{
  "executive_summary": {
    "badge": "Verified",
    "security_score": 92.75,
    "view": "composite",
    "scanner_badges": {
      "cisco-skill-scanner": "Verified",
      "agent-audit-kit": "Verified",
      "nerlo-behavioral": "Verified",
      "nerlo-install-instruction": "Verified",
      "nerlo-multi-source": "unavailable",
      "trivy": "unavailable",
      "osv-scanner": "unavailable",
      "trivy_image": "unavailable"
    },
    "finding_counts": {
      "critical": 0,
      "high": 0,
      "medium": 5,
      "low": 0,
      "informational": 8
    },
    "recommendation": "@blackboxfoundry/livedatalink meets the registry's verification bar at scan time. Keep monitoring enabled \u2014 verification reflects this commit, not future releases."
  },
  "source_provenance": {
    "repository_url": "https://github.com/blackboxfoundry/livedatalink",
    "commit_sha_scanned": null,
    "license": "MIT",
    "maintainer": "Blackbox Foundry LLC <support@livedatalink.ai>",
    "name": "@blackboxfoundry/livedatalink",
    "version": "1.2.0"
  },
  "per_scanner_detail": [
    {
      "scanner_name": "cisco-skill-scanner",
      "scanner_version": "2.0.11",
      "score": 91.0,
      "scanner_badge": "Verified",
      "findings": [
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "social_engineering",
          "file_path": "/repo/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "[mcp_server policy: capability-matches-purpose class; severity low -> informational] Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "data_exfiltration",
          "file_path": "/repo/bin/install.js",
          "line_number": 231,
          "rule_identifier": "DATA_EXFIL_JS_FS_ACCESS",
          "title": "Node.js filesystem access that could read or write sensitive data",
          "description": "[mcp_server policy: capability-matches-purpose class; severity high -> informational] Pattern detected: fs.readFileSync(",
          "remediation": "Review filesystem operations. Ensure they don't access sensitive system files or credential stores"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "data_exfiltration",
          "file_path": "/repo/bin/install.js",
          "line_number": 250,
          "rule_identifier": "DATA_EXFIL_JS_FS_ACCESS",
          "title": "Node.js filesystem access that could read or write sensitive data",
          "description": "[mcp_server policy: capability-matches-purpose class; severity high -> informational] Pattern detected: fs.writeFileSync(",
          "remediation": "Review filesystem operations. Ensure they don't access sensitive system files or credential stores"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "obfuscation",
          "file_path": "/repo/llms.txt",
          "line_number": null,
          "rule_identifier": "FILE_MAGIC_MISMATCH",
          "title": "File extension does not match actual content type",
          "description": "File 'llms.txt' extension (.txt) suggests one format but Magika detected a different text format: Markdown document (markdown). This may indicate content obfuscation or a misnamed file.",
          "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "data_exfiltration",
          "file_path": "/repo/scripts/update-tool-count.mjs",
          "line_number": 30,
          "rule_identifier": "DATA_EXFIL_JS_NETWORK",
          "title": "Outbound network request primitives in JavaScript/TypeScript",
          "description": "[mcp_server policy: capability-matches-purpose class; severity medium -> informational] Pattern detected: fetch(",
          "remediation": "Ensure network operations are necessary and document allowed destinations"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "data_exfiltration",
          "file_path": "/repo/scripts/update-tool-count.mjs",
          "line_number": 81,
          "rule_identifier": "DATA_EXFIL_JS_NETWORK",
          "title": "Outbound network request primitives in JavaScript/TypeScript",
          "description": "[mcp_server policy: capability-matches-purpose class; severity medium -> informational] Pattern detected: fetch(",
          "remediation": "Ensure network operations are necessary and document allowed destinations"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "social_engineering",
          "file_path": "/repo/examples/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "[mcp_server policy: capability-matches-purpose class; severity low -> informational] Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/examples/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        }
