[ { "scanner_name": "agentshield", "scanner_version": "1.4.0", "score": 95, "scanner_badge": "Verified", "findings": [ { "tool_name": "agentshield", "severity": "medium", "category": "permissions", "file_path": "settings.json", "line_number": null, "rule_identifier": "permissions-missing-deny-rm--rf", "title": "Missing deny rule: Recursive force delete", "description": "The deny list does not block \"rm -rf\". Consider adding it to prevent recursive force delete.", "remediation": null }, { "tool_name": "agentshield", "severity": "medium", "category": "permissions", "file_path": "settings.json", "line_number": null, "rule_identifier": "permissions-missing-deny-sudo", "title": "Missing deny rule: Privilege escalation", "description": "The deny list does not block \"sudo\". Consider adding it to prevent privilege escalation.", "remediation": null }, { "tool_name": "agentshield", "severity": "medium", "category": "permissions", "file_path": "settings.json", "line_number": null, "rule_identifier": "permissions-missing-deny-chmod-777", "title": "Missing deny rule: World-writable permissions", "description": "The deny list does not block \"chmod 777\". Consider adding it to prevent world-writable permissions.", "remediation": null }, { "tool_name": "agentshield", "severity": "medium", "category": "permissions", "file_path": "settings.json", "line_number": null, "rule_identifier": "permissions-missing-deny-ssh", "title": "Missing deny rule: SSH connections from agent", "description": "The deny list does not block \"ssh\". Consider adding it to prevent ssh connections from agent.", "remediation": null }, { "tool_name": "agentshield", "severity": "medium", "category": "permissions", "file_path": "settings.json", "line_number": null, "rule_identifier": "permissions-missing-deny->-/dev/", "title": "Missing deny rule: Writing to device files", "description": "The deny list does not block \"> /dev/\". Consider adding it to prevent writing to device files.", "remediation": null }, { "tool_name": "agentshield", "severity": "low", "category": "misconfiguration", "file_path": "settings.json", "line_number": null, "rule_identifier": "hooks-no-stop-hooks", "title": "No Stop hooks for session-end verification", "description": "Hooks are configured but no Stop hooks exist. Stop hooks run when a session ends and are useful for final verification — checking for uncommitted secrets, ensuring console.log statements were removed, or auditing file changes.", "remediation": "Add a Stop hook for session-end checks" } ], "execution_duration_seconds": 4.719628683000337, "status": "complete", "examined": null, "metadata": { "source": "npm", "source_url": "https://www.npmjs.com/package/ecc-agentshield", "install_command": "npm install -g ecc-agentshield@1.4.0", "scans_performed": [ "claude_config" ], "score_breakdown": { "mcp": 100, "hooks": 100, "agents": 100, "secrets": 100, "permissions": 73 } }, "display_score": 95, "display_badge": "Verified" }, { "scanner_name": "cisco-skill-scanner", "scanner_version": "2.0.11", "score": 0, "scanner_badge": "Unsafe", "findings": [], "execution_duration_seconds": 300, "status": "timeout", "examined": null, "metadata": { "failure_reason": "engine timeout after 300s", "timeout_seconds": 300 }, "display_score": null, "display_badge": "unavailable" }, { "scanner_name": "agent-audit-kit", "scanner_version": "0.3.26", "score": 0, "scanner_badge": "Unsafe", "findings": [], "execution_duration_seconds": 300, "status": "timeout", "examined": null, "metadata": { "failure_reason": "engine timeout after 300s", "timeout_seconds": 300 }, "display_score": null, "display_badge": "unavailable" }, { "scanner_name": "nerlo-behavioral", "scanner_version": "0.1.0", "score": 0, "scanner_badge": "Unsafe", "findings": [], "execution_duration_seconds": 300, "status": "timeout", "examined": null, "metadata": { "failure_reason": "engine timeout after 300s", "timeout_seconds": 300 }, "display_score": null, "display_badge": "unavailable" }, { "scanner_name": "nerlo-install-instruction", "scanner_version": "0.1.0", "score": 0, "scanner_badge": "Unsafe", "findings": [], "execution_duration_seconds": 300, "status": "timeout", "examined": null, "metadata": { "failure_reason": "engine timeout after 300s", "timeout_seconds": 300 }, "display_score": null, "display_badge": "unavailable" }, { "scanner_name": "nerlo-multi-source", "scanner_version": "0.1.0", "score": 100, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 10.980667829979211, "status": "not_applicable", "examined": null, "metadata": { "source": "nerlo-original", "per_source": [], "report_type": "nerlo-multi-source", "diverged_sources": [], "published_surfaces_scanned": 0 }, "display_score": null, "display_badge": "unavailable" }, { "scanner_name": "trivy", "scanner_version": "0.71.0", "score": 0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "mcp/ngfw/package-lock.json", "line_number": null, "rule_identifier": "GHSA-frvp-7c67-39w9", "title": "Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)", "description": "The same as the `hono` core [Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)](https://github.com/honojs/hono/security/advisories/GHSA-wwfh-h76j-fc44).