{
  "executive_summary": {
    "badge": "Unsafe",
    "security_score": null,
    "view": "composite",
    "aggregate_verdict_withheld": false,
    "aggregate_verdict_withheld_reason": null,
    "scanner_badges": {
      "agentshield": "Verified",
      "cisco-skill-scanner": "Unsafe",
      "agent-audit-kit": "Verified",
      "bearer": "Unsafe",
      "nerlo-behavioral": "Verified",
      "nerlo-install-instruction": "Verified",
      "capslock": "not_applicable"
    },
    "finding_counts": {
      "critical": 7,
      "high": 28,
      "medium": 3,
      "low": 11,
      "informational": 3
    },
    "recommendation": "@a5c-ai/atlas-gemini-cli is NOT recommended for integration: the scan surfaced 7 critical and 28 high-severity findings. Treat the Per-Scanner Detail section as a remediation worklist and re-scan before reconsidering."
  },
  "source_provenance": {
    "repository_url": "https://github.com/a5c-ai/atlas-gemini",
    "commit_sha_scanned": null,
    "license": "MIT",
    "maintainer": "a5c.ai",
    "name": "@a5c-ai/atlas-gemini-cli",
    "version": "6.0.3"
  },
  "per_scanner_detail": [
    {
      "scanner_name": "agentshield",
      "scanner_version": "1.4.0",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 0.6715834789793007,
      "status": "complete",
      "examined": {
        "unit": "scan_targets",
        "count": 1
      },
      "metadata": {
        "source": "npm",
        "source_url": "https://www.npmjs.com/package/ecc-agentshield",
        "install_command": "npm install -g ecc-agentshield@1.4.0",
        "scans_performed": [
          "supply_chain"
        ]
      },
      "display_score": 100.0,
      "display_badge": "Verified"
    },
    {
      "scanner_name": "cisco-skill-scanner",
      "scanner_version": "2.0.11",
      "score": 0.0,
      "scanner_badge": "Unsafe",
      "findings": [
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/skills/atlas/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/skills/atlas-graph-query/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "high",
          "category": "policy_violation",
          "file_path": "/repo",
          "line_number": null,
          "rule_identifier": "LOW_ANALYZABILITY",
          "title": "Critically low analyzability score",
          "description": "Only 54% of skill content could be analyzed. 11 of 26 files are opaque to the scanner. The safety assessment has low confidence.",
          "remediation": "Replace opaque files (binaries, encrypted content) with inspectable source code to improve scan confidence."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "critical",
          "category": "command_injection",
          "file_path": "/repo/bin/cli.js",
          "line_number": 5,
          "rule_identifier": "COMMAND_INJECTION_JS_CHILD_PROCESS",
          "title": "Node.js child_process module usage for shell command execution",
          "description": "Pattern detected: require('child_process')",
          "remediation": "Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "critical",
          "category": "command_injection",
          "file_path": "/repo/bin/cli.js",
          "line_number": 49,
          "rule_identifier": "COMMAND_INJECTION_JS_CHILD_PROCESS",
          "title": "Node.js child_process module usage for shell command execution",
          "description": "Pattern detected: spawnSync(",
          "remediation": "Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "critical",
          "category": "command_injection",
          "file_path": "/repo/bin/install-shared.js",
          "line_number": 6,
          "rule_identifier": "COMMAND_INJECTION_JS_CHILD_PROCESS",
          "title": "Node.js child_process module usage for shell command execution",
          "description": "Pattern detected: require('child_process')",
          "remediation": "Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "high",
          "category": "data_exfiltration",
          "file_path": "/repo/bin/install-shared.js",
          "line_number": 30,
          "rule_identifier": "DATA_EXFIL_JS_FS_ACCESS",
          "title": "Node.js filesystem access that could read or write sensitive data",
          "description": "Pattern detected: fs.readFileSync(",
          "remediation": "Review filesystem operations. Ensure they don't access sensitive system files or credential stores"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "high",
          "category": "data_exfiltration",
          "file_path": "/repo/bin/install-shared.js",
          "line_number": 34,
          "rule_identifier": "DATA_EXFIL_JS_FS_ACCESS",
          "title": "Node.js filesystem access that could read or write sensitive data",
          "description": "Pattern detected: fs.writeFileSync(",
          "remediation": "Review filesystem operations. Ensure they don't access sensitive system files or credential stores"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "high",
          "category": "data_exfiltration",
          "file_path": "/repo/bin/install-shared.js",
          "line_number": 71,
          "rule_identifier": "DATA_EXFIL_JS_FS_ACCESS",
          "title": "Node.js filesystem access that could read or write sensitive data",
          "description": "Pattern detected: fs.readFileSync(",
          "remediation": "Review filesystem operations. Ensure they don't access sensitive system files or credential stores"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "high",
          "category": "data_exfiltration",
          "file_path": "/repo/bin/install-shared.js",
          "line_number": 79,
          "rule_identifier": "DATA_EXFIL_JS_FS_ACCESS",
          "title": "Node.js filesystem access that could read or write sensitive data",
          "description": "Pattern detected: fs.writeFileSync(",
          "remediation": "Review filesystem operations. Ensure they don't access sensitive system files or credential stores"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "critical",
          "category": "command_injection",
          "file_path": "/repo/bin/install-shared.js",
          "line_number": 131,
          "rule_identifier": "COMMAND_INJECTION_JS_CHILD_PROCESS",
          "title": "Node.js child_process module usage for shell command execution",
          "description": "Pattern detected: spawnSync(",
          "remediation": "Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "obfuscation",
          "file_path": "/repo/commands/discover.toml",
          "line_number": null,
          "rule_identifier": "FILE_MAGIC_MISMATCH",
          "title": "File extension does not match actual content type",
          "description": "File 'discover.toml' extension (.toml) suggests one format but Magika detected a different text format: Shell script (shell). This may indicate content obfuscation or a misnamed file.",
          "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "critical",
          "category": "command_injection",
          "file_path": "/repo/scripts/create-release-tag.mjs",
          "line_number": 6,
          "rule_identifier": "COMMAND_INJECTION_JS_CHILD_PROCESS",
          "title": "Node.js child_process module usage for shell command execution",
          "description": "Pattern detected: spawnSync(",
          "remediation": "Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings"
        }
      ],
      "execution_duration_seconds": 7.42511402600212,
      "status": "complete",
      "examined": {
        "unit": "skills",
        "count": 3
      },
      "metadata": {
        "source": "pypi",
        "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/",
        "report_type": "cisco-skill-sast",
        "analyzers_used": [
          "bytecode",
          "pipeline",
          "static_analyzer"
        ],
        "skills_scanned": [
          "atlas",
          "atlas-graph-query",
          "repo"
        ],
        "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt",
        "severity_counts": {
          "low": 1,
          "high": 5,
          "medium": 1,
          "critical": 5,
          "informational": 3
        },
        "artifact_type_policy": "gemini_extension"
      },
      "display_score": 0.0,
      "display_badge": "Unsafe"
    },
    {
      "scanner_name": "agent-audit-kit",
      "scanner_version": "0.3.26",
      "score": 90.0,
      "scanner_badge": "Verified",
      "findings": [
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "supply-chain",
          "file_path": "package.json",
          "line_number": null,
          "rule_identifier": "AAK-SUPPLY-004",
          "title": "No lockfile present",
          "description": "A package manifest exists but no lockfile was found. Without lockfiles, dependency versions float and can be silently updated.",
          "remediation": "Generate and commit lockfile."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "supply-chain",
          "file_path": ".github/workflows/publish.yml",
          "line_number": 28,
          "rule_identifier": "AAK-GHA-IMMUTABLE-001",
          "title": "Third-party GitHub Action not pinned by full commit SHA",
          "description": "A workflow in `.github/workflows/` uses a third-party Action (`owner/action@ref`) where `ref` is a tag or branch name instead of a 40-character commit SHA. A repo-takeover of the Action's publisher can re-point the tag to a malicious revision \u2014 the downstream repo consuming it will happily run the new code with `GITHUB_TOKEN` and write permissions. GitHub's April 2026 Security Roadmap ships Immutable Actions and makes SHA pinning the default policy.",
          "remediation": "Repin third-party Actions to a 40-character commit SHA and add a `# v1.2.3`-style trailing comment for humans. First-party Actions under `actions/` and `github/` are exempt (they now ship Immutable Actions). Dependabot will auto-bump SHA pins when `update-type: all` is set."
