# Security Audit Report — anti-ai-writing

- **Report ID:** `f1cefcfe-e312-4e3a-8480-d1dc337efa82`
- **Generated:** 2026-07-31T15:39:43.921076+00:00
- **Signature:** unsigned (cosign keyless signing runs in CI; Req 22.4)

## 1. Executive Summary

**Badge:** Unsafe (composite)  
**Security score:** 72.2

| Scanner | Badge |
| --- | --- |
| agent-audit-kit | Unsafe |
| agentshield | Verified |
| cisco-skill-scanner | Unsafe |
| nerlo-behavioral | Unsafe |
| nerlo-install-instruction | Verified |
| nerlo-multi-source | unavailable |
| osv-scanner | unavailable |
| trivy | unavailable |
| trivy_image | unavailable |

| Severity | Findings |
| --- | --- |
| critical | 0 |
| high | 6 |
| medium | 9 |
| low | 2 |
| informational | 8 |

anti-ai-writing is NOT recommended for integration: the scan surfaced 0 critical and 6 high-severity findings. Treat the Per-Scanner Detail section as a remediation worklist and re-scan before reconsidering.

## 2. Source Provenance

- **Repository:** https://github.com/rhowardstone/ai-job-coach
- **Commit scanned:** `unknown`
- **License:** unknown
- **Maintainer:** unknown
- **Version:** unknown

## 3. Per-Scanner Detail

### agentshield (v1.4.0) — Verified / 99.0

- **[medium] No PreToolUse security hooks configured** — No PreToolUse hooks are defined. These hooks can catch dangerous operations before they run, providing an essential security layer. (settings.json:None)

### cisco-skill-scanner (v2.0.11) — Unsafe / 52.0

- **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/.claude/skills/interview-prep/SKILL.md:None)
- **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/.claude/skills/job-batch/SKILL.md:None)
- **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/.claude/skills/job-search/SKILL.md:None)
- **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/.claude/skills/ats-review/SKILL.md:None)
- **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/.claude/skills/anti-ai-writing/SKILL.md:None)
- **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/.claude/skills/apply/SKILL.md:None)
- **[medium] Undeclared network usage** — Skill code uses network libraries but doesn't declare network requirement (/repo/repo/CLAUDE.template.md:None)
- **[low] Vague skill description** — Skill description is too short (16 chars). Provide detailed explanation. (/repo/SKILL.md:None)
- **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/SKILL.md:None)
- **[medium] Outbound network request primitives that can transmit data externally** — Pattern detected: requests.get( (/repo/toolkit/scripts/email_finder.py:121)
- **[medium] Outbound network request primitives that can transmit data externally** — Pattern detected: requests.get( (/repo/toolkit/scripts/email_finder.py:134)
- **[medium] Outbound network request primitives that can transmit data externally** — Pattern detected: requests.get( (/repo/toolkit/scripts/greenhouse_search.py:84)
- **[medium] Undeclared network usage** — Skill code uses network libraries but doesn't declare network requirement (/repo/toolkit/repo/toolkit/README.md:None)
- **[low] Vague skill description** — Skill description is too short (16 chars). Provide detailed explanation. (/repo/toolkit/SKILL.md:None)
- **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/toolkit/SKILL.md:None)
- **[medium] Outbound network request primitives that can transmit data externally** — Pattern detected: requests.get( (/repo/toolkit/scripts/email_finder.py:121)
- **[medium] Outbound network request primitives that can transmit data externally** — Pattern detected: requests.get( (/repo/toolkit/scripts/email_finder.py:134)
- **[medium] Outbound network request primitives that can transmit data externally** — Pattern detected: requests.get( (/repo/toolkit/scripts/greenhouse_search.py:84)

### agent-audit-kit (v0.3.26) — Unsafe / 55.0

- **[high] Generic high-entropy secret** — A value assigned to a secret-like key has high Shannon entropy, indicating a likely credential or API key. (toolkit/scripts/email_finder.py:192)
- **[high] Generic high-entropy secret** — A value assigned to a secret-like key has high Shannon entropy, indicating a likely credential or API key. (toolkit/scripts/test_email_finder.py:81)
- **[high] Generic high-entropy secret** — A value assigned to a secret-like key has high Shannon entropy, indicating a likely credential or API key. (toolkit/scripts/test_email_finder.py:140)

