build file (cmake). This may indicate content obfuscation or a misnamed file.",
          "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "obfuscation",
          "file_path": "/repo/tests/CMakeLists.txt",
          "line_number": null,
          "rule_identifier": "FILE_MAGIC_MISMATCH",
          "title": "File extension does not match actual content type",
          "description": "File 'CMakeLists.txt' extension (.txt) suggests one format but Magika detected a different text format: CMake build file (cmake). This may indicate content obfuscation or a misnamed file.",
          "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "obfuscation",
          "file_path": "/repo/third_party/CMakeLists.txt",
          "line_number": null,
          "rule_identifier": "FILE_MAGIC_MISMATCH",
          "title": "File extension does not match actual content type",
          "description": "File 'CMakeLists.txt' extension (.txt) suggests one format but Magika detected a different text format: CMake build file (cmake). This may indicate content obfuscation or a misnamed file.",
          "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "obfuscation",
          "file_path": "/repo/third_party/brotli-cmake/CMakeLists.txt",
          "line_number": null,
          "rule_identifier": "FILE_MAGIC_MISMATCH",
          "title": "File extension does not match actual content type",
          "description": "File 'CMakeLists.txt' extension (.txt) suggests one format but Magika detected a different text format: CMake build file (cmake). This may indicate content obfuscation or a misnamed file.",
          "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "obfuscation",
          "file_path": "/repo/third_party/clickhouse-cmake/CMakeLists.txt",
          "line_number": null,
          "rule_identifier": "FILE_MAGIC_MISMATCH",
          "title": "File extension does not match actual content type",
          "description": "File 'CMakeLists.txt' extension (.txt) suggests one format but Magika detected a different text format: CMake build file (cmake). This may indicate content obfuscation or a misnamed file.",
          "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "obfuscation",
          "file_path": "/repo/third_party/concurrentqueue-cmake/CMakeLists.txt",
          "line_number": null,
          "rule_identifier": "FILE_MAGIC_MISMATCH",
          "title": "File extension does not match actual content type",
          "description": "File 'CMakeLists.txt' extension (.txt) suggests one format but Magika detected a different text format: CMake build file (cmake). This may indicate content obfuscation or a misnamed file.",
          "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "obfuscation",
          "file_path": "/repo/third_party/googletest-cmake/CMakeLists.txt",
          "line_number": null,
          "rule_identifier": "FILE_MAGIC_MISMATCH",
          "title": "File extension does not match actual content type",
          "description": "File 'CMakeLists.txt' extension (.txt) suggests one format but Magika detected a different text format: CMake build file (cmake). This may indicate content obfuscation or a misnamed file.",
          "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "obfuscation",
          "file_path": "/repo/third_party/httplib-cmake/CMakeLists.txt",
          "line_number": null,
          "rule_identifier": "FILE_MAGIC_MISMATCH",
          "title": "File extension does not match actual content type",
          "description": "File 'CMakeLists.txt' extension (.txt) suggests one format but Magika detected a different text format: CMake build file (cmake). This may indicate content obfuscation or a misnamed file.",
          "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "obfuscation",
          "file_path": "/repo/third_party/nlohmann_json-cmake/CMakeLists.txt",
          "line_number": null,
          "rule_identifier": "FILE_MAGIC_MISMATCH",
          "title": "File extension does not match actual content type",
          "description": "File 'CMakeLists.txt' extension (.txt) suggests one format but Magika detected a different text format: CMake build file (cmake). This may indicate content obfuscation or a misnamed file.",
          "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "obfuscation",
          "file_path": "/repo/third_party/nlohmann_json_patched/CMakeLists.txt",
          "line_number": null,
          "rule_identifier": "FILE_MAGIC_MISMATCH",
          "title": "File extension does not match actual content type",
          "description": "File 'CMakeLists.txt' extension (.txt) suggests one format but Magika detected a different text format: CMake build file (cmake). This may indicate content obfuscation or a misnamed file.",
          "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "obfuscation",
          "file_path": "/repo/third_party/nlohmann_json_patched/src/modules/CMakeLists.txt",
          "line_number": null,
          "rule_identifier": "FILE_MAGIC_MISMATCH",
          "title": "File extension does not match actual content type",
