{
  "executive_summary": {
    "badge": "Verified",
    "security_score": 97.5,
    "view": "composite",
    "scanner_badges": {
      "agentshield": "unavailable",
      "cisco-skill-scanner": "Verified",
      "agent-audit-kit": "Verified",
      "nerlo-behavioral": "unavailable",
      "nerlo-install-instruction": "Verified",
      "nerlo-multi-source": "unavailable",
      "trivy": "unavailable",
      "osv-scanner": "unavailable",
      "trivy_image": "unavailable"
    },
    "finding_counts": {
      "critical": 0,
      "high": 0,
      "medium": 1,
      "low": 1
    },
    "recommendation": "arm-mcp-gemini meets the registry's verification bar at scan time. Keep monitoring enabled \u2014 verification reflects this commit, not future releases."
  },
  "source_provenance": {
    "repository_url": "https://github.com/arm/arm-mcp-gemini",
    "commit_sha_scanned": null,
    "license": null,
    "maintainer": null,
    "name": "arm-mcp-gemini",
    "version": "2.0.0"
  },
  "per_scanner_detail": [
    {
      "scanner_name": "agentshield",
      "scanner_version": "1.4.0",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 0.31387630400422495,
      "status": "not_applicable",
      "examined": null,
      "metadata": {
        "source": "npm",
        "source_url": "https://www.npmjs.com/package/ecc-agentshield",
        "install_command": "npm install -g ecc-agentshield@1.4.0",
        "scans_performed": []
      },
      "display_score": null,
      "display_badge": "unavailable"
    },
    {
      "scanner_name": "cisco-skill-scanner",
      "scanner_version": "2.0.11",
      "score": 92.5,
      "scanner_badge": "Verified",
      "findings": [
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "obfuscation",
          "file_path": "/repo/commands/arm-vs-x86-performance-comparison.toml",
          "line_number": null,
          "rule_identifier": "FILE_MAGIC_MISMATCH",
          "title": "File extension does not match actual content type",
          "description": "File 'arm-vs-x86-performance-comparison.toml' extension (.toml) suggests one format but Magika detected a different text format: Python source (python). This may indicate content obfuscation or a misnamed file.",
          "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious."
        }
      ],
      "execution_duration_seconds": 6.7314469370030565,
      "status": "complete",
      "examined": null,
      "metadata": {
        "source": "pypi",
        "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/",
        "report_type": "cisco-skill-sast",
        "analyzers_used": [
          "bytecode",
          "pipeline",
          "static_analyzer"
        ],
        "skills_scanned": [
          "repo"
        ],
        "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt",
        "severity_counts": {
          "low": 1,
          "high": 0,
          "medium": 1,
          "critical": 0,
          "informational": 1
        },
        "artifact_type_policy": "gemini_extension"
      },
      "display_score": 92.5,
      "display_badge": "Verified"
    },
    {
      "scanner_name": "agent-audit-kit",
      "scanner_version": "0.3.26",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 0.880566509993514,
      "status": "complete",
      "examined": null,
      "metadata": {
        "source": "pypi",
        "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/",
        "report_type": "agent-audit-kit-sast",
        "files_scanned": 6,
        "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt",
        "rules_evaluated": 211
      },
      "display_score": 100.0,
      "display_badge": "Verified"
    },
    {
      "scanner_name": "nerlo-behavioral",
      "scanner_version": "0.1.0",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 27.875655494994135,
      "status": "not_applicable",
      "examined": null,
      "metadata": {
        "source": "nerlo-original",
        "source_url": "https://github.com/nerlo-ai/nerlo",
        "report_type": "nerlo-behavioral",
        "ruleset_path": "/opt/nerlo-rules/exfiltration.yaml",
        "files_scanned": 0,
        "ruleset_paths": [
          "/opt/nerlo-rules/exfiltration.yaml",
          "/opt/nerlo-rules/clipboard_exfiltration.yaml",
          "/opt/nerlo-rules/rce_endpoint.yaml",
          "/opt/nerlo-rules/taint_egress.yaml"
        ],
        "install_command": "pip install 'semgrep==1.97.0'",
        "merged_invocation": true
      },
      "display_score": null,
      "display_badge": "unavailable"
    },
    {
      "scanner_name": "nerlo-install-instruction",
      "scanner_version": "0.1.0",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 27.875692105008056,
      "status": "complete",
      "examined": null,
      "metadata": {
        "source": "nerlo-original",
        "source_url": "https://github.com/nerlo-ai/nerlo",
        "report_type": "nerlo-install-instruction",
        "ruleset_path": "/opt/nerlo-rules/install_instructions.yaml",
        "files_scanned": 1,
        "ruleset_paths": [
          "/opt/nerlo-rules/install_instructions.yaml",
          "/opt/nerlo-rules/cursor_rules.yaml"