      ],
      "execution_duration_seconds": 17.987414969014935,
      "status": "complete",
      "examined": {
        "unit": "skills",
        "count": 2
      },
      "metadata": {
        "source": "pypi",
        "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/",
        "report_type": "cisco-skill-sast",
        "analyzers_used": [
          "bytecode",
          "pipeline",
          "static_analyzer"
        ],
        "skills_scanned": [
          "repo",
          "examples"
        ],
        "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt",
        "severity_counts": {
          "low": 0,
          "high": 0,
          "medium": 1,
          "critical": 0,
          "informational": 8
        },
        "artifact_type_policy": "mcp_server",
        "downweighted_findings": 6
      },
      "display_score": 91.0,
      "display_badge": "Verified"
    },
    {
      "scanner_name": "agent-audit-kit",
      "scanner_version": "0.3.26",
      "score": 90.0,
      "scanner_badge": "Verified",
      "findings": [
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "supply-chain",
          "file_path": "package.json",
          "line_number": null,
          "rule_identifier": "AAK-SUPPLY-004",
          "title": "No lockfile present",
          "description": "A package manifest exists but no lockfile was found. Without lockfiles, dependency versions float and can be silently updated.",
          "remediation": "Generate and commit lockfile."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "legal-compliance",
          "file_path": "llms.txt",
          "line_number": null,
          "rule_identifier": "AAK-HEALTHCARE-AI-004",
          "title": "Healthcare context without explicit AI-disclosure to user",
          "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
          "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
        }
      ],
      "execution_duration_seconds": 1.9761205090035219,
      "status": "complete",
      "examined": {
        "unit": "files",
        "count": 21
      },
      "metadata": {
        "source": "pypi",
        "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/",
        "report_type": "agent-audit-kit-sast",
        "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt",
        "rules_evaluated": 211,
        "severity_counts": {
          "low": 0,
          "high": 0,
          "medium": 2,
          "critical": 0,
          "informational": 0
        }
      },
      "display_score": 90.0,
      "display_badge": "Verified"
    },
    {
      "scanner_name": "nerlo-behavioral",
      "scanner_version": "0.1.0",
      "score": 90.0,
      "scanner_badge": "Verified",
      "findings": [
        {
          "tool_name": "nerlo-behavioral",
          "severity": "medium",
          "category": "undisclosed-egress",
          "file_path": "/repo/scripts/update-tool-count.mjs",
          "line_number": 30,
          "rule_identifier": "opt.nerlo-rules.nerlo-hardcoded-external-egress",
          "title": "opt.nerlo-rules.nerlo-hardcoded-external-egress",
          "description": "Network request to a hardcoded external host/URL. Undisclosed egress in an MCP server is a common exfiltration channel \u2014 confirm it is expected.",
          "remediation": null
        },
        {
          "tool_name": "nerlo-behavioral",
          "severity": "medium",
          "category": "undisclosed-egress",
          "file_path": "/repo/scripts/update-tool-count.mjs",
          "line_number": 81,
          "rule_identifier": "opt.nerlo-rules.nerlo-hardcoded-external-egress",
          "title": "opt.nerlo-rules.nerlo-hardcoded-external-egress",
          "description": "Network request to a hardcoded external host/URL. Undisclosed egress in an MCP server is a common exfiltration channel \u2014 confirm it is expected.",
          "remediation": null
        }
      ],
      "execution_duration_seconds": 32.99525825900491,
      "status": "complete",
      "examined": {
        "unit": "files",
        "count": 2
      },
      "metadata": {
        "source": "nerlo-original",
        "source_url": "https://github.com/nerlo-ai/nerlo",
        "report_type": "nerlo-behavioral",
        "ruleset_path": "/opt/nerlo-rules/exfiltration.yaml",
        "ruleset_paths": [