          "description": "File 'CMakeLists.txt' extension (.txt) suggests one format but Magika detected a different text format: CMake build file (cmake). This may indicate content obfuscation or a misnamed file.",
          "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "obfuscation",
          "file_path": "/repo/third_party/stduuid-cmake/CMakeLists.txt",
          "line_number": null,
          "rule_identifier": "FILE_MAGIC_MISMATCH",
          "title": "File extension does not match actual content type",
          "description": "File 'CMakeLists.txt' extension (.txt) suggests one format but Magika detected a different text format: CMake build file (cmake). This may indicate content obfuscation or a misnamed file.",
          "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "obfuscation",
          "file_path": "/repo/third_party/zlib-cmake/CMakeLists.txt",
          "line_number": null,
          "rule_identifier": "FILE_MAGIC_MISMATCH",
          "title": "File extension does not match actual content type",
          "description": "File 'CMakeLists.txt' extension (.txt) suggests one format but Magika detected a different text format: CMake build file (cmake). This may indicate content obfuscation or a misnamed file.",
          "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/third_party/concurrentqueue-header-only/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/third_party/concurrentqueue-header-only/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        }
      ],
      "execution_duration_seconds": 18.1427011040214,
      "status": "complete",
      "examined": {
        "unit": "skills",
        "count": 2
      },
      "metadata": {
        "source": "pypi",
        "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/",
        "report_type": "cisco-skill-sast",
        "analyzers_used": [
          "bytecode",
          "pipeline",
          "static_analyzer"
        ],
        "skills_scanned": [
          "repo",
          "concurrentqueue-header-only"
        ],
        "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt",
        "severity_counts": {
          "low": 6,
          "high": 0,
          "medium": 17,
          "critical": 0,
          "informational": 2
        },
        "artifact_type_policy": "cursor_rule"
      },
      "display_score": 2.0,
      "display_badge": "Unsafe"
    },
    {
      "scanner_name": "agent-audit-kit",
      "scanner_version": "0.3.26",
      "score": 85.0,
      "scanner_badge": "Verified",
      "findings": [
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "mcp-config",
          "file_path": "scripts/lint.py",
          "line_number": null,
          "rule_identifier": "AAK-TASKS-003",
          "title": "MCP task has no TTL or cancellation path",
          "description": "A task record has no expiration and no cancellation endpoint. Orphaned tasks accumulate forever, including their inputs.",
          "remediation": "Set a TTL on every task; expose a cancellation endpoint that zeroizes inputs and credentials."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "supply-chain",
          "file_path": ".github/workflows/ci.yml",
          "line_number": 37,
          "rule_identifier": "AAK-GHA-IMMUTABLE-001",
          "title": "Third-party GitHub Action not pinned by full commit SHA",
          "description": "A workflow in `.github/workflows/` uses a third-party Action (`owner/action@ref`) where `ref` is a tag or branch name instead of a 40-character commit SHA. A repo-takeover of the Action's publisher can re-point the tag to a malicious revision \u2014 the downstream repo consuming it will happily run the new code with `GITHUB_TOKEN` and write permissions. GitHub's April 2026 Security Roadmap ships Immutable Actions and makes SHA pinning the default policy.",
          "remediation": "Repin third-party Actions to a 40-character commit SHA and add a `# v1.2.3`-style trailing comment for humans. First-party Actions under `actions/` and `github/` are exempt (they now ship Immutable Actions). Dependabot will auto-bump SHA pins when `update-type: all` is set."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "supply-chain",
          "file_path": ".github/workflows/ci.yml",
          "line_number": 45,
          "rule_identifier": "AAK-GHA-IMMUTABLE-001",
          "title": "Third-party GitHub Action not pinned by full commit SHA",
          "description": "A workflow in `.github/workflows/` uses a third-party Action (`owner/action@ref`) where `ref` is a tag or branch name instead of a 40-character commit SHA. A repo-takeover of the Action's publisher can re-point the tag to a malicious revision \u2014 the downstream repo consuming it will happily run the new code with `GITHUB_TOKEN` and write permissions. GitHub's April 2026 Security Roadmap ships Immutable Actions and makes SHA pinning the default policy.",
          "remediation": "Repin third-party Actions to a 40-character commit SHA and add a `# v1.2.3`-style trailing comment for humans. First-party Actions under `actions/` and `github/` are exempt (they now ship Immutable Actions). Dependabot will auto-bump SHA pins when `update-type: all` is set."
