# Security Audit Report — @squadai/tools - **Report ID:** `22ee58ca-e238-4059-8813-bc414e3562f2` - **Generated:** 2026-07-22T05:33:26.041683+00:00 - **Signature:** unsigned (cosign keyless signing runs in CI; Req 22.4) ## 1. Executive Summary **Badge:** Verified (composite) **Security score:** 89.94 | Scanner | Badge | | --- | --- | | agent-audit-kit | Verified | | agentshield | Verified | | bearer | Verified | | cisco-skill-scanner | Unsafe | | osv-scanner | Verified | | trivy | Verified | | Severity | Findings | | --- | --- | | critical | 0 | | high | 1 | | medium | 7 | | low | 12 | @squadai/tools may be integrated with compensating controls: review the 1 high-severity findings below, restrict granted permissions to the minimum the manifest declares, and subscribe to monitoring alerts for score changes. ## 2. Source Provenance - **Repository:** https://github.com/the-basilisk-ai/squad-mcp - **Commit scanned:** `unknown` - **License:** MIT - **Maintainer:** unknown - **Version:** 4.0.0 ## 3. Per-Scanner Detail ### agentshield (v1.4.0) — Verified / 100.0 No findings. ### cisco-skill-scanner (v2.0.11) — Unsafe / 44.5 - **[high] Critically low analyzability score** — Only 38% of skill content could be analyzed. 58 of 98 files are opaque to the scanner. The safety assessment has low confidence. (/repo:None) - **[low] Hidden data file detected** — Hidden file found: .squad/plans/squad-mcp-v2/decisions/adr-001-curated-tools-over-raw-graphql.md. Hidden files may contain concealed configuration or data that should be reviewed. (/repo/.squad/plans/squad-mcp-v2/decisions/adr-001-curated-tools-over-raw-graphql.md:None) - **[low] Hidden data file detected** — Hidden file found: .squad/plans/squad-mcp-v2/decisions/adr-002-evolve-repo-graphql-codegen.md. Hidden files may contain concealed configuration or data that should be reviewed. (/repo/.squad/plans/squad-mcp-v2/decisions/adr-002-evolve-repo-graphql-codegen.md:None) - **[low] Hidden data file detected** — Hidden file found: .squad/plans/squad-mcp-v2/decisions/adr-003-oauth-plus-minted-service-jwt.md. Hidden files may contain concealed configuration or data that should be reviewed. (/repo/.squad/plans/squad-mcp-v2/decisions/adr-003-oauth-plus-minted-service-jwt.md:None) - **[low] Hidden data file detected** — Hidden file found: .squad/plans/squad-mcp-v2/decisions/adr-004-implicit-tenant-context.md. Hidden files may contain concealed configuration or data that should be reviewed. (/repo/.squad/plans/squad-mcp-v2/decisions/adr-004-implicit-tenant-context.md:None) - **[low] Hidden data file detected** — Hidden file found: .squad/plans/squad-mcp-v2/decisions/adr-005-polymorphic-get-entity.md. Hidden files may contain concealed configuration or data that should be reviewed. (/repo/.squad/plans/squad-mcp-v2/decisions/adr-005-polymorphic-get-entity.md:None) - **[low] Hidden data file detected** — Hidden file found: .squad/plans/squad-mcp-v2/decisions/adr-006-response-discipline.md. Hidden files may contain concealed configuration or data that should be reviewed. (/repo/.squad/plans/squad-mcp-v2/decisions/adr-006-response-discipline.md:None) - **[low] Hidden data file detected** — Hidden file found: .squad/plans/squad-mcp-v2/decisions/adr-007-domain-cutover-v1-branch.md. Hidden files may contain concealed configuration or data that should be reviewed. (/repo/.squad/plans/squad-mcp-v2/decisions/adr-007-domain-cutover-v1-branch.md:None) - **[low] Hidden data file detected** — Hidden file found: .squad/plans/squad-mcp-v2/prd.md. Hidden files may contain concealed configuration or data that should be reviewed. (/repo/.squad/plans/squad-mcp-v2/prd.md:None) - **[low] Hidden data file detected** — Hidden file found: .squad/plans/squad-mcp-v2/technical-overview.md. Hidden files may contain concealed configuration or data that should be reviewed. (/repo/.squad/plans/squad-mcp-v2/technical-overview.md:None) - **[low] Vague skill description** — Skill description is too short (16 chars). Provide detailed