agentaudit 3.9.43 → 3.9.45

package/cli.mjs

@@ -1956,7 +1956,14 @@ async function auditRepo(url) {
   
   // Display results
   console.log();
-  const riskScore = report.risk_score || 0;
+  // Always recalculate risk_score from findings severities (never trust LLM's score)
+  const _sevW = { critical: 25, high: 15, medium: 5, low: 1 };
+  const recalcRisk = report.findings && report.findings.length > 0
+    ? Math.min(100, report.findings.reduce((s, f) => s + (_sevW[f.severity] || 0), 0))
+    : 0;
+  report.risk_score = recalcRisk;
+  report.result = recalcRisk === 0 ? 'safe' : recalcRisk <= 20 ? 'caution' : 'unsafe';
+  const riskScore = recalcRisk;
   const trustScore = 100 - riskScore;
   const trustColor = trustScore >= 70 ? c.green : trustScore >= 40 ? c.yellow : c.red;
   const trustLabel = trustScore >= 70 ? 'SAFE' : trustScore >= 40 ? 'CAUTION' : 'UNSAFE';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentaudit",
-  "version": "3.9.43",
+  "version": "3.9.45",
   "description": "Security scanner for AI packages — MCP server + CLI",
   "type": "module",
   "bin": {

package/prompts/audit-prompt.md

@@ -409,12 +409,9 @@ If **any** fails → real vulnerability (`by_design: false`).
 
 ## 3.10 Final Triage
 
-### Finding Count Cap: Maximum 8 real findings per audit.
+### Finding Quality Check
 
-If more than 8 candidates after triage:
-1. Keep highest severity + highest confidence
-2. Merge ONLY when same pattern_id + same file
-3. Drop LOW-confidence findings first
+Report ALL genuine findings — do not artificially limit the count. If a package has 20 real vulnerabilities, report all 20. However, if you have more than 15 candidates, double-check each against the Self-Check (§3.1) to ensure every finding has concrete evidence and is not a duplicate.
 
 ### Anti-Merging Rules
 
@@ -654,10 +651,6 @@ Consult these patterns during Phase 2 evidence collection. Remember: a pattern m
 - risk_score > 50 for a package with no confirmed exploit path
 - Multiple credential-config findings for the same .env/env-var system — merge or drop
 
-## Ideal Distribution (benchmark)
+## Quality Guidance
 
-- ~60-70% of packages: `safe` (0-25 risk)
-- ~20-25%: `caution` (26-50)
-- ~5-10%: `unsafe` (51-100) — only confirmed malware or severe vulnerabilities
-- CRITICAL findings in <5% of audits
-- Average findings per audit: 1-3 (not 5-10)
+Judge each audit on its own merits. A clean package should have 0 findings; a heavily vulnerable package may have 20+. Do not target a specific distribution — report what you find with evidence.