        }
      ],
      "execution_duration_seconds": 4.915217303001555,
      "status": "complete",
      "examined": {
        "unit": "files",
        "count": 30
      },
      "metadata": {
        "source": "pypi",
        "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/",
        "report_type": "agent-audit-kit-sast",
        "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt",
        "rules_evaluated": 211,
        "severity_counts": {
          "low": 0,
          "high": 0,
          "medium": 3,
          "critical": 0,
          "informational": 0
        }
      },
      "display_score": 85.0,
      "display_badge": "Verified"
    },
    {
      "scanner_name": "nerlo-behavioral",
      "scanner_version": "0.1.0",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 35.14234035499976,
      "status": "complete",
      "examined": {
        "unit": "files",
        "count": 3
      },
      "metadata": {
        "source": "nerlo-original",
        "source_url": "https://github.com/nerlo-ai/nerlo",
        "report_type": "nerlo-behavioral",
        "ruleset_path": "/opt/nerlo-rules/exfiltration.yaml",
        "ruleset_paths": [
          "/opt/nerlo-rules/exfiltration.yaml",
          "/opt/nerlo-rules/clipboard_exfiltration.yaml",
          "/opt/nerlo-rules/rce_endpoint.yaml",
          "/opt/nerlo-rules/taint_egress.yaml"
        ],
        "install_command": "pip install 'semgrep==1.97.0'",
        "merged_invocation": true
      },
      "display_score": 100.0,
      "display_badge": "Verified"
    },
    {
      "scanner_name": "nerlo-install-instruction",
      "scanner_version": "0.1.0",
      "score": 59.0,
      "scanner_badge": "Unsafe",
      "findings": [
        {
          "tool_name": "nerlo-install-instruction",
          "severity": "high",
          "category": "install-instruction-exec",
          "file_path": "/repo/DEVELOPMENT.md",
          "line_number": 35,
          "rule_identifier": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
          "title": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
          "description": "Documentation instructs piping a downloaded artifact directly into a shell (curl/wget/iwr ... | bash/sh/iex). This is the curl-pipe-bash install shape used by the ClawHub skill droppers and countless malware loaders \u2014 the fetched payload is executed with zero inspection. Confirm this is expected; it is a strong weaponized-documentation signal.",
          "remediation": null
        }
      ],
      "execution_duration_seconds": 35.14400993601885,
      "status": "complete",
      "examined": {
        "unit": "files",
        "count": 25
      },
      "metadata": {
        "source": "nerlo-original",
        "source_url": "https://github.com/nerlo-ai/nerlo",
        "report_type": "nerlo-install-instruction",
        "ruleset_path": "/opt/nerlo-rules/install_instructions.yaml",
        "ruleset_paths": [
          "/opt/nerlo-rules/install_instructions.yaml",
          "/opt/nerlo-rules/cursor_rules.yaml"
        ],
        "install_command": "pip install 'semgrep==1.97.0'",
        "severity_counts": {
          "low": 0,
          "high": 1,
          "medium": 0,
          "critical": 0,
          "informational": 0
        },
        "merged_invocation": true
      },
      "display_score": 59.0,
      "display_badge": "Unsafe"
    },
    {
      "scanner_name": "nerlo-multi-source",
      "scanner_version": "0.1.0",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 11.298799762997078,
      "status": "not_applicable",
      "examined": null,
      "metadata": {
        "source": "nerlo-original",
        "per_source": [],
        "report_type": "nerlo-multi-source",
        "diverged_sources": [],
        "published_surfaces_scanned": 0
      },
      "display_score": null,
      "display_badge": "unavailable"
    },
    {
      "scanner_name": "trivy",
      "scanner_version": "0.71.0",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 1.2842200309969485,
      "status": "not_applicable",
      "examined": {
        "unit": "manifests",
        "count": 0
      },
      "metadata": {
        "source": "github-releases",
        "source_url": "https://github.com/aquasecurity/trivy/releases/tag/v0.71.0",
        "report_type": "filesystem-vulnerability",
        "install_command": "curl -sfL -o /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.71.0/trivy_0.71.0_Linux-64bit.deb && echo '<sha256>  /tmp/trivy.deb' | sha256sum -c - && dpkg -i /tmp/trivy.deb",
        "manifests_scanned": []
      },
      "display_score": null,
      "display_badge": "unavailable"
    },
    {
      "scanner_name": "osv-scanner",
      "scanner_version": "2.3.8",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 2.4471260480058845,