explanation. (/repo/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/SKILL.md:None) - **[medium] Outbound network request primitives in JavaScript/TypeScript** — Pattern detected: fetch( (/repo/src/helpers/oauth.ts:32) - **[medium] Outbound network request primitives in JavaScript/TypeScript** — Pattern detected: fetch( (/repo/src/lib/ingest-client.ts:29) - **[medium] Outbound network request primitives in JavaScript/TypeScript** — Pattern detected: fetch( (/repo/src/lib/squad-api-client.ts:50) - **[low] Vague skill description** — Skill description is too short (16 chars). Provide detailed explanation. (/repo/.squad/plans/squad-mcp-v2/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/.squad/plans/squad-mcp-v2/SKILL.md:None) - **[low] Vague skill description** — Skill description is too short (16 chars). Provide detailed explanation. (/repo/.squad/plans/squad-mcp-v2/decisions/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/.squad/plans/squad-mcp-v2/decisions/SKILL.md:None) ### agent-audit-kit (v0.3.26) — Verified / 85.0 - **[medium] Dependency uses install scripts** — package.json has install scripts (preinstall, postinstall, etc.) that execute arbitrary commands during npm install. (package.json:16) - **[medium] Repo depends on a third-party agent-platform SDK** — The project depends on an agent-platform SDK (context-ai, langsmith, helicone, langfuse, humanloop, MCP SDK). Informational finding so reviewers audit the vendor's OAuth-scope footprint before merging. Raised to MEDIUM because the April 19 2026 Vercel × Context.ai incident showed a single vendor compromise can turn into a production breach via transitive OAuth grants. (package.json:25) - **[medium] Third-party GitHub Action not pinned by full commit SHA** — A workflow in '.github/workflows/' uses a third-party Action ('owner/action@ref') where 'ref' is a tag or branch name instead of a 40-character commit SHA. A repo-takeover of the Action's publisher can re-point the tag to a malicious revision — the downstream repo consuming it will happily run the new code with 'GITHUB_TOKEN' and write permissions. GitHub's April 2026 Security Roadmap ships Immutable Actions and makes SHA pinning the default policy. (.github/workflows/claude-pr-assistant.yaml:33) ### bearer (v2.0.2) — Verified / 100.0 No findings. ### trivy (v0.71.0) — Verified / 100.0 No findings. ### osv-scanner (v2.3.8) — Verified / 95.0 - **[medium] GHSA-jxxr-4gwj-5jf2 — npm brace-expansion@5.0.5** — aliases: CVE-2026-45149, GHSA-jxxr-4gwj-5jf2 \| CVSS: 6.5 (/repo/yarn.lock:None) ## 4. Threat Model Threat model synthesis has not yet run for this scan. This section is generated by the registry's LLM pipeline (Req 22.3) and will appear in the next regeneration of this report. ## 5. Audit Chain - **Scan job:** `8de58473-f889-4a1d-8797-30b7e529b745` - **Completed:** 2026-07-20T18:48:25.383418+00:00 - **Scanner base image:** `us-central1-docker.pkg.dev/nerlo-vsk-prod/nerlo/scanner-base@sha256:65817f4fb3e818a3e792f04b1ce1ebe213e663adb4d71ceae96771bcd197c695` - **AI decision log entries:** 1 - `bd2fc73b-7fb0-4db2-947f-b41febbac860` ## 6. Appendix — Raw Scanner Output ```json [ { "scanner_name": "agentshield", "scanner_version": "1.4.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 5.84263244298927, "status": "complete", "metadata": { "source": "npm", "source_url": "https://www.npmjs.com/package/ecc-agentshield", "install_command": "npm install -g ecc-agentshield@1.4.0", "scans_performed": [ "supply_chain" ] }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "cisco-skill-scanner", "scanner_version": "2.0.11", "score": 44.5, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "cisco-skill-scanner", "severity": "high", "category": "policy_violation", "file_path": "/repo", "line_number": null, "rule_identifier": "LOW_ANALYZABILITY", "title": "Critically low analyzability score", "description": "Only 38% of skill content could be analyzed. 58 of 98 files are opaque to the scanner. The safety assessment has low confidence.", "remediation": "Replace opaque files (binaries, encrypted content) with inspectable source code to improve scan confidence." