# Security Audit Report — aida - **Report ID:** `601f2386-86c6-481d-bd2b-e609283834fe` - **Generated:** 2026-07-29T05:50:43.731500+00:00 - **Signature:** unsigned (cosign keyless signing runs in CI; Req 22.4) ## 1. Executive Summary **Badge:** Unsafe (composite) **Security score:** 53.6 | Scanner | Badge | | --- | --- | | agent-audit-kit | Caution | | agentshield | Verified | | bearer | Verified | | cisco-skill-scanner | Unsafe | | nerlo-behavioral | unavailable | | nerlo-install-instruction | Unsafe | | nerlo-multi-source | unavailable | | osv-scanner | unavailable | | trivy | unavailable | | Severity | Findings | | --- | --- | | critical | 0 | | high | 18 | | medium | 29 | | low | 27 | aida is NOT recommended for integration: the scan surfaced 0 critical and 18 high-severity findings. Treat the Per-Scanner Detail section as a remediation worklist and re-scan before reconsidering. ## 2. Source Provenance - **Repository:** https://github.com/clearclown/claude-code-aida - **Commit scanned:** `unknown` - **License:** unknown - **Maintainer:** unknown - **Version:** unknown ## 3. Per-Scanner Detail ### agentshield (v1.4.0) — Verified / 98.0 - **[medium] No permissions block configured** — settings.json has configuration but no permissions section. Without explicit allow/deny lists, the agent relies on default permissions which may be too broad. Add a permissions block to restrict tool access. (settings.json:None) - **[medium] No PreToolUse security hooks configured** — No PreToolUse hooks are defined. These hooks can catch dangerous operations before they run, providing an essential security layer. (settings.json:None) ### cisco-skill-scanner (v2.0.11) — Unsafe / 0.0 - **[informational] Skill name does not follow agent skills naming rules** — Skill name 'aida:fix' is invalid. Agent skills require lowercase letters, numbers, and hyphens only, with a maximum length of 64 characters. (/repo/skills/fix/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/skills/fix/SKILL.md:None) - **[informational] Skill name does not follow agent skills naming rules** — Skill name 'aida:resume' is invalid. Agent skills require lowercase letters, numbers, and hyphens only, with a maximum length of 64 characters. (/repo/skills/resume/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/skills/resume/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/skills/core/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/skills/orchestrator/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/skills/pipeline/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/skills/requirements-gen/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/skills/aida/SKILL.md:None) - **[low] Skill package contains many files** — Skill package contains 138 files. Large file counts increase attack surface and may indicate bundled dependencies or unnecessary content. (/repo/.:None) - **[low] Dangerous data flow in command pipeline** — Pipeline downloads data from the network and executes it: 'curl -sSL https://raw.githubusercontent.com/clearclown/claude-code-aida/main/scripts/install.sh \| bash'. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.) (/repo/README.md:1) - **[low] Vague skill description** — Skill description is too short (16 chars). Provide detailed explanation. (/repo/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/SKILL.md:None) - **[low] Dangerous data flow in command pipeline** — Pipeline downloads data from the network and executes it: 'curl -sSL https://raw.githubusercontent.com/clearclown/claude-code-aida/main/scripts/install.sh \| bash'. This is a remote code execution pattern. (Note: appears to be instructional install text in SKILL.md; review URL trust and pinning.) (/repo/SKILL.md:1) - **[low] Dangerous data flow in command pipeline** — Pipeline downloads data from the network and executes it: 'curl -fsSL https://raw.githubusercontent.com/clearclown/claude-code-aida/main/scripts/install.sh \| bash'. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.) (/repo/docs/readmeLang/README_ar.md:1) - **[low] Dangerous data flow in command pipeline** — Pipeline downloads data from the network and executes it: 'curl -fsSL https://raw.githubusercontent.com/clearclown/claude-code-aida/main/scripts/install.sh \| bash'. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.) (/repo/docs/readmeLang/README_fa.md:1) - **[low] Dangerous data flow in command pipeline** — Pipeline downloads data from the network and executes it: 'curl -fsSL https://raw.githubusercontent.com/clearclown/claude-code-aida/main/scripts/install.sh \| bash'. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.) (/repo/docs/readmeLang/README_ja.md:1) - **[low] Dangerous data flow in command pipeline** — Pipeline downloads data from the network and executes it: 'curl -fsSL https://raw.githubusercontent.com/clearclown/claude-code-aida/main/scripts/install.sh \| bash'. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.) (/repo/docs/readmeLang/README_ru.md:1) - **[low] Dangerous data flow in command pipeline** — Pipeline downloads data from the network and executes it: 'curl -fsSL https://raw.githubusercontent.com/clearclown/claude-code-aida/main/scripts/install.sh \| bash'. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.) (/repo/docs/readmeLang/README_zh-CN.md:1) - **[low] Dangerous data flow in command pipeline** — Pipeline downloads data from the network and executes it: 'curl -fsSL https://raw.githubusercontent.com/clearclown/claude-code-aida/main/scripts/install.sh \| bash'. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.) (/repo/docs/readmeLang/README_zh-TW.md:1) - **[medium] Glob or find pattern targeting hidden (dot) files, which may expose sensitive configurations** — Pattern detected: find "$evidence_dir" -name "*.json" -not -name ".* (/repo/hooks/stop/ralph-gate.sh:150) - **[medium] Attempting to install system packages with elevated privileges** — Pattern detected: sudo pacman -S (/repo/scripts/file-picker.sh:25) - **[medium] Attempting to install system packages with elevated privileges** — Pattern detected: sudo pacman -S (/repo/scripts/setup-grepai.sh:112) - **[medium] Attempting to install system packages with elevated privileges** — Pattern detected: sudo pacman -S (/repo/scripts/setup-jj.sh:60) - **[high] Archive extraction followed by execution** — An archive is extracted and its contents are then executed. This pattern can deliver and run malicious payloads hidden in archives. (/repo/scripts/setup-jj.sh:100) - **[low] Hidden data file detected** — Hidden file found: tests/.aida/specs/tests-reverse-design.md. Hidden files may contain concealed configuration or data that should be reviewed. (/repo/tests/.aida/specs/tests-reverse-design.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/agents/SKILL.md:None) - **[high] Database connection string with embedded credentials** — Pattern detected: post**** (/repo/agents/SKILL.md:4992) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/commands/SKILL.md:None) - **[low] Vague skill description** — Skill description is too short (16 chars). Provide detailed explanation. (/repo/docs/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/docs/SKILL.md:None) - **[low] Dangerous data flow in command pipeline** — Pipeline downloads data from the network and executes it: 'curl -fsSL https://raw.githubusercontent.com/clearclown/claude-code-aida/main/scripts/install.sh \| bash'. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.) (/repo/docs/readmeLang/README_ar.md:1) - **[low] Dangerous data flow in command pipeline** — Pipeline downloads data from the network and executes it: 'curl -fsSL https://raw.githubusercontent.com/clearclown/claude-code-aida/main/scripts/install.sh \| bash'. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.) (/repo/docs/readmeLang/README_fa.md:1) - **[low] Dangerous data flow in command pipeline** — Pipeline downloads data from the network and executes it: 'curl -fsSL https://raw.githubusercontent.com/clearclown/claude-code-aida/main/scripts/install.sh \| bash'. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.) (/repo/docs/readmeLang/README_ja.md:1) - **[low] Dangerous data flow in command pipeline** — Pipeline downloads data from the network and executes it: 'curl -fsSL https://raw.githubusercontent.com/clearclown/claude-code-aida/main/scripts/install.sh \| bash'. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.) (/repo/docs/readmeLang/README_ru.md:1) - **[low] Dangerous data flow in command pipeline** — Pipeline downloads data from the network and executes it: 'curl -fsSL https://raw.githubusercontent.com/clearclown/claude-code-aida/main/scripts/install.sh \| bash'. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.) (/repo/docs/readmeLang/README_zh-CN.md:1) - **[low] Dangerous data flow in command pipeline** — Pipeline downloads data from the network and executes it: 'curl -fsSL https://raw.githubusercontent.com/clearclown/claude-code-aida/main/scripts/install.sh \| bash'. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.) (/repo/docs/readmeLang/README_zh-TW.md:1) - **[low] Vague skill description** — Skill description is too short (16 chars). Provide detailed explanation. (/repo/tests/.aida/specs/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/tests/.aida/specs/SKILL.md:None) - **[low] Dangerous data flow in command pipeline** — Pipeline downloads data from the network and executes it: 'curl -fsSL https://raw.githubusercontent.com/clearclown/claude-code-aida/main/scripts/install.sh \| bash'. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.) (/repo/docs/readmeLang/README_ar.md:1) - **[low] Dangerous data flow in command pipeline** — Pipeline downloads data from the network and executes it: 'curl -fsSL https://raw.githubusercontent.com/clearclown/claude-code-aida/main/scripts/install.sh \| bash'. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.) (/repo/docs/readmeLang/README_fa.md:1) - **[low] Dangerous data flow in command pipeline** — Pipeline downloads data from the network and executes it: 'curl -fsSL https://raw.githubusercontent.com/clearclown/claude-code-aida/main/scripts/install.sh \| bash'. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.) (/repo/docs/readmeLang/README_ja.md:1) - **[low] Dangerous data flow in command pipeline** — Pipeline downloads data from the network and executes it: 'curl -fsSL https://raw.githubusercontent.com/clearclown/claude-code-aida/main/scripts/install.sh \| bash'. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.) (/repo/docs/readmeLang/README_ru.md:1) - **[low] Dangerous data flow in command pipeline** — Pipeline downloads data from the network and executes it: 'curl -fsSL https://raw.githubusercontent.com/clearclown/claude-code-aida/main/scripts/install.sh \| bash'. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.) (/repo/docs/readmeLang/README_zh-CN.md:1) - **[low] Dangerous data flow in command pipeline** — Pipeline downloads data from the network and executes it: 'curl -fsSL https://raw.githubusercontent.com/clearclown/claude-code-aida/main/scripts/install.sh \| bash'. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.) (/repo/docs/readmeLang/README_zh-TW.md:1) - **[medium] Deeply nested file references detected** — Skill has file references nested more than 5 levels deep. This could be an attempt to hide malicious content in files that are only loaded under specific conditions. (/repo/docs/readmeLang/SKILL.md:None) - **[low] Vague skill description** — Skill description is too short (16 chars). Provide detailed explanation. (/repo/docs/readmeLang/SKILL.md:None) - **[informational] Skill name does not follow agent skills naming rules** — Skill name 'readmeLang' is invalid. Agent skills require lowercase letters, numbers, and hyphens only, with a maximum length of 64 characters. (/repo/docs/readmeLang/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/docs/readmeLang/SKILL.md:None) - **[low] Dangerous data flow in command pipeline** — Pipeline downloads data from the network and executes it: 'curl -fsSL https://raw.githubusercontent.com/clearclown/claude-code-aida/main/scripts/install.sh \| bash'. This is a remote code execution pattern. (Note: appears to be instructional install text in SKILL.md; review URL trust and pinning.) (/repo/docs/readmeLang/SKILL.md:1) ### agent-audit-kit (v0.3.26) — Caution / 70.0 - **[high] Unsigned marketplace.json manifest** — .claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection. (.claude-plugin/marketplace.json:13) - **[high] Indirect-prompt-injection wild payload checked into repo** — A source / config file ('.md', '.txt', '.yml', '.yaml', '.json', '.py') embeds a known wild IPI payload from the 2026-04-24 Help Net Security + Infosec Magazine catalogue. Common shapes: ignore-prior + exfil, system-role override, reveal-system-prompt, credential exfil via cURL, tool-call rerouting, delete-repository, admin role escalation, obfuscated prompt break, image-attached IPI, RAG-poisoned document. Refresh the corpus with 'aak corpus update --ipi'. (agents/testing-protocol.md:195) ### bearer (v2.0.2) — Verified / 100.0 No findings. ### nerlo-behavioral (v0.1.0) — unavailable / n/a No findings. ### nerlo-install-instruction (v0.1.0) — Unsafe / 0.0 - **[high] opt.nerlo-rules.nerlo-install-pipe-to-shell** — Documentation instructs piping a downloaded artifact directly into a shell (curl/wget/iwr ... \| bash/sh/iex). This is the curl-pipe-bash install shape used by the ClawHub skill droppers and countless malware loaders — the fetched payload is executed with zero inspection. Confirm this is expected; it is a strong weaponized-documentation signal. (/repo/README.md:87) - **[high] opt.nerlo-rules.nerlo-install-fetch-raw-then-run** — Documentation directs fetching a raw file (raw.githubusercontent.com, a gist raw URL, or a GitHub release asset) and executing it. Fetch-then-run of an untrusted raw artifact is a fetch-and-execute install directive — the FakeGit "download and run" shape. Confirm the artifact and origin. (/repo/README.md:87) - **[medium] opt.nerlo-rules.nerlo-install-run-bundled-artifact** — Documentation instructs running or double-clicking a bundled/opaque artifact (e.g. "run resource.txt", "execute install.sh", "double-click setup.exe"). This is the FakeGit README shape, where the payload ships as a file the docs tell you to run. Verify the artifact is inspectable and expected — opaque bundled executables directed by docs warrant review. (/repo/README.md:597) - **[medium] opt.nerlo-rules.nerlo-install-run-bundled-artifact** — Documentation instructs running or double-clicking a bundled/opaque artifact (e.g. "run resource.txt", "execute install.sh", "double-click setup.exe"). This is the FakeGit README shape, where the payload ships as a file the docs tell you to run. Verify the artifact is inspectable and expected — opaque bundled executables directed by docs warrant review. (/repo/agents/conductor.md:75) - **[medium] opt.nerlo-rules.nerlo-install-run-bundled-artifact** — Documentation instructs running or double-clicking a bundled/opaque artifact (e.g. "run resource.txt", "execute install.sh", "double-click setup.exe"). This is the FakeGit README shape, where the payload ships as a file the docs tell you to run. Verify the artifact is inspectable and expected — opaque bundled executables directed by docs warrant review. (/repo/agents/conductor.md:78) - **[medium] opt.nerlo-rules.nerlo-install-run-bundled-artifact** — Documentation instructs running or double-clicking a bundled/opaque artifact (e.g. "run resource.txt", "execute install.sh", "double-click setup.exe"). This is the FakeGit README shape, where the payload ships as a file the docs tell you to run. Verify the artifact is inspectable and expected — opaque bundled executables directed by docs warrant review. (/repo/agents/conductor.md:109) - **[medium] opt.nerlo-rules.nerlo-install-run-bundled-artifact** — Documentation instructs running or double-clicking a bundled/opaque artifact (e.g. "run resource.txt", "execute install.sh", "double-click setup.exe"). This is the FakeGit README shape, where the payload ships as a file the docs tell you to run. Verify the artifact is inspectable and expected — opaque bundled executables directed by docs warrant review. (/repo/agents/conductor.md:266) - **[medium] opt.nerlo-rules.nerlo-install-run-bundled-artifact** — Documentation instructs running or double-clicking a bundled/opaque artifact (e.g. "run resource.txt", "execute install.sh", "double-click setup.exe"). This is the FakeGit README shape, where the payload ships as a file the docs tell you to run. Verify the artifact is inspectable and expected — opaque bundled executables directed by docs warrant review. (/repo/agents/conductor.md:424) - **[medium] opt.nerlo-rules.nerlo-install-run-bundled-artifact** — Documentation instructs running or double-clicking a bundled/opaque artifact (e.g. "run resource.txt", "execute install.sh", "double-click setup.exe"). This is the FakeGit README shape, where the payload ships as a file the docs tell you to run. Verify the artifact is inspectable and expected — opaque bundled executables directed by docs warrant review. (/repo/agents/conductor.md:440) - **[medium] opt.nerlo-rules.nerlo-install-run-bundled-artifact** — Documentation instructs running or double-clicking a bundled/opaque artifact (e.g. "run resource.txt", "execute install.sh", "double-click setup.exe"). This is the FakeGit README shape, where the payload ships as a file the docs tell you to run. Verify the artifact is inspectable and expected — opaque bundled executables directed by docs warrant review. (/repo/agents/leader-enhance.md:50) - **[medium] opt.nerlo-rules.nerlo-install-run-bundled-artifact** — Documentation instructs running or double-clicking a bundled/opaque artifact (e.g. "run resource.txt", "execute install.sh", "double-click setup.exe"). This is the FakeGit README shape, where the payload ships as a file the docs tell you to run. Verify the artifact is inspectable and expected — opaque bundled executables directed by docs warrant review. (/repo/agents/leader-enhance.md:51) - **[medium] opt.nerlo-rules.nerlo-install-run-bundled-artifact** — Documentation instructs running or double-clicking a bundled/opaque artifact (e.g. "run resource.txt", "execute install.sh", "double-click setup.exe"). This is the FakeGit README shape, where the payload ships as a file the docs tell you to run. Verify the artifact is inspectable and expected — opaque bundled executables directed by docs warrant review. (/repo/agents/leader-impl.md:193) - **[medium] opt.nerlo-rules.nerlo-install-run-bundled-artifact** — Documentation instructs running or double-clicking a bundled/opaque artifact (e.g. "run resource.txt", "execute install.sh", "double-click setup.exe"). This is the FakeGit README shape, where the payload ships as a file the docs tell you to run. Verify the artifact is inspectable and expected — opaque bundled executables directed by docs warrant review. (/repo/agents/leader-impl.md:521) - **[medium] opt.nerlo-rules.nerlo-install-run-bundled-artifact** — Documentation instructs running or double-clicking a bundled/opaque artifact (e.g. "run resource.txt", "execute install.sh", "double-click setup.exe"). This is the FakeGit README shape, where the payload ships as a file the docs tell you to run. Verify the artifact is inspectable and expected — opaque bundled executables directed by docs warrant review. (/repo/agents/leader-impl.md:646) - **[medium] opt.nerlo-rules.nerlo-install-run-bundled-artifact** — Documentation instructs running or double-clicking a bundled/opaque artifact (e.g. "run resource.txt", "execute install.sh", "double-click setup.exe"). This is the FakeGit README shape, where the payload