      "status": "complete",
      "examined": null,
      "metadata": {
        "source": "github-releases",
        "source_url": "https://github.com/google/osv-scanner/releases/tag/v2.3.8",
        "report_type": "osv-vulnerability",
        "ecosystems_seen": [],
        "install_command": "curl -sfL -o /usr/local/bin/osv-scanner https://github.com/google/osv-scanner/releases/download/v2.3.8/osv-scanner_linux_amd64 && echo '<sha256>  /usr/local/bin/osv-scanner' | sha256sum -c - && chmod +x /usr/local/bin/osv-scanner",
        "manifests_scanned": [],
        "finding_id_aliases": {},
        "cross_scanner_correlation": {
          "only_osv": [],
          "only_trivy": [],
          "intersection_ids": []
        }
      },
      "display_score": 100.0,
      "display_badge": "Verified"
    }
  ],
  "threat_model": "Threat model synthesis has not yet run for this scan. This section is generated by the registry's LLM pipeline (Req 22.3) and will appear in the next regeneration of this report.",
  "audit_chain": {
    "scan_job_id": "67a69c6f-7901-436c-bbb9-87b7c25ff88d",
    "scan_completed_at": "2026-08-01T21:06:46.405057+00:00",
    "scanner_versions": {
      "agentshield": "1.4.0",
      "cisco-skill-scanner": "2.0.11",
      "agent-audit-kit": "0.3.26",
      "nerlo-behavioral": "0.1.0",
      "nerlo-install-instruction": "0.1.0",
      "nerlo-multi-source": "0.1.0",
      "trivy": "0.71.0",
      "osv-scanner": "2.3.8"
    },
    "scanner_base_image": "us-central1-docker.pkg.dev/nerlo-vsk-prod/nerlo/scanner-base@sha256:5b605cdef65aaf3d8b562c388cdd6483d6922974476d23c1f8e4f6c5f6ae723e",
    "ai_decision_log_ids": [
      "cb4583c4-349f-4472-b9ce-aaae5023305d",
      "5f8f89f2-887b-4517-a2e1-f3f98dce150d"
    ],
    "self_attestation_url": "http://localhost:8000/api/v1/registry/self-attestation"
  },
  "appendix": {
    "raw_scanner_reports": [
      {
        "scanner_name": "agentshield",
        "scanner_version": "1.4.0",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 0.34604762800154276,
        "status": "not_applicable",
        "examined": null,
        "metadata": {
          "source": "npm",
          "source_url": "https://www.npmjs.com/package/ecc-agentshield",
          "install_command": "npm install -g ecc-agentshield@1.4.0",
          "scans_performed": []
        },
        "display_score": null,
        "display_badge": "unavailable"
      },
      {
        "scanner_name": "cisco-skill-scanner",
        "scanner_version": "2.0.11",
        "score": 2.0,
        "scanner_badge": "Unsafe",
        "findings": [
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "policy_violation",
            "file_path": "/repo/.",
            "line_number": null,
            "rule_identifier": "EXCESSIVE_FILE_COUNT",
            "title": "Skill package contains many files",
            "description": "Skill package contains 191 files. Large file counts increase attack surface and may indicate bundled dependencies or unnecessary content.",
            "remediation": "Review file inventory and remove unnecessary files."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "obfuscation",
            "file_path": "/repo/.env.local.example",
            "line_number": null,
            "rule_identifier": "HIDDEN_DATA_FILE",
            "title": "Hidden data file detected",
            "description": "Hidden file found: .env.local.example. Hidden files may contain concealed configuration or data that should be reviewed.",
            "remediation": "Move file to a visible location or document its purpose."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "obfuscation",
            "file_path": "/repo/CMakeLists.txt",
            "line_number": null,
            "rule_identifier": "FILE_MAGIC_MISMATCH",
            "title": "File extension does not match actual content type",
            "description": "File 'CMakeLists.txt' extension (.txt) suggests one format but Magika detected a different text format: CMake build file (cmake). This may indicate content obfuscation or a misnamed file.",
            "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "command_injection",
            "file_path": "/repo/DEVELOPMENT.md",
            "line_number": 2,
            "rule_identifier": "PIPELINE_TAINT_FLOW",
            "title": "Dangerous data flow in command pipeline",
            "description": "Pipeline downloads data from the network and executes it: `curl -LsSf https://astral.sh/uv/install.sh | sh`. This is a remote code execution pattern. (Note: uses a well-known installer URL - likely a standard installation command.)",
            "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "command_injection",
            "file_path": "/repo/SKILL.md",
            "line_number": 2,