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "obfuscation", "file_path": "/repo/.squad/plans/squad-mcp-v2/decisions/adr-001-curated-tools-over-raw-graphql.md", "line_number": null, "rule_identifier": "HIDDEN_DATA_FILE", "title": "Hidden data file detected", "description": "Hidden file found: .squad/plans/squad-mcp-v2/decisions/adr-001-curated-tools-over-raw-graphql.md. Hidden files may contain concealed configuration or data that should be reviewed.", "remediation": "Move file to a visible location or document its purpose." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "obfuscation", "file_path": "/repo/.squad/plans/squad-mcp-v2/decisions/adr-002-evolve-repo-graphql-codegen.md", "line_number": null, "rule_identifier": "HIDDEN_DATA_FILE", "title": "Hidden data file detected", "description": "Hidden file found: .squad/plans/squad-mcp-v2/decisions/adr-002-evolve-repo-graphql-codegen.md. Hidden files may contain concealed configuration or data that should be reviewed.", "remediation": "Move file to a visible location or document its purpose." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "obfuscation", "file_path": "/repo/.squad/plans/squad-mcp-v2/decisions/adr-003-oauth-plus-minted-service-jwt.md", "line_number": null, "rule_identifier": "HIDDEN_DATA_FILE", "title": "Hidden data file detected", "description": "Hidden file found: .squad/plans/squad-mcp-v2/decisions/adr-003-oauth-plus-minted-service-jwt.md. Hidden files may contain concealed configuration or data that should be reviewed.", "remediation": "Move file to a visible location or document its purpose." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "obfuscation", "file_path": "/repo/.squad/plans/squad-mcp-v2/decisions/adr-004-implicit-tenant-context.md", "line_number": null, "rule_identifier": "HIDDEN_DATA_FILE", "title": "Hidden data file detected", "description": "Hidden file found: .squad/plans/squad-mcp-v2/decisions/adr-004-implicit-tenant-context.md. Hidden files may contain concealed configuration or data that should be reviewed.", "remediation": "Move file to a visible location or document its purpose." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "obfuscation", "file_path": "/repo/.squad/plans/squad-mcp-v2/decisions/adr-005-polymorphic-get-entity.md", "line_number": null, "rule_identifier": "HIDDEN_DATA_FILE", "title": "Hidden data file detected", "description": "Hidden file found: .squad/plans/squad-mcp-v2/decisions/adr-005-polymorphic-get-entity.md. Hidden files may contain concealed configuration or data that should be reviewed.", "remediation": "Move file to a visible location or document its purpose." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "obfuscation", "file_path": "/repo/.squad/plans/squad-mcp-v2/decisions/adr-006-response-discipline.md", "line_number": null, "rule_identifier": "HIDDEN_DATA_FILE", "title": "Hidden data file detected", "description": "Hidden file found: .squad/plans/squad-mcp-v2/decisions/adr-006-response-discipline.md. Hidden files may contain concealed configuration or data that should be reviewed.", "remediation": "Move file to a visible location or document its purpose." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "obfuscation", "file_path": "/repo/.squad/plans/squad-mcp-v2/decisions/adr-007-domain-cutover-v1-branch.md", "line_number": null, "rule_identifier": "HIDDEN_DATA_FILE", "title": "Hidden data file detected", "description": "Hidden file found: .squad/plans/squad-mcp-v2/decisions/adr-007-domain-cutover-v1-branch.md. Hidden files may contain concealed configuration or data that should be reviewed.", "remediation": "Move file to a visible location or document its purpose." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "obfuscation", "file_path": "/repo/.squad/plans/squad-mcp-v2/prd.md", "line_number": null, "rule_identifier": "HIDDEN_DATA_FILE", "title": "Hidden data file detected", "description": "Hidden file found: .squad/plans/squad-mcp-v2/prd.md. Hidden files may contain concealed configuration or data that should be reviewed.", "remediation": "Move file to a visible location or document its purpose." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "obfuscation", "file_path": "/repo/.squad/plans/squad-mcp-v2/technical-overview.md", "line_number": null, "rule_identifier": "HIDDEN_DATA_FILE", "title": "Hidden data file detected", "description": "Hidden file found: .squad/plans/squad-mcp-v2/technical-overview.md. Hidden files may contain concealed configuration or data that should be reviewed.", "remediation": "Move file to a visible location or document its purpose." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "data_exfiltration", "file_path": "/repo/src/helpers/oauth.ts", "line_number": 32, "rule_identifier": "DATA_EXFIL_JS_NETWORK", "title": "Outbound network request primitives in JavaScript/TypeScript", "description": "Pattern detected: fetch(", "remediation": "Ensure network operations are necessary and document allowed destinations" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "data_exfiltration", "file_path": "/repo/src/lib/ingest-client.ts", "line_number": 29, "rule_identifier": "DATA_EXFIL_JS_NETWORK", "title": "Outbound network request primitives in JavaScript/TypeScript", "description": "Pattern detected: fetch(", "remediation": "Ensure network operations are necessary and document allowed destinations" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "data_exfiltration", "file_path": "/repo/src/lib/squad-api-client.ts", "line_number": 50, "rule_identifier": "DATA_EXFIL_JS_NETWORK", "title": "Outbound network request primitives in JavaScript/TypeScript", "description": "Pattern detected: fetch(", "remediation": "Ensure network operations are necessary and document allowed destinations" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/.squad/plans/squad-mcp-v2/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/.squad/plans/squad-mcp-v2/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/.squad/plans/squad-mcp-v2/decisions/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/.squad/plans/squad-mcp-v2/decisions/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" } ], "execution_duration_seconds": 30.800226455001393, "status": "complete", "metadata": { "source": "pypi", "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/", "report_type": "cisco-skill-sast", "analyzers_used": [ "bytecode", "pipeline", "static_analyzer" ], "skills_scanned": [ "repo", "squad-mcp-v2", "decisions" ], "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt", "severity_counts": { "low": 12, "high": 1, "medium": 3, "critical": 0, "informational": 3 } }, "display_score": 44.5, "display_badge": "Unsafe" }, { "scanner_name": "agent-audit-kit", "scanner_version": "0.3.26", "score": 85.0, "scanner_badge": "Verified", "findings": [ { "tool_name": "agent-audit-kit", "severity": "medium", "category": "supply-chain", "file_path": "package.json", "line_number": 16, "rule_identifier": "AAK-SUPPLY-003", "title": "Dependency uses install scripts", "description": "package.json has install scripts (preinstall, postinstall, etc.) that execute arbitrary commands during npm install.", "remediation": "Audit install scripts. Use --ignore-scripts flag and run scripts manually after review." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "supply-chain", "file_path": "package.json", "line_number": 25, "rule_identifier": "AAK-OAUTH-3P-001", "title": "Repo depends on a third-party agent-platform SDK", "description": "The project depends on an agent-platform SDK (context-ai, langsmith, helicone, langfuse, humanloop, MCP SDK). Informational finding so reviewers audit the vendor's OAuth-scope footprint before merging. Raised to MEDIUM because the April 19 2026 Vercel \u00d7 Context.ai incident showed a single vendor compromise can turn into a production breach via transitive OAuth grants.", "remediation": "Pin the SDK to an exact version, audit the OAuth scopes it requests, and keep any deployment-level