        }
      ],
      "execution_duration_seconds": 0.8192450880305842,
      "status": "complete",
      "examined": {
        "unit": "files",
        "count": 26
      },
      "metadata": {
        "source": "pypi",
        "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/",
        "report_type": "agent-audit-kit-sast",
        "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt",
        "rules_evaluated": 211,
        "severity_counts": {
          "low": 0,
          "high": 0,
          "medium": 2,
          "critical": 0,
          "informational": 0
        }
      },
      "display_score": 90.0,
      "display_badge": "Verified"
    },
    {
      "scanner_name": "bearer",
      "scanner_version": "2.0.2",
      "score": 0.0,
      "scanner_badge": "Unsafe",
      "findings": [
        {
          "tool_name": "bearer",
          "severity": "critical",
          "category": null,
          "file_path": "/repo/bin/cli.js",
          "line_number": 49,
          "rule_identifier": null,
          "title": "Unsanitized dynamic input in OS command",
          "description": "## Description\n\nIncorporating unsanitized dynamic input directly into operating system commands poses a significant security risk. This practice could give attackers the opportunity to execute harmful commands on your system.\n\n## Remediations\n\n- **Do** use static, hardcoded values in command strings - wherever possible - to avoid relying on dynamic data.\n  ```javascript\n  let filePattern = \"*.js\";\n  cp.exec(`cp ${filePattern} destinationFolder`, (error, stdout, stderr) => {});\n  ```\n- **Do** san",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "critical",
          "category": null,
          "file_path": "/repo/bin/install-shared.js",
          "line_number": 131,
          "rule_identifier": null,
          "title": "Unsanitized dynamic input in OS command",
          "description": "## Description\n\nIncorporating unsanitized dynamic input directly into operating system commands poses a significant security risk. This practice could give attackers the opportunity to execute harmful commands on your system.\n\n## Remediations\n\n- **Do** use static, hardcoded values in command strings - wherever possible - to avoid relying on dynamic data.\n  ```javascript\n  let filePattern = \"*.js\";\n  cp.exec(`cp ${filePattern} destinationFolder`, (error, stdout, stderr) => {});\n  ```\n- **Do** san",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "high",
          "category": null,
          "file_path": "/repo/bin/install-shared.js",
          "line_number": 84,
          "rule_identifier": null,
          "title": "Permissive file assignment",
          "description": "## Description\n\nPermissive file assignment exposes sensitive information by granting unnecessary read, write, or execute permissions to users without ownership privileges.\n\n## Remediations\n\n- **Do** keep file permissions as restrictive as possible to minimize the risk of unauthorized access. Use the principle of least privilege to only grant permissions that are absolutely necessary for the operation of the application.\n  ```javascript\n  fs.chmod(path, 0o600);\n  ```\n- **Do** prefer assigning fil",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "high",
          "category": null,
          "file_path": "/repo/bin/install-shared.js",
          "line_number": 30,
          "rule_identifier": null,
          "title": "Unsanitized dynamic input in file path",
          "description": "## Description\n\nAllowing unsanitized dynamic input in file paths can lead to unauthorized file and folder access. This vulnerability arises when dynamic data is used within the file system operations, potentially allowing attackers to access unauthorized or hidden files and folders.\n\n## Remediations\n\n- **Do** sanitize all dynamic data and function arguments before using them in file system operations. This step is crucial to prevent unauthorized access.\n- **Do** use a combination of hard-coded s",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "high",
          "category": null,
          "file_path": "/repo/bin/install-shared.js",
          "line_number": 33,
          "rule_identifier": null,
          "title": "Unsanitized dynamic input in file path",
          "description": "## Description\n\nAllowing unsanitized dynamic input in file paths can lead to unauthorized file and folder access. This vulnerability arises when dynamic data is used within the file system operations, potentially allowing attackers to access unauthorized or hidden files and folders.\n\n## Remediations\n\n- **Do** sanitize all dynamic data and function arguments before using them in file system operations. This step is crucial to prevent unauthorized access.\n- **Do** use a combination of hard-coded s",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "high",
          "category": null,
          "file_path": "/repo/bin/install-shared.js",
          "line_number": 34,
          "rule_identifier": null,
          "title": "Unsanitized dynamic input in file path",
          "description": "## Description\n\nAllowing unsanitized dynamic input in file paths can lead to unauthorized file and folder access. This vulnerability arises when dynamic data is used within the file system operations, potentially allowing attackers to access unauthorized or hidden files and folders.\n\n## Remediations\n\n- **Do** sanitize all dynamic data and function arguments before using them in file system operations. This step is crucial to prevent unauthorized access.\n- **Do** use a combination of hard-coded s",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "high",
          "category": null,
          "file_path": "/repo/bin/install-shared.js",
          "line_number": 39,
          "rule_identifier": null,
          "title": "Unsanitized dynamic input in file path",
          "description": "## Description\n\nAllowing unsanitized dynamic input in file paths can lead to unauthorized file and folder access. This vulnerability arises when dynamic data is used within the file system operations, potentially allowing attackers to access unauthorized or hidden files and folders.\n\n## Remediations\n\n- **Do** sanitize all dynamic data and function arguments before using them in file system operations. This step is crucial to prevent unauthorized access.\n- **Do** use a combination of hard-coded s",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "high",
          "category": null,
          "file_path": "/repo/bin/install-shared.js",
          "line_number": 40,
          "rule_identifier": null,
          "title": "Unsanitized dynamic input in file path",
          "description": "## Description\n\nAllowing unsanitized dynamic input in file paths can lead to unauthorized file and folder access. This vulnerability arises when dynamic data is used within the file system operations, potentially allowing attackers to access unauthorized or hidden files and folders.\n\n## Remediations\n\n- **Do** sanitize all dynamic data and function arguments before using them in file system operations. This step is crucial to prevent unauthorized access.\n- **Do** use a combination of hard-coded s",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "high",
          "category": null,
          "file_path": "/repo/bin/install-shared.js",
          "line_number": 47,
          "rule_identifier": null,
          "title": "Unsanitized dynamic input in file path",
          "description": "## Description\n\nAllowing unsanitized dynamic input in file paths can lead to unauthorized file and folder access. This vulnerability arises when dynamic data is used within the file system operations, potentially allowing attackers to access unauthorized or hidden files and folders.\n\n## Remediations\n\n- **Do** sanitize all dynamic data and function arguments before using them in file system operations. This step is crucial to prevent unauthorized access.\n- **Do** use a combination of hard-coded s",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "high",
          "category": null,
          "file_path": "/repo/bin/install-shared.js",
          "line_number": 53,
          "rule_identifier": null,
          "title": "Unsanitized dynamic input in file path",
          "description": "## Description\n\nAllowing unsanitized dynamic input in file paths can lead to unauthorized file and folder access. This vulnerability arises when dynamic data is used within the file system operations, potentially allowing attackers to access unauthorized or hidden files and folders.\n\n## Remediations\n\n- **Do** sanitize all dynamic data and function arguments before using them in file system operations. This step is crucial to prevent unauthorized access.\n- **Do** use a combination of hard-coded s",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "high",
          "category": null,
          "file_path": "/repo/bin/install-shared.js",
          "line_number": 56,
          "rule_identifier": null,
          "title": "Unsanitized dynamic input in file path",
          "description": "## Description\n\nAllowing unsanitized dynamic input in file paths can lead to unauthorized file and folder access. This vulnerability arises when dynamic data is used within the file system operations, potentially allowing attackers to access unauthorized or hidden files and folders.\n\n## Remediations\n\n- **Do** sanitize all dynamic data and function arguments before using them in file system operations. This step is crucial to prevent unauthorized access.\n- **Do** use a combination of hard-coded s",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "high",
          "category": null,
          "file_path": "/repo/bin/install-shared.js",
          "line_number": 60,
          "rule_identifier": null,
          "title": "Unsanitized dynamic input in file path",
          "description": "## Description\n\nAllowing unsanitized dynamic input in file paths can lead to unauthorized file and folder access. This vulnerability arises when dynamic data is used within the file system operations, potentially allowing attackers to access unauthorized or hidden files and folders.\n\n## Remediations\n\n- **Do** sanitize all dynamic data and function arguments before using them in file system operations. This step is crucial to prevent unauthorized access.\n- **Do** use a combination of hard-coded s",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "high",