            "rule_identifier": "PIPELINE_TAINT_FLOW",
            "title": "Dangerous data flow in command pipeline",
            "description": "Pipeline downloads data from the network and executes it: `curl -LsSf https://astral.sh/uv/install.sh | sh`. This is a remote code execution pattern. (Note: uses a well-known installer URL - likely a standard installation command.)",
            "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "obfuscation",
            "file_path": "/repo/examples/CMakeLists.txt",
            "line_number": null,
            "rule_identifier": "FILE_MAGIC_MISMATCH",
            "title": "File extension does not match actual content type",
            "description": "File 'CMakeLists.txt' extension (.txt) suggests one format but Magika detected a different text format: CMake build file (cmake). This may indicate content obfuscation or a misnamed file.",
            "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "obfuscation",
            "file_path": "/repo/examples/components/all/CMakeLists.txt",
            "line_number": null,
            "rule_identifier": "FILE_MAGIC_MISMATCH",
            "title": "File extension does not match actual content type",
            "description": "File 'CMakeLists.txt' extension (.txt) suggests one format but Magika detected a different text format: CMake build file (cmake). This may indicate content obfuscation or a misnamed file.",
            "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "obfuscation",
            "file_path": "/repo/examples/components/anthropic/CMakeLists.txt",
            "line_number": null,
            "rule_identifier": "FILE_MAGIC_MISMATCH",
            "title": "File extension does not match actual content type",
            "description": "File 'CMakeLists.txt' extension (.txt) suggests one format but Magika detected a different text format: CMake build file (cmake). This may indicate content obfuscation or a misnamed file.",
            "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "obfuscation",
            "file_path": "/repo/examples/components/openai/CMakeLists.txt",
            "line_number": null,
            "rule_identifier": "FILE_MAGIC_MISMATCH",
            "title": "File extension does not match actual content type",
            "description": "File 'CMakeLists.txt' extension (.txt) suggests one format but Magika detected a different text format: CMake build file (cmake). This may indicate content obfuscation or a misnamed file.",
            "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "obfuscation",
            "file_path": "/repo/tests/CMakeLists.txt",
            "line_number": null,
            "rule_identifier": "FILE_MAGIC_MISMATCH",
            "title": "File extension does not match actual content type",
            "description": "File 'CMakeLists.txt' extension (.txt) suggests one format but Magika detected a different text format: CMake build file (cmake). This may indicate content obfuscation or a misnamed file.",
            "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "obfuscation",
            "file_path": "/repo/third_party/CMakeLists.txt",
            "line_number": null,
            "rule_identifier": "FILE_MAGIC_MISMATCH",
            "title": "File extension does not match actual content type",
            "description": "File 'CMakeLists.txt' extension (.txt) suggests one format but Magika detected a different text format: CMake build file (cmake). This may indicate content obfuscation or a misnamed file.",
            "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "obfuscation",
            "file_path": "/repo/third_party/brotli-cmake/CMakeLists.txt",
            "line_number": null,
            "rule_identifier": "FILE_MAGIC_MISMATCH",
            "title": "File extension does not match actual content type",
            "description": "File 'CMakeLists.txt' extension (.txt) suggests one format but Magika detected a different text format: CMake build file (cmake). This may indicate content obfuscation or a misnamed file.",
            "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "obfuscation",
            "file_path": "/repo/third_party/clickhouse-cmake/CMakeLists.txt",
            "line_number": null,
            "rule_identifier": "FILE_MAGIC_MISMATCH",
            "title": "File extension does not match actual content type",
            "description": "File 'CMakeLists.txt' extension (.txt) suggests one format but Magika detected a different text format: CMake build file (cmake). This may indicate content obfuscation or a misnamed file.",
            "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "obfuscation",
            "file_path": "/repo/third_party/concurrentqueue-cmake/CMakeLists.txt",
