{
  "executive_summary": {
    "badge": "Caution",
    "security_score": 82.85,
    "view": "composite",
    "scanner_badges": {
      "agentshield": "unavailable",
      "cisco-skill-scanner": "Unsafe",
      "agent-audit-kit": "Verified",
      "bearer": "Verified",
      "nerlo-behavioral": "Verified",
      "nerlo-install-instruction": "Unsafe",
      "trivy": "Verified",
      "osv-scanner": "unavailable"
    },
    "finding_counts": {
      "critical": 0,
      "high": 14,
      "medium": 4,
      "low": 10
    },
    "recommendation": "xray may be integrated with compensating controls: review the 14 high-severity findings below, restrict granted permissions to the minimum the manifest declares, and subscribe to monitoring alerts for score changes."
  },
  "source_provenance": {
    "repository_url": "https://github.com/srijanshukla18/xray",
    "commit_sha_scanned": null,
    "license": "MIT",
    "maintainer": "Srijan Shukla",
    "name": "xray",
    "version": "0.6.1"
  },
  "per_scanner_detail": [
    {
      "scanner_name": "agentshield",
      "scanner_version": "1.4.0",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 0.8802287619910203,
      "status": "not_applicable",
      "metadata": {
        "source": "npm",
        "source_url": "https://www.npmjs.com/package/ecc-agentshield",
        "install_command": "npm install -g ecc-agentshield@1.4.0",
        "scans_performed": []
      },
      "display_score": null,
      "display_badge": "unavailable"
    },
    {
      "scanner_name": "cisco-skill-scanner",
      "scanner_version": "2.0.11",
      "score": 35.5,
      "scanner_badge": "Unsafe",
      "findings": [
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "high",
          "category": "policy_violation",
          "file_path": "/repo",
          "line_number": null,
          "rule_identifier": "LOW_ANALYZABILITY",
          "title": "Critically low analyzability score",
          "description": "Only 67% of skill content could be analyzed. 6 of 22 files are opaque to the scanner. The safety assessment has low confidence.",
          "remediation": "Replace opaque files (binaries, encrypted content) with inspectable source code to improve scan confidence."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "obfuscation",
          "file_path": "/repo/.xray/xray.db",
          "line_number": null,
          "rule_identifier": "HIDDEN_DATA_FILE",
          "title": "Hidden data file detected",
          "description": "Hidden file found: .xray/xray.db. Hidden files may contain concealed configuration or data that should be reviewed.",
          "remediation": "Move file to a visible location or document its purpose."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "policy_violation",
          "file_path": "/repo/.xray/xray.db-shm",
          "line_number": null,
          "rule_identifier": "UNANALYZABLE_BINARY",
          "title": "Unanalyzable binary file",
          "description": "Binary file '.xray/xray.db-shm' cannot be inspected by the scanner. Reason: Binary file (.db-shm) - cannot inspect content. Binary files resist static analysis and may contain hidden functionality.",
          "remediation": "Replace binary files with source code, or submit the binary to VirusTotal for independent verification (--use-virustotal)."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "obfuscation",
          "file_path": "/repo/.xray/xray.db-shm",
          "line_number": null,
          "rule_identifier": "HIDDEN_DATA_FILE",
          "title": "Hidden data file detected",
          "description": "Hidden file found: .xray/xray.db-shm. Hidden files may contain concealed configuration or data that should be reviewed.",
          "remediation": "Move file to a visible location or document its purpose."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/.xray/xray.db-shm",
          "line_number": null,
          "rule_identifier": "BINARY_FILE_DETECTED",
          "title": "Binary file detected in skill package",
          "description": "Binary file found: .xray/xray.db-shm. Binary files cannot be inspected by static analysis. Consider using Python or Bash scripts for transparency.",
          "remediation": "Review binary file necessity. Replace with auditable scripts if possible."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "policy_violation",
          "file_path": "/repo/.xray/xray.db-wal",
          "line_number": null,
          "rule_identifier": "UNANALYZABLE_BINARY",
          "title": "Unanalyzable binary file",
          "description": "Binary file '.xray/xray.db-wal' cannot be inspected by the scanner. Reason: Binary file (.db-wal) - cannot inspect content. Binary files resist static analysis and may contain hidden functionality.",
          "remediation": "Replace binary files with source code, or submit the binary to VirusTotal for independent verification (--use-virustotal)."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "obfuscation",
          "file_path": "/repo/.xray/xray.db-wal",
          "line_number": null,
          "rule_identifier": "HIDDEN_DATA_FILE",
          "title": "Hidden data file detected",
          "description": "Hidden file found: .xray/xray.db-wal. Hidden files may contain concealed configuration or data that should be reviewed.",
          "remediation": "Move file to a visible location or document its purpose."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/.xray/xray.db-wal",
          "line_number": null,
          "rule_identifier": "BINARY_FILE_DETECTED",
          "title": "Binary file detected in skill package",
          "description": "Binary file found: .xray/xray.db-wal. Binary files cannot be inspected by static analysis. Consider using Python or Bash scripts for transparency.",