ships as a file the docs tell you to run. Verify the artifact is inspectable and expected — opaque bundled executables directed by docs warrant review. (/repo/agents/leader-impl.md:1365) - **[medium] opt.nerlo-rules.nerlo-install-run-bundled-artifact** — Documentation instructs running or double-clicking a bundled/opaque artifact (e.g. "run resource.txt", "execute install.sh", "double-click setup.exe"). This is the FakeGit README shape, where the payload ships as a file the docs tell you to run. Verify the artifact is inspectable and expected — opaque bundled executables directed by docs warrant review. (/repo/agents/leader-impl.md:1366) - **[medium] opt.nerlo-rules.nerlo-install-run-bundled-artifact** — Documentation instructs running or double-clicking a bundled/opaque artifact (e.g. "run resource.txt", "execute install.sh", "double-click setup.exe"). This is the FakeGit README shape, where the payload ships as a file the docs tell you to run. Verify the artifact is inspectable and expected — opaque bundled executables directed by docs warrant review. (/repo/agents/leader-impl.md:1512) - **[medium] opt.nerlo-rules.nerlo-install-run-bundled-artifact** — Documentation instructs running or double-clicking a bundled/opaque artifact (e.g. "run resource.txt", "execute install.sh", "double-click setup.exe"). This is the FakeGit README shape, where the payload ships as a file the docs tell you to run. Verify the artifact is inspectable and expected — opaque bundled executables directed by docs warrant review. (/repo/agents/player.md:269) - **[medium] opt.nerlo-rules.nerlo-install-run-bundled-artifact** — Documentation instructs running or double-clicking a bundled/opaque artifact (e.g. "run resource.txt", "execute install.sh", "double-click setup.exe"). This is the FakeGit README shape, where the payload ships as a file the docs tell you to run. Verify the artifact is inspectable and expected — opaque bundled executables directed by docs warrant review. (/repo/commands/pipeline.md:422) - **[medium] opt.nerlo-rules.nerlo-install-run-bundled-artifact** — Documentation instructs running or double-clicking a bundled/opaque artifact (e.g. "run resource.txt", "execute install.sh", "double-click setup.exe"). This is the FakeGit README shape, where the payload ships as a file the docs tell you to run. Verify the artifact is inspectable and expected — opaque bundled executables directed by docs warrant review. (/repo/commands/pipeline.md:575) - **[medium] opt.nerlo-rules.nerlo-install-run-bundled-artifact** — Documentation instructs running or double-clicking a bundled/opaque artifact (e.g. "run resource.txt", "execute install.sh", "double-click setup.exe"). This is the FakeGit README shape, where the payload ships as a file the docs tell you to run. Verify the artifact is inspectable and expected — opaque bundled executables directed by docs warrant review. (/repo/commands/work.md:469) - **[high] opt.nerlo-rules.nerlo-install-pipe-to-shell** — Documentation instructs piping a downloaded artifact directly into a shell (curl/wget/iwr ... \| bash/sh/iex). This is the curl-pipe-bash install shape used by the ClawHub skill droppers and countless malware loaders — the fetched payload is executed with zero inspection. Confirm this is expected; it is a strong weaponized-documentation signal. (/repo/docs/readmeLang/README_ar.md:29) - **[high] opt.nerlo-rules.nerlo-install-fetch-raw-then-run** — Documentation directs fetching a raw file (raw.githubusercontent.com, a gist raw URL, or a GitHub release asset) and executing it. Fetch-then-run of an untrusted raw artifact is a fetch-and-execute install directive — the FakeGit "download and run" shape. Confirm the artifact and origin. (/repo/docs/readmeLang/README_ar.md:29) - **[high] opt.nerlo-rules.nerlo-install-pipe-to-shell** — Documentation instructs piping a downloaded artifact directly into a shell (curl/wget/iwr ... \| bash/sh/iex). This is the curl-pipe-bash install shape used by the ClawHub skill droppers and countless malware loaders — the fetched payload is executed with zero inspection. Confirm this is expected; it is a strong weaponized-documentation signal. (/repo/docs/readmeLang/README_fa.md:29) - **[high] opt.nerlo-rules.nerlo-install-fetch-raw-then-run** — Documentation directs fetching a raw file (raw.githubusercontent.com, a gist raw URL, or a GitHub release asset) and executing it. Fetch-then-run of an untrusted raw artifact is a fetch-and-execute install directive — the FakeGit "download and run" shape. Confirm the artifact and origin. (/repo/docs/readmeLang/README_fa.md:29) - **[high] opt.nerlo-rules.nerlo-install-pipe-to-shell** — Documentation instructs piping a downloaded artifact directly into a shell (curl/wget/iwr ... \| bash/sh/iex). This is the curl-pipe-bash install shape used by the ClawHub skill droppers and countless malware loaders — the fetched payload is executed with zero inspection. Confirm this is expected; it is a strong weaponized-documentation signal. (/repo/docs/readmeLang/README_ja.md:27) - **[high] opt.nerlo-rules.nerlo-install-fetch-raw-then-run** — Documentation directs fetching a raw file (raw.githubusercontent.com, a gist raw URL, or a GitHub release asset) and executing it. Fetch-then-run of an untrusted raw artifact is a fetch-and-execute install directive — the FakeGit "download and run" shape. Confirm the artifact and origin. (/repo/docs/readmeLang/README_ja.md:27) - **[high] opt.nerlo-rules.nerlo-install-pipe-to-shell** — Documentation instructs piping a downloaded artifact directly into a shell (curl/wget/iwr ... \| bash/sh/iex). This is the curl-pipe-bash install shape used by the ClawHub skill droppers and countless malware loaders — the fetched payload is executed with zero inspection. Confirm this is expected; it is a strong weaponized-documentation signal. (/repo/docs/readmeLang/README_ru.md:27) - **[high] opt.nerlo-rules.nerlo-install-fetch-raw-then-run** — Documentation directs fetching a raw file (raw.githubusercontent.com, a gist raw URL, or a GitHub release asset) and executing it. Fetch-then-run of an untrusted raw artifact is a fetch-and-execute install directive — the FakeGit "download and run" shape. Confirm the artifact and origin. (/repo/docs/readmeLang/README_ru.md:27) - **[high] opt.nerlo-rules.nerlo-install-pipe-to-shell** — Documentation instructs piping a downloaded artifact directly into a shell (curl/wget/iwr ... \| bash/sh/iex). This is the curl-pipe-bash install shape used by the ClawHub skill droppers and countless malware loaders — the fetched payload is executed with zero inspection. Confirm this is expected; it is a strong weaponized-documentation signal. (/repo/docs/readmeLang/README_zh-CN.md:27) - **[high] opt.nerlo-rules.nerlo-install-fetch-raw-then-run** — Documentation directs fetching a raw file (raw.githubusercontent.com, a gist raw URL, or a GitHub release asset) and executing it. Fetch-then-run of an untrusted raw artifact is a fetch-and-execute install directive — the FakeGit "download and run" shape. Confirm the artifact and origin. (/repo/docs/readmeLang/README_zh-CN.md:27) - **[high] opt.nerlo-rules.nerlo-install-pipe-to-shell** — Documentation instructs piping a downloaded artifact directly into a shell (curl/wget/iwr ... \| bash/sh/iex). This is the curl-pipe-bash install shape used by the ClawHub skill droppers and countless malware loaders — the fetched payload is executed with zero inspection. Confirm this is expected; it is a strong weaponized-documentation signal. (/repo/docs/readmeLang/README_zh-TW.md:27) - **[high] opt.nerlo-rules.nerlo-install-fetch-raw-then-run** — Documentation directs fetching a raw file (raw.githubusercontent.com, a gist raw URL, or a GitHub release asset) and executing it. Fetch-then-run of an untrusted raw artifact is a fetch-and-execute install directive — the FakeGit "download and run" shape. Confirm the artifact and origin. (/repo/docs/readmeLang/README_zh-TW.md:27) - **[medium] opt.nerlo-rules.nerlo-install-run-bundled-artifact** — Documentation instructs running or double-clicking a bundled/opaque artifact (e.g. "run resource.txt", "execute install.sh", "double-click setup.exe"). This is the FakeGit README shape, where the payload ships as a file the docs tell you to run. Verify the artifact is inspectable and expected — opaque bundled executables directed by docs warrant review. (/repo/scripts/setup-jj.sh:198) - **[medium] opt.nerlo-rules.nerlo-install-run-bundled-artifact** — Documentation instructs running or double-clicking a bundled/opaque artifact (e.g. "run resource.txt", "execute install.sh", "double-click setup.exe"). This is the FakeGit README shape, where the payload ships as a file the docs tell you to run. Verify the artifact is inspectable and expected — opaque bundled executables directed by docs warrant review. (/repo/skills/fix/SKILL.md:219) - **[medium] opt.nerlo-rules.nerlo-install-run-bundled-artifact** — Documentation instructs running or double-clicking a bundled/opaque artifact (e.g. "run resource.txt", "execute install.sh", "double-click setup.exe"). This is the FakeGit README shape, where the payload ships as a file the docs tell you to run. Verify the artifact is inspectable and expected — opaque bundled executables directed by docs warrant review. (/repo/skills/resume/SKILL.md:132) ### nerlo-multi-source (v0.1.0) — unavailable / n/a No findings. ### trivy (v0.71.0) — unavailable / n/a No findings. ### osv-scanner (v2.3.8) — unavailable / n/a No findings. ## 4. Threat Model Threat model synthesis has not yet run for this scan. This section is generated by the registry's LLM pipeline (Req 22.3) and will appear in the next regeneration of this report. ## 5. Audit Chain - **Scan job:** `dad200a6-2d1f-458f-a546-3cebebcb4de8` - **Completed:** 2026-07-26T04:53:16.524311+00:00 - **Scanner base