### nerlo-behavioral (v0.1.0) — Unsafe / 55.0

- **[high] opt.nerlo-rules.nerlo-py-secret-to-network-egress** — A secret / environment variable / token value flows into a network request (requests / httpx / urllib / socket). This is the postmark-mcp supply-chain exfiltration shape: a credential read from the environment is shipped off-box. Confirm the egress is expected and the value is not being exfiltrated to an attacker-controlled host. (/repo/toolkit/scripts/email_finder.py:121)
- **[high] opt.nerlo-rules.nerlo-py-secret-to-network-egress** — A secret / environment variable / token value flows into a network request (requests / httpx / urllib / socket). This is the postmark-mcp supply-chain exfiltration shape: a credential read from the environment is shipped off-box. Confirm the egress is expected and the value is not being exfiltrated to an attacker-controlled host. (/repo/toolkit/scripts/email_finder.py:134)
- **[high] opt.nerlo-rules.nerlo-py-secret-to-network-egress** — A secret / environment variable / token value flows into a network request (requests / httpx / urllib / socket). This is the postmark-mcp supply-chain exfiltration shape: a credential read from the environment is shipped off-box. Confirm the egress is expected and the value is not being exfiltrated to an attacker-controlled host. (/repo/toolkit/scripts/greenhouse_search.py:84)

### nerlo-install-instruction (v0.1.0) — Verified / 100.0

No findings.

### nerlo-multi-source (v0.1.0) — unavailable / n/a

No findings.

### trivy (v0.71.0) — unavailable / n/a

No findings.

### osv-scanner (v2.3.8) — unavailable / n/a

No findings.

### trivy_image (v0.71.0) — unavailable / n/a

No findings.

## 4. Threat Model

Threat model synthesis has not yet run for this scan. This section is generated by the registry's LLM pipeline (Req 22.3) and will appear in the next regeneration of this report.

## 5. Audit Chain

- **Scan job:** `536077f6-0ac3-4d85-9413-8827299bc81d`
- **Completed:** 2026-07-31T07:54:44.080774+00:00
- **Scanner base image:** `us-central1-docker.pkg.dev/nerlo-vsk-prod/nerlo/scanner-base@sha256:04d4ebff19b52711a0fc06336d25964d24b9072474ff98811e5b82af008f1b8d`
- **AI decision log entries:** 2
  - `691b54df-f02e-432c-a138-4918db90bf4c`
  - `07a9520f-c959-419f-9bb7-3c5445e8d61a`