          "remediation": "Review binary file necessity. Replace with auditable scripts if possible."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "command_injection",
          "file_path": "/repo/README.md",
          "line_number": 2,
          "rule_identifier": "PIPELINE_TAINT_FLOW",
          "title": "Dangerous data flow in command pipeline",
          "description": "Pipeline downloads data from the network and executes it: `curl -fsSL https://raw.githubusercontent.com/srijanshukla18/xray/main/install.sh | bash`. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.)",
          "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "command_injection",
          "file_path": "/repo/README.md",
          "line_number": 3,
          "rule_identifier": "PIPELINE_TAINT_FLOW",
          "title": "Dangerous data flow in command pipeline",
          "description": "Pipeline downloads data from the network and executes it: `curl -LsSf https://astral.sh/uv/install.sh | sh`. This is a remote code execution pattern. (Note: uses a well-known installer URL - likely a standard installation command.)",
          "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "command_injection",
          "file_path": "/repo/SKILL.md",
          "line_number": 2,
          "rule_identifier": "PIPELINE_TAINT_FLOW",
          "title": "Dangerous data flow in command pipeline",
          "description": "Pipeline downloads data from the network and executes it: `curl -fsSL https://raw.githubusercontent.com/srijanshukla18/xray/main/install.sh | bash`. This is a remote code execution pattern. (Note: appears to be instructional install text in SKILL.md; review URL trust and pinning.)",
          "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "command_injection",
          "file_path": "/repo/SKILL.md",
          "line_number": 3,
          "rule_identifier": "PIPELINE_TAINT_FLOW",
          "title": "Dangerous data flow in command pipeline",
          "description": "Pipeline downloads data from the network and executes it: `curl -LsSf https://astral.sh/uv/install.sh | sh`. This is a remote code execution pattern. (Note: uses a well-known installer URL - likely a standard installation command.)",
          "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "high",
          "category": "command_injection",
          "file_path": "/repo/getting_started.md",
          "line_number": 1,
          "rule_identifier": "PIPELINE_TAINT_FLOW",
          "title": "Dangerous data flow in command pipeline",
          "description": "Pipeline downloads data from the network and executes it: `curl -fsSL https://raw.githubusercontent.com/srijanshukla18/xray/main/install.sh | bash`. This is a remote code execution pattern.",
          "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "command_injection",
          "file_path": "/repo/getting_started.md",
          "line_number": 2,
          "rule_identifier": "PIPELINE_TAINT_FLOW",
          "title": "Dangerous data flow in command pipeline",
          "description": "Pipeline downloads data from the network and executes it: `curl -LsSf https://astral.sh/uv/install.sh | sh`. This is a remote code execution pattern. (Note: uses a well-known installer URL - likely a standard installation command.)",
          "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "data_exfiltration",
          "file_path": "/repo/test_samples/test.js",
          "line_number": 13,
          "rule_identifier": "DATA_EXFIL_JS_NETWORK",
          "title": "Outbound network request primitives in JavaScript/TypeScript",
          "description": "Pattern detected: axios.get(",
          "remediation": "Ensure network operations are necessary and document allowed destinations"
        }
      ],
      "execution_duration_seconds": 37.11739819700597,
      "status": "complete",
      "metadata": {
        "source": "pypi",
        "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/",
        "report_type": "cisco-skill-sast",
        "analyzers_used": [
          "bytecode",
          "pipeline",
          "static_analyzer"
        ],
        "skills_scanned": [
          "repo"
        ],
        "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt",
        "severity_counts": {
          "low": 9,
          "high": 2,
          "medium": 3,
          "critical": 0,
          "informational": 3
        }
      },
      "display_score": 35.5,
      "display_badge": "Unsafe"
    },
    {
      "scanner_name": "agent-audit-kit",
      "scanner_version": "0.3.26",
      "score": 93.0,
      "scanner_badge": "Verified",
      "findings": [
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "supply-chain",
          "file_path": "pyproject.toml",
          "line_number": null,
          "rule_identifier": "AAK-SUPPLY-004",
          "title": "No lockfile present",
          "description": "A package manifest exists but no lockfile was found. Without lockfiles, dependency versions float and can be silently updated.",
          "remediation": "Generate and commit lockfile."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "low",
          "category": "supply-chain",
          "file_path": "SECURITY.md",
          "line_number": null,
          "rule_identifier": "AAK-SEC-MD-001",
          "title": "MCP server repo missing SECURITY.md or security_contact",
          "description": "A repository whose name or pyproject keywords declare it as an MCP server ships without a top-level SECURITY.md AND without a `security_contact` entry in marketplace.json / pyproject.toml / package.json. Anthropic's April 2026 SECURITY.md guidance makes this the baseline expectation so researchers have a channel.",
          "remediation": "Add SECURITY.md at the repo root with a disclosure email and response SLA; OR add `security_contact` to the project manifest."