            "line_number": null,
            "rule_identifier": "FILE_MAGIC_MISMATCH",
            "title": "File extension does not match actual content type",
            "description": "File 'CMakeLists.txt' extension (.txt) suggests one format but Magika detected a different text format: CMake build file (cmake). This may indicate content obfuscation or a misnamed file.",
            "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "obfuscation",
            "file_path": "/repo/third_party/googletest-cmake/CMakeLists.txt",
            "line_number": null,
            "rule_identifier": "FILE_MAGIC_MISMATCH",
            "title": "File extension does not match actual content type",
            "description": "File 'CMakeLists.txt' extension (.txt) suggests one format but Magika detected a different text format: CMake build file (cmake). This may indicate content obfuscation or a misnamed file.",
            "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "obfuscation",
            "file_path": "/repo/third_party/httplib-cmake/CMakeLists.txt",
            "line_number": null,
            "rule_identifier": "FILE_MAGIC_MISMATCH",
            "title": "File extension does not match actual content type",
            "description": "File 'CMakeLists.txt' extension (.txt) suggests one format but Magika detected a different text format: CMake build file (cmake). This may indicate content obfuscation or a misnamed file.",
            "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "obfuscation",
            "file_path": "/repo/third_party/nlohmann_json-cmake/CMakeLists.txt",
            "line_number": null,
            "rule_identifier": "FILE_MAGIC_MISMATCH",
            "title": "File extension does not match actual content type",
            "description": "File 'CMakeLists.txt' extension (.txt) suggests one format but Magika detected a different text format: CMake build file (cmake). This may indicate content obfuscation or a misnamed file.",
            "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "obfuscation",
            "file_path": "/repo/third_party/nlohmann_json_patched/CMakeLists.txt",
            "line_number": null,
            "rule_identifier": "FILE_MAGIC_MISMATCH",
            "title": "File extension does not match actual content type",
            "description": "File 'CMakeLists.txt' extension (.txt) suggests one format but Magika detected a different text format: CMake build file (cmake). This may indicate content obfuscation or a misnamed file.",
            "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "obfuscation",
            "file_path": "/repo/third_party/nlohmann_json_patched/src/modules/CMakeLists.txt",
            "line_number": null,
            "rule_identifier": "FILE_MAGIC_MISMATCH",
            "title": "File extension does not match actual content type",
            "description": "File 'CMakeLists.txt' extension (.txt) suggests one format but Magika detected a different text format: CMake build file (cmake). This may indicate content obfuscation or a misnamed file.",
            "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "obfuscation",
            "file_path": "/repo/third_party/stduuid-cmake/CMakeLists.txt",
            "line_number": null,
            "rule_identifier": "FILE_MAGIC_MISMATCH",
            "title": "File extension does not match actual content type",
            "description": "File 'CMakeLists.txt' extension (.txt) suggests one format but Magika detected a different text format: CMake build file (cmake). This may indicate content obfuscation or a misnamed file.",
            "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "obfuscation",
            "file_path": "/repo/third_party/zlib-cmake/CMakeLists.txt",
            "line_number": null,
            "rule_identifier": "FILE_MAGIC_MISMATCH",
            "title": "File extension does not match actual content type",
            "description": "File 'CMakeLists.txt' extension (.txt) suggests one format but Magika detected a different text format: CMake build file (cmake). This may indicate content obfuscation or a misnamed file.",
            "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/third_party/concurrentqueue-header-only/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/third_party/concurrentqueue-header-only/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          }
        ],
        "execution_duration_seconds": 18.1427011040214,
        "status": "complete",
        "examined": {
          "unit": "skills",
          "count": 2
        },
        "metadata": {
          "source": "pypi",
          "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/",
          "report_type": "cisco-skill-sast",
          "analyzers_used": [