          "category": null,
          "file_path": "/repo/bin/install-shared.js",
          "line_number": 64,
          "rule_identifier": null,
          "title": "Unsanitized dynamic input in file path",
          "description": "## Description\n\nAllowing unsanitized dynamic input in file paths can lead to unauthorized file and folder access. This vulnerability arises when dynamic data is used within the file system operations, potentially allowing attackers to access unauthorized or hidden files and folders.\n\n## Remediations\n\n- **Do** sanitize all dynamic data and function arguments before using them in file system operations. This step is crucial to prevent unauthorized access.\n- **Do** use a combination of hard-coded s",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "high",
          "category": null,
          "file_path": "/repo/bin/install-shared.js",
          "line_number": 71,
          "rule_identifier": null,
          "title": "Unsanitized dynamic input in file path",
          "description": "## Description\n\nAllowing unsanitized dynamic input in file paths can lead to unauthorized file and folder access. This vulnerability arises when dynamic data is used within the file system operations, potentially allowing attackers to access unauthorized or hidden files and folders.\n\n## Remediations\n\n- **Do** sanitize all dynamic data and function arguments before using them in file system operations. This step is crucial to prevent unauthorized access.\n- **Do** use a combination of hard-coded s",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "high",
          "category": null,
          "file_path": "/repo/bin/install-shared.js",
          "line_number": 78,
          "rule_identifier": null,
          "title": "Unsanitized dynamic input in file path",
          "description": "## Description\n\nAllowing unsanitized dynamic input in file paths can lead to unauthorized file and folder access. This vulnerability arises when dynamic data is used within the file system operations, potentially allowing attackers to access unauthorized or hidden files and folders.\n\n## Remediations\n\n- **Do** sanitize all dynamic data and function arguments before using them in file system operations. This step is crucial to prevent unauthorized access.\n- **Do** use a combination of hard-coded s",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "high",
          "category": null,
          "file_path": "/repo/bin/install-shared.js",
          "line_number": 79,
          "rule_identifier": null,
          "title": "Unsanitized dynamic input in file path",
          "description": "## Description\n\nAllowing unsanitized dynamic input in file paths can lead to unauthorized file and folder access. This vulnerability arises when dynamic data is used within the file system operations, potentially allowing attackers to access unauthorized or hidden files and folders.\n\n## Remediations\n\n- **Do** sanitize all dynamic data and function arguments before using them in file system operations. This step is crucial to prevent unauthorized access.\n- **Do** use a combination of hard-coded s",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "high",
          "category": null,
          "file_path": "/repo/bin/install-shared.js",
          "line_number": 84,
          "rule_identifier": null,
          "title": "Unsanitized dynamic input in file path",
          "description": "## Description\n\nAllowing unsanitized dynamic input in file paths can lead to unauthorized file and folder access. This vulnerability arises when dynamic data is used within the file system operations, potentially allowing attackers to access unauthorized or hidden files and folders.\n\n## Remediations\n\n- **Do** sanitize all dynamic data and function arguments before using them in file system operations. This step is crucial to prevent unauthorized access.\n- **Do** use a combination of hard-coded s",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "high",
          "category": null,
          "file_path": "/repo/bin/uninstall.js",
          "line_number": 13,
          "rule_identifier": null,
          "title": "Unsanitized dynamic input in file path",
          "description": "## Description\n\nAllowing unsanitized dynamic input in file paths can lead to unauthorized file and folder access. This vulnerability arises when dynamic data is used within the file system operations, potentially allowing attackers to access unauthorized or hidden files and folders.\n\n## Remediations\n\n- **Do** sanitize all dynamic data and function arguments before using them in file system operations. This step is crucial to prevent unauthorized access.\n- **Do** use a combination of hard-coded s",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "high",
          "category": null,
          "file_path": "/repo/bin/uninstall.js",
          "line_number": 17,
          "rule_identifier": null,
          "title": "Unsanitized dynamic input in file path",
          "description": "## Description\n\nAllowing unsanitized dynamic input in file paths can lead to unauthorized file and folder access. This vulnerability arises when dynamic data is used within the file system operations, potentially allowing attackers to access unauthorized or hidden files and folders.\n\n## Remediations\n\n- **Do** sanitize all dynamic data and function arguments before using them in file system operations. This step is crucial to prevent unauthorized access.\n- **Do** use a combination of hard-coded s",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "high",
          "category": null,
          "file_path": "/repo/bin/cli.js",
          "line_number": 35,
          "rule_identifier": null,
          "title": "Unsanitized dynamic input in file path",
          "description": "## Description\n\nUsing unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.\n\n## Remediations\n\n- **Do not** directly use user input to construct file paths. This can lead to unauthorized file access.\n- **Do** sanitize user input used in file paths. Replace patterns that can nav",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "high",
          "category": null,
          "file_path": "/repo/bin/install-shared.js",
          "line_number": 42,
          "rule_identifier": null,
          "title": "Unsanitized dynamic input in file path",
          "description": "## Description\n\nUsing unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.\n\n## Remediations\n\n- **Do not** directly use user input to construct file paths. This can lead to unauthorized file access.\n- **Do** sanitize user input used in file paths. Replace patterns that can nav",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "high",
          "category": null,
          "file_path": "/repo/bin/install-shared.js",
          "line_number": 43,
          "rule_identifier": null,
          "title": "Unsanitized dynamic input in file path",
          "description": "## Description\n\nUsing unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.\n\n## Remediations\n\n- **Do not** directly use user input to construct file paths. This can lead to unauthorized file access.\n- **Do** sanitize user input used in file paths. Replace patterns that can nav",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "high",
          "category": null,
          "file_path": "/repo/bin/install-shared.js",
          "line_number": 58,
          "rule_identifier": null,
          "title": "Unsanitized dynamic input in file path",
          "description": "## Description\n\nUsing unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.\n\n## Remediations\n\n- **Do not** directly use user input to construct file paths. This can lead to unauthorized file access.\n- **Do** sanitize user input used in file paths. Replace patterns that can nav",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "high",
          "category": null,
          "file_path": "/repo/bin/install-shared.js",
          "line_number": 59,
          "rule_identifier": null,
          "title": "Unsanitized dynamic input in file path",
          "description": "## Description\n\nUsing unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.\n\n## Remediations\n\n- **Do not** directly use user input to construct file paths. This can lead to unauthorized file access.\n- **Do** sanitize user input used in file paths. Replace patterns that can nav",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "high",
          "category": null,
          "file_path": "/repo/bin/install-shared.js",
          "line_number": 129,
          "rule_identifier": null,
          "title": "Unsanitized dynamic input in file path",
          "description": "## Description\n\nUsing unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.\n\n## Remediations\n\n- **Do not** directly use user input to construct file paths. This can lead to unauthorized file access.\n- **Do** sanitize user input used in file paths. Replace patterns that can nav",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "low",
          "category": null,
          "file_path": "/repo/bin/cli.js",
          "line_number": 12,
          "rule_identifier": null,
          "title": "Leakage of information in logger message",
          "description": "## Description\n\nInformation leakage through logger messages can compromise sensitive data. This vulnerability arises when dynamic data or variables, which may contain sensitive information, are included in log messages.\n\n## Remediations\n\n- **Do not** include sensitive data directly in logger messages. This can lead to the exposure of such data in log files, which might be accessible to unauthorized individuals.\n  ```javascript\n  logger.info(`Results: ${data}`) // unsafe\n  ```\n- **Do** use loggin",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "low",
          "category": null,
          "file_path": "/repo/bin/install.js",
          "line_number": 13,
          "rule_identifier": null,
          "title": "Leakage of information in logger message",