        }
      ],
      "execution_duration_seconds": 17.135930351010757,
      "status": "complete",
      "metadata": {
        "source": "pypi",
        "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/",
        "report_type": "agent-audit-kit-sast",
        "files_scanned": 18,
        "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt",
        "rules_evaluated": 211,
        "severity_counts": {
          "low": 1,
          "high": 0,
          "medium": 1,
          "critical": 0,
          "informational": 0
        }
      },
      "display_score": 93.0,
      "display_badge": "Verified"
    },
    {
      "scanner_name": "bearer",
      "scanner_version": "2.0.2",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 14.77391144898138,
      "status": "complete",
      "metadata": {
        "source": "github-releases",
        "source_url": "https://github.com/Bearer/bearer",
        "report_type": "security",
        "rules_loaded": 1,
        "install_command": "curl -sfL https://raw.githubusercontent.com/Bearer/bearer/main/contrib/install.sh | sh -s -- -b /usr/local/bin \"v2.0.2\""
      },
      "display_score": 100.0,
      "display_badge": "Verified"
    },
    {
      "scanner_name": "nerlo-behavioral",
      "scanner_version": "0.1.0",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 47.12683028000174,
      "status": "complete",
      "metadata": {
        "source": "nerlo-original",
        "source_url": "https://github.com/nerlo-ai/nerlo",
        "report_type": "nerlo-behavioral",
        "ruleset_path": "/opt/nerlo-rules/exfiltration.yaml",
        "files_scanned": 9,
        "install_command": "pip install 'semgrep==1.97.0'"
      },
      "display_score": 100.0,
      "display_badge": "Verified"
    },
    {
      "scanner_name": "nerlo-install-instruction",
      "scanner_version": "0.1.0",
      "score": 0.0,
      "scanner_badge": "Unsafe",
      "findings": [
        {
          "tool_name": "nerlo-install-instruction",
          "severity": "high",
          "category": "install-instruction-exec",
          "file_path": "/repo/README.md",
          "line_number": 38,
          "rule_identifier": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
          "title": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
          "description": "Documentation instructs piping a downloaded artifact directly into a shell (curl/wget/iwr ... | bash/sh/iex). This is the curl-pipe-bash install shape used by the ClawHub skill droppers and countless malware loaders \u2014 the fetched payload is executed with zero inspection. Confirm this is expected; it is a strong weaponized-documentation signal.",
          "remediation": null
        },
        {
          "tool_name": "nerlo-install-instruction",
          "severity": "high",
          "category": "install-instruction-exec",
          "file_path": "/repo/README.md",
          "line_number": 51,
          "rule_identifier": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
          "title": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
          "description": "Documentation instructs piping a downloaded artifact directly into a shell (curl/wget/iwr ... | bash/sh/iex). This is the curl-pipe-bash install shape used by the ClawHub skill droppers and countless malware loaders \u2014 the fetched payload is executed with zero inspection. Confirm this is expected; it is a strong weaponized-documentation signal.",
          "remediation": null
        },
        {
          "tool_name": "nerlo-install-instruction",
          "severity": "high",
          "category": "install-instruction-exec",
          "file_path": "/repo/README.md",
          "line_number": 51,
          "rule_identifier": "opt.nerlo-rules.nerlo-install-fetch-raw-then-run",
          "title": "opt.nerlo-rules.nerlo-install-fetch-raw-then-run",
          "description": "Documentation directs fetching a raw file (raw.githubusercontent.com, a gist raw URL, or a GitHub release asset) and executing it. Fetch-then-run of an untrusted raw artifact is a fetch-and-execute install directive \u2014 the FakeGit \"download and run\" shape. Confirm the artifact and origin.",
          "remediation": null
        },
        {
          "tool_name": "nerlo-install-instruction",
          "severity": "high",
          "category": "install-instruction-exec",
          "file_path": "/repo/README.md",
          "line_number": 211,
          "rule_identifier": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
          "title": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
          "description": "Documentation instructs piping a downloaded artifact directly into a shell (curl/wget/iwr ... | bash/sh/iex). This is the curl-pipe-bash install shape used by the ClawHub skill droppers and countless malware loaders \u2014 the fetched payload is executed with zero inspection. Confirm this is expected; it is a strong weaponized-documentation signal.",
          "remediation": null
        },
        {
          "tool_name": "nerlo-install-instruction",
          "severity": "high",
          "category": "install-instruction-exec",
          "file_path": "/repo/README.md",
          "line_number": 227,
          "rule_identifier": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
          "title": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
          "description": "Documentation instructs piping a downloaded artifact directly into a shell (curl/wget/iwr ... | bash/sh/iex). This is the curl-pipe-bash install shape used by the ClawHub skill droppers and countless malware loaders \u2014 the fetched payload is executed with zero inspection. Confirm this is expected; it is a strong weaponized-documentation signal.",
          "remediation": null
        },
        {
          "tool_name": "nerlo-install-instruction",
          "severity": "high",
          "category": "install-instruction-exec",
          "file_path": "/repo/README.md",
          "line_number": 227,
          "rule_identifier": "opt.nerlo-rules.nerlo-install-fetch-raw-then-run",
          "title": "opt.nerlo-rules.nerlo-install-fetch-raw-then-run",
          "description": "Documentation directs fetching a raw file (raw.githubusercontent.com, a gist raw URL, or a GitHub release asset) and executing it. Fetch-then-run of an untrusted raw artifact is a fetch-and-execute install directive \u2014 the FakeGit \"download and run\" shape. Confirm the artifact and origin.",
