# Security Audit Report — vibe-coding - **Report ID:** `7c0fdd82-25c9-49f3-9540-c62a2a444c6f` - **Generated:** 2026-08-13T15:08:24.354015+00:00 - **Signature:** unsigned (cosign keyless signing runs in CI; Req 22.4) ## 1. Executive Summary **Badge:** Verified (composite) **Security score:** 100.0 | Scanner | Badge | | --- | --- | | agent-audit-kit | Verified | | agentshield | not_applicable | | cisco-skill-scanner | not_applicable | | nerlo-behavioral | not_applicable | | nerlo-install-instruction | Verified | | nerlo-multi-source | not_applicable | | osv-scanner | not_applicable | | trivy | not_applicable | | Severity | Findings | | --- | --- | | critical | 0 | | high | 0 | | medium | 0 | | low | 0 | | informational | 0 | vibe-coding meets the registry's verification bar at scan time. Keep monitoring enabled — verification reflects this commit, not future releases. ## 2. Source Provenance - **Repository:** https://github.com/sevochka/vibe-coding - **Commit scanned:** `unknown` - **License:** unknown - **Maintainer:** unknown - **Version:** unknown ## 3. Per-Scanner Detail ### agentshield (v1.4.0) — not_applicable / n/a No findings. ### cisco-skill-scanner (v2.0.11) — not_applicable / n/a No findings. ### agent-audit-kit (v0.3.26) — Verified / 100.0 No findings. ### nerlo-behavioral (v0.1.0) — not_applicable / n/a No findings. ### nerlo-install-instruction (v0.1.0) — Verified / 100.0 No findings. ### nerlo-multi-source (v0.1.0) — not_applicable / n/a No findings. ### trivy (v0.71.0) — not_applicable / n/a No findings. ### osv-scanner (v2.3.8) — not_applicable / n/a No findings. ## 4. Threat Model Threat model synthesis has not yet run for this scan. This section is generated by the registry's LLM pipeline (Req 22.3) and will appear in the next regeneration of this report. ## 5. Audit Chain - **Scan job:** `80f18711-01b0-4626-a603-077a9cd7a30a` - **Completed:** 2026-08-01T10:10:18.914339+00:00 - **Scanner base image:** `us-central1-docker.pkg.dev/nerlo-vsk-prod/nerlo/scanner-base@sha256:5f45d10278ac35d7492d5f81d502a583236c7acdaed5bc2b0443a0c45cfbb4db` - **AI decision log entries:** 2 - `ac9bb63c-322a-46cd-bdec-5c3d40868709` - `b746a269-8256-41fa-b4f7-b75e68f219f4` ## 6. Appendix — Raw Scanner Output ```json [ { "scanner_name": "agentshield", "scanner_version": "1.4.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 0.5087191030033864, "status": "not_applicable", "examined": null, "metadata": { "source": "npm", "source_url": "https://www.npmjs.com/package/ecc-agentshield", "install_command": "npm install -g ecc-agentshield@1.4.0", "scans_performed": [] }, "display_score": null, "display_badge": "not_applicable" }, { "scanner_name": "cisco-skill-scanner", "scanner_version": "2.0.11", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 17.362047575996257, "status": "not_applicable", "examined": { "unit": "skills", "count": 0 }, "metadata": { "source": "pypi", "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/", "report_type": "cisco-skill-sast", "analyzers_used": [], "skills_scanned": [], "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt", "artifact_type_policy": "cursor_rule" }, "display_score": null, "display_badge": "not_applicable" }, { "scanner_name": "agent-audit-kit", "scanner_version": "0.3.26", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 2.824053365009604, "status": "complete", "examined": { "unit": "files", "count": 1 }, "metadata": { "source": "pypi", "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/", "report_type": "agent-audit-kit-sast", "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt", "rules_evaluated": 211 }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "nerlo-behavioral", "scanner_version": "0.1.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 35.51121760200476, "status": "not_applicable", "examined": { "unit": "files", "count": 0 }, "metadata": { "source": "nerlo-original", "source_url": "https://github.com/nerlo-ai/nerlo", "report_type": "nerlo-behavioral", "ruleset_path": "/opt/nerlo-rules/exfiltration.yaml", "ruleset_paths": [ "/opt/nerlo-rules/exfiltration.yaml", "/opt/nerlo-rules/clipboard_exfiltration.yaml", "/opt/nerlo-rules/rce_endpoint.yaml", "/opt/nerlo-rules/taint_egress.yaml" ], "install_command": "pip install 'semgrep==1.97.0'", "merged_invocation": true }, "display_score": null, "display_badge": "not_applicable" }, { "scanner_name": "nerlo-install-instruction", "scanner_version": "0.1.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 35.51157972100191, "status": "complete", "examined": { "unit": "files", "count": 7 }, "metadata": { "source": "nerlo-original", "source_url": "https://github.com/nerlo-ai/nerlo", "report_type": "nerlo-install-instruction", "ruleset_path": "/opt/nerlo-rules/install_instructions.yaml", "ruleset_paths": [ "/opt/nerlo-rules/install_instructions.yaml", "/opt/nerlo-rules/cursor_rules.yaml" ], "install_command": "pip install 'semgrep==1.97.0'", "merged_invocation": true }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "nerlo-multi-source", "scanner_version": "0.1.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 11.430919071979588, "status": "not_applicable", "examined": null, "metadata": { "source": "nerlo-original", "per_source": [], "report_type": "nerlo-multi-source", "diverged_sources": [], "published_surfaces_scanned": 0 }, "display_score": null, "display_badge": "not_applicable" }, { "scanner_name": "trivy", "scanner_version": "0.71.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 0.48275783300050534, "status": "not_applicable", "examined": { "unit": "manifests", "count": 0 }, "metadata": { "source": "github-releases", "source_url": "https://github.com/aquasecurity/trivy/releases/tag/v0.71.0", "report_type": "filesystem-vulnerability", "install_command": "curl -sfL -o /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.71.0/trivy_0.71.0_Linux-64bit.deb && echo ' /tmp/trivy.deb' | sha256sum -c - && dpkg -i /tmp/trivy.deb", "manifests_scanned": [] }, "display_score": null, "display_badge": "not_applicable" }, { "scanner_name": "osv-scanner", "scanner_version": "2.3.8", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 0.3975341040058993, "status": "not_applicable", "examined": { "unit": "manifests", "count": 0 }, "metadata": { "source": "github-releases", "source_url": "https://github.com/google/osv-scanner/releases/tag/v2.3.8", "report_type": "osv-vulnerability", "ecosystems_seen": [], "install_command": "curl -sfL -o /usr/local/bin/osv-scanner https://github.com/google/osv-scanner/releases/download/v2.3.8/osv-scanner_linux_amd64 && echo ' /usr/local/bin/osv-scanner' | sha256sum -c - && chmod +x /usr/local/bin/osv-scanner", "manifests_scanned": [], "finding_id_aliases": {}, "cross_scanner_correlation": { "only_osv": [], "only_trivy": [], "intersection_ids": [] } }, "display_score": null, "display_badge": "not_applicable" } ] ```