          "/opt/nerlo-rules/exfiltration.yaml",
          "/opt/nerlo-rules/clipboard_exfiltration.yaml",
          "/opt/nerlo-rules/rce_endpoint.yaml",
          "/opt/nerlo-rules/taint_egress.yaml"
        ],
        "install_command": "pip install 'semgrep==1.97.0'",
        "severity_counts": {
          "low": 0,
          "high": 0,
          "medium": 2,
          "critical": 0,
          "informational": 0
        },
        "merged_invocation": true
      },
      "display_score": 90.0,
      "display_badge": "Verified"
    },
    {
      "scanner_name": "nerlo-install-instruction",
      "scanner_version": "0.1.0",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 32.99540901900036,
      "status": "complete",
      "examined": {
        "unit": "files",
        "count": 8
      },
      "metadata": {
        "source": "nerlo-original",
        "source_url": "https://github.com/nerlo-ai/nerlo",
        "report_type": "nerlo-install-instruction",
        "ruleset_path": "/opt/nerlo-rules/install_instructions.yaml",
        "ruleset_paths": [
          "/opt/nerlo-rules/install_instructions.yaml",
          "/opt/nerlo-rules/cursor_rules.yaml"
        ],
        "install_command": "pip install 'semgrep==1.97.0'",
        "merged_invocation": true
      },
      "display_score": 100.0,
      "display_badge": "Verified"
    },
    {
      "scanner_name": "nerlo-multi-source",
      "scanner_version": "0.1.0",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 12.896941348008113,
      "status": "not_applicable",
      "examined": null,
      "metadata": {
        "source": "nerlo-original",
        "per_source": [],
        "report_type": "nerlo-multi-source",
        "diverged_sources": [],
        "published_surfaces_scanned": 0
      },
      "display_score": null,
      "display_badge": "unavailable"
    },
    {
      "scanner_name": "trivy",
      "scanner_version": "0.71.0",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 0.7273431189823896,
      "status": "not_applicable",
      "examined": {
        "unit": "manifests",
        "count": 0
      },
      "metadata": {
        "source": "github-releases",
        "source_url": "https://github.com/aquasecurity/trivy/releases/tag/v0.71.0",
        "report_type": "filesystem-vulnerability",
        "install_command": "curl -sfL -o /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.71.0/trivy_0.71.0_Linux-64bit.deb && echo '<sha256>  /tmp/trivy.deb' | sha256sum -c - && dpkg -i /tmp/trivy.deb",
        "manifests_scanned": []
      },
      "display_score": null,
      "display_badge": "unavailable"
    },
    {
      "scanner_name": "osv-scanner",
      "scanner_version": "2.3.8",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 0.44458618000498973,
      "status": "not_applicable",
      "examined": {
        "unit": "manifests",
        "count": 0
      },
      "metadata": {
        "source": "github-releases",
        "source_url": "https://github.com/google/osv-scanner/releases/tag/v2.3.8",
        "report_type": "osv-vulnerability",
        "ecosystems_seen": [],
        "install_command": "curl -sfL -o /usr/local/bin/osv-scanner https://github.com/google/osv-scanner/releases/download/v2.3.8/osv-scanner_linux_amd64 && echo '<sha256>  /usr/local/bin/osv-scanner' | sha256sum -c - && chmod +x /usr/local/bin/osv-scanner",
        "manifests_scanned": [],
        "finding_id_aliases": {},
        "cross_scanner_correlation": {
          "only_osv": [],
          "only_trivy": [],
          "intersection_ids": []
        }
      },
      "display_score": null,
      "display_badge": "unavailable"
    },
    {
      "scanner_name": "trivy_image",
      "scanner_version": "0.71.0",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 4.6079978346824646e-05,
      "status": "not_applicable",
      "examined": {
        "unit": "image_targets",
        "count": 0
      },
      "metadata": {
        "reason": "no OCI image acquired for this artifact"
      },
      "display_score": null,
      "display_badge": "unavailable"
    }
  ],
  "threat_model": "Threat model synthesis has not yet run for this scan. This section is generated by the registry's LLM pipeline (Req 22.3) and will appear in the next regeneration of this report.",
  "audit_chain": {
    "scan_job_id": "e712d56a-c601-4cba-920b-70ebaa40e211",
    "scan_completed_at": "2026-07-30T01:08:58.163277+00:00",
    "scanner_versions": {