image:** `us-central1-docker.pkg.dev/nerlo-vsk-prod/nerlo/scanner-base@sha256:86a3d299a4356dfd5a34cd31cfa9f4c28d236d387691f7c8070086afe5224516` - **AI decision log entries:** 2 - `b07205ab-0cb4-4520-a439-05d56135ded9` - `39c61e79-f46b-47ba-a344-62fb82585d0d` ## 6. Appendix — Raw Scanner Output ```json [ { "scanner_name": "agentshield", "scanner_version": "1.4.0", "score": 98.0, "scanner_badge": "Verified", "findings": [ { "tool_name": "agentshield", "severity": "medium", "category": "permissions", "file_path": "settings.json", "line_number": null, "rule_identifier": "permissions-no-block", "title": "No permissions block configured", "description": "settings.json has configuration but no permissions section. Without explicit allow/deny lists, the agent relies on default permissions which may be too broad. Add a permissions block to restrict tool access.", "remediation": "Add a permissions block with scoped allow and deny lists" }, { "tool_name": "agentshield", "severity": "medium", "category": "misconfiguration", "file_path": "settings.json", "line_number": null, "rule_identifier": "hooks-no-pretooluse", "title": "No PreToolUse security hooks configured", "description": "No PreToolUse hooks are defined. These hooks can catch dangerous operations before they run, providing an essential security layer.", "remediation": "Add PreToolUse hooks for security-sensitive operations" } ], "execution_duration_seconds": 24.162844976992346, "status": "complete", "examined": null, "metadata": { "source": "npm", "source_url": "https://www.npmjs.com/package/ecc-agentshield", "install_command": "npm install -g ecc-agentshield@1.4.0", "scans_performed": [ "claude_config" ], "score_breakdown": { "mcp": 100, "hooks": 100, "agents": 100, "secrets": 100, "permissions": 90 } }, "display_score": 98.0, "display_badge": "Verified" }, { "scanner_name": "cisco-skill-scanner", "scanner_version": "2.0.11", "score": 0.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/skills/fix/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_INVALID_NAME", "title": "Skill name does not follow agent skills naming rules", "description": "Skill name 'aida:fix' is invalid. Agent skills require lowercase letters, numbers, and hyphens only, with a maximum length of 64 characters.", "remediation": "Rename the skill to match `[a-z0-9-]{1,64}` (e.g., 'pdf-processing')" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/skills/fix/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/skills/resume/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_INVALID_NAME", "title": "Skill name does not follow agent skills naming rules", "description": "Skill name 'aida:resume' is invalid. Agent skills require lowercase letters, numbers, and hyphens only, with a maximum length of 64 characters.", "remediation": "Rename the skill to match `[a-z0-9-]{1,64}` (e.g., 'pdf-processing')" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/skills/resume/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/skills/core/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/skills/orchestrator/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/skills/pipeline/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/skills/requirements-gen/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/skills/aida/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "policy_violation", "file_path": "/repo/.", "line_number": null, "rule_identifier": "EXCESSIVE_FILE_COUNT", "title": "Skill package contains many files", "description": "Skill package contains 138 files. Large file counts increase attack surface and may indicate bundled dependencies or unnecessary content.", "remediation": "Review file inventory and remove unnecessary files." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "command_injection", "file_path": "/repo/README.md", "line_number": 1, "rule_identifier": "PIPELINE_TAINT_FLOW", "title": "Dangerous data flow in command pipeline", "description": "Pipeline downloads data from the network and executes it: `curl -sSL https://raw.githubusercontent.com/clearclown/claude-code-aida/main/scripts/install.sh | bash`. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.)", "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "command_injection", "file_path": "/repo/SKILL.md", "line_number": 1, "rule_identifier": "PIPELINE_TAINT_FLOW", "title": "Dangerous data flow in command pipeline", "description": "Pipeline downloads data from the network and executes it: `curl -sSL https://raw.githubusercontent.com/clearclown/claude-code-aida/main/scripts/install.sh | bash`. This is a remote code execution pattern. (Note: appears to be instructional install text in SKILL.md; review URL trust and pinning.)", "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "command_injection", "file_path": "/repo/docs/readmeLang/README_ar.md", "line_number": 1, "rule_identifier": "PIPELINE_TAINT_FLOW", "title": "Dangerous data flow in command pipeline", "description": "Pipeline downloads data from the network and executes it: `curl -fsSL https://raw.githubusercontent.com/clearclown/claude-code-aida/main/scripts/install.sh | bash`. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.)", "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "command_injection", "file_path": "/repo/docs/readmeLang/README_fa.md", "line_number": 1, "rule_identifier": "PIPELINE_TAINT_FLOW", "title": "Dangerous data flow in command pipeline", "description": "Pipeline downloads data from the network and executes it: `curl -fsSL https://raw.githubusercontent.com/clearclown/claude-code-aida/main/scripts/install.sh | bash`. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.)", "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "command_injection", "file_path": "/repo/docs/readmeLang/README_ja.md", "line_number": 1, "rule_identifier": "PIPELINE_TAINT_FLOW", "title": "Dangerous data flow in command pipeline", "description": "Pipeline downloads data from the network and executes it: `curl -fsSL https://raw.githubusercontent.com/clearclown/claude-code-aida/main/scripts/install.sh | bash`. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.)", "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "command_injection", "file_path": "/repo/docs/readmeLang/README_ru.md", "line_number": 1, "rule_identifier": "PIPELINE_TAINT_FLOW", "title": "Dangerous data flow in command pipeline", "description": "Pipeline downloads data from the network and executes it: `curl -fsSL https://raw.githubusercontent.com/clearclown/claude-code-aida/main/scripts/install.sh | bash`. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.)", "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "command_injection", "file_path": "/repo/docs/readmeLang/README_zh-CN.md", "line_number": 1, "rule_identifier": "PIPELINE_TAINT_FLOW", "title": "Dangerous data flow in command pipeline", "description": "Pipeline downloads data from the network and executes it: `curl -fsSL https://raw.githubusercontent.com/clearclown/claude-code-aida/main/scripts/install.sh | bash`. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.)", "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "command_injection", "file_path": "/repo/docs/readmeLang/README_zh-TW.md", "line_number": 1, "rule_identifier": "PIPELINE_TAINT_FLOW", "title": "Dangerous data flow in command pipeline", "description": "Pipeline downloads data from the network and executes it: `curl -fsSL https://raw.githubusercontent.com/clearclown/claude-code-aida/main/scripts/install.sh | bash`. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.)", "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution." }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "command_injection", "file_path": "/repo/hooks/stop/ralph-gate.sh", "line_number": 150, "rule_identifier": "GLOB_HIDDEN_FILE_TARGETING", "title": "Glob or find pattern targeting hidden (dot) files, which may expose sensitive configurations", "description": "Pattern detected: find \"$evidence_dir\" -name \"*.json\" -not -name \".*", "remediation": "Avoid targeting hidden files with glob patterns. Be explicit about which files to access" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "unauthorized_tool_use", "file_path": "/repo/scripts/file-picker.sh", "line_number": 25, "rule_identifier": "TOOL_ABUSE_SYSTEM_PACKAGE_INSTALL", "title": "Attempting to install system packages with elevated privileges", "description": "Pattern detected: sudo pacman -S", "remediation": "Use user-level installs without sudo. Document if system install is necessary" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "unauthorized_tool_use", "file_path": "/repo/scripts/setup-grepai.sh", "line_number": 112, "rule_identifier": "TOOL_ABUSE_SYSTEM_PACKAGE_INSTALL", "title": "Attempting to install system packages with elevated privileges", "description": "Pattern detected: sudo pacman -S", "remediation": "Use user-level installs without sudo. Document if system install is necessary" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "unauthorized_tool_use", "file_path": "/repo/scripts/setup-jj.sh", "line_number": 60, "rule_identifier": "TOOL_ABUSE_SYSTEM_PACKAGE_INSTALL", "title": "Attempting to install system packages with elevated privileges", "description": "Pattern detected: sudo pacman -S", "remediation": "Use user-level installs without sudo. Document if system install is necessary" }, { "tool_name": "cisco-skill-scanner", "severity": "high", "category": "supply_chain_attack", "file_path": "/repo/scripts/setup-jj.sh", "line_number": 100, "rule_identifier": "COMPOUND_EXTRACT_EXECUTE", "title": "Archive extraction followed by execution", "description": "An archive is extracted and its contents are then executed. This pattern can deliver and run malicious payloads hidden in archives.", "remediation": "Review the command sequence for potential multi-step attacks. Ensure all steps are necessary and safe." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "obfuscation", "file_path": "/repo/tests/.aida/specs/tests-reverse-design.md", "line_number": null, "rule_identifier": "HIDDEN_DATA_FILE", "title": "Hidden data file detected", "description": "Hidden file found: tests/.aida/specs/tests-reverse-design.md. Hidden files may contain concealed configuration or data that should be reviewed.", "remediation": "Move file to a visible location or document its purpose." }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/agents/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "high", "category": "hardcoded_secrets", "file_path": "/repo/agents/SKILL.md", "line_number": 4992, "rule_identifier": "SECRET_CONNECTION_STRING", "title": "Database connection string with embedded credentials", "description": "Pattern detected: post****", "remediation": "Remove credentials from connection strings" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/commands/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/docs/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/docs/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "command_injection", "file_path": "/repo/docs/readmeLang/README_ar.md", "line_number": 1, "rule_identifier": "PIPELINE_TAINT_FLOW", "title": "Dangerous data flow in command pipeline", "description": "Pipeline downloads data from the network and executes it: `curl -fsSL https://raw.githubusercontent.com/clearclown/claude-code-aida/main/scripts/install.sh | bash`. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.)", "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "command_injection", "file_path": "/repo/docs/readmeLang/README_fa.md", "line_number": 1, "rule_identifier": "PIPELINE_TAINT_FLOW", "title": "Dangerous data flow in command pipeline", "description": "Pipeline downloads data from the network and executes it: `curl -fsSL https://raw.githubusercontent.com/clearclown/claude-code-aida/main/scripts/install.sh | bash`. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.)", "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "command_injection", "file_path": "/repo/docs/readmeLang/README_ja.md", "line_number": 1, "rule_identifier": "PIPELINE_TAINT_FLOW", "title": "Dangerous data flow in command pipeline", "description": "Pipeline downloads data from the network and executes it: `curl -fsSL https://raw.githubusercontent.com/clearclown/claude-code-aida/main/scripts/install.sh | bash`. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.)", "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "command_injection", "file_path": "/repo/docs/readmeLang/README_ru.md", "line_number": 1, "rule_identifier": "PIPELINE_TAINT_FLOW", "title": "Dangerous data flow in command pipeline", "description": "Pipeline downloads data from the network and executes it: `curl -fsSL https://raw.githubusercontent.com/clearclown/claude-code-aida/main/scripts/install.sh | bash`. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.)", "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "command_injection", "file_path": "/repo/docs/readmeLang/README_zh-CN.md", "line_number": 1, "rule_identifier": "PIPELINE_TAINT_FLOW", "title": "Dangerous data flow in command pipeline", "description": "Pipeline downloads data from the network and executes it: `curl -fsSL https://raw.githubusercontent.com/clearclown/claude-code-aida/main/scripts/install.sh | bash`. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.)", "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "command_injection", "file_path": "/repo/docs/readmeLang/README_zh-TW.md", "line_number": 1, "rule_identifier": "PIPELINE_TAINT_FLOW", "title": "Dangerous data flow in command pipeline", "description": "Pipeline downloads data from the network and executes it: `curl -fsSL https://raw.githubusercontent.com/clearclown/claude-code-aida/main/scripts/install.sh | bash`. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.)", "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/tests/.aida/specs/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/tests/.aida/specs/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "command_injection", "file_path": "/repo/docs/readmeLang/README_ar.md", "line_number": 1, "rule_identifier": "PIPELINE_TAINT_FLOW", "title": "Dangerous data flow in command pipeline", "description": "Pipeline downloads data from the network and executes it: `curl -fsSL https://raw.githubusercontent.com/clearclown/claude-code-aida/main/scripts/install.sh | bash`. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.)", "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "command_injection", "file_path": "/repo/docs/readmeLang/README_fa.md", "line_number": 1, "rule_identifier": "PIPELINE_TAINT_FLOW", "title": "Dangerous data flow in command pipeline", "description": "Pipeline downloads data from the network and executes it: `curl -fsSL https://raw.githubusercontent.com/clearclown/claude-code-aida/main/scripts/install.sh | bash`. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.)", "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "command_injection", "file_path": "/repo/docs/readmeLang/README_ja.md", "line_number": 1, "rule_identifier": "PIPELINE_TAINT_FLOW", "title": "Dangerous data flow in command pipeline", "description": "Pipeline downloads data from the network and executes it: `curl -fsSL https://raw.githubusercontent.com/clearclown/claude-code-aida/main/scripts/install.sh | bash`. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.)", "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "command_injection", "file_path": "/repo/docs/readmeLang/README_ru.md", "line_number": 1, "rule_identifier": "PIPELINE_TAINT_FLOW", "title": "Dangerous data flow in command pipeline", "description": "Pipeline downloads data from the network and executes it: `curl -fsSL https://raw.githubusercontent.com/clearclown/claude-code-aida/main/scripts/install.sh | bash`. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.)", "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "command_injection", "file_path": "/repo/docs/readmeLang/README_zh-CN.md", "line_number": 1, "rule_identifier": "PIPELINE_TAINT_FLOW", "title": "Dangerous data flow in command pipeline", "description": "Pipeline downloads data from the network and executes it: `curl -fsSL https://raw.githubusercontent.com/clearclown/claude-code-aida/main/scripts/install.sh | bash`. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.)", "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "command_injection", "file_path": "/repo/docs/readmeLang/README_zh-TW.md", "line_number": 1, "rule_identifier": "PIPELINE_TAINT_FLOW", "title": "Dangerous data flow in command pipeline", "description": "Pipeline downloads data from the network and executes it: `curl -fsSL https://raw.githubusercontent.com/clearclown/claude-code-aida/main/scripts/install.sh | bash`. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.)", "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution." }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "obfuscation", "file_path": "/repo/docs/readmeLang/SKILL.md", "line_number": null, "rule_identifier": "LAZY_LOAD_DEEP_NESTING", "title": "Deeply nested file references detected", "description": "Skill has file references nested more than 5 levels deep. This could be an attempt to hide malicious content in files that are only loaded under specific conditions.", "remediation": "Flatten the reference structure or ensure all nested files are safe" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/docs/readmeLang/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/docs/readmeLang/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_INVALID_NAME", "title": "Skill name does not follow agent skills naming rules", "description": "Skill name 'readmeLang' is invalid. Agent skills require lowercase letters, numbers, and hyphens only, with a maximum length of 64 characters.", "remediation": "Rename the skill to match `[a-z0-9-]{1,64}` (e.g., 'pdf-processing')" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/docs/readmeLang/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "command_injection", "file_path": "/repo/docs/readmeLang/SKILL.md", "line_number": 1, "rule_identifier": "PIPELINE_TAINT_FLOW", "title": "Dangerous data flow in command pipeline", "description": "Pipeline downloads data from the network and executes it: `curl -fsSL https://raw.githubusercontent.com/clearclown/claude-code-aida/main/scripts/install.sh | bash`. This is a remote code execution pattern. (Note: appears to be instructional install text in SKILL.md; review URL trust and pinning.)", "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution." } ], "execution_duration_seconds": 177.4437308710767, "status": "complete", "examined": null, "metadata": { "source": "pypi", "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/", "report_type": "cisco-skill-sast", "analyzers_used": [ "bytecode", "pipeline", "static_analyzer" ], "skills_scanned": [ "aida:fix", "aida:resume", "core", "orchestrator", "pipeline", "requirements-gen", "aida", "repo", "conductor", "commands", "docs", "specs", "readmeLang" ], "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt", "severity_counts": { "low": 27, "high": 2, "medium": 5, "critical": 0, "informational": 16 }, "artifact_type_policy": "claude_skill" }, "display_score": 0.0, "display_badge": "Unsafe" }, { "scanner_name": "agent-audit-kit", "scanner_version": "0.3.26", "score": 70.0, "scanner_badge": "Caution", "findings": [ { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 13, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "taint-analysis", "file_path": "agents/testing-protocol.md", "line_number": 195, "rule_identifier": "AAK-IPI-WILD-CORPUS-001", "title": "Indirect-prompt-injection wild payload checked into repo", "description": "A source / config file (`.md`, `.txt`, `.yml`, `.yaml`, `.json`, `.py`) embeds a known wild