\n\n### Summary\n\nOn Windows hosts, an encoded backslash (`%5C`) in the request path decodes to `\\`, which the Windows path resolver treats as a separator. `serve-static` then resolves a single URL segment such as `admin\\secret.txt` into a nested file under the root and serves it, letting an attacker read static files meant t", "remediation": "Upgrade @hono/node-server from 1.19.14 to 2.0.5 or later" }, { "tool_name": "trivy", "severity": "low", "category": "npm", "file_path": "mcp/ngfw/package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-12590", "title": "body-parser: body-parser: Denial of Service via invalid limit option", "description": "Impact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that rely on limit as their primary safeguard against oversized request bodies will accept arbitrarily large payloads, leading to excessive memory and CPU usage and denial of service. Patches: This issue is fixed in body-pars", "remediation": "Upgrade body-parser from 2.2.2 to 1.20.6, 2.3.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "mcp/ngfw/package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-13676", "title": "fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization", "description": "fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize() and equal() still return values that differ from a WHATWG-compatible URL parser. Applications that use fast-uri to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) befo", "remediation": "Upgrade fast-uri from 3.1.2 to 4.0.1, 3.1.3, 2.4.2 or later" }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "mcp/ngfw/package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-16221", "title": "Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x ...", "description": "Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the backslash to a forward slash for special schemes such as http, https, ws, wss, ftp, and file. As a result, the two parsers extract different hosts from the same input string. Applications that use f", "remediation": "Upgrade fast-uri from 3.1.2 to 2.4.3, 3.1.4, 4.1.1 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "mcp/ops/package-lock.json", "line_number": null, "rule_identifier": "GHSA-frvp-7c67-39w9", "title": "Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)", "description": "The same as the `hono` core [Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)](https://github.com/honojs/hono/security/advisories/GHSA-wwfh-h76j-fc44).\n\n### Summary\n\nOn Windows hosts, an encoded backslash (`%5C`) in the request path decodes to `\\`, which the Windows path resolver treats as a separator. `serve-static` then resolves a single URL segment such as `admin\\secret.txt` into a nested file under the root and serves it, letting an attacker read static files meant t", "remediation": "Upgrade @hono/node-server from 1.19.14 to 2.0.5 or later" }, { "tool_name": "trivy", "severity": "low", "category": "npm", "file_path": "mcp/ops/package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-12590", "title": "body-parser: body-parser: Denial of Service via invalid limit option", "description": "Impact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that rely on limit as their primary safeguard against oversized request bodies will accept arbitrarily large payloads, leading to excessive memory and CPU usage and denial of service. Patches: This issue is fixed in body-pars", "remediation": "Upgrade body-parser from 2.2.2 to 1.20.6, 2.3.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "mcp/ops/package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-13676", "title": "fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization", "description": "fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize() and equal() still return values that differ from a WHATWG-compatible URL parser. Applications that use fast-uri to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) befo", "remediation": "Upgrade fast-uri from 3.1.2 to 4.0.1, 3.1.3, 2.4.2 or later" }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "mcp/ops/package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-16221", "title": "Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x ...", "description": "Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the backslash to a forward slash for special schemes such as http, https, ws, wss, ftp, and file. As a result, the two parsers extract different hosts from the same input string. Applications that use f", "remediation": "Upgrade fast-uri from 3.1.2 to 2.4.3, 3.1.4, 4.1.1 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "mcp/planner/package-lock.json", "line_number": null, "rule_identifier": "GHSA-frvp-7c67-39w9", "title": "Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)", "description": "The same as the `hono` core [Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)](https://github.com/honojs/hono/security/advisories/GHSA-wwfh-h76j-fc44).