Provenance
- Archive digest
- sha256:d08d5e0f3bb6f8974587174a80a8bde8e5498eeda478f98beeed3c304d27dbef
- Report digest
- sha256:4d524bca55104d283b3c6f91146e38ab8e3b5a041b93d80e49b4bb93a88d903a
- Attestation
- signed (DSSE)
- Signing key
- -_Ea_eEb6AVt8DSP
agentry verify blaktron/vuln-reachability-audit@0.8.0
Check the key id against the registry's published set at /.well-known/agentry/signing-keys.json. A signature proves who built this release, not that its contents are safe.
Manifest
The manifest as the registry validated and stored it, in canonical JSON.
{
"name": "vuln-reachability-audit",
"tags": [
"vulnerabilities",
"cve",
"osv",
"reachability",
"dependency-audit",
"html-report",
"github"
],
"guide": {
"task": "e.g. Audit all workspaces, including build tooling, and identify which known dependency vulnerabilities are reachable.",
"files": "Optional CycloneDX or SPDX JSON SBOMs and supplemental source/configuration; supplied project files can replace repository intake for code the runner cannot fetch.",
"prepare": [
"Provide the repository HTTPS address; include a branch, tag or full commit to select a specific snapshot.",
"For private repositories, provide access through the repository source setup; the audit does not receive that credential.",
"Include manifests, lockfiles and build configuration for every workspace you want audited.",
"Optionally supply a current CycloneDX or SPDX JSON SBOM with provenance and deployment/environment assumptions.",
"Large repositories may exceed download or audit limits; completed findings and unfinished scope are reported explicitly."
],
"overview": "The runner downloads the repository snapshot you select before the audit starts. The agent inventories dependency versions, queries current OSV advisories and traces affected behavior through source and build configuration, returning reports/vuln-reachability.html with findings, remediation and explicit coverage gaps. This is static dependency and reachability analysis, not an executable scanner or a full source-code vulnerability scan; incomplete coverage is prominently labelled."
},
"modes": [
"autonomous"
],
"inputs": {
"view": "original",
"kinds": [
"code",
"data"
]
},
"intake": [
{
"id": "repository_url",
"type": "repository",
"prompt": "Repository HTTPS address, optionally with a branch, tag or full commit; leave blank to audit supplied project files."
}
],
"license": "MIT",
"publish": {
"include": [
"agent.yaml",
"AGENT.md",
"README.md",
"LICENSE"
]
},
"runtime": {
"interfaces": [
"claude-skill",
"agents-md"
]
},
"summary": "Audits repository dependencies against OSV and reports vulnerability reachability, fixes and coverage in HTML.",
"version": "0.8.0",
"namespace": "blaktron",
"entrypoints": {
"instruction": "AGENT.md"
},
"capabilities": {
"exec": "none",
"network": {
"egress": [
"api.osv.dev"
]
},
"dataAccess": [
"code"
],
"filesystem": {
"read": "none",
"write": "none"
}
},
"schemaVersion": "2"
}