      "cisco-skill-scanner": "2.0.11",
      "agent-audit-kit": "0.3.26",
      "nerlo-behavioral": "0.1.0",
      "nerlo-install-instruction": "0.1.0",
      "nerlo-multi-source": "0.1.0",
      "trivy": "0.71.0",
      "osv-scanner": "2.3.8",
      "trivy_image": "0.71.0"
    },
    "scanner_base_image": "us-central1-docker.pkg.dev/nerlo-vsk-prod/nerlo/scanner-base@sha256:18193e789f73339d5d3d9d784011bdb7c9af4b815925f756cc1dc842ecb3fe2d",
    "ai_decision_log_ids": [
      "3b6e7131-fd16-4c2b-8e1d-19ad6c571885",
      "5dc50435-d7bb-4a3e-ae6b-8b07aa5b9922"
    ],
    "self_attestation_url": "http://localhost:8000/api/v1/registry/self-attestation"
  },
  "appendix": {
    "raw_scanner_reports": [
      {
        "scanner_name": "cisco-skill-scanner",
        "scanner_version": "2.0.11",
        "score": 91.0,
        "scanner_badge": "Verified",
        "findings": [
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "social_engineering",
            "file_path": "/repo/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "[mcp_server policy: capability-matches-purpose class; severity low -> informational] Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "data_exfiltration",
            "file_path": "/repo/bin/install.js",
            "line_number": 231,
            "rule_identifier": "DATA_EXFIL_JS_FS_ACCESS",
            "title": "Node.js filesystem access that could read or write sensitive data",
            "description": "[mcp_server policy: capability-matches-purpose class; severity high -> informational] Pattern detected: fs.readFileSync(",
            "remediation": "Review filesystem operations. Ensure they don't access sensitive system files or credential stores"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "data_exfiltration",
            "file_path": "/repo/bin/install.js",
            "line_number": 250,
            "rule_identifier": "DATA_EXFIL_JS_FS_ACCESS",
            "title": "Node.js filesystem access that could read or write sensitive data",
            "description": "[mcp_server policy: capability-matches-purpose class; severity high -> informational] Pattern detected: fs.writeFileSync(",
            "remediation": "Review filesystem operations. Ensure they don't access sensitive system files or credential stores"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "obfuscation",
            "file_path": "/repo/llms.txt",
            "line_number": null,
            "rule_identifier": "FILE_MAGIC_MISMATCH",
            "title": "File extension does not match actual content type",
            "description": "File 'llms.txt' extension (.txt) suggests one format but Magika detected a different text format: Markdown document (markdown). This may indicate content obfuscation or a misnamed file.",
            "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "data_exfiltration",
            "file_path": "/repo/scripts/update-tool-count.mjs",
            "line_number": 30,
            "rule_identifier": "DATA_EXFIL_JS_NETWORK",
            "title": "Outbound network request primitives in JavaScript/TypeScript",
            "description": "[mcp_server policy: capability-matches-purpose class; severity medium -> informational] Pattern detected: fetch(",
            "remediation": "Ensure network operations are necessary and document allowed destinations"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "data_exfiltration",
            "file_path": "/repo/scripts/update-tool-count.mjs",
            "line_number": 81,
            "rule_identifier": "DATA_EXFIL_JS_NETWORK",
            "title": "Outbound network request primitives in JavaScript/TypeScript",
            "description": "[mcp_server policy: capability-matches-purpose class; severity medium -> informational] Pattern detected: fetch(",
            "remediation": "Ensure network operations are necessary and document allowed destinations"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "social_engineering",
            "file_path": "/repo/examples/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "[mcp_server policy: capability-matches-purpose class; severity low -> informational] Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/examples/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          }
        ],
        "execution_duration_seconds": 17.987414969014935,
        "status": "complete",
        "examined": {
          "unit": "skills",
          "count": 2
