# Security Audit Report — @bubblav/tools - **Report ID:** `22ae0843-b231-4292-bb6b-33dacc9e7686` - **Generated:** 2026-07-29T05:50:38.351687+00:00 - **Signature:** unsigned (cosign keyless signing runs in CI; Req 22.4) ## 1. Executive Summary **Badge:** Unsafe (composite) **Security score:** 89.17 | Scanner | Badge | | --- | --- | | agent-audit-kit | Caution | | agentshield | Verified | | bearer | Verified | | cisco-skill-scanner | Verified | | nerlo-behavioral | Unsafe | | nerlo-install-instruction | Verified | | nerlo-multi-source | unavailable | | osv-scanner | unavailable | | trivy | unavailable | | Severity | Findings | | --- | --- | | critical | 0 | | high | 2 | | medium | 0 | | low | 3 | @bubblav/tools is NOT recommended for integration: the scan surfaced 0 critical and 2 high-severity findings. Treat the Per-Scanner Detail section as a remediation worklist and re-scan before reconsidering. ## 2. Source Provenance - **Repository:** https://github.com/bubblav-org/tools - **Commit scanned:** `unknown` - **License:** MIT - **Maintainer:** unknown - **Version:** 0.2.0 ## 3. Per-Scanner Detail ### agentshield (v1.4.0) — Verified / 100.0 No findings. ### cisco-skill-scanner (v2.0.11) — Verified / 97.0 - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/skills/web-scrape-md/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/skills/manage-custom-tools/SKILL.md:None) - **[informational] Moderate analyzability score** — [mcp_server policy: capability-matches-purpose class; severity medium -> informational] Only 80% of skill content could be analyzed. 2 of 11 files are opaque to the scanner. Some content could not be verified as safe. (/repo:None) - **[informational] Vague skill description** — [mcp_server policy: capability-matches-purpose class; severity low -> informational] Skill description is too short (16 chars). Provide detailed explanation. (/repo/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/SKILL.md:None) - **[informational] Outbound network request primitives in JavaScript/TypeScript** — [mcp_server policy: capability-matches-purpose class; severity medium -> informational] Pattern detected: fetch( (/repo/src/index.js:11) ### agent-audit-kit (v0.3.26) — Caution / 83.0 - **[high] Unsigned marketplace.json manifest** — .claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection. (.claude-plugin/marketplace.json:2) - **[low] MCP server repo missing SECURITY.md or security_contact** — A repository whose name or pyproject keywords declare it as an MCP server ships without a top-level SECURITY.md AND without a 'security_contact' entry in marketplace.json / pyproject.toml / package.json. Anthropic's April 2026 SECURITY.md guidance makes this the baseline expectation so researchers have a channel. (SECURITY.md:None) ### bearer (v2.0.2) — Verified / 96.0 - **[low] Leakage of information in logger message** — \#\# Description Information leakage through logger messages can compromise sensitive data. This vulnerability arises when dynamic data or variables, which may contain sensitive information, are included in log messages. \#\# Remediations - **Do not** include sensitive data directly in logger messages. This can lead to the exposure of such data in log files, which might be accessible to unauthorized individuals. '''javascript logger.info('Results: ${data}') // unsafe ''' - **Do** use loggin (/repo/src/cli.js:44) - **[low] Leakage of information in logger message** — \#\# Description Information leakage through logger messages can compromise sensitive data. This vulnerability arises when dynamic data or variables, which may contain sensitive information, are included in log messages. \#\# Remediations - **Do not** include sensitive data directly in logger messages. This can lead to the exposure of such data in log files, which might be accessible to unauthorized individuals. '''javascript logger.info('Results: ${data}') // unsafe ''' - **Do** use loggin (/repo/src/cli.js:47) ### nerlo-behavioral (v0.1.0) — Unsafe / 59.0 - **[high] opt.nerlo-rules.nerlo-js-secret-to-network-egress** — A secret / environment variable / token value flows into a network request (fetch / axios / XMLHttpRequest). This is the postmark-mcp supply-chain exfiltration shape reproduced in Node/JS: a credential read from the environment is shipped off-box. Confirm the egress is expected and the value is not being exfiltrated to an attacker-controlled host. (/repo/src/index.js:11) ### nerlo-install-instruction (v0.1.0) — Verified / 100.0 No findings. ### nerlo-multi-source (v0.1.0) — unavailable / n/a No findings. ### trivy (v0.71.0) — unavailable / n/a No findings. ### osv-scanner (v2.3.8) — unavailable / n/a No findings. ## 4. Threat Model Threat model synthesis has not yet run for this scan. This section is generated by the registry's LLM pipeline (Req 22.3) and will appear in the next regeneration of this report. ## 5. Audit Chain - **Scan job:** `052b421e-c9c7-437f-9fcb-108418c07abe` - **Completed:** 2026-07-26T04:28:07.734426+00:00 - **Scanner base image:** `us-central1-docker.pkg.dev/nerlo-vsk-prod/nerlo/scanner-base@sha256:86a3d299a4356dfd5a34cd31cfa9f4c28d236d387691f7c8070086afe5224516` - **AI decision log entries:** 2 - `11a53a47-c034-4b2f-9382-8f967ecc2105` - `14a2309e-7f92-4348-b970-e466b0d344a8` ## 6. Appendix — Raw Scanner Output ```json [ { "scanner_name": "agentshield", "scanner_version": "1.4.