IPI payload from the 2026-04-24 Help Net Security + Infosec Magazine catalogue. Common shapes: ignore-prior + exfil, system-role override, reveal-system-prompt, credential exfil via cURL, tool-call rerouting, delete-repository, admin role escalation, obfuscated prompt break, image-attached IPI, RAG-poisoned document. Refresh the corpus with `aak corpus update --ipi`.", "remediation": "Remove the payload from the file. If the file is intentionally an attack-corpus fixture, exclude it via `--ignore-paths`. The real risk is checked-in poisoned templates / system-prompt files / RAG seed corpora \u2014 those need to be sanitized at ingestion time, not at scan time." } ], "execution_duration_seconds": 62.01951747597195, "status": "complete", "examined": null, "metadata": { "source": "pypi", "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/", "report_type": "agent-audit-kit-sast", "files_scanned": 133, "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt", "rules_evaluated": 211, "severity_counts": { "low": 0, "high": 2, "medium": 0, "critical": 0, "informational": 0 } }, "display_score": 70.0, "display_badge": "Caution" }, { "scanner_name": "bearer", "scanner_version": "2.0.2", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 118.28560547495726, "status": "complete", "examined": null, "metadata": { "source": "github-releases", "source_url": "https://github.com/Bearer/bearer", "report_type": "security", "rules_loaded": 554, "install_command": "curl -sfL https://raw.githubusercontent.com/Bearer/bearer/main/contrib/install.sh | sh -s -- -b /usr/local/bin \"v2.0.2\"" }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "nerlo-behavioral", "scanner_version": "0.1.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 174.39281800296158, "status": "not_applicable", "examined": null, "metadata": { "source": "nerlo-original", "source_url": "https://github.com/nerlo-ai/nerlo", "report_type": "nerlo-behavioral", "ruleset_path": "/opt/nerlo-rules/exfiltration.yaml", "files_scanned": 0, "ruleset_paths": [ "/opt/nerlo-rules/exfiltration.yaml", "/opt/nerlo-rules/clipboard_exfiltration.yaml", "/opt/nerlo-rules/rce_endpoint.yaml", "/opt/nerlo-rules/taint_egress.yaml" ], "install_command": "pip install 'semgrep==1.97.0'", "merged_invocation": true }, "display_score": null, "display_badge": "unavailable" }, { "scanner_name": "nerlo-install-instruction", "scanner_version": "0.1.0", "score": 0.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "nerlo-install-instruction", "severity": "high", "category": "install-instruction-exec", "file_path": "/repo/README.md", "line_number": 87, "rule_identifier": "opt.nerlo-rules.nerlo-install-pipe-to-shell", "title": "opt.nerlo-rules.nerlo-install-pipe-to-shell", "description": "Documentation instructs piping a downloaded artifact directly into a shell (curl/wget/iwr ... | bash/sh/iex). This is the curl-pipe-bash install shape used by the ClawHub skill droppers and countless malware loaders \u2014 the fetched payload is executed with zero inspection. Confirm this is expected; it is a strong weaponized-documentation signal.", "remediation": null }, { "tool_name": "nerlo-install-instruction", "severity": "high", "category": "install-instruction-exec", "file_path": "/repo/README.md", "line_number": 87, "rule_identifier": "opt.nerlo-rules.nerlo-install-fetch-raw-then-run", "title": "opt.nerlo-rules.nerlo-install-fetch-raw-then-run", "description": "Documentation directs fetching a raw file (raw.githubusercontent.com, a gist raw URL, or a GitHub release asset) and executing it. Fetch-then-run of an untrusted raw artifact is a fetch-and-execute install directive \u2014 the FakeGit \"download and run\" shape. Confirm the artifact and origin.", "remediation": null }, { "tool_name": "nerlo-install-instruction", "severity": "medium", "category": "install-instruction-run", "file_path": "/repo/README.md", "line_number": 597, "rule_identifier": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "title": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "description": "Documentation instructs running or double-clicking a bundled/opaque artifact (e.g. \"run resource.txt\", \"execute install.sh\", \"double-click setup.exe\"). This is the FakeGit README shape, where the payload ships as a file the docs tell you to run. Verify the artifact is inspectable and expected \u2014 opaque bundled executables directed by docs warrant review.", "remediation": null }, { "tool_name": "nerlo-install-instruction", "severity": "medium", "category": "install-instruction-run", "file_path": "/repo/agents/conductor.md", "line_number": 75, "rule_identifier": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "title": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "description": "Documentation instructs running or double-clicking a bundled/opaque artifact (e.g. \"run resource.txt\", \"execute install.sh\", \"double-click setup.exe\"). This is the FakeGit README shape, where the payload ships as a file the docs tell you to run. Verify the artifact is inspectable and expected \u2014 opaque bundled executables directed by docs warrant review.", "remediation": null }, { "tool_name": "nerlo-install-instruction", "severity": "medium", "category": "install-instruction-run", "file_path": "/repo/agents/conductor.md", "line_number": 78, "rule_identifier": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "title": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "description": "Documentation instructs running or double-clicking a bundled/opaque artifact (e.g. \"run resource.txt\", \"execute install.sh\", \"double-click setup.exe\"). This is the FakeGit README shape, where the payload ships as a file the docs tell you to run. Verify the artifact is inspectable and expected \u2014 opaque bundled executables directed by docs warrant review.", "remediation": null }, { "tool_name": "nerlo-install-instruction", "severity": "medium", "category": "install-instruction-run", "file_path": "/repo/agents/conductor.md", "line_number": 109, "rule_identifier": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "title": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "description": "Documentation instructs running or double-clicking a bundled/opaque artifact (e.g. \"run resource.txt\", \"execute install.sh\", \"double-click setup.exe\"). This is the FakeGit README shape, where the payload ships as a file the docs tell you to run. Verify the artifact is inspectable and expected \u2014 opaque bundled executables directed by docs warrant review.", "remediation": null }, { "tool_name": "nerlo-install-instruction", "severity": "medium", "category": "install-instruction-run", "file_path": "/repo/agents/conductor.md", "line_number": 266, "rule_identifier": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "title": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "description": "Documentation instructs running or double-clicking a bundled/opaque artifact (e.g. \"run resource.txt\", \"execute install.sh\", \"double-click setup.exe\"). This is the FakeGit README shape, where the payload ships as a file the docs tell you to run. Verify the artifact is inspectable and expected \u2014 opaque bundled executables directed by docs warrant review.", "remediation": null }, { "tool_name": "nerlo-install-instruction", "severity": "medium", "category": "install-instruction-run", "file_path": "/repo/agents/conductor.md", "line_number": 424, "rule_identifier": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "title": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "description": "Documentation instructs running or double-clicking a bundled/opaque artifact (e.g. \"run resource.txt\", \"execute install.sh\", \"double-click setup.exe\"). This is the FakeGit README shape, where the payload ships as a file the docs tell you to run. Verify the artifact is inspectable and expected \u2014 opaque bundled executables directed by docs warrant review.", "remediation": null }, { "tool_name": "nerlo-install-instruction", "severity": "medium", "category": "install-instruction-run", "file_path": "/repo/agents/conductor.md", "line_number": 440, "rule_identifier": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "title": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "description": "Documentation instructs running or double-clicking a bundled/opaque artifact (e.g. \"run resource.txt\", \"execute install.sh\", \"double-click setup.exe\"). This is the FakeGit README shape, where the payload ships as a file the docs tell you to run. Verify the artifact is inspectable and expected \u2014 opaque bundled executables directed by docs warrant review.", "remediation": null }, { "tool_name": "nerlo-install-instruction", "severity": "medium", "category": "install-instruction-run", "file_path": "/repo/agents/leader-enhance.md", "line_number": 50, "rule_identifier": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "title": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "description": "Documentation instructs running or double-clicking a bundled/opaque artifact (e.g. \"run resource.txt\", \"execute install.sh\", \"double-click setup.exe\"). This is the FakeGit README shape, where the payload ships as a file the docs tell you to run. Verify the artifact is inspectable and expected \u2014 opaque bundled executables directed by docs warrant review.", "remediation": null }, { "tool_name": "nerlo-install-instruction", "severity": "medium", "category": "install-instruction-run", "file_path": "/repo/agents/leader-enhance.md", "line_number": 51, "rule_identifier": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "title": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "description": "Documentation instructs running or double-clicking a bundled/opaque artifact (e.g. \"run resource.txt\", \"execute install.sh\", \"double-click setup.exe\"). This is the FakeGit README