The scanner suite
Nerlo runs a suite of independent scanners over every artifact and publishes each verdict separately. They are shown here at one flat rank: no scanner is privileged, none can veto another, and there is no visual hierarchy between them. The composite trust score is a subordinate summary layered on top for readers who want one number — it never hides, overrides, or reranks a per-scanner verdict.
Each scanner below is one of two kinds: off-the-shelf tools we pin and run as-is, or Nerlo-original detectors we built ourselves. The kind is a provenance label, not a rank — an off-the-shelf CVE finding and a Nerlo-original behavioral finding count exactly the same.
- agentshieldOff-the-shelf
Agent/MCP config safety — unsafe tool grants and prompt-injection surface.
- agent-audit-kitOff-the-shelf
Agent-config auditing across the OWASP Agentic and MCP top-10s.
- bearerOff-the-shelf
Data-flow SAST — secrets, injection, and unsafe data flows in JS/TS/Python/Ruby.
- cisco-skill-scannerOff-the-shelf
SKILL.md and skill-config risks via a multi-engine static suite.
- osv-scannerOff-the-shelf
Known-vulnerable dependencies matched against the OSV database.
- trivyOff-the-shelf
Dependency CVEs, hardcoded secrets, and misconfiguration.
- nerlo-skill-scanner · behavioralNerlo-original
Obfuscated decode-then-exec, dynamic eval/exec, and hardcoded exfiltration — the postmark-mcp backdoor shape.
- nerlo-skill-scanner · install-docNerlo-original
READMEs that direct execution of a bundled or fetched artifact — curl-pipe-bash, run resource.txt — the FakeGit shape.
Want the exact scoring math and how the composite is assembled? See the scoring methodology. Every scanner also publishes its source, version, and install command with each scan so you can verify its provenance yourself.