            "bytecode",
            "pipeline",
            "static_analyzer"
          ],
          "skills_scanned": [
            "repo",
            "concurrentqueue-header-only"
          ],
          "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt",
          "severity_counts": {
            "low": 6,
            "high": 0,
            "medium": 17,
            "critical": 0,
            "informational": 2
          },
          "artifact_type_policy": "cursor_rule"
        },
        "display_score": 2.0,
        "display_badge": "Unsafe"
      },
      {
        "scanner_name": "agent-audit-kit",
        "scanner_version": "0.3.26",
        "score": 85.0,
        "scanner_badge": "Verified",
        "findings": [
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "mcp-config",
            "file_path": "scripts/lint.py",
            "line_number": null,
            "rule_identifier": "AAK-TASKS-003",
            "title": "MCP task has no TTL or cancellation path",
            "description": "A task record has no expiration and no cancellation endpoint. Orphaned tasks accumulate forever, including their inputs.",
            "remediation": "Set a TTL on every task; expose a cancellation endpoint that zeroizes inputs and credentials."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "supply-chain",
            "file_path": ".github/workflows/ci.yml",
            "line_number": 37,
            "rule_identifier": "AAK-GHA-IMMUTABLE-001",
            "title": "Third-party GitHub Action not pinned by full commit SHA",
            "description": "A workflow in `.github/workflows/` uses a third-party Action (`owner/action@ref`) where `ref` is a tag or branch name instead of a 40-character commit SHA. A repo-takeover of the Action's publisher can re-point the tag to a malicious revision \u2014 the downstream repo consuming it will happily run the new code with `GITHUB_TOKEN` and write permissions. GitHub's April 2026 Security Roadmap ships Immutable Actions and makes SHA pinning the default policy.",
            "remediation": "Repin third-party Actions to a 40-character commit SHA and add a `# v1.2.3`-style trailing comment for humans. First-party Actions under `actions/` and `github/` are exempt (they now ship Immutable Actions). Dependabot will auto-bump SHA pins when `update-type: all` is set."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "supply-chain",
            "file_path": ".github/workflows/ci.yml",
            "line_number": 45,
            "rule_identifier": "AAK-GHA-IMMUTABLE-001",
            "title": "Third-party GitHub Action not pinned by full commit SHA",
            "description": "A workflow in `.github/workflows/` uses a third-party Action (`owner/action@ref`) where `ref` is a tag or branch name instead of a 40-character commit SHA. A repo-takeover of the Action's publisher can re-point the tag to a malicious revision \u2014 the downstream repo consuming it will happily run the new code with `GITHUB_TOKEN` and write permissions. GitHub's April 2026 Security Roadmap ships Immutable Actions and makes SHA pinning the default policy.",
            "remediation": "Repin third-party Actions to a 40-character commit SHA and add a `# v1.2.3`-style trailing comment for humans. First-party Actions under `actions/` and `github/` are exempt (they now ship Immutable Actions). Dependabot will auto-bump SHA pins when `update-type: all` is set."
          }
        ],
        "execution_duration_seconds": 4.915217303001555,
        "status": "complete",
        "examined": {
          "unit": "files",
          "count": 30
        },
        "metadata": {
          "source": "pypi",
          "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/",
          "report_type": "agent-audit-kit-sast",
          "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt",
          "rules_evaluated": 211,
          "severity_counts": {
            "low": 0,
            "high": 0,
            "medium": 3,
            "critical": 0,
            "informational": 0
          }
        },
        "display_score": 85.0,
        "display_badge": "Verified"
      },
      {
        "scanner_name": "nerlo-behavioral",
        "scanner_version": "0.1.0",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 35.14234035499976,
        "status": "complete",
        "examined": {
          "unit": "files",
          "count": 3
        },
        "metadata": {
          "source": "nerlo-original",
          "source_url": "https://github.com/nerlo-ai/nerlo",
          "report_type": "nerlo-behavioral",
          "ruleset_path": "/opt/nerlo-rules/exfiltration.yaml",
          "ruleset_paths": [
            "/opt/nerlo-rules/exfiltration.yaml",
            "/opt/nerlo-rules/clipboard_exfiltration.yaml",