## 6. Appendix — Raw Scanner Output

```json
[
  {
    "scanner_name": "agentshield",
    "scanner_version": "1.4.0",
    "score": 99.0,
    "scanner_badge": "Verified",
    "findings": [
      {
        "tool_name": "agentshield",
        "severity": "medium",
        "category": "misconfiguration",
        "file_path": "settings.json",
        "line_number": null,
        "rule_identifier": "hooks-no-pretooluse",
        "title": "No PreToolUse security hooks configured",
        "description": "No PreToolUse hooks are defined. These hooks can catch dangerous operations before they run, providing an essential security layer.",
        "remediation": "Add PreToolUse hooks for security-sensitive operations"
      }
    ],
    "execution_duration_seconds": 1.6872399400017457,
    "status": "complete",
    "examined": null,
    "metadata": {
      "source": "npm",
      "source_url": "https://www.npmjs.com/package/ecc-agentshield",
      "install_command": "npm install -g ecc-agentshield@1.4.0",
      "scans_performed": [
        "claude_config"
      ],
      "score_breakdown": {
        "mcp": 100,
        "hooks": 100,
        "agents": 100,
        "secrets": 100,
        "permissions": 95
      }
    },
    "display_score": 99.0,
    "display_badge": "Verified"
  },
  {
    "scanner_name": "cisco-skill-scanner",
    "scanner_version": "2.0.11",
    "score": 52.0,
    "scanner_badge": "Unsafe",
    "findings": [
      {
        "tool_name": "cisco-skill-scanner",
        "severity": "informational",
        "category": "policy_violation",
        "file_path": "/repo/.claude/skills/interview-prep/SKILL.md",
        "line_number": null,
        "rule_identifier": "MANIFEST_MISSING_LICENSE",
        "title": "Skill does not specify a license",
        "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
        "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
      },
      {
        "tool_name": "cisco-skill-scanner",
        "severity": "informational",
        "category": "policy_violation",
        "file_path": "/repo/.claude/skills/job-batch/SKILL.md",
        "line_number": null,
        "rule_identifier": "MANIFEST_MISSING_LICENSE",
        "title": "Skill does not specify a license",
        "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
        "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
      },
      {
        "tool_name": "cisco-skill-scanner",
        "severity": "informational",
        "category": "policy_violation",
        "file_path": "/repo/.claude/skills/job-search/SKILL.md",
        "line_number": null,
        "rule_identifier": "MANIFEST_MISSING_LICENSE",
        "title": "Skill does not specify a license",
        "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
        "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
      },
      {
        "tool_name": "cisco-skill-scanner",
        "severity": "informational",
        "category": "policy_violation",
        "file_path": "/repo/.claude/skills/ats-review/SKILL.md",
        "line_number": null,
        "rule_identifier": "MANIFEST_MISSING_LICENSE",
        "title": "Skill does not specify a license",
        "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
        "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
      },
      {
        "tool_name": "cisco-skill-scanner",
        "severity": "informational",
        "category": "policy_violation",
        "file_path": "/repo/.claude/skills/anti-ai-writing/SKILL.md",
        "line_number": null,
        "rule_identifier": "MANIFEST_MISSING_LICENSE",
        "title": "Skill does not specify a license",
        "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
        "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
      },
      {
        "tool_name": "cisco-skill-scanner",
        "severity": "informational",
        "category": "policy_violation",
        "file_path": "/repo/.claude/skills/apply/SKILL.md",
        "line_number": null,
        "rule_identifier": "MANIFEST_MISSING_LICENSE",
        "title": "Skill does not specify a license",
        "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
        "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
      },
      {
        "tool_name": "cisco-skill-scanner",
        "severity": "medium",
        "category": "unauthorized_tool_use",
        "file_path": "/repo/repo/CLAUDE.template.md",
        "line_number": null,
        "rule_identifier": "TOOL_ABUSE_UNDECLARED_NETWORK",
        "title": "Undeclared network usage",
        "description": "Skill code uses network libraries but doesn't declare network requirement",
        "remediation": "Declare network usage in compatibility field or remove network calls"
      },
      {
        "tool_name": "cisco-skill-scanner",
        "severity": "low",
        "category": "social_engineering",
        "file_path": "/repo/SKILL.md",
        "line_number": null,
        "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
        "title": "Vague skill description",
        "description": "Skill description is too short (16 chars). Provide detailed explanation.",