        },
        "metadata": {
          "source": "pypi",
          "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/",
          "report_type": "cisco-skill-sast",
          "analyzers_used": [
            "bytecode",
            "pipeline",
            "static_analyzer"
          ],
          "skills_scanned": [
            "repo",
            "examples"
          ],
          "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt",
          "severity_counts": {
            "low": 0,
            "high": 0,
            "medium": 1,
            "critical": 0,
            "informational": 8
          },
          "artifact_type_policy": "mcp_server",
          "downweighted_findings": 6
        },
        "display_score": 91.0,
        "display_badge": "Verified"
      },
      {
        "scanner_name": "agent-audit-kit",
        "scanner_version": "0.3.26",
        "score": 90.0,
        "scanner_badge": "Verified",
        "findings": [
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "supply-chain",
            "file_path": "package.json",
            "line_number": null,
            "rule_identifier": "AAK-SUPPLY-004",
            "title": "No lockfile present",
            "description": "A package manifest exists but no lockfile was found. Without lockfiles, dependency versions float and can be silently updated.",
            "remediation": "Generate and commit lockfile."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "legal-compliance",
            "file_path": "llms.txt",
            "line_number": null,
            "rule_identifier": "AAK-HEALTHCARE-AI-004",
            "title": "Healthcare context without explicit AI-disclosure to user",
            "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
            "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
          }
        ],
        "execution_duration_seconds": 1.9761205090035219,
        "status": "complete",
        "examined": {
          "unit": "files",
          "count": 21
        },
        "metadata": {
          "source": "pypi",
          "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/",
          "report_type": "agent-audit-kit-sast",
          "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt",
          "rules_evaluated": 211,
          "severity_counts": {
            "low": 0,
            "high": 0,
            "medium": 2,
            "critical": 0,
            "informational": 0
          }
        },
        "display_score": 90.0,
        "display_badge": "Verified"
      },
      {
        "scanner_name": "nerlo-behavioral",
        "scanner_version": "0.1.0",
        "score": 90.0,
        "scanner_badge": "Verified",
        "findings": [
          {
            "tool_name": "nerlo-behavioral",
            "severity": "medium",
            "category": "undisclosed-egress",
            "file_path": "/repo/scripts/update-tool-count.mjs",
            "line_number": 30,
            "rule_identifier": "opt.nerlo-rules.nerlo-hardcoded-external-egress",
            "title": "opt.nerlo-rules.nerlo-hardcoded-external-egress",
            "description": "Network request to a hardcoded external host/URL. Undisclosed egress in an MCP server is a common exfiltration channel \u2014 confirm it is expected.",
            "remediation": null
          },
          {
            "tool_name": "nerlo-behavioral",
            "severity": "medium",
            "category": "undisclosed-egress",
            "file_path": "/repo/scripts/update-tool-count.mjs",
            "line_number": 81,
            "rule_identifier": "opt.nerlo-rules.nerlo-hardcoded-external-egress",
            "title": "opt.nerlo-rules.nerlo-hardcoded-external-egress",
            "description": "Network request to a hardcoded external host/URL. Undisclosed egress in an MCP server is a common exfiltration channel \u2014 confirm it is expected.",
            "remediation": null
          }
        ],
        "execution_duration_seconds": 32.99525825900491,
        "status": "complete",
        "examined": {
          "unit": "files",
          "count": 2
        },
        "metadata": {
          "source": "nerlo-original",
          "source_url": "https://github.com/nerlo-ai/nerlo",
          "report_type": "nerlo-behavioral",
          "ruleset_path": "/opt/nerlo-rules/exfiltration.yaml",
          "ruleset_paths": [
            "/opt/nerlo-rules/exfiltration.yaml",