shape, where the payload ships as a file the docs tell you to run. Verify the artifact is inspectable and expected \u2014 opaque bundled executables directed by docs warrant review.", "remediation": null }, { "tool_name": "nerlo-install-instruction", "severity": "medium", "category": "install-instruction-run", "file_path": "/repo/agents/leader-impl.md", "line_number": 193, "rule_identifier": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "title": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "description": "Documentation instructs running or double-clicking a bundled/opaque artifact (e.g. \"run resource.txt\", \"execute install.sh\", \"double-click setup.exe\"). This is the FakeGit README shape, where the payload ships as a file the docs tell you to run. Verify the artifact is inspectable and expected \u2014 opaque bundled executables directed by docs warrant review.", "remediation": null }, { "tool_name": "nerlo-install-instruction", "severity": "medium", "category": "install-instruction-run", "file_path": "/repo/agents/leader-impl.md", "line_number": 521, "rule_identifier": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "title": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "description": "Documentation instructs running or double-clicking a bundled/opaque artifact (e.g. \"run resource.txt\", \"execute install.sh\", \"double-click setup.exe\"). This is the FakeGit README shape, where the payload ships as a file the docs tell you to run. Verify the artifact is inspectable and expected \u2014 opaque bundled executables directed by docs warrant review.", "remediation": null }, { "tool_name": "nerlo-install-instruction", "severity": "medium", "category": "install-instruction-run", "file_path": "/repo/agents/leader-impl.md", "line_number": 646, "rule_identifier": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "title": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "description": "Documentation instructs running or double-clicking a bundled/opaque artifact (e.g. \"run resource.txt\", \"execute install.sh\", \"double-click setup.exe\"). This is the FakeGit README shape, where the payload ships as a file the docs tell you to run. Verify the artifact is inspectable and expected \u2014 opaque bundled executables directed by docs warrant review.", "remediation": null }, { "tool_name": "nerlo-install-instruction", "severity": "medium", "category": "install-instruction-run", "file_path": "/repo/agents/leader-impl.md", "line_number": 1365, "rule_identifier": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "title": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "description": "Documentation instructs running or double-clicking a bundled/opaque artifact (e.g. \"run resource.txt\", \"execute install.sh\", \"double-click setup.exe\"). This is the FakeGit README shape, where the payload ships as a file the docs tell you to run. Verify the artifact is inspectable and expected \u2014 opaque bundled executables directed by docs warrant review.", "remediation": null }, { "tool_name": "nerlo-install-instruction", "severity": "medium", "category": "install-instruction-run", "file_path": "/repo/agents/leader-impl.md", "line_number": 1366, "rule_identifier": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "title": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "description": "Documentation instructs running or double-clicking a bundled/opaque artifact (e.g. \"run resource.txt\", \"execute install.sh\", \"double-click setup.exe\"). This is the FakeGit README shape, where the payload ships as a file the docs tell you to run. Verify the artifact is inspectable and expected \u2014 opaque bundled executables directed by docs warrant review.", "remediation": null }, { "tool_name": "nerlo-install-instruction", "severity": "medium", "category": "install-instruction-run", "file_path": "/repo/agents/leader-impl.md", "line_number": 1512, "rule_identifier": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "title": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "description": "Documentation instructs running or double-clicking a bundled/opaque artifact (e.g. \"run resource.txt\", \"execute install.sh\", \"double-click setup.exe\"). This is the FakeGit README shape, where the payload ships as a file the docs tell you to run. Verify the artifact is inspectable and expected \u2014 opaque bundled executables directed by docs warrant review.", "remediation": null }, { "tool_name": "nerlo-install-instruction", "severity": "medium", "category": "install-instruction-run", "file_path": "/repo/agents/player.md", "line_number": 269, "rule_identifier": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "title": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "description": "Documentation instructs running or double-clicking a bundled/opaque artifact (e.g. \"run resource.txt\", \"execute install.sh\", \"double-click setup.exe\"). This is the FakeGit README shape, where the payload ships as a file the docs tell you to run. Verify the artifact is inspectable and expected \u2014 opaque bundled executables directed by docs warrant review.", "remediation": null }, { "tool_name": "nerlo-install-instruction", "severity": "medium", "category": "install-instruction-run", "file_path": "/repo/commands/pipeline.md", "line_number": 422, "rule_identifier": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "title": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "description": "Documentation instructs running or double-clicking a bundled/opaque artifact (e.g. \"run resource.txt\", \"execute install.sh\", \"double-click setup.exe\"). This is the FakeGit README shape, where the payload ships as a file the docs tell you to run. Verify the artifact is inspectable and expected \u2014 opaque bundled executables directed by docs warrant review.", "remediation": null }, { "tool_name": "nerlo-install-instruction", "severity": "medium", "category": "install-instruction-run", "file_path": "/repo/commands/pipeline.md", "line_number": 575, "rule_identifier": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "title": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "description": "Documentation instructs running or double-clicking a bundled/opaque artifact (e.g. \"run resource.txt\", \"execute install.sh\", \"double-click setup.exe\"). This is the FakeGit README shape, where the payload ships as a file the docs tell you to run. Verify the artifact is inspectable and expected \u2014 opaque bundled executables directed by docs warrant review.", "remediation": null }, { "tool_name": "nerlo-install-instruction", "severity": "medium", "category": "install-instruction-run", "file_path": "/repo/commands/work.md", "line_number": 469, "rule_identifier": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "title": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "description": "Documentation instructs running or double-clicking a bundled/opaque artifact (e.g. \"run resource.txt\", \"execute install.sh\", \"double-click setup.exe\"). This is the FakeGit README shape, where the payload ships as a file the docs tell you to run. Verify the artifact is inspectable and expected \u2014 opaque bundled executables directed by docs warrant review.", "remediation": null }, { "tool_name": "nerlo-install-instruction", "severity": "high", "category": "install-instruction-exec", "file_path": "/repo/docs/readmeLang/README_ar.md", "line_number": 29, "rule_identifier": "opt.nerlo-rules.nerlo-install-pipe-to-shell", "title": "opt.nerlo-rules.nerlo-install-pipe-to-shell", "description": "Documentation instructs piping a downloaded artifact directly into a shell (curl/wget/iwr ... | bash/sh/iex). This is the curl-pipe-bash install shape used by the ClawHub skill droppers and countless malware loaders \u2014 the fetched payload is executed with zero inspection. Confirm this is expected; it is a strong weaponized-documentation signal.", "remediation": null }, { "tool_name": "nerlo-install-instruction", "severity": "high", "category": "install-instruction-exec", "file_path": "/repo/docs/readmeLang/README_ar.md", "line_number": 29, "rule_identifier": "opt.nerlo-rules.nerlo-install-fetch-raw-then-run", "title": "opt.nerlo-rules.nerlo-install-fetch-raw-then-run", "description": "Documentation directs fetching a raw file (raw.githubusercontent.com, a gist raw URL, or a GitHub release asset) and executing it. Fetch-then-run of an untrusted raw artifact is a fetch-and-execute install directive \u2014 the FakeGit \"download and run\" shape. Confirm the artifact and origin.", "remediation": null }, { "tool_name": "nerlo-install-instruction", "severity": "high", "category": "install-instruction-exec", "file_path": "/repo/docs/readmeLang/README_fa.md", "line_number": 29, "rule_identifier": "opt.nerlo-rules.nerlo-install-pipe-to-shell", "title": "opt.nerlo-rules.nerlo-install-pipe-to-shell", "description": "Documentation instructs piping a downloaded artifact directly into a shell (curl/wget/iwr ... | bash/sh/iex). This is the curl-pipe-bash install shape used by the ClawHub skill droppers and countless malware loaders \u2014 the fetched payload is executed with zero inspection. Confirm this is expected; it is a strong weaponized-documentation signal.", "remediation": null }, { "tool_name": "nerlo-install-instruction", "severity": "high", "category": "install-instruction-exec", "file_path": "/repo/docs/readmeLang/README_fa.md", "line_number": 29, "rule_identifier": "opt.nerlo-rules.nerlo-install-fetch-raw-then-run", "title": "opt.nerlo-rules.nerlo-install-fetch-raw-then-run", "description": "Documentation directs fetching a raw file (raw.githubusercontent.com, a gist raw URL, or a GitHub release asset) and executing it. Fetch-then-run of an untrusted raw artifact is a fetch-and-execute install directive \u2014 the FakeGit \"download and run\" shape. Confirm the artifact