        "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
      },
      {
        "tool_name": "cisco-skill-scanner",
        "severity": "informational",
        "category": "policy_violation",
        "file_path": "/repo/SKILL.md",
        "line_number": null,
        "rule_identifier": "MANIFEST_MISSING_LICENSE",
        "title": "Skill does not specify a license",
        "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
        "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
      },
      {
        "tool_name": "cisco-skill-scanner",
        "severity": "medium",
        "category": "data_exfiltration",
        "file_path": "/repo/toolkit/scripts/email_finder.py",
        "line_number": 121,
        "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
        "title": "Outbound network request primitives that can transmit data externally",
        "description": "Pattern detected: requests.get(",
        "remediation": "Ensure network operations are necessary and document allowed destinations"
      },
      {
        "tool_name": "cisco-skill-scanner",
        "severity": "medium",
        "category": "data_exfiltration",
        "file_path": "/repo/toolkit/scripts/email_finder.py",
        "line_number": 134,
        "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
        "title": "Outbound network request primitives that can transmit data externally",
        "description": "Pattern detected: requests.get(",
        "remediation": "Ensure network operations are necessary and document allowed destinations"
      },
      {
        "tool_name": "cisco-skill-scanner",
        "severity": "medium",
        "category": "data_exfiltration",
        "file_path": "/repo/toolkit/scripts/greenhouse_search.py",
        "line_number": 84,
        "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
        "title": "Outbound network request primitives that can transmit data externally",
        "description": "Pattern detected: requests.get(",
        "remediation": "Ensure network operations are necessary and document allowed destinations"
      },
      {
        "tool_name": "cisco-skill-scanner",
        "severity": "medium",
        "category": "unauthorized_tool_use",
        "file_path": "/repo/toolkit/repo/toolkit/README.md",
        "line_number": null,
        "rule_identifier": "TOOL_ABUSE_UNDECLARED_NETWORK",
        "title": "Undeclared network usage",
        "description": "Skill code uses network libraries but doesn't declare network requirement",
        "remediation": "Declare network usage in compatibility field or remove network calls"
      },
      {
        "tool_name": "cisco-skill-scanner",
        "severity": "low",
        "category": "social_engineering",
        "file_path": "/repo/toolkit/SKILL.md",
        "line_number": null,
        "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
        "title": "Vague skill description",
        "description": "Skill description is too short (16 chars). Provide detailed explanation.",
        "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
      },
      {
        "tool_name": "cisco-skill-scanner",
        "severity": "informational",
        "category": "policy_violation",
        "file_path": "/repo/toolkit/SKILL.md",
        "line_number": null,
        "rule_identifier": "MANIFEST_MISSING_LICENSE",
        "title": "Skill does not specify a license",
        "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
        "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
      },
      {
        "tool_name": "cisco-skill-scanner",
        "severity": "medium",
        "category": "data_exfiltration",
        "file_path": "/repo/toolkit/scripts/email_finder.py",
        "line_number": 121,
        "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
        "title": "Outbound network request primitives that can transmit data externally",
        "description": "Pattern detected: requests.get(",
        "remediation": "Ensure network operations are necessary and document allowed destinations"
      },
      {
        "tool_name": "cisco-skill-scanner",
        "severity": "medium",
        "category": "data_exfiltration",
        "file_path": "/repo/toolkit/scripts/email_finder.py",
        "line_number": 134,
        "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
        "title": "Outbound network request primitives that can transmit data externally",
        "description": "Pattern detected: requests.get(",
        "remediation": "Ensure network operations are necessary and document allowed destinations"
      },
      {
        "tool_name": "cisco-skill-scanner",
        "severity": "medium",
        "category": "data_exfiltration",
        "file_path": "/repo/toolkit/scripts/greenhouse_search.py",
        "line_number": 84,
        "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
        "title": "Outbound network request primitives that can transmit data externally",
        "description": "Pattern detected: requests.get(",