          "remediation": null
        },
        {
          "tool_name": "nerlo-install-instruction",
          "severity": "high",
          "category": "install-instruction-exec",
          "file_path": "/repo/getting_started.md",
          "line_number": 14,
          "rule_identifier": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
          "title": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
          "description": "Documentation instructs piping a downloaded artifact directly into a shell (curl/wget/iwr ... | bash/sh/iex). This is the curl-pipe-bash install shape used by the ClawHub skill droppers and countless malware loaders \u2014 the fetched payload is executed with zero inspection. Confirm this is expected; it is a strong weaponized-documentation signal.",
          "remediation": null
        },
        {
          "tool_name": "nerlo-install-instruction",
          "severity": "high",
          "category": "install-instruction-exec",
          "file_path": "/repo/getting_started.md",
          "line_number": 30,
          "rule_identifier": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
          "title": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
          "description": "Documentation instructs piping a downloaded artifact directly into a shell (curl/wget/iwr ... | bash/sh/iex). This is the curl-pipe-bash install shape used by the ClawHub skill droppers and countless malware loaders \u2014 the fetched payload is executed with zero inspection. Confirm this is expected; it is a strong weaponized-documentation signal.",
          "remediation": null
        },
        {
          "tool_name": "nerlo-install-instruction",
          "severity": "high",
          "category": "install-instruction-exec",
          "file_path": "/repo/getting_started.md",
          "line_number": 30,
          "rule_identifier": "opt.nerlo-rules.nerlo-install-fetch-raw-then-run",
          "title": "opt.nerlo-rules.nerlo-install-fetch-raw-then-run",
          "description": "Documentation directs fetching a raw file (raw.githubusercontent.com, a gist raw URL, or a GitHub release asset) and executing it. Fetch-then-run of an untrusted raw artifact is a fetch-and-execute install directive \u2014 the FakeGit \"download and run\" shape. Confirm the artifact and origin.",
          "remediation": null
        },
        {
          "tool_name": "nerlo-install-instruction",
          "severity": "high",
          "category": "install-instruction-exec",
          "file_path": "/repo/install.sh",
          "line_number": 4,
          "rule_identifier": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
          "title": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
          "description": "Documentation instructs piping a downloaded artifact directly into a shell (curl/wget/iwr ... | bash/sh/iex). This is the curl-pipe-bash install shape used by the ClawHub skill droppers and countless malware loaders \u2014 the fetched payload is executed with zero inspection. Confirm this is expected; it is a strong weaponized-documentation signal.",
          "remediation": null
        },
        {
          "tool_name": "nerlo-install-instruction",
          "severity": "high",
          "category": "install-instruction-exec",
          "file_path": "/repo/install.sh",
          "line_number": 4,
          "rule_identifier": "opt.nerlo-rules.nerlo-install-fetch-raw-then-run",
          "title": "opt.nerlo-rules.nerlo-install-fetch-raw-then-run",
          "description": "Documentation directs fetching a raw file (raw.githubusercontent.com, a gist raw URL, or a GitHub release asset) and executing it. Fetch-then-run of an untrusted raw artifact is a fetch-and-execute install directive \u2014 the FakeGit \"download and run\" shape. Confirm the artifact and origin.",
          "remediation": null
        },
        {
          "tool_name": "nerlo-install-instruction",
          "severity": "high",
          "category": "install-instruction-exec",
          "file_path": "/repo/install.sh",
          "line_number": 59,
          "rule_identifier": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
          "title": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
          "description": "Documentation instructs piping a downloaded artifact directly into a shell (curl/wget/iwr ... | bash/sh/iex). This is the curl-pipe-bash install shape used by the ClawHub skill droppers and countless malware loaders \u2014 the fetched payload is executed with zero inspection. Confirm this is expected; it is a strong weaponized-documentation signal.",
          "remediation": null
        }
      ],
      "execution_duration_seconds": 46.728259494993836,
      "status": "complete",
      "metadata": {
        "source": "nerlo-original",
        "source_url": "https://github.com/nerlo-ai/nerlo",
        "report_type": "nerlo-install-instruction",
        "ruleset_path": "/opt/nerlo-rules/install_instructions.yaml",
        "files_scanned": 3,
        "install_command": "pip install 'semgrep==1.97.0'",
        "severity_counts": {
          "low": 0,
          "high": 12,
          "medium": 0,
          "critical": 0,
          "informational": 0
        }
      },
      "display_score": 0.0,
      "display_badge": "Unsafe"
    },
    {
      "scanner_name": "trivy",
      "scanner_version": "0.71.0",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 0.8484299739939161,
      "status": "complete",
      "metadata": {
        "source": "github-releases",
        "source_url": "https://github.com/aquasecurity/trivy/releases/tag/v0.71.0",
        "report_type": "filesystem-vulnerability",
        "install_command": "curl -sfL -o /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.71.0/trivy_0.71.0_Linux-64bit.deb && echo '<sha256>  /tmp/trivy.deb' | sha256sum -c - && dpkg -i /tmp/trivy.deb",
        "manifests_scanned": []
      },
      "display_score": 100.0,
      "display_badge": "Verified"
    },
    {
      "scanner_name": "osv-scanner",
      "scanner_version": "2.3.8",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 0.5843883199850097,
      "status": "not_applicable",
