v0.7.0

publishedstablecli-upload

What the registry recorded: This version's findings are within the auto-publish threshold, so the gate published it.

Security report

7 findings

mediumhigh confidenceS9/capability-widened
Capability newly declared this release: env

mediumhigh confidenceS9/new-egress-content

New egress destination in package content: github.com

AGENT.md:10

- `repository_url` in the intake answers selects a GitHub repository. Accept `https://github.com/owner/repo`, an optional `.git` suffix, `/tree/ref`, or `git@gi

mediumhigh confidenceS9/new-egress-content

New egress destination in package content: git@github.com

AGENT.md:10

- `repository_url` in the intake answers selects a GitHub repository. Accept `https://github.com/owner/repo`, an optional `.git` suffix, `/tree/ref`, or `git@gi

lowhigh confidenceS9/new-egress
New network egress host in this release: raw.githubusercontent.com
lowhigh confidenceS9/new-egress
New network egress host in this release: api.github.com

lowhigh confidenceS9/new-egress-content

New egress destination in package content: api.github.com

AGENT.md:19

1. **Establish scope and a stable file inventory.** For supplied files, use `list_inputs` through every listing page. For GitHub, use GET requests on `https://a

lowhigh confidenceS9/new-egress-content

New egress destination in package content: raw.githubusercontent.com

AGENT.md:22

   - Fetch text files at `https://raw.githubusercontent.com/{owner}/{repo}/{commit-sha}/{encoded-path}`. Encode path segments individually. For a private file t

Findings are shown in full, including any a reviewer dismissed and why. Scanning reduces risk; it does not prove this version safe.

Capabilities

network: 2 hostssecrets: 1data: codemcp servers: 1

Declared capabilities are a contract from the author: what this release says it needs, and what scanning and policy check against. The registry cannot enforce them while your QuickAgent runs.

Provenance

Archive digest: sha256:eb27c7c93656b150a3561f492386f4bf01e6cd0130ce342520e2026fa144ea6d
Report digest: sha256:b530ab260c295db1b7a81979e389c51417e4a7eb4295220b6169a712e8781b1f
Attestation: signed (DSSE)
Signing key: -_Ea_eEb6AVt8DSP

agentry verify blaktron/vuln-reachability-audit@0.7.0

Check the key id against the registry's published set at /.well-known/agentry/signing-keys.json. A signature proves who built this release, not that its contents are safe.

Manifest

The manifest as the registry validated and stored it, in canonical JSON.

{
  "name": "vuln-reachability-audit",
  "tags": [
    "vulnerabilities",
    "cve",
    "osv",
    "reachability",
    "dependency-audit",
    "html-report",
    "github"
  ],
  "guide": {
    "task": "e.g. Audit this repository's dependencies, including build tooling, and identify which known vulnerabilities are reachable.",
    "files": "Add repository source, configuration, manifests and lockfiles, loose or in an archive. Optional CycloneDX or SPDX JSON SBOMs can supplement dependency evidence; source is needed for reachability.",
    "connect": {
      "GITHUB_TOKEN": "Optional for public repositories; needed for private repositories and authenticated API limits. Create a fine-grained GitHub personal access token restricted to the selected repository with Contents read-only permission. The agent reads files and does not modify the repository."
    },
    "prepare": [
      "The GitHub repository URL; optionally name a branch, tag or commit in the task.",
      "For uploaded scans, supply a repository archive containing manifests, lockfiles and source.",
      "For monorepos, include every workspace's dependency files and build configuration.",
      "Optionally include a current CycloneDX or SPDX JSON SBOM with provenance.",
      "Large repositories may exceed run limits; the report preserves findings and lists incomplete coverage."
    ],
    "overview": "Reads the GitHub repository you name or the repository files you supply, queries current OSV advisories for exact dependency versions, and traces affected behavior through source code. Returns reports/vuln-reachability.html with severity, reachability evidence, fix suggestions and explicit dependency/query/source coverage. This is a static dependency audit, not an executable scanner or a full source-code vulnerability scan; incomplete coverage is prominently labelled."
  },
  "modes": [
    "autonomous"
  ],
  "inputs": {
    "view": "original",
    "kinds": [
      "code",
      "data"
    ]
  },
  "intake": [
    {
      "id": "repository_url",
      "prompt": "GitHub repository URL to audit (leave blank to scan the files you add)"
    }
  ],
  "license": "MIT",
  "publish": {
    "include": [
      "agent.yaml",
      "AGENT.md",
      "README.md",
      "LICENSE"
    ]
  },
  "runtime": {
    "interfaces": [
      "claude-skill",
      "agents-md"
    ]
  },
  "summary": "Audits GitHub or uploaded repository dependencies against OSV and reports vulnerability reachability, fixes and coverage in HTML.",
  "version": "0.7.0",
  "namespace": "blaktron",
  "entrypoints": {
    "instruction": "AGENT.md"
  },
  "capabilities": {
    "exec": "none",
    "network": {
      "egress": [
        "api.github.com",
        "raw.githubusercontent.com"
      ]
    },
    "secrets": [
      "GITHUB_TOKEN"
    ],
    "dataAccess": [
      "code"
    ],
    "filesystem": {
      "read": "none",
      "write": "none"
    },
    "mcpServers": [
      {
        "npm": "@cyanheads/osv-advisory-mcp-server",
        "tools": [
          "osv_query_batch",
          "osv_query_package",
          "osv_get_vulnerability",
          "osv_list_ecosystems"
        ],
        "egress": [
          "api.osv.dev"
        ],
        "version": "0.1.16"
      }
    ],
    "optionalSecrets": [
      "GITHUB_TOKEN"
    ]
  },
  "schemaVersion": "2"
}