        "remediation": "Ensure network operations are necessary and document allowed destinations"
      }
    ],
    "execution_duration_seconds": 18.084191059999284,
    "status": "complete",
    "examined": {
      "unit": "skills",
      "count": 8
    },
    "metadata": {
      "source": "pypi",
      "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/",
      "report_type": "cisco-skill-sast",
      "analyzers_used": [
        "bytecode",
        "pipeline",
        "static_analyzer"
      ],
      "skills_scanned": [
        "interview-prep",
        "job-batch",
        "job-search",
        "ats-review",
        "anti-ai-writing",
        "apply",
        "repo",
        "toolkit"
      ],
      "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt",
      "severity_counts": {
        "low": 2,
        "high": 0,
        "medium": 8,
        "critical": 0,
        "informational": 8
      },
      "artifact_type_policy": "claude_skill"
    },
    "display_score": 52.0,
    "display_badge": "Unsafe"
  },
  {
    "scanner_name": "agent-audit-kit",
    "scanner_version": "0.3.26",
    "score": 55.0,
    "scanner_badge": "Unsafe",
    "findings": [
      {
        "tool_name": "agent-audit-kit",
        "severity": "high",
        "category": "secret-exposure",
        "file_path": "toolkit/scripts/email_finder.py",
        "line_number": 192,
        "rule_identifier": "AAK-SECRET-004",
        "title": "Generic high-entropy secret",
        "description": "A value assigned to a secret-like key has high Shannon entropy, indicating a likely credential or API key.",
        "remediation": "Move to environment variables or secrets manager."
      },
      {
        "tool_name": "agent-audit-kit",
        "severity": "high",
        "category": "secret-exposure",
        "file_path": "toolkit/scripts/test_email_finder.py",
        "line_number": 81,
        "rule_identifier": "AAK-SECRET-004",
        "title": "Generic high-entropy secret",
        "description": "A value assigned to a secret-like key has high Shannon entropy, indicating a likely credential or API key.",
        "remediation": "Move to environment variables or secrets manager."
      },
      {
        "tool_name": "agent-audit-kit",
        "severity": "high",
        "category": "secret-exposure",
        "file_path": "toolkit/scripts/test_email_finder.py",
        "line_number": 140,
        "rule_identifier": "AAK-SECRET-004",
        "title": "Generic high-entropy secret",
        "description": "A value assigned to a secret-like key has high Shannon entropy, indicating a likely credential or API key.",
        "remediation": "Move to environment variables or secrets manager."
      }
    ],
    "execution_duration_seconds": 4.079061696000281,
    "status": "complete",
    "examined": {
      "unit": "files",
      "count": 19
    },
    "metadata": {
      "source": "pypi",
      "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/",
      "report_type": "agent-audit-kit-sast",
      "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt",
      "rules_evaluated": 211,
      "severity_counts": {
        "low": 0,
        "high": 3,
        "medium": 0,
        "critical": 0,
        "informational": 0
      }
    },
    "display_score": 55.0,
    "display_badge": "Unsafe"
  },
  {
    "scanner_name": "nerlo-behavioral",
    "scanner_version": "0.1.0",
    "score": 55.0,
    "scanner_badge": "Unsafe",
    "findings": [
      {
        "tool_name": "nerlo-behavioral",
        "severity": "high",
        "category": "data-exfiltration",
        "file_path": "/repo/toolkit/scripts/email_finder.py",
        "line_number": 121,
        "rule_identifier": "opt.nerlo-rules.nerlo-py-secret-to-network-egress",
        "title": "opt.nerlo-rules.nerlo-py-secret-to-network-egress",
        "description": "A secret / environment variable / token value flows into a network request (requests / httpx / urllib / socket). This is the postmark-mcp supply-chain exfiltration shape: a credential read from the environment is shipped off-box. Confirm the egress is expected and the value is not being exfiltrated to an attacker-controlled host.",
        "remediation": null
      },
      {
        "tool_name": "nerlo-behavioral",
        "severity": "high",
        "category": "data-exfiltration",
        "file_path": "/repo/toolkit/scripts/email_finder.py",
        "line_number": 134,
        "rule_identifier": "opt.nerlo-rules.nerlo-py-secret-to-network-egress",
        "title": "opt.nerlo-rules.nerlo-py-secret-to-network-egress",
        "description": "A secret / environment variable / token value flows into a network request (requests / httpx / urllib / socket). This is the postmark-mcp supply-chain exfiltration shape: a credential read from the environment is shipped off-box. Confirm the egress is expected and the value is not being exfiltrated to an attacker-controlled host.",
        "remediation": null
      },
      {
        "tool_name": "nerlo-behavioral",
        "severity": "high",
        "category": "data-exfiltration",
        "file_path": "/repo/toolkit/scripts/greenhouse_search.py",