      "metadata": {
        "source": "github-releases",
        "source_url": "https://github.com/google/osv-scanner/releases/tag/v2.3.8",
        "report_type": "osv-vulnerability",
        "ecosystems_seen": [],
        "install_command": "curl -sfL -o /usr/local/bin/osv-scanner https://github.com/google/osv-scanner/releases/download/v2.3.8/osv-scanner_linux_amd64 && echo '<sha256>  /usr/local/bin/osv-scanner' | sha256sum -c - && chmod +x /usr/local/bin/osv-scanner",
        "manifests_scanned": [],
        "finding_id_aliases": {},
        "cross_scanner_correlation": {
          "only_osv": [],
          "only_trivy": [],
          "intersection_ids": []
        }
      },
      "display_score": null,
      "display_badge": "unavailable"
    }
  ],
  "threat_model": "Threat model synthesis has not yet run for this scan. This section is generated by the registry's LLM pipeline (Req 22.3) and will appear in the next regeneration of this report.",
  "audit_chain": {
    "scan_job_id": "2da49912-767e-4ef7-87cc-4998a7f38219",
    "scan_completed_at": "2026-07-21T04:29:40.386386+00:00",
    "scanner_versions": {
      "agentshield": "1.4.0",
      "cisco-skill-scanner": "2.0.11",
      "agent-audit-kit": "0.3.26",
      "bearer": "2.0.2",
      "nerlo-behavioral": "0.1.0",
      "nerlo-install-instruction": "0.1.0",
      "trivy": "0.71.0",
      "osv-scanner": "2.3.8"
    },
    "scanner_base_image": "us-central1-docker.pkg.dev/nerlo-vsk-prod/nerlo/scanner-base@sha256:229184f5b7dddaed2b5e2a60a9cd3eeecfc0a610ac8e28131e02a7d179fdc00f",
    "ai_decision_log_ids": [
      "4199fc8d-4d6f-4be6-a9b4-e4aff1a7f1fa"
    ],
    "self_attestation_url": "http://localhost:8000/api/v1/registry/self-attestation"
  },
  "appendix": {
    "raw_scanner_reports": [
      {
        "scanner_name": "agentshield",
        "scanner_version": "1.4.0",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 0.8802287619910203,
        "status": "not_applicable",
        "metadata": {
          "source": "npm",
          "source_url": "https://www.npmjs.com/package/ecc-agentshield",
          "install_command": "npm install -g ecc-agentshield@1.4.0",
          "scans_performed": []
        },
        "display_score": null,
        "display_badge": "unavailable"
      },
      {
        "scanner_name": "cisco-skill-scanner",
        "scanner_version": "2.0.11",
        "score": 35.5,
        "scanner_badge": "Unsafe",
        "findings": [
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "high",
            "category": "policy_violation",
            "file_path": "/repo",
            "line_number": null,
            "rule_identifier": "LOW_ANALYZABILITY",
            "title": "Critically low analyzability score",
            "description": "Only 67% of skill content could be analyzed. 6 of 22 files are opaque to the scanner. The safety assessment has low confidence.",
            "remediation": "Replace opaque files (binaries, encrypted content) with inspectable source code to improve scan confidence."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "obfuscation",
            "file_path": "/repo/.xray/xray.db",
            "line_number": null,
            "rule_identifier": "HIDDEN_DATA_FILE",
            "title": "Hidden data file detected",
            "description": "Hidden file found: .xray/xray.db. Hidden files may contain concealed configuration or data that should be reviewed.",
            "remediation": "Move file to a visible location or document its purpose."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "policy_violation",
            "file_path": "/repo/.xray/xray.db-shm",
            "line_number": null,
            "rule_identifier": "UNANALYZABLE_BINARY",
            "title": "Unanalyzable binary file",
            "description": "Binary file '.xray/xray.db-shm' cannot be inspected by the scanner. Reason: Binary file (.db-shm) - cannot inspect content. Binary files resist static analysis and may contain hidden functionality.",
            "remediation": "Replace binary files with source code, or submit the binary to VirusTotal for independent verification (--use-virustotal)."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "obfuscation",
            "file_path": "/repo/.xray/xray.db-shm",
            "line_number": null,
            "rule_identifier": "HIDDEN_DATA_FILE",
            "title": "Hidden data file detected",
            "description": "Hidden file found: .xray/xray.db-shm. Hidden files may contain concealed configuration or data that should be reviewed.",
            "remediation": "Move file to a visible location or document its purpose."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/.xray/xray.db-shm",
            "line_number": null,
            "rule_identifier": "BINARY_FILE_DETECTED",
            "title": "Binary file detected in skill package",
            "description": "Binary file found: .xray/xray.db-shm. Binary files cannot be inspected by static analysis. Consider using Python or Bash scripts for transparency.",
            "remediation": "Review binary file necessity. Replace with auditable scripts if possible."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "policy_violation",
            "file_path": "/repo/.xray/xray.db-wal",
            "line_number": null,
            "rule_identifier": "UNANALYZABLE_BINARY",
            "title": "Unanalyzable binary file",
            "description": "Binary file '.xray/xray.db-wal' cannot be inspected by the scanner. Reason: Binary file (.db-wal) - cannot inspect content. Binary files resist static analysis and may contain hidden functionality.",
            "remediation": "Replace binary files with source code, or submit the binary to VirusTotal for independent verification (--use-virustotal)."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "obfuscation",
            "file_path": "/repo/.xray/xray.db-wal",
            "line_number": null,
            "rule_identifier": "HIDDEN_DATA_FILE",
            "title": "Hidden data file detected",
            "description": "Hidden file found: .xray/xray.db-wal. Hidden files may contain concealed configuration or data that should be reviewed.",
            "remediation": "Move file to a visible location or document its purpose."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/.xray/xray.db-wal",