          "description": "## Description\n\nInformation leakage through logger messages can compromise sensitive data. This vulnerability arises when dynamic data or variables, which may contain sensitive information, are included in log messages.\n\n## Remediations\n\n- **Do not** include sensitive data directly in logger messages. This can lead to the exposure of such data in log files, which might be accessible to unauthorized individuals.\n  ```javascript\n  logger.info(`Results: ${data}`) // unsafe\n  ```\n- **Do** use loggin",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "low",
          "category": null,
          "file_path": "/repo/bin/install.js",
          "line_number": 22,
          "rule_identifier": null,
          "title": "Leakage of information in logger message",
          "description": "## Description\n\nInformation leakage through logger messages can compromise sensitive data. This vulnerability arises when dynamic data or variables, which may contain sensitive information, are included in log messages.\n\n## Remediations\n\n- **Do not** include sensitive data directly in logger messages. This can lead to the exposure of such data in log files, which might be accessible to unauthorized individuals.\n  ```javascript\n  logger.info(`Results: ${data}`) // unsafe\n  ```\n- **Do** use loggin",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "low",
          "category": null,
          "file_path": "/repo/bin/install.js",
          "line_number": 23,
          "rule_identifier": null,
          "title": "Leakage of information in logger message",
          "description": "## Description\n\nInformation leakage through logger messages can compromise sensitive data. This vulnerability arises when dynamic data or variables, which may contain sensitive information, are included in log messages.\n\n## Remediations\n\n- **Do not** include sensitive data directly in logger messages. This can lead to the exposure of such data in log files, which might be accessible to unauthorized individuals.\n  ```javascript\n  logger.info(`Results: ${data}`) // unsafe\n  ```\n- **Do** use loggin",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "low",
          "category": null,
          "file_path": "/repo/bin/install.js",
          "line_number": 25,
          "rule_identifier": null,
          "title": "Leakage of information in logger message",
          "description": "## Description\n\nInformation leakage through logger messages can compromise sensitive data. This vulnerability arises when dynamic data or variables, which may contain sensitive information, are included in log messages.\n\n## Remediations\n\n- **Do not** include sensitive data directly in logger messages. This can lead to the exposure of such data in log files, which might be accessible to unauthorized individuals.\n  ```javascript\n  logger.info(`Results: ${data}`) // unsafe\n  ```\n- **Do** use loggin",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "low",
          "category": null,
          "file_path": "/repo/bin/uninstall.js",
          "line_number": 14,
          "rule_identifier": null,
          "title": "Leakage of information in logger message",
          "description": "## Description\n\nInformation leakage through logger messages can compromise sensitive data. This vulnerability arises when dynamic data or variables, which may contain sensitive information, are included in log messages.\n\n## Remediations\n\n- **Do not** include sensitive data directly in logger messages. This can lead to the exposure of such data in log files, which might be accessible to unauthorized individuals.\n  ```javascript\n  logger.info(`Results: ${data}`) // unsafe\n  ```\n- **Do** use loggin",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "low",
          "category": null,
          "file_path": "/repo/bin/uninstall.js",
          "line_number": 18,
          "rule_identifier": null,
          "title": "Leakage of information in logger message",
          "description": "## Description\n\nInformation leakage through logger messages can compromise sensitive data. This vulnerability arises when dynamic data or variables, which may contain sensitive information, are included in log messages.\n\n## Remediations\n\n- **Do not** include sensitive data directly in logger messages. This can lead to the exposure of such data in log files, which might be accessible to unauthorized individuals.\n  ```javascript\n  logger.info(`Results: ${data}`) // unsafe\n  ```\n- **Do** use loggin",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "low",
          "category": null,
          "file_path": "/repo/bin/uninstall.js",
          "line_number": 20,
          "rule_identifier": null,
          "title": "Leakage of information in logger message",
          "description": "## Description\n\nInformation leakage through logger messages can compromise sensitive data. This vulnerability arises when dynamic data or variables, which may contain sensitive information, are included in log messages.\n\n## Remediations\n\n- **Do not** include sensitive data directly in logger messages. This can lead to the exposure of such data in log files, which might be accessible to unauthorized individuals.\n  ```javascript\n  logger.info(`Results: ${data}`) // unsafe\n  ```\n- **Do** use loggin",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "low",
          "category": null,
          "file_path": "/repo/bin/uninstall.js",
          "line_number": 32,
          "rule_identifier": null,
          "title": "Leakage of information in logger message",
          "description": "## Description\n\nInformation leakage through logger messages can compromise sensitive data. This vulnerability arises when dynamic data or variables, which may contain sensitive information, are included in log messages.\n\n## Remediations\n\n- **Do not** include sensitive data directly in logger messages. This can lead to the exposure of such data in log files, which might be accessible to unauthorized individuals.\n  ```javascript\n  logger.info(`Results: ${data}`) // unsafe\n  ```\n- **Do** use loggin",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "low",
          "category": null,
          "file_path": "/repo/scripts/team-install.js",
          "line_number": 16,
          "rule_identifier": null,
          "title": "Leakage of information in logger message",
          "description": "## Description\n\nInformation leakage through logger messages can compromise sensitive data. This vulnerability arises when dynamic data or variables, which may contain sensitive information, are included in log messages.\n\n## Remediations\n\n- **Do not** include sensitive data directly in logger messages. This can lead to the exposure of such data in log files, which might be accessible to unauthorized individuals.\n  ```javascript\n  logger.info(`Results: ${data}`) // unsafe\n  ```\n- **Do** use loggin",
          "remediation": null
        }
      ],
      "execution_duration_seconds": 6.993098220031243,
      "status": "complete",
      "examined": {
        "unit": "files",
        "count": 11
      },
      "metadata": {
        "source": "github-releases",
        "source_url": "https://github.com/Bearer/bearer",
        "report_type": "security",
        "rules_loaded": 554,
        "install_command": "curl -sfL https://raw.githubusercontent.com/Bearer/bearer/main/contrib/install.sh | sh -s -- -b /usr/local/bin \"v2.0.2\"",
        "severity_counts": {
          "low": 10,
          "high": 23,
          "medium": 0,
          "critical": 2,
          "informational": 0
        }
      },
      "display_score": 0.0,
      "display_badge": "Unsafe"
    },
    {
      "scanner_name": "nerlo-behavioral",
      "scanner_version": "0.1.0",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 3.528077694005333,
      "status": "complete",
      "examined": {
        "unit": "files",
        "count": 11
      },
      "metadata": {
        "source": "nerlo-original",
        "source_url": "https://github.com/nerlo-ai/nerlo",
        "report_type": "nerlo-behavioral",
        "ruleset_path": "/opt/nerlo-rules/exfiltration.yaml",
        "ruleset_paths": [
          "/opt/nerlo-rules/exfiltration.yaml",
          "/opt/nerlo-rules/clipboard_exfiltration.yaml",
          "/opt/nerlo-rules/rce_endpoint.yaml",
          "/opt/nerlo-rules/taint_egress.yaml"
        ],
        "install_command": "pip install 'semgrep==1.97.0'",
        "merged_invocation": true
      },
      "display_score": 100.0,
      "display_badge": "Verified"
    },
    {
      "scanner_name": "nerlo-install-instruction",
      "scanner_version": "0.1.0",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 3.528165113995783,
      "status": "complete",
      "examined": {
        "unit": "files",
        "count": 7
      },
      "metadata": {
        "source": "nerlo-original",
        "source_url": "https://github.com/nerlo-ai/nerlo",
        "report_type": "nerlo-install-instruction",
        "ruleset_path": "/opt/nerlo-rules/install_instructions.yaml",
        "ruleset_paths": [
          "/opt/nerlo-rules/install_instructions.yaml",
          "/opt/nerlo-rules/cursor_rules.yaml"
        ],
        "install_command": "pip install 'semgrep==1.97.0'",
        "merged_invocation": true
      },
      "display_score": 100.0,
      "display_badge": "Verified"
    },
    {
      "scanner_name": "capslock",
      "scanner_version": "v0.3.2",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 0.10028183698887005,
      "status": "not_applicable",
      "examined": {
        "unit": "packages",
        "count": 0
      },
      "metadata": {
        "source": "go-module-proxy",
        "source_url": "https://github.com/google/capslock/releases/tag/v0.3.2",
        "report_type": "go-capability",
        "vendor_mode": false,
        "install_command": "GOTOOLCHAIN=local GOFLAGS=-mod=mod GOSUMDB=sum.golang.org GOBIN=/usr/local/bin go install github.com/google/capslock/cmd/capslock@v0.3.2  # github.com/google/capslock v0.3.2 h1:0ZQa9YR8s9ewFu1g5w6Rgd/lW/4dga7qJew3K6Ql7aM=",
        "environment_note": "capslock found no .go files to analyze; reported not_applicable rather than a clean 100 \u2014 the scanner never ran, so it has no verdict to contribute",
        "go_files_present": 0,