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 7.938945383997634, "status": "complete", "examined": null, "metadata": { "source": "npm", "source_url": "https://www.npmjs.com/package/ecc-agentshield", "install_command": "npm install -g ecc-agentshield@1.4.0", "scans_performed": [ "supply_chain" ] }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "cisco-skill-scanner", "scanner_version": "2.0.11", "score": 97.0, "scanner_badge": "Verified", "findings": [ { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/skills/web-scrape-md/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/skills/manage-custom-tools/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo", "line_number": null, "rule_identifier": "LOW_ANALYZABILITY", "title": "Moderate analyzability score", "description": "[mcp_server policy: capability-matches-purpose class; severity medium -> informational] Only 80% of skill content could be analyzed. 2 of 11 files are opaque to the scanner. Some content could not be verified as safe.", "remediation": "Review opaque files and replace with inspectable formats where possible." }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "social_engineering", "file_path": "/repo/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "[mcp_server policy: capability-matches-purpose class; severity low -> informational] Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "data_exfiltration", "file_path": "/repo/src/index.js", "line_number": 11, "rule_identifier": "DATA_EXFIL_JS_NETWORK", "title": "Outbound network request primitives in JavaScript/TypeScript", "description": "[mcp_server policy: capability-matches-purpose class; severity medium -> informational] Pattern detected: fetch(", "remediation": "Ensure network operations are necessary and document allowed destinations" } ], "execution_duration_seconds": 71.78129888395779, "status": "complete", "examined": null, "metadata": { "source": "pypi", "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/", "report_type": "cisco-skill-sast", "analyzers_used": [ "bytecode", "pipeline", "static_analyzer" ], "skills_scanned": [ "web-scrape-md", "manage-custom-tools", "repo" ], "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt", "severity_counts": { "low": 0, "high": 0, "medium": 0, "critical": 0, "informational": 6 }, "artifact_type_policy": "mcp_server", "downweighted_findings": 3 }, "display_score": 97.0, "display_badge": "Verified" }, { "scanner_name": "agent-audit-kit", "scanner_version": "0.3.26", "score": 83.0, "scanner_badge": "Caution", "findings": [ { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 2, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "low", "category": "supply-chain", "file_path": "SECURITY.md", "line_number": null, "rule_identifier": "AAK-SEC-MD-001", "title": "MCP server repo missing SECURITY.md or security_contact", "description": "A repository whose name or pyproject keywords declare it as an MCP server ships without a top-level SECURITY.md AND without a `security_contact` entry in marketplace.json / pyproject.toml / package.json. Anthropic's April 2026 SECURITY.md guidance makes this the baseline expectation so researchers have a channel.", "remediation": "Add SECURITY.md at the repo root with a disclosure email and response SLA; OR add `security_contact` to the project manifest." } ], "execution_duration_seconds": 9.049099178984761, "status": "complete", "examined": null, "metadata": { "source": "pypi", "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/", "report_type": "agent-audit-kit-sast", "files_scanned": 11, "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt", "rules_evaluated": 211, "severity_counts": { "low": 1, "high": 1, "medium": 0, "critical": 0, "informational": 0 } }, "display_score": 83.0, "display_badge": "Caution" }, { "scanner_name": "bearer", "scanner_version": "2.0.2", "score": 96.0, "scanner_badge": "Verified", "findings": [ { "tool_name": "bearer", "severity": "low", "category": null, "file_path": "/repo/src/cli.js", "line_number": 44, "rule_identifier": null, "title": "Leakage of information in logger message", "description": "## Description\n\nInformation leakage through logger messages can compromise sensitive data. This vulnerability arises when dynamic data or variables, which may contain sensitive information, are included in log messages.\n\n## Remediations\n\n- **Do not** include sensitive data directly in logger messages. This can lead to the exposure of such data in log files, which might be accessible to unauthorized individuals.