kio-orzeczenia-mcp

Why those were dismissed

Two keys had to turn. The model had to name a reason from a fixed list of six, and a deterministic check of ours — over which files this artifact actually installs — had to independently agree. Anything it could not corroborate is in “not reviewed” above, at full severity.

• 2 Test or fixture file — The match is in a test or fixture. Our own check confirmed the file is not part of what gets installed.

  Rules: SOCIAL_ENG_VAGUE_DESCRIPTION, MANIFEST_MISSING_LICENSE · Files: /repo/tests/fixtures/SKILL.md · reported by cisco-skill-scanner

• 1 CI or editor configuration — The match is in build, CI or editor configuration, confirmed by our own check to be outside the installed artifact.

  Rules: AAK-GHA-IMMUTABLE-001 · Files: .github/workflows/release.yml · reported by agent-audit-kit

In installed code — never dismissed

These findings are in files this artifact installs and are not placeholder values. No false-positive basis can be corroborated for such a finding, so this review never dismisses one; they were not sent to the model and stand at their scanner's severity.

• 2 GHSA-4xgf-cpjx-pc3j

  Files: /repo/uv.lock, uv.lock · reported by osv-scanner, trivy

• 2 GHSA-537c-gmf6-5ccf

  Files: uv.lock, /repo/uv.lock · reported by trivy, osv-scanner

• 1 AAK-MCP-SDK-CVE-2026-52869-001

  Files: uv.lock · reported by agent-audit-kit

• 1 AAK-SEC-MD-001

  Files: SECURITY.md · reported by agent-audit-kit

• 1 CVE-2025-69872

  Files: uv.lock · reported by trivy

• 1 CVE-2026-49852

  Files: uv.lock · reported by trivy

• 1

Upheld — the review declined to dismiss these

The model could have called any of these a false positive and did not.

• 1 CVE-2026-54282

  Files: uv.lock · reported by trivy

• 1 CVE-2026-69248

  Files: uv.lock · reported by trivy

Not reviewed

• 1 The model called these false positives and our own check did not agree, so the dismissal was refused.

  Rules: HIDDEN_DATA_FILE · Files: /repo/.mcp.json.example · reported by cisco-skill-scanner