grants (Vercel, GCP, Workspace) in a secrets vault \u2014 never in a committed env file. See Vercel's bulletin for sensitive-env-var guidance: https://vercel.com/kb/bulletin/vercel-april-2026-security-incident" }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "supply-chain", "file_path": ".github/workflows/claude-pr-assistant.yaml", "line_number": 33, "rule_identifier": "AAK-GHA-IMMUTABLE-001", "title": "Third-party GitHub Action not pinned by full commit SHA", "description": "A workflow in `.github/workflows/` uses a third-party Action (`owner/action@ref`) where `ref` is a tag or branch name instead of a 40-character commit SHA. A repo-takeover of the Action's publisher can re-point the tag to a malicious revision \u2014 the downstream repo consuming it will happily run the new code with `GITHUB_TOKEN` and write permissions. GitHub's April 2026 Security Roadmap ships Immutable Actions and makes SHA pinning the default policy.", "remediation": "Repin third-party Actions to a 40-character commit SHA and add a `# v1.2.3`-style trailing comment for humans. First-party Actions under `actions/` and `github/` are exempt (they now ship Immutable Actions). Dependabot will auto-bump SHA pins when `update-type: all` is set." } ], "execution_duration_seconds": 14.081469839002239, "status": "complete", "metadata": { "source": "pypi", "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/", "report_type": "agent-audit-kit-sast", "files_scanned": 82, "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt", "rules_evaluated": 211, "severity_counts": { "low": 0, "high": 0, "medium": 3, "critical": 0, "informational": 0 } }, "display_score": 85.0, "display_badge": "Verified" }, { "scanner_name": "bearer", "scanner_version": "2.0.2", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 10.917832899998757, "status": "complete", "metadata": { "source": "github-releases", "source_url": "https://github.com/Bearer/bearer", "report_type": "security", "rules_loaded": 1, "install_command": "curl -sfL https://raw.githubusercontent.com/Bearer/bearer/main/contrib/install.sh | sh -s -- -b /usr/local/bin \"v2.0.2\"" }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "trivy", "scanner_version": "0.71.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 0.8132090169965522, "status": "complete", "metadata": { "source": "github-releases", "source_url": "https://github.com/aquasecurity/trivy/releases/tag/v0.71.0", "report_type": "filesystem-vulnerability", "install_command": "curl -sfL -o /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.71.0/trivy_0.71.0_Linux-64bit.deb && echo ' /tmp/trivy.deb' | sha256sum -c - && dpkg -i /tmp/trivy.deb", "manifests_scanned": [ "yarn.lock" ] }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "osv-scanner", "scanner_version": "2.3.8", "score": 95.0, "scanner_badge": "Verified", "findings": [ { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/yarn.lock", "line_number": null, "rule_identifier": "GHSA-jxxr-4gwj-5jf2", "title": "GHSA-jxxr-4gwj-5jf2 \u2014 npm brace-expansion@5.0.5", "description": "aliases: CVE-2026-45149, GHSA-jxxr-4gwj-5jf2 | CVSS: 6.5", "remediation": null } ], "execution_duration_seconds": 27.090173076998326, "status": "complete", "metadata": { "source": "github-releases", "source_url": "https://github.com/google/osv-scanner/releases/tag/v2.3.8", "report_type": "osv-vulnerability", "ecosystems_seen": [ "npm" ], "install_command": "curl -sfL -o /usr/local/bin/osv-scanner https://github.com/google/osv-scanner/releases/download/v2.3.8/osv-scanner_linux_amd64 && echo ' /usr/local/bin/osv-scanner' | sha256sum -c - && chmod +x /usr/local/bin/osv-scanner", "severity_counts": { "low": 0, "high": 0, "medium": 1, "critical": 0, "informational": 0 }, "manifests_scanned": [ "/repo/yarn.lock" ], "finding_id_aliases": { "GHSA-jxxr-4gwj-5jf2": [ "CVE-2026-45149" ] }, "cross_scanner_correlation": { "only_osv": [ "GHSA-jxxr-4gwj-5jf2" ], "only_trivy": [], "intersection_ids": [] } }, "display_score": 95.0, "display_badge": "Verified" } ] ```