wortwildnis

Why those were dismissed

Two keys had to turn. The model had to name a reason from a fixed list of six, and a deterministic check of ours — over which files this artifact actually installs — had to independently agree. Anything it could not corroborate is in “not reviewed” above, at full severity.

• 8 Agent instruction file — The match is in a file that instructs an AI coding agent — a CLAUDE.md or similar. It is documentation of intent, and our own check confirmed it is not part of what gets installed.

  Rules: AAK-AGENT-005 · Files: AGENTS.md · reported by agent-audit-kit

Upheld — the review declined to dismiss these

The model could have called any of these a false positive and did not.

• 3 ARCHIVE_FILE_DETECTED

  Files: /repo/priv/static/robots-9e2c81b0855bbff2baa8371bc4a78186.txt.gz, /repo/priv/static/robots-2ccc7d104fdd25084eed801209f4112c.txt.gz, /repo/priv/static/robots.txt.gz · reported by cisco-skill-scanner

• 3 UNANALYZABLE_BINARY

  Files: /repo/priv/static/robots-2ccc7d104fdd25084eed801209f4112c.txt.gz, /repo/priv/static/robots-9e2c81b0855bbff2baa8371bc4a78186.txt.gz, /repo/priv/static/robots.txt.gz · reported by cisco-skill-scanner

• 1 AAK-LEGAL-002

  Files: package.json · reported by agent-audit-kit

• 1 AAK-SUPPLY-003

  Files: package.json · reported by agent-audit-kit

• 1 AAK-SUPPLY-004

  Files: package.json · reported by agent-audit-kit

• 1 CVE-2026-32686

  Files: mix.lock · reported by trivy

• 1 CVE-2026-32687

  Files:

Not reviewed

• 17 The model called these false positives and our own check did not agree, so the dismissal was refused.

  Rules: permissions-no-deny-list, DATA_EXFIL_JS_FS_ACCESS, AAK-TRUST-004 and 5 more · Files: settings.local.json, .claude/settings.local.json, /repo/assets/vendor/heroicons.js and 7 more · reported by agentshield, cisco-skill-scanner, agent-audit-kit