        ],
        "install_command": "pip install 'semgrep==1.97.0'",
        "merged_invocation": true
      },
      "display_score": 100.0,
      "display_badge": "Verified"
    },
    {
      "scanner_name": "nerlo-multi-source",
      "scanner_version": "0.1.0",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 10.870668877003482,
      "status": "not_applicable",
      "examined": null,
      "metadata": {
        "source": "nerlo-original",
        "report_type": "nerlo-multi-source",
        "published_surfaces_scanned": 0
      },
      "display_score": null,
      "display_badge": "unavailable"
    },
    {
      "scanner_name": "trivy",
      "scanner_version": "0.71.0",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 0.22563363499648403,
      "status": "not_applicable",
      "examined": null,
      "metadata": {
        "source": "github-releases",
        "source_url": "https://github.com/aquasecurity/trivy/releases/tag/v0.71.0",
        "report_type": "filesystem-vulnerability",
        "install_command": "curl -sfL -o /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.71.0/trivy_0.71.0_Linux-64bit.deb && echo '<sha256>  /tmp/trivy.deb' | sha256sum -c - && dpkg -i /tmp/trivy.deb",
        "manifests_scanned": []
      },
      "display_score": null,
      "display_badge": "unavailable"
    },
    {
      "scanner_name": "osv-scanner",
      "scanner_version": "2.3.8",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 0.1913478189962916,
      "status": "not_applicable",
      "examined": null,
      "metadata": {
        "source": "github-releases",
        "source_url": "https://github.com/google/osv-scanner/releases/tag/v2.3.8",
        "report_type": "osv-vulnerability",
        "ecosystems_seen": [],
        "install_command": "curl -sfL -o /usr/local/bin/osv-scanner https://github.com/google/osv-scanner/releases/download/v2.3.8/osv-scanner_linux_amd64 && echo '<sha256>  /usr/local/bin/osv-scanner' | sha256sum -c - && chmod +x /usr/local/bin/osv-scanner",
        "manifests_scanned": [],
        "finding_id_aliases": {},
        "cross_scanner_correlation": {
          "only_osv": [],
          "only_trivy": [],
          "intersection_ids": []
        }
      },
      "display_score": null,
      "display_badge": "unavailable"
    },
    {
      "scanner_name": "trivy_image",
      "scanner_version": "0.71.0",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 8.15100793261081e-06,
      "status": "not_applicable",
      "examined": null,
      "metadata": {
        "reason": "no OCI image acquired for this artifact"
      },
      "display_score": null,
      "display_badge": "unavailable"
    }
  ],
  "threat_model": "Threat model synthesis has not yet run for this scan. This section is generated by the registry's LLM pipeline (Req 22.3) and will appear in the next regeneration of this report.",
  "audit_chain": {
    "scan_job_id": "b9ada0a0-af3d-4727-bc36-5744a3edbbd1",
    "scan_completed_at": "2026-07-28T06:53:44.582753+00:00",
    "scanner_versions": {
      "agentshield": "1.4.0",
      "cisco-skill-scanner": "2.0.11",
      "agent-audit-kit": "0.3.26",
      "nerlo-behavioral": "0.1.0",
      "nerlo-install-instruction": "0.1.0",
      "nerlo-multi-source": "0.1.0",
      "trivy": "0.71.0",
      "osv-scanner": "2.3.8",
      "trivy_image": "0.71.0"
    },
    "scanner_base_image": "us-central1-docker.pkg.dev/nerlo-vsk-prod/nerlo/scanner-base@sha256:05580105b6f4eef09aaef9c7d7c0ee0059e060ccc2d3f9fb2e7a39a3d9c94009",
    "ai_decision_log_ids": [
      "8af29bfb-cef9-4a06-aad6-b1d2713ff15d",
      "2415fd2e-82af-46ee-90e7-511e8585cf07"
    ],
    "self_attestation_url": "http://localhost:8000/api/v1/registry/self-attestation"
  },
  "appendix": {
    "raw_scanner_reports": [
      {
        "scanner_name": "agentshield",
        "scanner_version": "1.4.0",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 0.31387630400422495,
        "status": "not_applicable",
        "examined": null,
        "metadata": {
          "source": "npm",
          "source_url": "https://www.npmjs.com/package/ecc-agentshield",
          "install_command": "npm install -g ecc-agentshield@1.4.0",
          "scans_performed": []
        },
        "display_score": null,
        "display_badge": "unavailable"
      },
      {
        "scanner_name": "cisco-skill-scanner",
        "scanner_version": "2.0.11",
        "score": 92.5,
        "scanner_badge": "Verified",
        "findings": [
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "obfuscation",
            "file_path": "/repo/commands/arm-vs-x86-performance-comparison.toml",
            "line_number": null,
            "rule_identifier": "FILE_MAGIC_MISMATCH",
            "title": "File extension does not match actual content type",
            "description": "File 'arm-vs-x86-performance-comparison.toml' extension (.toml) suggests one format but Magika detected a different text format: Python source (python). This may indicate content obfuscation or a misnamed file.",
            "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious."