\n ```javascript\n logger.info(`Results: ${data}`) // unsafe\n ```\n- **Do** use loggin", "remediation": null }, { "tool_name": "bearer", "severity": "low", "category": null, "file_path": "/repo/src/cli.js", "line_number": 47, "rule_identifier": null, "title": "Leakage of information in logger message", "description": "## Description\n\nInformation leakage through logger messages can compromise sensitive data. This vulnerability arises when dynamic data or variables, which may contain sensitive information, are included in log messages.\n\n## Remediations\n\n- **Do not** include sensitive data directly in logger messages. This can lead to the exposure of such data in log files, which might be accessible to unauthorized individuals.\n ```javascript\n logger.info(`Results: ${data}`) // unsafe\n ```\n- **Do** use loggin", "remediation": null } ], "execution_duration_seconds": 66.4869768540375, "status": "complete", "examined": null, "metadata": { "source": "github-releases", "source_url": "https://github.com/Bearer/bearer", "report_type": "security", "rules_loaded": 554, "install_command": "curl -sfL https://raw.githubusercontent.com/Bearer/bearer/main/contrib/install.sh | sh -s -- -b /usr/local/bin \"v2.0.2\"", "severity_counts": { "low": 2, "high": 0, "medium": 0, "critical": 0, "informational": 0 } }, "display_score": 96.0, "display_badge": "Verified" }, { "scanner_name": "nerlo-behavioral", "scanner_version": "0.1.0", "score": 59.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "nerlo-behavioral", "severity": "high", "category": "data-exfiltration", "file_path": "/repo/src/index.js", "line_number": 11, "rule_identifier": "opt.nerlo-rules.nerlo-js-secret-to-network-egress", "title": "opt.nerlo-rules.nerlo-js-secret-to-network-egress", "description": "A secret / environment variable / token value flows into a network request (fetch / axios / XMLHttpRequest). This is the postmark-mcp supply-chain exfiltration shape reproduced in Node/JS: a credential read from the environment is shipped off-box. Confirm the egress is expected and the value is not being exfiltrated to an attacker-controlled host.", "remediation": null } ], "execution_duration_seconds": 65.63937351305503, "status": "complete", "examined": null, "metadata": { "source": "nerlo-original", "source_url": "https://github.com/nerlo-ai/nerlo", "report_type": "nerlo-behavioral", "ruleset_path": "/opt/nerlo-rules/exfiltration.yaml", "files_scanned": 2, "ruleset_paths": [ "/opt/nerlo-rules/exfiltration.yaml", "/opt/nerlo-rules/clipboard_exfiltration.yaml", "/opt/nerlo-rules/rce_endpoint.yaml", "/opt/nerlo-rules/taint_egress.yaml" ], "install_command": "pip install 'semgrep==1.97.0'", "severity_counts": { "low": 0, "high": 1, "medium": 0, "critical": 0, "informational": 0 }, "merged_invocation": true }, "display_score": 59.0, "display_badge": "Unsafe" }, { "scanner_name": "nerlo-install-instruction", "scanner_version": "0.1.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 65.63918482500594, "status": "complete", "examined": null, "metadata": { "source": "nerlo-original", "source_url": "https://github.com/nerlo-ai/nerlo", "report_type": "nerlo-install-instruction", "ruleset_path": "/opt/nerlo-rules/install_instructions.yaml", "files_scanned": 3, "ruleset_paths": [ "/opt/nerlo-rules/install_instructions.yaml", "/opt/nerlo-rules/cursor_rules.yaml" ], "install_command": "pip install 'semgrep==1.97.0'", "merged_invocation": true }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "nerlo-multi-source", "scanner_version": "0.1.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 14.242337678093463, "status": "not_applicable", "examined": null, "metadata": { "source": "nerlo-original", "report_type": "nerlo-multi-source", "published_surfaces_scanned": 0 }, "display_score": null, "display_badge": "unavailable" }, { "scanner_name": "trivy", "scanner_version": "0.71.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 0.8560068550286815, "status": "not_applicable", "examined": null, "metadata": { "source": "github-releases", "source_url": "https://github.com/aquasecurity/trivy/releases/tag/v0.71.0", "report_type": "filesystem-vulnerability", "install_command": "curl -sfL -o /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.71.0/trivy_0.71.0_Linux-64bit.deb && echo ' /tmp/trivy.deb' | sha256sum -c - && dpkg -i /tmp/trivy.deb", "manifests_scanned": [] }, "display_score": null, "display_badge": "unavailable" }, { "scanner_name": "osv-scanner", "scanner_version": "2.3.8", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 0.5829726620577276, "status": "not_applicable", "examined": null, "metadata": { "source": "github-releases", "source_url": "https://github.com/google/osv-scanner/releases/tag/v2.3.8", "report_type": "osv-vulnerability", "ecosystems_seen": [], "install_command": "curl -sfL -o /usr/local/bin/osv-scanner https://github.com/google/osv-scanner/releases/download/v2.3.8/osv-scanner_linux_amd64 && echo ' /usr/local/bin/osv-scanner' | sha256sum -c - && chmod +x /usr/local/bin/osv-scanner", "manifests_scanned": [], "finding_id_aliases": {}, "cross_scanner_correlation": { "only_osv": [], "only_trivy": [], "intersection_ids": [] } }, "display_score": null, "display_badge": "unavailable" } ] ```