            "line_number": null,
            "rule_identifier": "BINARY_FILE_DETECTED",
            "title": "Binary file detected in skill package",
            "description": "Binary file found: .xray/xray.db-wal. Binary files cannot be inspected by static analysis. Consider using Python or Bash scripts for transparency.",
            "remediation": "Review binary file necessity. Replace with auditable scripts if possible."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "command_injection",
            "file_path": "/repo/README.md",
            "line_number": 2,
            "rule_identifier": "PIPELINE_TAINT_FLOW",
            "title": "Dangerous data flow in command pipeline",
            "description": "Pipeline downloads data from the network and executes it: `curl -fsSL https://raw.githubusercontent.com/srijanshukla18/xray/main/install.sh | bash`. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.)",
            "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "command_injection",
            "file_path": "/repo/README.md",
            "line_number": 3,
            "rule_identifier": "PIPELINE_TAINT_FLOW",
            "title": "Dangerous data flow in command pipeline",
            "description": "Pipeline downloads data from the network and executes it: `curl -LsSf https://astral.sh/uv/install.sh | sh`. This is a remote code execution pattern. (Note: uses a well-known installer URL - likely a standard installation command.)",
            "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "command_injection",
            "file_path": "/repo/SKILL.md",
            "line_number": 2,
            "rule_identifier": "PIPELINE_TAINT_FLOW",
            "title": "Dangerous data flow in command pipeline",
            "description": "Pipeline downloads data from the network and executes it: `curl -fsSL https://raw.githubusercontent.com/srijanshukla18/xray/main/install.sh | bash`. This is a remote code execution pattern. (Note: appears to be instructional install text in SKILL.md; review URL trust and pinning.)",
            "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "command_injection",
            "file_path": "/repo/SKILL.md",
            "line_number": 3,
            "rule_identifier": "PIPELINE_TAINT_FLOW",
            "title": "Dangerous data flow in command pipeline",
            "description": "Pipeline downloads data from the network and executes it: `curl -LsSf https://astral.sh/uv/install.sh | sh`. This is a remote code execution pattern. (Note: uses a well-known installer URL - likely a standard installation command.)",
            "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "high",
            "category": "command_injection",
            "file_path": "/repo/getting_started.md",
            "line_number": 1,
            "rule_identifier": "PIPELINE_TAINT_FLOW",
            "title": "Dangerous data flow in command pipeline",
            "description": "Pipeline downloads data from the network and executes it: `curl -fsSL https://raw.githubusercontent.com/srijanshukla18/xray/main/install.sh | bash`. This is a remote code execution pattern.",
            "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "command_injection",
            "file_path": "/repo/getting_started.md",
            "line_number": 2,
            "rule_identifier": "PIPELINE_TAINT_FLOW",
            "title": "Dangerous data flow in command pipeline",
            "description": "Pipeline downloads data from the network and executes it: `curl -LsSf https://astral.sh/uv/install.sh | sh`. This is a remote code execution pattern. (Note: uses a well-known installer URL - likely a standard installation command.)",
            "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "data_exfiltration",
            "file_path": "/repo/test_samples/test.js",
            "line_number": 13,
            "rule_identifier": "DATA_EXFIL_JS_NETWORK",
            "title": "Outbound network request primitives in JavaScript/TypeScript",
            "description": "Pattern detected: axios.get(",
            "remediation": "Ensure network operations are necessary and document allowed destinations"
          }
        ],
        "execution_duration_seconds": 37.11739819700597,
        "status": "complete",
        "metadata": {
          "source": "pypi",
          "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/",
          "report_type": "cisco-skill-sast",
          "analyzers_used": [
            "bytecode",
            "pipeline",
            "static_analyzer"
          ],
          "skills_scanned": [
            "repo"
          ],
          "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt",
          "severity_counts": {
            "low": 9,
            "high": 2,
            "medium": 3,
            "critical": 0,
            "informational": 3
          }
        },
        "display_score": 35.5,
        "display_badge": "Unsafe"
      },
      {
        "scanner_name": "agent-audit-kit",
        "scanner_version": "0.3.26",
        "score": 93.0,
        "scanner_badge": "Verified",
        "findings": [
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "supply-chain",
            "file_path": "pyproject.toml",
            "line_number": null,
            "rule_identifier": "AAK-SUPPLY-004",
            "title": "No lockfile present",
            "description": "A package manifest exists but no lockfile was found. Without lockfiles, dependency versions float and can be silently updated.",
            "remediation": "Generate and commit lockfile."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "low",
            "category": "supply-chain",
            "file_path": "SECURITY.md",
            "line_number": null,
            "rule_identifier": "AAK-SEC-MD-001",
            "title": "MCP server repo missing SECURITY.md or security_contact",
            "description": "A repository whose name or pyproject keywords declare it as an MCP server ships without a top-level SECURITY.md AND without a `security_contact` entry in marketplace.json / pyproject.toml / package.json. Anthropic's April 2026 SECURITY.md guidance makes this the baseline expectation so researchers have a channel.",
            "remediation": "Add SECURITY.md at the repo root with a disclosure email and response SLA; OR add `security_contact` to the project manifest."