          }
        ],
        "execution_duration_seconds": 6.7314469370030565,
        "status": "complete",
        "examined": null,
        "metadata": {
          "source": "pypi",
          "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/",
          "report_type": "cisco-skill-sast",
          "analyzers_used": [
            "bytecode",
            "pipeline",
            "static_analyzer"
          ],
          "skills_scanned": [
            "repo"
          ],
          "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt",
          "severity_counts": {
            "low": 1,
            "high": 0,
            "medium": 1,
            "critical": 0,
            "informational": 1
          },
          "artifact_type_policy": "gemini_extension"
        },
        "display_score": 92.5,
        "display_badge": "Verified"
      },
      {
        "scanner_name": "agent-audit-kit",
        "scanner_version": "0.3.26",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 0.880566509993514,
        "status": "complete",
        "examined": null,
        "metadata": {
          "source": "pypi",
          "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/",
          "report_type": "agent-audit-kit-sast",
          "files_scanned": 6,
          "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt",
          "rules_evaluated": 211
        },
        "display_score": 100.0,
        "display_badge": "Verified"
      },
      {
        "scanner_name": "nerlo-behavioral",
        "scanner_version": "0.1.0",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 27.875655494994135,
        "status": "not_applicable",
        "examined": null,
        "metadata": {
          "source": "nerlo-original",
          "source_url": "https://github.com/nerlo-ai/nerlo",
          "report_type": "nerlo-behavioral",
          "ruleset_path": "/opt/nerlo-rules/exfiltration.yaml",
          "files_scanned": 0,
          "ruleset_paths": [
            "/opt/nerlo-rules/exfiltration.yaml",
            "/opt/nerlo-rules/clipboard_exfiltration.yaml",
            "/opt/nerlo-rules/rce_endpoint.yaml",
            "/opt/nerlo-rules/taint_egress.yaml"
          ],
          "install_command": "pip install 'semgrep==1.97.0'",
          "merged_invocation": true
        },
        "display_score": null,
        "display_badge": "unavailable"
      },
      {
        "scanner_name": "nerlo-install-instruction",
        "scanner_version": "0.1.0",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 27.875692105008056,
        "status": "complete",
        "examined": null,
        "metadata": {
          "source": "nerlo-original",
          "source_url": "https://github.com/nerlo-ai/nerlo",
          "report_type": "nerlo-install-instruction",
          "ruleset_path": "/opt/nerlo-rules/install_instructions.yaml",
          "files_scanned": 1,
          "ruleset_paths": [
            "/opt/nerlo-rules/install_instructions.yaml",
            "/opt/nerlo-rules/cursor_rules.yaml"
          ],
          "install_command": "pip install 'semgrep==1.97.0'",
          "merged_invocation": true
        },
        "display_score": 100.0,
        "display_badge": "Verified"
      },
      {
        "scanner_name": "nerlo-multi-source",
        "scanner_version": "0.1.0",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 10.870668877003482,
        "status": "not_applicable",
        "examined": null,
        "metadata": {
          "source": "nerlo-original",
          "report_type": "nerlo-multi-source",
          "published_surfaces_scanned": 0
        },
        "display_score": null,
        "display_badge": "unavailable"
      },
      {
        "scanner_name": "trivy",
        "scanner_version": "0.71.0",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 0.22563363499648403,
        "status": "not_applicable",
        "examined": null,
        "metadata": {
          "source": "github-releases",
          "source_url": "https://github.com/aquasecurity/trivy/releases/tag/v0.71.0",
          "report_type": "filesystem-vulnerability",
          "install_command": "curl -sfL -o /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.71.0/trivy_0.71.0_Linux-64bit.deb && echo '<sha256>  /tmp/trivy.deb' | sha256sum -c - && dpkg -i /tmp/trivy.deb",
          "manifests_scanned": []
        },
        "display_score": null,
        "display_badge": "unavailable"
      },
      {
        "scanner_name": "osv-scanner",
        "scanner_version": "2.3.8",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 0.1913478189962916,
        "status": "not_applicable",
        "examined": null,
        "metadata": {
          "source": "github-releases",
          "source_url": "https://github.com/google/osv-scanner/releases/tag/v2.3.8",
          "report_type": "osv-vulnerability",
          "ecosystems_seen": [],
          "install_command": "curl -sfL -o /usr/local/bin/osv-scanner https://github.com/google/osv-scanner/releases/download/v2.3.8/osv-scanner_linux_amd64 && echo '<sha256>  /usr/local/bin/osv-scanner' | sha256sum -c - && chmod +x /usr/local/bin/osv-scanner",
          "manifests_scanned": [],
          "finding_id_aliases": {},
          "cross_scanner_correlation": {
            "only_osv": [],
            "only_trivy": [],
            "intersection_ids": []
          }
        },
        "display_score": null,
        "display_badge": "unavailable"
      },
      {
        "scanner_name": "trivy_image",
        "scanner_version": "0.71.0",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 8.15100793261081e-06,
        "status": "not_applicable",
        "examined": null,
        "metadata": {
          "reason": "no OCI image acquired for this artifact"
        },
        "display_score": null,
        "display_badge": "unavailable"
      }
    ]
  },
  "report": {
    "report_id": "70453ea7-3a47-41b4-b439-3fd380cfbd5d",
    "format": "json",
    "generated_at": "2026-07-29T04:46:38.621641+00:00",
    "scanner_filter": null,
    "signature": null
  }
}