and origin.", "remediation": null }, { "tool_name": "nerlo-install-instruction", "severity": "high", "category": "install-instruction-exec", "file_path": "/repo/docs/readmeLang/README_ja.md", "line_number": 27, "rule_identifier": "opt.nerlo-rules.nerlo-install-pipe-to-shell", "title": "opt.nerlo-rules.nerlo-install-pipe-to-shell", "description": "Documentation instructs piping a downloaded artifact directly into a shell (curl/wget/iwr ... | bash/sh/iex). This is the curl-pipe-bash install shape used by the ClawHub skill droppers and countless malware loaders \u2014 the fetched payload is executed with zero inspection. Confirm this is expected; it is a strong weaponized-documentation signal.", "remediation": null }, { "tool_name": "nerlo-install-instruction", "severity": "high", "category": "install-instruction-exec", "file_path": "/repo/docs/readmeLang/README_ja.md", "line_number": 27, "rule_identifier": "opt.nerlo-rules.nerlo-install-fetch-raw-then-run", "title": "opt.nerlo-rules.nerlo-install-fetch-raw-then-run", "description": "Documentation directs fetching a raw file (raw.githubusercontent.com, a gist raw URL, or a GitHub release asset) and executing it. Fetch-then-run of an untrusted raw artifact is a fetch-and-execute install directive \u2014 the FakeGit \"download and run\" shape. Confirm the artifact and origin.", "remediation": null }, { "tool_name": "nerlo-install-instruction", "severity": "high", "category": "install-instruction-exec", "file_path": "/repo/docs/readmeLang/README_ru.md", "line_number": 27, "rule_identifier": "opt.nerlo-rules.nerlo-install-pipe-to-shell", "title": "opt.nerlo-rules.nerlo-install-pipe-to-shell", "description": "Documentation instructs piping a downloaded artifact directly into a shell (curl/wget/iwr ... | bash/sh/iex). This is the curl-pipe-bash install shape used by the ClawHub skill droppers and countless malware loaders \u2014 the fetched payload is executed with zero inspection. Confirm this is expected; it is a strong weaponized-documentation signal.", "remediation": null }, { "tool_name": "nerlo-install-instruction", "severity": "high", "category": "install-instruction-exec", "file_path": "/repo/docs/readmeLang/README_ru.md", "line_number": 27, "rule_identifier": "opt.nerlo-rules.nerlo-install-fetch-raw-then-run", "title": "opt.nerlo-rules.nerlo-install-fetch-raw-then-run", "description": "Documentation directs fetching a raw file (raw.githubusercontent.com, a gist raw URL, or a GitHub release asset) and executing it. Fetch-then-run of an untrusted raw artifact is a fetch-and-execute install directive \u2014 the FakeGit \"download and run\" shape. Confirm the artifact and origin.", "remediation": null }, { "tool_name": "nerlo-install-instruction", "severity": "high", "category": "install-instruction-exec", "file_path": "/repo/docs/readmeLang/README_zh-CN.md", "line_number": 27, "rule_identifier": "opt.nerlo-rules.nerlo-install-pipe-to-shell", "title": "opt.nerlo-rules.nerlo-install-pipe-to-shell", "description": "Documentation instructs piping a downloaded artifact directly into a shell (curl/wget/iwr ... | bash/sh/iex). This is the curl-pipe-bash install shape used by the ClawHub skill droppers and countless malware loaders \u2014 the fetched payload is executed with zero inspection. Confirm this is expected; it is a strong weaponized-documentation signal.", "remediation": null }, { "tool_name": "nerlo-install-instruction", "severity": "high", "category": "install-instruction-exec", "file_path": "/repo/docs/readmeLang/README_zh-CN.md", "line_number": 27, "rule_identifier": "opt.nerlo-rules.nerlo-install-fetch-raw-then-run", "title": "opt.nerlo-rules.nerlo-install-fetch-raw-then-run", "description": "Documentation directs fetching a raw file (raw.githubusercontent.com, a gist raw URL, or a GitHub release asset) and executing it. Fetch-then-run of an untrusted raw artifact is a fetch-and-execute install directive \u2014 the FakeGit \"download and run\" shape. Confirm the artifact and origin.", "remediation": null }, { "tool_name": "nerlo-install-instruction", "severity": "high", "category": "install-instruction-exec", "file_path": "/repo/docs/readmeLang/README_zh-TW.md", "line_number": 27, "rule_identifier": "opt.nerlo-rules.nerlo-install-pipe-to-shell", "title": "opt.nerlo-rules.nerlo-install-pipe-to-shell", "description": "Documentation instructs piping a downloaded artifact directly into a shell (curl/wget/iwr ... | bash/sh/iex). This is the curl-pipe-bash install shape used by the ClawHub skill droppers and countless malware loaders \u2014 the fetched payload is executed with zero inspection. Confirm this is expected; it is a strong weaponized-documentation signal.", "remediation": null }, { "tool_name": "nerlo-install-instruction", "severity": "high", "category": "install-instruction-exec", "file_path": "/repo/docs/readmeLang/README_zh-TW.md", "line_number": 27, "rule_identifier": "opt.nerlo-rules.nerlo-install-fetch-raw-then-run", "title": "opt.nerlo-rules.nerlo-install-fetch-raw-then-run", "description": "Documentation directs fetching a raw file (raw.githubusercontent.com, a gist raw URL, or a GitHub release asset) and executing it. Fetch-then-run of an untrusted raw artifact is a fetch-and-execute install directive \u2014 the FakeGit \"download and run\" shape. Confirm the artifact and origin.", "remediation": null }, { "tool_name": "nerlo-install-instruction", "severity": "medium", "category": "install-instruction-run", "file_path": "/repo/scripts/setup-jj.sh", "line_number": 198, "rule_identifier": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "title": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "description": "Documentation instructs running or double-clicking a bundled/opaque artifact (e.g. \"run resource.txt\", \"execute install.sh\", \"double-click setup.exe\"). This is the FakeGit README shape, where the payload ships as a file the docs tell you to run. Verify the artifact is inspectable and expected \u2014 opaque bundled executables directed by docs warrant review.", "remediation": null }, { "tool_name": "nerlo-install-instruction", "severity": "medium", "category": "install-instruction-run", "file_path": "/repo/skills/fix/SKILL.md", "line_number": 219, "rule_identifier": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "title": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "description": "Documentation instructs running or double-clicking a bundled/opaque artifact (e.g. \"run resource.txt\", \"execute install.sh\", \"double-click setup.exe\"). This is the FakeGit README shape, where the payload ships as a file the docs tell you to run. Verify the artifact is inspectable and expected \u2014 opaque bundled executables directed by docs warrant review.", "remediation": null }, { "tool_name": "nerlo-install-instruction", "severity": "medium", "category": "install-instruction-run", "file_path": "/repo/skills/resume/SKILL.md", "line_number": 132, "rule_identifier": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "title": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "description": "Documentation instructs running or double-clicking a bundled/opaque artifact (e.g. \"run resource.txt\", \"execute install.sh\", \"double-click setup.exe\"). This is the FakeGit README shape, where the payload ships as a file the docs tell you to run. Verify the artifact is inspectable and expected \u2014 opaque bundled executables directed by docs warrant review.", "remediation": null } ], "execution_duration_seconds": 174.420643880032, "status": "complete", "examined": null, "metadata": { "source": "nerlo-original", "source_url": "https://github.com/nerlo-ai/nerlo", "report_type": "nerlo-install-instruction", "ruleset_path": "/opt/nerlo-rules/install_instructions.yaml", "files_scanned": 39, "ruleset_paths": [ "/opt/nerlo-rules/install_instructions.yaml", "/opt/nerlo-rules/cursor_rules.yaml" ], "install_command": "pip install 'semgrep==1.97.0'", "severity_counts": { "low": 0, "high": 14, "medium": 22, "critical": 0, "informational": 0 }, "merged_invocation": true }, "display_score": 0.0, "display_badge": "Unsafe" }, { "scanner_name": "nerlo-multi-source", "scanner_version": "0.1.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 19.595111781032756, "status": "not_applicable", "examined": null, "metadata": { "source": "nerlo-original", "report_type": "nerlo-multi-source", "published_surfaces_scanned": 0 }, "display_score": null, "display_badge": "unavailable" }, { "scanner_name": "trivy", "scanner_version": "0.71.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 2.0838693670229986, "status": "not_applicable", "examined": null, "metadata": { "source": "github-releases", "source_url": "https://github.com/aquasecurity/trivy/releases/tag/v0.71.0", "report_type": "filesystem-vulnerability", "install_command": "curl -sfL -o /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.71.0/trivy_0.71.0_Linux-64bit.deb && echo ' /tmp/trivy.deb' | sha256sum -c - && dpkg -i /tmp/trivy.deb", "manifests_scanned": [] }, "display_score": null, "display_badge": "unavailable" }, { "scanner_name": "osv-scanner", "scanner_version": "2.3.8", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 1.0165739480871707, "status": "not_applicable", "examined": null, "metadata": { "source": "github-releases", "source_url": "https://github.com/google/osv-scanner/releases/tag/v2.3.8", "report_type": "osv-vulnerability", "ecosystems_seen": [], "install_command": "curl -sfL -o /usr/local/bin/osv-scanner https://github.com/google/osv-scanner/releases/download/v2.3.8/osv-scanner_linux_amd64 && echo ' /usr/local/bin/osv-scanner' | sha256sum -c - && chmod +x /usr/local/bin/osv-scanner", "manifests_scanned": [], "finding_id_aliases": {}, "cross_scanner_correlation": { "only_osv": [], "only_trivy": [], "intersection_ids": [] } }, "display_score": null, "display_badge": "unavailable" } ] ```