          }
        ],
        "execution_duration_seconds": 17.135930351010757,
        "status": "complete",
        "metadata": {
          "source": "pypi",
          "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/",
          "report_type": "agent-audit-kit-sast",
          "files_scanned": 18,
          "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt",
          "rules_evaluated": 211,
          "severity_counts": {
            "low": 1,
            "high": 0,
            "medium": 1,
            "critical": 0,
            "informational": 0
          }
        },
        "display_score": 93.0,
        "display_badge": "Verified"
      },
      {
        "scanner_name": "bearer",
        "scanner_version": "2.0.2",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 14.77391144898138,
        "status": "complete",
        "metadata": {
          "source": "github-releases",
          "source_url": "https://github.com/Bearer/bearer",
          "report_type": "security",
          "rules_loaded": 1,
          "install_command": "curl -sfL https://raw.githubusercontent.com/Bearer/bearer/main/contrib/install.sh | sh -s -- -b /usr/local/bin \"v2.0.2\""
        },
        "display_score": 100.0,
        "display_badge": "Verified"
      },
      {
        "scanner_name": "nerlo-behavioral",
        "scanner_version": "0.1.0",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 47.12683028000174,
        "status": "complete",
        "metadata": {
          "source": "nerlo-original",
          "source_url": "https://github.com/nerlo-ai/nerlo",
          "report_type": "nerlo-behavioral",
          "ruleset_path": "/opt/nerlo-rules/exfiltration.yaml",
          "files_scanned": 9,
          "install_command": "pip install 'semgrep==1.97.0'"
        },
        "display_score": 100.0,
        "display_badge": "Verified"
      },
      {
        "scanner_name": "nerlo-install-instruction",
        "scanner_version": "0.1.0",
        "score": 0.0,
        "scanner_badge": "Unsafe",
        "findings": [
          {
            "tool_name": "nerlo-install-instruction",
            "severity": "high",
            "category": "install-instruction-exec",
            "file_path": "/repo/README.md",
            "line_number": 38,
            "rule_identifier": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
            "title": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
            "description": "Documentation instructs piping a downloaded artifact directly into a shell (curl/wget/iwr ... | bash/sh/iex). This is the curl-pipe-bash install shape used by the ClawHub skill droppers and countless malware loaders \u2014 the fetched payload is executed with zero inspection. Confirm this is expected; it is a strong weaponized-documentation signal.",
            "remediation": null
          },
          {
            "tool_name": "nerlo-install-instruction",
            "severity": "high",
            "category": "install-instruction-exec",
            "file_path": "/repo/README.md",
            "line_number": 51,
            "rule_identifier": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
            "title": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
            "description": "Documentation instructs piping a downloaded artifact directly into a shell (curl/wget/iwr ... | bash/sh/iex). This is the curl-pipe-bash install shape used by the ClawHub skill droppers and countless malware loaders \u2014 the fetched payload is executed with zero inspection. Confirm this is expected; it is a strong weaponized-documentation signal.",
            "remediation": null
          },
          {
            "tool_name": "nerlo-install-instruction",
            "severity": "high",
            "category": "install-instruction-exec",
            "file_path": "/repo/README.md",
            "line_number": 51,
            "rule_identifier": "opt.nerlo-rules.nerlo-install-fetch-raw-then-run",
            "title": "opt.nerlo-rules.nerlo-install-fetch-raw-then-run",
            "description": "Documentation directs fetching a raw file (raw.githubusercontent.com, a gist raw URL, or a GitHub release asset) and executing it. Fetch-then-run of an untrusted raw artifact is a fetch-and-execute install directive \u2014 the FakeGit \"download and run\" shape. Confirm the artifact and origin.",
            "remediation": null
          },
          {
            "tool_name": "nerlo-install-instruction",
            "severity": "high",
            "category": "install-instruction-exec",
            "file_path": "/repo/README.md",
            "line_number": 211,
            "rule_identifier": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
            "title": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
            "description": "Documentation instructs piping a downloaded artifact directly into a shell (curl/wget/iwr ... | bash/sh/iex). This is the curl-pipe-bash install shape used by the ClawHub skill droppers and countless malware loaders \u2014 the fetched payload is executed with zero inspection. Confirm this is expected; it is a strong weaponized-documentation signal.",
            "remediation": null
          },
          {
            "tool_name": "nerlo-install-instruction",
            "severity": "high",
            "category": "install-instruction-exec",
            "file_path": "/repo/README.md",
            "line_number": 227,
            "rule_identifier": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
            "title": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
            "description": "Documentation instructs piping a downloaded artifact directly into a shell (curl/wget/iwr ... | bash/sh/iex). This is the curl-pipe-bash install shape used by the ClawHub skill droppers and countless malware loaders \u2014 the fetched payload is executed with zero inspection. Confirm this is expected; it is a strong weaponized-documentation signal.",
            "remediation": null
          },
          {
            "tool_name": "nerlo-install-instruction",
            "severity": "high",
            "category": "install-instruction-exec",
            "file_path": "/repo/README.md",
            "line_number": 227,
            "rule_identifier": "opt.nerlo-rules.nerlo-install-fetch-raw-then-run",
            "title": "opt.nerlo-rules.nerlo-install-fetch-raw-then-run",
            "description": "Documentation directs fetching a raw file (raw.githubusercontent.com, a gist raw URL, or a GitHub release asset) and executing it. Fetch-then-run of an untrusted raw artifact is a fetch-and-execute install directive \u2014 the FakeGit \"download and run\" shape. Confirm the artifact and origin.",
            "remediation": null
          },
          {
            "tool_name": "nerlo-install-instruction",
            "severity": "high",
            "category": "install-instruction-exec",
            "file_path": "/repo/getting_started.md",
            "line_number": 14,
            "rule_identifier": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