        "artifact_type_policy": "gemini_extension",
        "expected_capabilities": null,
        "artifact_type_explicit": true
      },
      "display_score": null,
      "display_badge": "not_applicable"
    }
  ],
  "threat_model": "Threat model synthesis has not yet run for this scan. This section is generated by the registry's LLM pipeline (Req 22.3) and will appear in the next regeneration of this report.",
  "audit_chain": {
    "scan_job_id": "bfab9b6d-2573-4682-96f7-c6ca426d482f",
    "scan_completed_at": "2026-08-12T17:10:13.283445+00:00",
    "scanner_versions": {
      "agentshield": "1.4.0",
      "cisco-skill-scanner": "2.0.11",
      "agent-audit-kit": "0.3.26",
      "bearer": "2.0.2",
      "nerlo-behavioral": "0.1.0",
      "nerlo-install-instruction": "0.1.0",
      "capslock": "v0.3.2"
    },
    "scanner_base_image": "us-central1-docker.pkg.dev/nerlo-vsk-prod/nerlo/scanner-base@sha256:d5aaefa8b517d1f03832091ab094e20dc73160a07ae1102af1b2e395ce6ce852",
    "ai_decision_log_ids": [
      "1976a15b-338a-4f6b-8919-53fb22adc3fd"
    ],
    "self_attestation_url": "http://localhost:8000/api/v1/registry/self-attestation"
  },
  "appendix": {
    "raw_scanner_reports": [
      {
        "scanner_name": "agentshield",
        "scanner_version": "1.4.0",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 0.6715834789793007,
        "status": "complete",
        "examined": {
          "unit": "scan_targets",
          "count": 1
        },
        "metadata": {
          "source": "npm",
          "source_url": "https://www.npmjs.com/package/ecc-agentshield",
          "install_command": "npm install -g ecc-agentshield@1.4.0",
          "scans_performed": [
            "supply_chain"
          ]
        },
        "display_score": 100.0,
        "display_badge": "Verified"
      },
      {
        "scanner_name": "cisco-skill-scanner",
        "scanner_version": "2.0.11",
        "score": 0.0,
        "scanner_badge": "Unsafe",
        "findings": [
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/skills/atlas/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/skills/atlas-graph-query/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "high",
            "category": "policy_violation",
            "file_path": "/repo",
            "line_number": null,
            "rule_identifier": "LOW_ANALYZABILITY",
            "title": "Critically low analyzability score",
            "description": "Only 54% of skill content could be analyzed. 11 of 26 files are opaque to the scanner. The safety assessment has low confidence.",
            "remediation": "Replace opaque files (binaries, encrypted content) with inspectable source code to improve scan confidence."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "critical",
            "category": "command_injection",
            "file_path": "/repo/bin/cli.js",
            "line_number": 5,
            "rule_identifier": "COMMAND_INJECTION_JS_CHILD_PROCESS",
            "title": "Node.js child_process module usage for shell command execution",
            "description": "Pattern detected: require('child_process')",
            "remediation": "Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "critical",
            "category": "command_injection",
            "file_path": "/repo/bin/cli.js",
            "line_number": 49,
            "rule_identifier": "COMMAND_INJECTION_JS_CHILD_PROCESS",
            "title": "Node.js child_process module usage for shell command execution",
            "description": "Pattern detected: spawnSync(",
            "remediation": "Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "critical",
            "category": "command_injection",
            "file_path": "/repo/bin/install-shared.js",
            "line_number": 6,
            "rule_identifier": "COMMAND_INJECTION_JS_CHILD_PROCESS",
            "title": "Node.js child_process module usage for shell command execution",
            "description": "Pattern detected: require('child_process')",
            "remediation": "Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "high",
            "category": "data_exfiltration",
            "file_path": "/repo/bin/install-shared.js",
            "line_number": 30,
            "rule_identifier": "DATA_EXFIL_JS_FS_ACCESS",
            "title": "Node.js filesystem access that could read or write sensitive data",
            "description": "Pattern detected: fs.readFileSync(",
            "remediation": "Review filesystem operations. Ensure they don't access sensitive system files or credential stores"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "high",
            "category": "data_exfiltration",
            "file_path": "/repo/bin/install-shared.js",
            "line_number": 34,
            "rule_identifier": "DATA_EXFIL_JS_FS_ACCESS",
            "title": "Node.js filesystem access that could read or write sensitive data",
            "description": "Pattern detected: fs.writeFileSync(",
            "remediation": "Review filesystem operations. Ensure they don't access sensitive system files or credential stores"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "high",
            "category": "data_exfiltration",
            "file_path": "/repo/bin/install-shared.js",
            "line_number": 71,
            "rule_identifier": "DATA_EXFIL_JS_FS_ACCESS",
            "title": "Node.js filesystem access that could read or write sensitive data",
            "description": "Pattern detected: fs.readFileSync(",
            "remediation": "Review filesystem operations. Ensure they don't access sensitive system files or credential stores"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "high",
            "category": "data_exfiltration",
            "file_path": "/repo/bin/install-shared.js",
            "line_number": 79,
            "rule_identifier": "DATA_EXFIL_JS_FS_ACCESS",
            "title": "Node.js filesystem access that could read or write sensitive data",
            "description": "Pattern detected: fs.writeFileSync(",
            "remediation": "Review filesystem operations. Ensure they don't access sensitive system files or credential stores"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "critical",
            "category": "command_injection",
            "file_path": "/repo/bin/install-shared.js",
            "line_number": 131,
            "rule_identifier": "COMMAND_INJECTION_JS_CHILD_PROCESS",
            "title": "Node.js child_process module usage for shell command execution",
            "description": "Pattern detected: spawnSync(",
            "remediation": "Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "obfuscation",
            "file_path": "/repo/commands/discover.toml",
            "line_number": null,
            "rule_identifier": "FILE_MAGIC_MISMATCH",
            "title": "File extension does not match actual content type",
            "description": "File 'discover.toml' extension (.toml) suggests one format but Magika detected a different text format: Shell script (shell). This may indicate content obfuscation or a misnamed file.",
            "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "critical",
            "category": "command_injection",
            "file_path": "/repo/scripts/create-release-tag.mjs",
            "line_number": 6,
            "rule_identifier": "COMMAND_INJECTION_JS_CHILD_PROCESS",
            "title": "Node.js child_process module usage for shell command execution",
            "description": "Pattern detected: spawnSync(",
            "remediation": "Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings"
          }
        ],
        "execution_duration_seconds": 7.42511402600212,
        "status": "complete",
        "examined": {
          "unit": "skills",
          "count": 3
        },
        "metadata": {
          "source": "pypi",
          "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/",
          "report_type": "cisco-skill-sast",
          "analyzers_used": [
            "bytecode",
            "pipeline",
            "static_analyzer"
          ],
          "skills_scanned": [
            "atlas",
            "atlas-graph-query",
            "repo"
          ],
          "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt",
          "severity_counts": {
            "low": 1,
            "high": 5,
            "medium": 1,
            "critical": 5,
            "informational": 3
          },
          "artifact_type_policy": "gemini_extension"
        },
        "display_score": 0.0,
        "display_badge": "Unsafe"
      },
      {
        "scanner_name": "agent-audit-kit",
        "scanner_version": "0.3.26",
        "score": 90.0,
        "scanner_badge": "Verified",
        "findings": [
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "supply-chain",
            "file_path": "package.json",
            "line_number": null,
            "rule_identifier": "AAK-SUPPLY-004",
            "title": "No lockfile present",
            "description": "A package manifest exists but no lockfile was found. Without lockfiles, dependency versions float and can be silently updated.",
            "remediation": "Generate and commit lockfile."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "supply-chain",
            "file_path": ".github/workflows/publish.yml",
            "line_number": 28,
            "rule_identifier": "AAK-GHA-IMMUTABLE-001",
            "title": "Third-party GitHub Action not pinned by full commit SHA",
            "description": "A workflow in `.github/workflows/` uses a third-party Action (`owner/action@ref`) where `ref` is a tag or branch name instead of a 40-character commit SHA. A repo-takeover of the Action's publisher can re-point the tag to a malicious revision \u2014 the downstream repo consuming it will happily run the new code with `GITHUB_TOKEN` and write permissions. GitHub's April 2026 Security Roadmap ships Immutable Actions and makes SHA pinning the default policy.",
            "remediation": "Repin third-party Actions to a 40-character commit SHA and add a `# v1.2.3`-style trailing comment for humans. First-party Actions under `actions/` and `github/` are exempt (they now ship Immutable Actions). Dependabot will auto-bump SHA pins when `update-type: all` is set."