            "/opt/nerlo-rules/rce_endpoint.yaml",
            "/opt/nerlo-rules/taint_egress.yaml"
          ],
          "install_command": "pip install 'semgrep==1.97.0'",
          "merged_invocation": true
        },
        "display_score": 100.0,
        "display_badge": "Verified"
      },
      {
        "scanner_name": "nerlo-install-instruction",
        "scanner_version": "0.1.0",
        "score": 59.0,
        "scanner_badge": "Unsafe",
        "findings": [
          {
            "tool_name": "nerlo-install-instruction",
            "severity": "high",
            "category": "install-instruction-exec",
            "file_path": "/repo/DEVELOPMENT.md",
            "line_number": 35,
            "rule_identifier": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
            "title": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
            "description": "Documentation instructs piping a downloaded artifact directly into a shell (curl/wget/iwr ... | bash/sh/iex). This is the curl-pipe-bash install shape used by the ClawHub skill droppers and countless malware loaders \u2014 the fetched payload is executed with zero inspection. Confirm this is expected; it is a strong weaponized-documentation signal.",
            "remediation": null
          }
        ],
        "execution_duration_seconds": 35.14400993601885,
        "status": "complete",
        "examined": {
          "unit": "files",
          "count": 25
        },
        "metadata": {
          "source": "nerlo-original",
          "source_url": "https://github.com/nerlo-ai/nerlo",
          "report_type": "nerlo-install-instruction",
          "ruleset_path": "/opt/nerlo-rules/install_instructions.yaml",
          "ruleset_paths": [
            "/opt/nerlo-rules/install_instructions.yaml",
            "/opt/nerlo-rules/cursor_rules.yaml"
          ],
          "install_command": "pip install 'semgrep==1.97.0'",
          "severity_counts": {
            "low": 0,
            "high": 1,
            "medium": 0,
            "critical": 0,
            "informational": 0
          },
          "merged_invocation": true
        },
        "display_score": 59.0,
        "display_badge": "Unsafe"
      },
      {
        "scanner_name": "nerlo-multi-source",
        "scanner_version": "0.1.0",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 11.298799762997078,
        "status": "not_applicable",
        "examined": null,
        "metadata": {
          "source": "nerlo-original",
          "per_source": [],
          "report_type": "nerlo-multi-source",
          "diverged_sources": [],
          "published_surfaces_scanned": 0
        },
        "display_score": null,
        "display_badge": "unavailable"
      },
      {
        "scanner_name": "trivy",
        "scanner_version": "0.71.0",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 1.2842200309969485,
        "status": "not_applicable",
        "examined": {
          "unit": "manifests",
          "count": 0
        },
        "metadata": {
          "source": "github-releases",
          "source_url": "https://github.com/aquasecurity/trivy/releases/tag/v0.71.0",
          "report_type": "filesystem-vulnerability",
          "install_command": "curl -sfL -o /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.71.0/trivy_0.71.0_Linux-64bit.deb && echo '<sha256>  /tmp/trivy.deb' | sha256sum -c - && dpkg -i /tmp/trivy.deb",
          "manifests_scanned": []
        },
        "display_score": null,
        "display_badge": "unavailable"
      },
      {
        "scanner_name": "osv-scanner",
        "scanner_version": "2.3.8",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 2.4471260480058845,
        "status": "complete",
        "examined": null,
        "metadata": {
          "source": "github-releases",
          "source_url": "https://github.com/google/osv-scanner/releases/tag/v2.3.8",
          "report_type": "osv-vulnerability",
          "ecosystems_seen": [],
          "install_command": "curl -sfL -o /usr/local/bin/osv-scanner https://github.com/google/osv-scanner/releases/download/v2.3.8/osv-scanner_linux_amd64 && echo '<sha256>  /usr/local/bin/osv-scanner' | sha256sum -c - && chmod +x /usr/local/bin/osv-scanner",
          "manifests_scanned": [],
          "finding_id_aliases": {},
          "cross_scanner_correlation": {
            "only_osv": [],
            "only_trivy": [],
            "intersection_ids": []
          }
        },
        "display_score": 100.0,
        "display_badge": "Verified"
      }
    ]
  },
  "report": {
    "report_id": "0b947244-39a8-43c3-9d1a-213fc90737f9",
    "format": "json",
    "generated_at": "2026-08-02T07:03:03.569283+00:00",
    "scanner_filter": null,
    "signature": null
  }
}