            "title": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
            "description": "Documentation instructs piping a downloaded artifact directly into a shell (curl/wget/iwr ... | bash/sh/iex). This is the curl-pipe-bash install shape used by the ClawHub skill droppers and countless malware loaders \u2014 the fetched payload is executed with zero inspection. Confirm this is expected; it is a strong weaponized-documentation signal.",
            "remediation": null
          },
          {
            "tool_name": "nerlo-install-instruction",
            "severity": "high",
            "category": "install-instruction-exec",
            "file_path": "/repo/getting_started.md",
            "line_number": 30,
            "rule_identifier": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
            "title": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
            "description": "Documentation instructs piping a downloaded artifact directly into a shell (curl/wget/iwr ... | bash/sh/iex). This is the curl-pipe-bash install shape used by the ClawHub skill droppers and countless malware loaders \u2014 the fetched payload is executed with zero inspection. Confirm this is expected; it is a strong weaponized-documentation signal.",
            "remediation": null
          },
          {
            "tool_name": "nerlo-install-instruction",
            "severity": "high",
            "category": "install-instruction-exec",
            "file_path": "/repo/getting_started.md",
            "line_number": 30,
            "rule_identifier": "opt.nerlo-rules.nerlo-install-fetch-raw-then-run",
            "title": "opt.nerlo-rules.nerlo-install-fetch-raw-then-run",
            "description": "Documentation directs fetching a raw file (raw.githubusercontent.com, a gist raw URL, or a GitHub release asset) and executing it. Fetch-then-run of an untrusted raw artifact is a fetch-and-execute install directive \u2014 the FakeGit \"download and run\" shape. Confirm the artifact and origin.",
            "remediation": null
          },
          {
            "tool_name": "nerlo-install-instruction",
            "severity": "high",
            "category": "install-instruction-exec",
            "file_path": "/repo/install.sh",
            "line_number": 4,
            "rule_identifier": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
            "title": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
            "description": "Documentation instructs piping a downloaded artifact directly into a shell (curl/wget/iwr ... | bash/sh/iex). This is the curl-pipe-bash install shape used by the ClawHub skill droppers and countless malware loaders \u2014 the fetched payload is executed with zero inspection. Confirm this is expected; it is a strong weaponized-documentation signal.",
            "remediation": null
          },
          {
            "tool_name": "nerlo-install-instruction",
            "severity": "high",
            "category": "install-instruction-exec",
            "file_path": "/repo/install.sh",
            "line_number": 4,
            "rule_identifier": "opt.nerlo-rules.nerlo-install-fetch-raw-then-run",
            "title": "opt.nerlo-rules.nerlo-install-fetch-raw-then-run",
            "description": "Documentation directs fetching a raw file (raw.githubusercontent.com, a gist raw URL, or a GitHub release asset) and executing it. Fetch-then-run of an untrusted raw artifact is a fetch-and-execute install directive \u2014 the FakeGit \"download and run\" shape. Confirm the artifact and origin.",
            "remediation": null
          },
          {
            "tool_name": "nerlo-install-instruction",
            "severity": "high",
            "category": "install-instruction-exec",
            "file_path": "/repo/install.sh",
            "line_number": 59,
            "rule_identifier": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
            "title": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
            "description": "Documentation instructs piping a downloaded artifact directly into a shell (curl/wget/iwr ... | bash/sh/iex). This is the curl-pipe-bash install shape used by the ClawHub skill droppers and countless malware loaders \u2014 the fetched payload is executed with zero inspection. Confirm this is expected; it is a strong weaponized-documentation signal.",
            "remediation": null
          }
        ],
        "execution_duration_seconds": 46.728259494993836,
        "status": "complete",
        "metadata": {
          "source": "nerlo-original",
          "source_url": "https://github.com/nerlo-ai/nerlo",
          "report_type": "nerlo-install-instruction",
          "ruleset_path": "/opt/nerlo-rules/install_instructions.yaml",
          "files_scanned": 3,
          "install_command": "pip install 'semgrep==1.97.0'",
          "severity_counts": {
            "low": 0,
            "high": 12,
            "medium": 0,
            "critical": 0,
            "informational": 0
          }
        },
        "display_score": 0.0,
        "display_badge": "Unsafe"
      },
      {
        "scanner_name": "trivy",
        "scanner_version": "0.71.0",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 0.8484299739939161,
        "status": "complete",
        "metadata": {
          "source": "github-releases",
          "source_url": "https://github.com/aquasecurity/trivy/releases/tag/v0.71.0",
          "report_type": "filesystem-vulnerability",
          "install_command": "curl -sfL -o /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.71.0/trivy_0.71.0_Linux-64bit.deb && echo '<sha256>  /tmp/trivy.deb' | sha256sum -c - && dpkg -i /tmp/trivy.deb",
          "manifests_scanned": []
        },
        "display_score": 100.0,
        "display_badge": "Verified"
      },
      {
        "scanner_name": "osv-scanner",
        "scanner_version": "2.3.8",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 0.5843883199850097,
        "status": "not_applicable",
        "metadata": {
          "source": "github-releases",
          "source_url": "https://github.com/google/osv-scanner/releases/tag/v2.3.8",
          "report_type": "osv-vulnerability",
          "ecosystems_seen": [],
          "install_command": "curl -sfL -o /usr/local/bin/osv-scanner https://github.com/google/osv-scanner/releases/download/v2.3.8/osv-scanner_linux_amd64 && echo '<sha256>  /usr/local/bin/osv-scanner' | sha256sum -c - && chmod +x /usr/local/bin/osv-scanner",
          "manifests_scanned": [],
          "finding_id_aliases": {},
          "cross_scanner_correlation": {
            "only_osv": [],
            "only_trivy": [],
            "intersection_ids": []
          }
        },
        "display_score": null,
        "display_badge": "unavailable"
      }
    ]
  },
  "report": {
    "report_id": "84ad8313-2b0b-4250-b401-2b67202cf092",
    "format": "json",
    "generated_at": "2026-07-21T18:00:01.927004+00:00",
    "scanner_filter": null,
    "signature": null
  }
}