          }
        ],
        "execution_duration_seconds": 0.8192450880305842,
        "status": "complete",
        "examined": {
          "unit": "files",
          "count": 26
        },
        "metadata": {
          "source": "pypi",
          "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/",
          "report_type": "agent-audit-kit-sast",
          "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt",
          "rules_evaluated": 211,
          "severity_counts": {
            "low": 0,
            "high": 0,
            "medium": 2,
            "critical": 0,
            "informational": 0
          }
        },
        "display_score": 90.0,
        "display_badge": "Verified"
      },
      {
        "scanner_name": "bearer",
        "scanner_version": "2.0.2",
        "score": 0.0,
        "scanner_badge": "Unsafe",
        "findings": [
          {
            "tool_name": "bearer",
            "severity": "critical",
            "category": null,
            "file_path": "/repo/bin/cli.js",
            "line_number": 49,
            "rule_identifier": null,
            "title": "Unsanitized dynamic input in OS command",
            "description": "## Description\n\nIncorporating unsanitized dynamic input directly into operating system commands poses a significant security risk. This practice could give attackers the opportunity to execute harmful commands on your system.\n\n## Remediations\n\n- **Do** use static, hardcoded values in command strings - wherever possible - to avoid relying on dynamic data.\n  ```javascript\n  let filePattern = \"*.js\";\n  cp.exec(`cp ${filePattern} destinationFolder`, (error, stdout, stderr) => {});\n  ```\n- **Do** san",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "critical",
            "category": null,
            "file_path": "/repo/bin/install-shared.js",
            "line_number": 131,
            "rule_identifier": null,
            "title": "Unsanitized dynamic input in OS command",
            "description": "## Description\n\nIncorporating unsanitized dynamic input directly into operating system commands poses a significant security risk. This practice could give attackers the opportunity to execute harmful commands on your system.\n\n## Remediations\n\n- **Do** use static, hardcoded values in command strings - wherever possible - to avoid relying on dynamic data.\n  ```javascript\n  let filePattern = \"*.js\";\n  cp.exec(`cp ${filePattern} destinationFolder`, (error, stdout, stderr) => {});\n  ```\n- **Do** san",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "high",
            "category": null,
            "file_path": "/repo/bin/install-shared.js",
            "line_number": 84,
            "rule_identifier": null,
            "title": "Permissive file assignment",
            "description": "## Description\n\nPermissive file assignment exposes sensitive information by granting unnecessary read, write, or execute permissions to users without ownership privileges.\n\n## Remediations\n\n- **Do** keep file permissions as restrictive as possible to minimize the risk of unauthorized access. Use the principle of least privilege to only grant permissions that are absolutely necessary for the operation of the application.\n  ```javascript\n  fs.chmod(path, 0o600);\n  ```\n- **Do** prefer assigning fil",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "high",
            "category": null,
            "file_path": "/repo/bin/install-shared.js",
            "line_number": 30,
            "rule_identifier": null,
            "title": "Unsanitized dynamic input in file path",
            "description": "## Description\n\nAllowing unsanitized dynamic input in file paths can lead to unauthorized file and folder access. This vulnerability arises when dynamic data is used within the file system operations, potentially allowing attackers to access unauthorized or hidden files and folders.\n\n## Remediations\n\n- **Do** sanitize all dynamic data and function arguments before using them in file system operations. This step is crucial to prevent unauthorized access.\n- **Do** use a combination of hard-coded s",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "high",
            "category": null,
            "file_path": "/repo/bin/install-shared.js",
            "line_number": 33,
            "rule_identifier": null,
            "title": "Unsanitized dynamic input in file path",
            "description": "## Description\n\nAllowing unsanitized dynamic input in file paths can lead to unauthorized file and folder access. This vulnerability arises when dynamic data is used within the file system operations, potentially allowing attackers to access unauthorized or hidden files and folders.\n\n## Remediations\n\n- **Do** sanitize all dynamic data and function arguments before using them in file system operations. This step is crucial to prevent unauthorized access.\n- **Do** use a combination of hard-coded s",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "high",
            "category": null,
            "file_path": "/repo/bin/install-shared.js",
            "line_number": 34,
            "rule_identifier": null,
            "title": "Unsanitized dynamic input in file path",
            "description": "## Description\n\nAllowing unsanitized dynamic input in file paths can lead to unauthorized file and folder access. This vulnerability arises when dynamic data is used within the file system operations, potentially allowing attackers to access unauthorized or hidden files and folders.\n\n## Remediations\n\n- **Do** sanitize all dynamic data and function arguments before using them in file system operations. This step is crucial to prevent unauthorized access.\n- **Do** use a combination of hard-coded s",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "high",
            "category": null,
            "file_path": "/repo/bin/install-shared.js",
            "line_number": 39,
            "rule_identifier": null,
            "title": "Unsanitized dynamic input in file path",
            "description": "## Description\n\nAllowing unsanitized dynamic input in file paths can lead to unauthorized file and folder access. This vulnerability arises when dynamic data is used within the file system operations, potentially allowing attackers to access unauthorized or hidden files and folders.\n\n## Remediations\n\n- **Do** sanitize all dynamic data and function arguments before using them in file system operations. This step is crucial to prevent unauthorized access.\n- **Do** use a combination of hard-coded s",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "high",
            "category": null,
            "file_path": "/repo/bin/install-shared.js",
            "line_number": 40,
            "rule_identifier": null,
            "title": "Unsanitized dynamic input in file path",
            "description": "## Description\n\nAllowing unsanitized dynamic input in file paths can lead to unauthorized file and folder access. This vulnerability arises when dynamic data is used within the file system operations, potentially allowing attackers to access unauthorized or hidden files and folders.\n\n## Remediations\n\n- **Do** sanitize all dynamic data and function arguments before using them in file system operations. This step is crucial to prevent unauthorized access.\n- **Do** use a combination of hard-coded s",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "high",
            "category": null,
            "file_path": "/repo/bin/install-shared.js",
            "line_number": 47,
            "rule_identifier": null,
            "title": "Unsanitized dynamic input in file path",
            "description": "## Description\n\nAllowing unsanitized dynamic input in file paths can lead to unauthorized file and folder access. This vulnerability arises when dynamic data is used within the file system operations, potentially allowing attackers to access unauthorized or hidden files and folders.\n\n## Remediations\n\n- **Do** sanitize all dynamic data and function arguments before using them in file system operations. This step is crucial to prevent unauthorized access.\n- **Do** use a combination of hard-coded s",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "high",
            "category": null,
            "file_path": "/repo/bin/install-shared.js",
            "line_number": 53,
            "rule_identifier": null,
            "title": "Unsanitized dynamic input in file path",
            "description": "## Description\n\nAllowing unsanitized dynamic input in file paths can lead to unauthorized file and folder access. This vulnerability arises when dynamic data is used within the file system operations, potentially allowing attackers to access unauthorized or hidden files and folders.\n\n## Remediations\n\n- **Do** sanitize all dynamic data and function arguments before using them in file system operations. This step is crucial to prevent unauthorized access.\n- **Do** use a combination of hard-coded s",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "high",
            "category": null,
            "file_path": "/repo/bin/install-shared.js",
            "line_number": 56,
            "rule_identifier": null,
            "title": "Unsanitized dynamic input in file path",
            "description": "## Description\n\nAllowing unsanitized dynamic input in file paths can lead to unauthorized file and folder access. This vulnerability arises when dynamic data is used within the file system operations, potentially allowing attackers to access unauthorized or hidden files and folders.\n\n## Remediations\n\n- **Do** sanitize all dynamic data and function arguments before using them in file system operations. This step is crucial to prevent unauthorized access.\n- **Do** use a combination of hard-coded s",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "high",
            "category": null,
            "file_path": "/repo/bin/install-shared.js",
            "line_number": 60,
            "rule_identifier": null,
            "title": "Unsanitized dynamic input in file path",
            "description": "## Description\n\nAllowing unsanitized dynamic input in file paths can lead to unauthorized file and folder access. This vulnerability arises when dynamic data is used within the file system operations, potentially allowing attackers to access unauthorized or hidden files and folders.\n\n## Remediations\n\n- **Do** sanitize all dynamic data and function arguments before using them in file system operations. This step is crucial to prevent unauthorized access.\n- **Do** use a combination of hard-coded s",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "high",