\n\n### Summary\n\nOn Windows hosts, an encoded backslash (`%5C`) in the request path decodes to `\\`, which the Windows path resolver treats as a separator. `serve-static` then resolves a single URL segment such as `admin\\secret.txt` into a nested file under the root and serves it, letting an attacker read static files meant t", "remediation": "Upgrade @hono/node-server from 1.19.14 to 2.0.5 or later" }, { "tool_name": "trivy", "severity": "low", "category": "npm", "file_path": "mcp/planner/package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-12590", "title": "body-parser: body-parser: Denial of Service via invalid limit option", "description": "Impact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that rely on limit as their primary safeguard against oversized request bodies will accept arbitrarily large payloads, leading to excessive memory and CPU usage and denial of service. Patches: This issue is fixed in body-pars", "remediation": "Upgrade body-parser from 2.2.2 to 1.20.6, 2.3.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "mcp/planner/package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-13676", "title": "fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization", "description": "fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize() and equal() still return values that differ from a WHATWG-compatible URL parser. Applications that use fast-uri to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) befo", "remediation": "Upgrade fast-uri from 3.1.2 to 4.0.1, 3.1.3, 2.4.2 or later" }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "mcp/planner/package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-16221", "title": "Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x ...", "description": "Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the backslash to a forward slash for special schemes such as http, https, ws, wss, ftp, and file. As a result, the two parsers extract different hosts from the same input string. Applications that use f", "remediation": "Upgrade fast-uri from 3.1.2 to 2.4.3, 3.1.4, 4.1.1 or later" }, { "tool_name": "trivy", "severity": "low", "category": "npm", "file_path": "platform/terraform/gcp/modules/portal/identity-platform/functions/identity-platform/package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-12590", "title": "body-parser: body-parser: Denial of Service via invalid limit option", "description": "Impact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that rely on limit as their primary safeguard against oversized request bodies will accept arbitrarily large payloads, leading to excessive memory and CPU usage and denial of service. Patches: This issue is fixed in body-pars", "remediation": "Upgrade body-parser from 1.20.5 to 1.20.6, 2.3.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "shifter/shifter_platform/frontend/package-lock.json", "line_number": null, "rule_identifier": "CVE-2025-15599", "title": "DOMPurify: DOMPurify: Cross-site scripting", "description": "DOMPurify 3.1.3 through 3.2.6 and 2.5.3 through 2.5.8 contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting missing textarea rawtext element validation in the SAFE_FOR_XML regex. Attackers can include closing rawtext tags like in attribute values to break out of rawtext contexts and execute JavaScript when sanitized output is placed inside rawtext elements. The 3.x branch was fixed in 3.2.7; the 2.x branch was never patched.", "remediation": "Upgrade dompurify from 3.1.6 to 3.2.7 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "shifter/shifter_platform/frontend/package-lock.json", "line_number": null, "rule_identifier": "CVE-2025-26791", "title": "dompurify: Mutation XSS in DOMPurify Due to Improper Template Literal Handling", "description": "DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS).", "remediation": "Upgrade dompurify from 3.1.6 to 3.2.4 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "shifter/shifter_platform/frontend/package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-0540", "title": "DOMPurify: DOMPurify: Cross-site scripting vulnerability", "description": "DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in commit 2726c74, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, noembed, noframes, iframe) in the SAFE_FOR_XML regex. Attackers can include payloads like