        "line_number": 84,
        "rule_identifier": "opt.nerlo-rules.nerlo-py-secret-to-network-egress",
        "title": "opt.nerlo-rules.nerlo-py-secret-to-network-egress",
        "description": "A secret / environment variable / token value flows into a network request (requests / httpx / urllib / socket). This is the postmark-mcp supply-chain exfiltration shape: a credential read from the environment is shipped off-box. Confirm the egress is expected and the value is not being exfiltrated to an attacker-controlled host.",
        "remediation": null
      }
    ],
    "execution_duration_seconds": 34.94166319999931,
    "status": "complete",
    "examined": {
      "unit": "files",
      "count": 4
    },
    "metadata": {
      "source": "nerlo-original",
      "source_url": "https://github.com/nerlo-ai/nerlo",
      "report_type": "nerlo-behavioral",
      "ruleset_path": "/opt/nerlo-rules/exfiltration.yaml",
      "ruleset_paths": [
        "/opt/nerlo-rules/exfiltration.yaml",
        "/opt/nerlo-rules/clipboard_exfiltration.yaml",
        "/opt/nerlo-rules/rce_endpoint.yaml",
        "/opt/nerlo-rules/taint_egress.yaml"
      ],
      "install_command": "pip install 'semgrep==1.97.0'",
      "severity_counts": {
        "low": 0,
        "high": 3,
        "medium": 0,
        "critical": 0,
        "informational": 0
      },
      "merged_invocation": true
    },
    "display_score": 55.0,
    "display_badge": "Unsafe"
  },
  {
    "scanner_name": "nerlo-install-instruction",
    "scanner_version": "0.1.0",
    "score": 100.0,
    "scanner_badge": "Verified",
    "findings": [],
    "execution_duration_seconds": 34.94126311199943,
    "status": "complete",
    "examined": {
      "unit": "files",
      "count": 11
    },
    "metadata": {
      "source": "nerlo-original",
      "source_url": "https://github.com/nerlo-ai/nerlo",
      "report_type": "nerlo-install-instruction",
      "ruleset_path": "/opt/nerlo-rules/install_instructions.yaml",
      "ruleset_paths": [
        "/opt/nerlo-rules/install_instructions.yaml",
        "/opt/nerlo-rules/cursor_rules.yaml"
      ],
      "install_command": "pip install 'semgrep==1.97.0'",
      "merged_invocation": true
    },
    "display_score": 100.0,
    "display_badge": "Verified"
  },
  {
    "scanner_name": "nerlo-multi-source",
    "scanner_version": "0.1.0",
    "score": 100.0,
    "scanner_badge": "Verified",
    "findings": [],
    "execution_duration_seconds": 10.983831428995472,
    "status": "not_applicable",
    "examined": null,
    "metadata": {
      "source": "nerlo-original",
      "per_source": [],
      "report_type": "nerlo-multi-source",
      "diverged_sources": [],
      "published_surfaces_scanned": 0
    },
    "display_score": null,
    "display_badge": "unavailable"
  },
  {
    "scanner_name": "trivy",
    "scanner_version": "0.71.0",
    "score": 100.0,
    "scanner_badge": "Verified",
    "findings": [],
    "execution_duration_seconds": 0.6484722669993062,
    "status": "not_applicable",
    "examined": {
      "unit": "manifests",
      "count": 0
    },
    "metadata": {
      "source": "github-releases",
      "source_url": "https://github.com/aquasecurity/trivy/releases/tag/v0.71.0",
      "report_type": "filesystem-vulnerability",
      "install_command": "curl -sfL -o /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.71.0/trivy_0.71.0_Linux-64bit.deb && echo '<sha256>  /tmp/trivy.deb' | sha256sum -c - && dpkg -i /tmp/trivy.deb",
      "manifests_scanned": []
    },
    "display_score": null,
    "display_badge": "unavailable"
  },
  {
    "scanner_name": "osv-scanner",
    "scanner_version": "2.3.8",
    "score": 100.0,
    "scanner_badge": "Verified",
    "findings": [],
    "execution_duration_seconds": 0.454898518997652,
    "status": "not_applicable",
    "examined": {
      "unit": "manifests",
      "count": 0
    },
    "metadata": {
      "source": "github-releases",
      "source_url": "https://github.com/google/osv-scanner/releases/tag/v2.3.8",
      "report_type": "osv-vulnerability",
      "ecosystems_seen": [],
      "install_command": "curl -sfL -o /usr/local/bin/osv-scanner https://github.com/google/osv-scanner/releases/download/v2.3.8/osv-scanner_linux_amd64 && echo '<sha256>  /usr/local/bin/osv-scanner' | sha256sum -c - && chmod +x /usr/local/bin/osv-scanner",
      "manifests_scanned": [],
      "finding_id_aliases": {},
      "cross_scanner_correlation": {
        "only_osv": [],
        "only_trivy": [],
        "intersection_ids": []
      }
    },
    "display_score": null,
    "display_badge": "unavailable"
  },
  {
    "scanner_name": "trivy_image",
    "scanner_version": "0.71.0",
    "score": 100.0,
    "scanner_badge": "Verified",
    "findings": [],
    "execution_duration_seconds": 3.8575999496970326e-05,
    "status": "not_applicable",
    "examined": {
      "unit": "image_targets",
      "count": 0
    },
    "metadata": {
      "reason": "no OCI image acquired for this artifact"
    },
    "display_score": null,
    "display_badge": "unavailable"
  }
]
```