            "/opt/nerlo-rules/clipboard_exfiltration.yaml",
            "/opt/nerlo-rules/rce_endpoint.yaml",
            "/opt/nerlo-rules/taint_egress.yaml"
          ],
          "install_command": "pip install 'semgrep==1.97.0'",
          "severity_counts": {
            "low": 0,
            "high": 0,
            "medium": 2,
            "critical": 0,
            "informational": 0
          },
          "merged_invocation": true
        },
        "display_score": 90.0,
        "display_badge": "Verified"
      },
      {
        "scanner_name": "nerlo-install-instruction",
        "scanner_version": "0.1.0",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 32.99540901900036,
        "status": "complete",
        "examined": {
          "unit": "files",
          "count": 8
        },
        "metadata": {
          "source": "nerlo-original",
          "source_url": "https://github.com/nerlo-ai/nerlo",
          "report_type": "nerlo-install-instruction",
          "ruleset_path": "/opt/nerlo-rules/install_instructions.yaml",
          "ruleset_paths": [
            "/opt/nerlo-rules/install_instructions.yaml",
            "/opt/nerlo-rules/cursor_rules.yaml"
          ],
          "install_command": "pip install 'semgrep==1.97.0'",
          "merged_invocation": true
        },
        "display_score": 100.0,
        "display_badge": "Verified"
      },
      {
        "scanner_name": "nerlo-multi-source",
        "scanner_version": "0.1.0",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 12.896941348008113,
        "status": "not_applicable",
        "examined": null,
        "metadata": {
          "source": "nerlo-original",
          "per_source": [],
          "report_type": "nerlo-multi-source",
          "diverged_sources": [],
          "published_surfaces_scanned": 0
        },
        "display_score": null,
        "display_badge": "unavailable"
      },
      {
        "scanner_name": "trivy",
        "scanner_version": "0.71.0",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 0.7273431189823896,
        "status": "not_applicable",
        "examined": {
          "unit": "manifests",
          "count": 0
        },
        "metadata": {
          "source": "github-releases",
          "source_url": "https://github.com/aquasecurity/trivy/releases/tag/v0.71.0",
          "report_type": "filesystem-vulnerability",
          "install_command": "curl -sfL -o /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.71.0/trivy_0.71.0_Linux-64bit.deb && echo '<sha256>  /tmp/trivy.deb' | sha256sum -c - && dpkg -i /tmp/trivy.deb",
          "manifests_scanned": []
        },
        "display_score": null,
        "display_badge": "unavailable"
      },
      {
        "scanner_name": "osv-scanner",
        "scanner_version": "2.3.8",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 0.44458618000498973,
        "status": "not_applicable",
        "examined": {
          "unit": "manifests",
          "count": 0
        },
        "metadata": {
          "source": "github-releases",
          "source_url": "https://github.com/google/osv-scanner/releases/tag/v2.3.8",
          "report_type": "osv-vulnerability",
          "ecosystems_seen": [],
          "install_command": "curl -sfL -o /usr/local/bin/osv-scanner https://github.com/google/osv-scanner/releases/download/v2.3.8/osv-scanner_linux_amd64 && echo '<sha256>  /usr/local/bin/osv-scanner' | sha256sum -c - && chmod +x /usr/local/bin/osv-scanner",
          "manifests_scanned": [],
          "finding_id_aliases": {},
          "cross_scanner_correlation": {
            "only_osv": [],
            "only_trivy": [],
            "intersection_ids": []
          }
        },
        "display_score": null,
        "display_badge": "unavailable"
      },
      {
        "scanner_name": "trivy_image",
        "scanner_version": "0.71.0",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 4.6079978346824646e-05,
        "status": "not_applicable",
        "examined": {
          "unit": "image_targets",
          "count": 0
        },
        "metadata": {
          "reason": "no OCI image acquired for this artifact"
        },
        "display_score": null,
        "display_badge": "unavailable"
      }
    ]
  },
  "report": {
    "report_id": "99c3c438-e9be-4b9c-b658-ce80a969b253",
    "format": "json",
    "generated_at": "2026-07-30T09:36:23.633231+00:00",
    "scanner_filter": null,
    "signature": null
  }
}