            "category": null,
            "file_path": "/repo/bin/install-shared.js",
            "line_number": 64,
            "rule_identifier": null,
            "title": "Unsanitized dynamic input in file path",
            "description": "## Description\n\nAllowing unsanitized dynamic input in file paths can lead to unauthorized file and folder access. This vulnerability arises when dynamic data is used within the file system operations, potentially allowing attackers to access unauthorized or hidden files and folders.\n\n## Remediations\n\n- **Do** sanitize all dynamic data and function arguments before using them in file system operations. This step is crucial to prevent unauthorized access.\n- **Do** use a combination of hard-coded s",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "high",
            "category": null,
            "file_path": "/repo/bin/install-shared.js",
            "line_number": 71,
            "rule_identifier": null,
            "title": "Unsanitized dynamic input in file path",
            "description": "## Description\n\nAllowing unsanitized dynamic input in file paths can lead to unauthorized file and folder access. This vulnerability arises when dynamic data is used within the file system operations, potentially allowing attackers to access unauthorized or hidden files and folders.\n\n## Remediations\n\n- **Do** sanitize all dynamic data and function arguments before using them in file system operations. This step is crucial to prevent unauthorized access.\n- **Do** use a combination of hard-coded s",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "high",
            "category": null,
            "file_path": "/repo/bin/install-shared.js",
            "line_number": 78,
            "rule_identifier": null,
            "title": "Unsanitized dynamic input in file path",
            "description": "## Description\n\nAllowing unsanitized dynamic input in file paths can lead to unauthorized file and folder access. This vulnerability arises when dynamic data is used within the file system operations, potentially allowing attackers to access unauthorized or hidden files and folders.\n\n## Remediations\n\n- **Do** sanitize all dynamic data and function arguments before using them in file system operations. This step is crucial to prevent unauthorized access.\n- **Do** use a combination of hard-coded s",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "high",
            "category": null,
            "file_path": "/repo/bin/install-shared.js",
            "line_number": 79,
            "rule_identifier": null,
            "title": "Unsanitized dynamic input in file path",
            "description": "## Description\n\nAllowing unsanitized dynamic input in file paths can lead to unauthorized file and folder access. This vulnerability arises when dynamic data is used within the file system operations, potentially allowing attackers to access unauthorized or hidden files and folders.\n\n## Remediations\n\n- **Do** sanitize all dynamic data and function arguments before using them in file system operations. This step is crucial to prevent unauthorized access.\n- **Do** use a combination of hard-coded s",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "high",
            "category": null,
            "file_path": "/repo/bin/install-shared.js",
            "line_number": 84,
            "rule_identifier": null,
            "title": "Unsanitized dynamic input in file path",
            "description": "## Description\n\nAllowing unsanitized dynamic input in file paths can lead to unauthorized file and folder access. This vulnerability arises when dynamic data is used within the file system operations, potentially allowing attackers to access unauthorized or hidden files and folders.\n\n## Remediations\n\n- **Do** sanitize all dynamic data and function arguments before using them in file system operations. This step is crucial to prevent unauthorized access.\n- **Do** use a combination of hard-coded s",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "high",
            "category": null,
            "file_path": "/repo/bin/uninstall.js",
            "line_number": 13,
            "rule_identifier": null,
            "title": "Unsanitized dynamic input in file path",
            "description": "## Description\n\nAllowing unsanitized dynamic input in file paths can lead to unauthorized file and folder access. This vulnerability arises when dynamic data is used within the file system operations, potentially allowing attackers to access unauthorized or hidden files and folders.\n\n## Remediations\n\n- **Do** sanitize all dynamic data and function arguments before using them in file system operations. This step is crucial to prevent unauthorized access.\n- **Do** use a combination of hard-coded s",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "high",
            "category": null,
            "file_path": "/repo/bin/uninstall.js",
            "line_number": 17,
            "rule_identifier": null,
            "title": "Unsanitized dynamic input in file path",
            "description": "## Description\n\nAllowing unsanitized dynamic input in file paths can lead to unauthorized file and folder access. This vulnerability arises when dynamic data is used within the file system operations, potentially allowing attackers to access unauthorized or hidden files and folders.\n\n## Remediations\n\n- **Do** sanitize all dynamic data and function arguments before using them in file system operations. This step is crucial to prevent unauthorized access.\n- **Do** use a combination of hard-coded s",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "high",
            "category": null,
            "file_path": "/repo/bin/cli.js",
            "line_number": 35,
            "rule_identifier": null,
            "title": "Unsanitized dynamic input in file path",
            "description": "## Description\n\nUsing unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.\n\n## Remediations\n\n- **Do not** directly use user input to construct file paths. This can lead to unauthorized file access.\n- **Do** sanitize user input used in file paths. Replace patterns that can nav",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "high",
            "category": null,
            "file_path": "/repo/bin/install-shared.js",
            "line_number": 42,
            "rule_identifier": null,
            "title": "Unsanitized dynamic input in file path",
            "description": "## Description\n\nUsing unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.\n\n## Remediations\n\n- **Do not** directly use user input to construct file paths. This can lead to unauthorized file access.\n- **Do** sanitize user input used in file paths. Replace patterns that can nav",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "high",
            "category": null,
            "file_path": "/repo/bin/install-shared.js",
            "line_number": 43,
            "rule_identifier": null,
            "title": "Unsanitized dynamic input in file path",
            "description": "## Description\n\nUsing unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.\n\n## Remediations\n\n- **Do not** directly use user input to construct file paths. This can lead to unauthorized file access.\n- **Do** sanitize user input used in file paths. Replace patterns that can nav",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "high",
            "category": null,
            "file_path": "/repo/bin/install-shared.js",
            "line_number": 58,
            "rule_identifier": null,
            "title": "Unsanitized dynamic input in file path",
            "description": "## Description\n\nUsing unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.\n\n## Remediations\n\n- **Do not** directly use user input to construct file paths. This can lead to unauthorized file access.\n- **Do** sanitize user input used in file paths. Replace patterns that can nav",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "high",
            "category": null,
            "file_path": "/repo/bin/install-shared.js",
            "line_number": 59,
            "rule_identifier": null,
            "title": "Unsanitized dynamic input in file path",
            "description": "## Description\n\nUsing unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.\n\n## Remediations\n\n- **Do not** directly use user input to construct file paths. This can lead to unauthorized file access.\n- **Do** sanitize user input used in file paths. Replace patterns that can nav",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "high",
            "category": null,
            "file_path": "/repo/bin/install-shared.js",
            "line_number": 129,
            "rule_identifier": null,
            "title": "Unsanitized dynamic input in file path",
            "description": "## Description\n\nUsing unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.\n\n## Remediations\n\n- **Do not** directly use user input to construct file paths. This can lead to unauthorized file access.\n- **Do** sanitize user input used in file paths. Replace patterns that can nav",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "low",
            "category": null,
            "file_path": "/repo/bin/cli.js",
            "line_number": 12,
            "rule_identifier": null,
            "title": "Leakage of information in logger message",
            "description": "## Description\n\nInformation leakage through logger messages can compromise sensitive data. This vulnerability arises when dynamic data or variables, which may contain sensitive information, are included in log messages.\n\n## Remediations\n\n- **Do not** include sensitive data directly in logger messages. This can lead to the exposure of such data in log files, which might be accessible to unauthorized individuals.\n  ```javascript\n  logger.info(`Results: ${data}`) // unsafe\n  ```\n- **Do** use loggin",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "low",
            "category": null,
            "file_path": "/repo/bin/install.js",
            "line_number": 13,
            "rule_identifier": null,
            "title": "Leakage of information in logger message",
            "description": "## Description\n\nInformation leakage through logger messages can compromise sensitive data. This vulnerability arises when dynamic data or variables, which may contain sensitive information, are included in log messages.\n\n## Remediations\n\n- **Do not** include sensitive data directly in logger messages. This can lead to the exposure of such data in log files, which might be accessible to unauthorized individuals.\n  ```javascript\n  logger.info(`Results: ${data}`) // unsafe\n  ```\n- **Do** use loggin",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "low",