in attribute values to execute JavaScript when sanitized output is placed inside these unprotected rawtext contexts.", "remediation": "Upgrade dompurify from 3.1.6 to 3.3.2, 2.5.9 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "shifter/shifter_platform/frontend/package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-41238", "title": "DOMPurify: DOMPurify: Cross-Site Scripting bypass via prototype pollution", "description": "DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions 3.0.1 through 3.3.3 are vulnerable to a prototype pollution-based XSS bypass. When an application uses `DOMPurify.sanitize()` with the default configuration (no `CUSTOM_ELEMENT_HANDLING` option), a prior prototype pollution gadget can inject permissive `tagNameCheck` and `attributeNameCheck` regex values into `Object.prototype`, causing DOMPurify to allow arbitrary custom elements with arbitrary attributes", "remediation": "Upgrade dompurify from 3.1.6 to 3.4.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "shifter/shifter_platform/frontend/package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-41239", "title": "DOMPurify: Vue 2: DOMPurify: Cross-site scripting due to incomplete sanitization of template expressions", "description": "DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Starting in version 1.0.10 and prior to version 3.4.0, `SAFE_FOR_TEMPLATES` strips `{{...}}` expressions from untrusted HTML. This works in string mode but not with `RETURN_DOM` or `RETURN_DOM_FRAGMENT`, allowing XSS via template-evaluating frameworks like Vue 2. Version 3.4.0 patches the issue.", "remediation": "Upgrade dompurify from 3.1.6 to 3.4.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "shifter/shifter_platform/frontend/package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-41240", "title": "DOMPurify: DOMPurify: Cross-Site Scripting (XSS) via inconsistent tag sanitization", "description": "DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions prior to 3.4.0 have an inconsistency between FORBID_TAGS and FORBID_ATTR handling when function-based ADD_TAGS is used. Commit c361baa added an early exit for FORBID_ATTR at line 1214. The same fix was not applied to FORBID_TAGS. At line 1118-1123, when EXTRA_ELEMENT_HANDLING.tagCheck returns true, the short-circuit evaluation skips the FORBID_TAGS check entirely. This allows forbidden elements to survive ", "remediation": "Upgrade dompurify from 3.1.6 to 3.4.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "shifter/shifter_platform/frontend/package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-49458", "title": "dompurify: DOMPurify: Cross-site scripting due to improper sanitization of DOM nodes", "description": "DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(node, { IN_PLACE: true }) accepted same-origin foreign-realm DOM nodes while follow-on checks used parent-realm constructors, causing instanceof checks for forms, named node maps, document fragments, and elements to fail and skip clobber, template-content, and shadow-DOM sanitization branches so executable markup could survive. This issue is fixed in version 3.4.6.", "remediation": "Upgrade dompurify from 3.1.6 to 3.4.6 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "shifter/shifter_platform/frontend/package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-49459", "title": "dompurify: DOMPurify: Cross-site scripting bypass allows arbitrary script execution", "description": "DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(root, { IN_PLACE: true }) could preserve event-handler attributes on an attacker-controlled

root when a descendant name clobbered properties checked by _isClobbered, because _forceRemove no-opped on the parent-less root and _sanitizeAttributes returned early. This issue is fixed in version 3.4.6.", "remediation": "Upgrade dompurify from 3.1.6 to 3.4.6 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "shifter/shifter_platform/frontend/package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-49978", "title": "dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution", "description": "DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.7, DOMPurify IN_PLACE sanitization could skip shadow contents attached to an element inside

Executive Summary

Source Provenance

Per-Scanner Detail

Threat Model

Audit Chain

Raw Scanner Outputs