            "category": null,
            "file_path": "/repo/bin/install.js",
            "line_number": 22,
            "rule_identifier": null,
            "title": "Leakage of information in logger message",
            "description": "## Description\n\nInformation leakage through logger messages can compromise sensitive data. This vulnerability arises when dynamic data or variables, which may contain sensitive information, are included in log messages.\n\n## Remediations\n\n- **Do not** include sensitive data directly in logger messages. This can lead to the exposure of such data in log files, which might be accessible to unauthorized individuals.\n  ```javascript\n  logger.info(`Results: ${data}`) // unsafe\n  ```\n- **Do** use loggin",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "low",
            "category": null,
            "file_path": "/repo/bin/install.js",
            "line_number": 23,
            "rule_identifier": null,
            "title": "Leakage of information in logger message",
            "description": "## Description\n\nInformation leakage through logger messages can compromise sensitive data. This vulnerability arises when dynamic data or variables, which may contain sensitive information, are included in log messages.\n\n## Remediations\n\n- **Do not** include sensitive data directly in logger messages. This can lead to the exposure of such data in log files, which might be accessible to unauthorized individuals.\n  ```javascript\n  logger.info(`Results: ${data}`) // unsafe\n  ```\n- **Do** use loggin",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "low",
            "category": null,
            "file_path": "/repo/bin/install.js",
            "line_number": 25,
            "rule_identifier": null,
            "title": "Leakage of information in logger message",
            "description": "## Description\n\nInformation leakage through logger messages can compromise sensitive data. This vulnerability arises when dynamic data or variables, which may contain sensitive information, are included in log messages.\n\n## Remediations\n\n- **Do not** include sensitive data directly in logger messages. This can lead to the exposure of such data in log files, which might be accessible to unauthorized individuals.\n  ```javascript\n  logger.info(`Results: ${data}`) // unsafe\n  ```\n- **Do** use loggin",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "low",
            "category": null,
            "file_path": "/repo/bin/uninstall.js",
            "line_number": 14,
            "rule_identifier": null,
            "title": "Leakage of information in logger message",
            "description": "## Description\n\nInformation leakage through logger messages can compromise sensitive data. This vulnerability arises when dynamic data or variables, which may contain sensitive information, are included in log messages.\n\n## Remediations\n\n- **Do not** include sensitive data directly in logger messages. This can lead to the exposure of such data in log files, which might be accessible to unauthorized individuals.\n  ```javascript\n  logger.info(`Results: ${data}`) // unsafe\n  ```\n- **Do** use loggin",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "low",
            "category": null,
            "file_path": "/repo/bin/uninstall.js",
            "line_number": 18,
            "rule_identifier": null,
            "title": "Leakage of information in logger message",
            "description": "## Description\n\nInformation leakage through logger messages can compromise sensitive data. This vulnerability arises when dynamic data or variables, which may contain sensitive information, are included in log messages.\n\n## Remediations\n\n- **Do not** include sensitive data directly in logger messages. This can lead to the exposure of such data in log files, which might be accessible to unauthorized individuals.\n  ```javascript\n  logger.info(`Results: ${data}`) // unsafe\n  ```\n- **Do** use loggin",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "low",
            "category": null,
            "file_path": "/repo/bin/uninstall.js",
            "line_number": 20,
            "rule_identifier": null,
            "title": "Leakage of information in logger message",
            "description": "## Description\n\nInformation leakage through logger messages can compromise sensitive data. This vulnerability arises when dynamic data or variables, which may contain sensitive information, are included in log messages.\n\n## Remediations\n\n- **Do not** include sensitive data directly in logger messages. This can lead to the exposure of such data in log files, which might be accessible to unauthorized individuals.\n  ```javascript\n  logger.info(`Results: ${data}`) // unsafe\n  ```\n- **Do** use loggin",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "low",
            "category": null,
            "file_path": "/repo/bin/uninstall.js",
            "line_number": 32,
            "rule_identifier": null,
            "title": "Leakage of information in logger message",
            "description": "## Description\n\nInformation leakage through logger messages can compromise sensitive data. This vulnerability arises when dynamic data or variables, which may contain sensitive information, are included in log messages.\n\n## Remediations\n\n- **Do not** include sensitive data directly in logger messages. This can lead to the exposure of such data in log files, which might be accessible to unauthorized individuals.\n  ```javascript\n  logger.info(`Results: ${data}`) // unsafe\n  ```\n- **Do** use loggin",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "low",
            "category": null,
            "file_path": "/repo/scripts/team-install.js",
            "line_number": 16,
            "rule_identifier": null,
            "title": "Leakage of information in logger message",
            "description": "## Description\n\nInformation leakage through logger messages can compromise sensitive data. This vulnerability arises when dynamic data or variables, which may contain sensitive information, are included in log messages.\n\n## Remediations\n\n- **Do not** include sensitive data directly in logger messages. This can lead to the exposure of such data in log files, which might be accessible to unauthorized individuals.\n  ```javascript\n  logger.info(`Results: ${data}`) // unsafe\n  ```\n- **Do** use loggin",
            "remediation": null
          }
        ],
        "execution_duration_seconds": 6.993098220031243,
        "status": "complete",
        "examined": {
          "unit": "files",
          "count": 11
        },
        "metadata": {
          "source": "github-releases",
          "source_url": "https://github.com/Bearer/bearer",
          "report_type": "security",
          "rules_loaded": 554,
          "install_command": "curl -sfL https://raw.githubusercontent.com/Bearer/bearer/main/contrib/install.sh | sh -s -- -b /usr/local/bin \"v2.0.2\"",
          "severity_counts": {
            "low": 10,
            "high": 23,
            "medium": 0,
            "critical": 2,
            "informational": 0
          }
        },
        "display_score": 0.0,
        "display_badge": "Unsafe"
      },
      {
        "scanner_name": "nerlo-behavioral",
        "scanner_version": "0.1.0",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 3.528077694005333,
        "status": "complete",
        "examined": {
          "unit": "files",
          "count": 11
        },
        "metadata": {
          "source": "nerlo-original",
          "source_url": "https://github.com/nerlo-ai/nerlo",
          "report_type": "nerlo-behavioral",
          "ruleset_path": "/opt/nerlo-rules/exfiltration.yaml",
          "ruleset_paths": [
            "/opt/nerlo-rules/exfiltration.yaml",
            "/opt/nerlo-rules/clipboard_exfiltration.yaml",
            "/opt/nerlo-rules/rce_endpoint.yaml",
            "/opt/nerlo-rules/taint_egress.yaml"
          ],
          "install_command": "pip install 'semgrep==1.97.0'",
          "merged_invocation": true
        },
        "display_score": 100.0,
        "display_badge": "Verified"
      },
      {
        "scanner_name": "nerlo-install-instruction",
        "scanner_version": "0.1.0",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 3.528165113995783,
        "status": "complete",
        "examined": {
          "unit": "files",
          "count": 7
        },
        "metadata": {
          "source": "nerlo-original",
          "source_url": "https://github.com/nerlo-ai/nerlo",
          "report_type": "nerlo-install-instruction",
          "ruleset_path": "/opt/nerlo-rules/install_instructions.yaml",
          "ruleset_paths": [
            "/opt/nerlo-rules/install_instructions.yaml",
            "/opt/nerlo-rules/cursor_rules.yaml"
          ],
          "install_command": "pip install 'semgrep==1.97.0'",
          "merged_invocation": true
        },
        "display_score": 100.0,
        "display_badge": "Verified"
      },
      {
        "scanner_name": "capslock",
        "scanner_version": "v0.3.2",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 0.10028183698887005,
        "status": "not_applicable",
        "examined": {
          "unit": "packages",
          "count": 0
        },
        "metadata": {
          "source": "go-module-proxy",
          "source_url": "https://github.com/google/capslock/releases/tag/v0.3.2",
          "report_type": "go-capability",
          "vendor_mode": false,
          "install_command": "GOTOOLCHAIN=local GOFLAGS=-mod=mod GOSUMDB=sum.golang.org GOBIN=/usr/local/bin go install github.com/google/capslock/cmd/capslock@v0.3.2  # github.com/google/capslock v0.3.2 h1:0ZQa9YR8s9ewFu1g5w6Rgd/lW/4dga7qJew3K6Ql7aM=",
          "environment_note": "capslock found no .go files to analyze; reported not_applicable rather than a clean 100 \u2014 the scanner never ran, so it has no verdict to contribute",
          "go_files_present": 0,
          "artifact_type_policy": "gemini_extension",
          "expected_capabilities": null,
          "artifact_type_explicit": true
        },
        "display_score": null,
        "display_badge": "not_applicable"
      }
    ]
  },
  "report": {
    "report_id": "d885814a-3ece-4fdd-af9f-3137723c4694",
    "format": "json",
    "generated_at": "2026-08-12T19:35:10.908655+00:00",
    "scanner_filter": null,
    "signature": null
  }
}