{"auditId":"aud_01KS3D0NAG8GQAJZRDY85S","status":"completed","startedAt":"2026-05-20T19:15:18.992Z","updatedAt":"2026-05-20T19:15:31.207Z","progressNote":"Risk class: unknown — running clause checkers","report":{"auditId":"aud_01KS3D0NAG8GQAJZRDY85S","source":{"kind":"repo","owner":"thejoven","repo":"awesome-eliza"},"input":{"auditId":"aud_01KS3D0NAG8GQAJZRDY85S","source":{"kind":"repo","owner":"thejoven","repo":"awesome-eliza"},"repoUrl":"https://github.com/thejoven/awesome-eliza","regulations":["eu-ai-act-2024-08","nist-ai-rmf-1.0"]},"fetch":{"repoUrl":"https://github.com/thejoven/awesome-eliza","owner":"thejoven","repo":"awesome-eliza","ref":"223af244192ce48699bd0ee5015317380b33ce59","commitSha":"223af244192ce48699bd0ee5015317380b33ce59","worktreeDir":"/tmp/ai-auditor/aud_01KS3D0NAG8GQAJZRDY85S","fileCount":4,"totalBytes":908543,"languages":{"Markdown":29909},"inventory":{"hasReadme":true,"hasLicense":true,"hasModelCard":false,"hasDataCard":false,"hasRiskRegister":false,"hasThreatModel":false,"hasSecurityMd":false,"hasPrivacyMd":false,"hasCodeOfConduct":false,"hasContributing":false,"hasCiWorkflows":false,"hasEvalDir":false,"hasTestsDir":false,"governanceDocFiles":["LICENSE","README.md"],"configFiles":[]},"fetchedAt":"2026-05-20T19:15:20.342Z"},"recon":{"signals":{"agent_framework":{"signal":"agent_framework","fired":false,"strength":0,"evidence":[]},"model_usage":{"signal":"model_usage","fired":false,"strength":0,"evidence":[]},"logging_hooks":{"signal":"logging_hooks","fired":false,"strength":0,"evidence":[]},"oversight_hooks":{"signal":"oversight_hooks","fired":false,"strength":0,"evidence":[]},"eval_artefacts":{"signal":"eval_artefacts","fired":false,"strength":0,"evidence":[]},"governance_docs":{"signal":"governance_docs","fired":true,"strength":0.5204119982655925,"evidence":[{"file":"LICENSE","rule":"governance_doc_present"},{"file":"README.md","rule":"governance_doc_present"}]},"cybersec_hooks":{"signal":"cybersec_hooks","fired":false,"strength":0,"evidence":[]},"provenance_hooks":{"signal":"provenance_hooks","fired":false,"strength":0,"evidence":[]},"data_io":{"signal":"data_io","fired":false,"strength":0,"evidence":[]},"pii_signals":{"signal":"pii_signals","fired":false,"strength":0,"evidence":[]},"bio_health_signals":{"signal":"bio_health_signals","fired":false,"strength":0,"evidence":[]},"employment_signals":{"signal":"employment_signals","fired":false,"strength":0,"evidence":[]},"bio_metric_signals":{"signal":"bio_metric_signals","fired":false,"strength":0,"evidence":[]},"education_signals":{"signal":"education_signals","fired":false,"strength":0,"evidence":[]},"law_enforcement_signals":{"signal":"law_enforcement_signals","fired":false,"strength":0,"evidence":[]},"migration_signals":{"signal":"migration_signals","fired":false,"strength":0,"evidence":[]},"justice_signals":{"signal":"justice_signals","fired":false,"strength":0,"evidence":[]},"essential_services_signals":{"signal":"essential_services_signals","fired":false,"strength":0,"evidence":[]},"critical_infra_signals":{"signal":"critical_infra_signals","fired":false,"strength":0,"evidence":[]},"content_generation_signals":{"signal":"content_generation_signals","fired":false,"strength":0,"evidence":[]},"emotion_recognition_signals":{"signal":"emotion_recognition_signals","fired":false,"strength":0,"evidence":[]}}},"scope":{"regulationIds":["eu-ai-act-2024-08","nist-ai-rmf-1.0"],"notes":["Auditing against packs: eu-ai-act-2024-08, nist-ai-rmf-1.0"]},"map":{"classification":"unknown","annexIiiCategories":[],"art50Triggers":[],"drivingSignals":[],"rationale":["No AI system detected in this repository — no agent framework or LLM call sites found.","EU AI Act and NIST AI RMF do not apply: the regulations target AI systems and these signals are absent."]},"checks":[{"clauseId":"eu-ai-act/art-5/1a-subliminal","regulationId":"eu-ai-act-2024-08","article":"5(1)(a)","title":"Subliminal techniques distorting behaviour","principle":"transparency","verdict":"pass","score":4,"rawScore":0,"evidence":[],"rules":[{"rule":"detect_manipulative_prompt_patterns","matched":0,"weight":1}],"rationale":"Composite raw score 0.00 (0/1 rules matched).","confidence":0.55,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-5/1b-vulnerability","regulationId":"eu-ai-act-2024-08","article":"5(1)(b)","title":"Exploiting vulnerabilities (age, disability, socio-economic)","principle":"fairness","verdict":"pass","score":4,"rawScore":0,"evidence":[],"rules":[{"rule":"detect_protected_attribute_targeting","matched":0,"weight":1}],"rationale":"Composite raw score 0.00 (0/1 rules matched).","confidence":0.55,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-5/1c-social-scoring","regulationId":"eu-ai-act-2024-08","article":"5(1)(c)","title":"Social scoring leading to detrimental treatment","principle":"fairness","verdict":"pass","score":4,"rawScore":0,"evidence":[],"rules":[{"rule":"detect_scoring_with_persistent_user_state","matched":0,"weight":1}],"rationale":"Composite raw score 0.00 (0/1 rules matched). Supporting docs may exist outside the repo.","confidence":0.55,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-5/1d-predictive-policing","regulationId":"eu-ai-act-2024-08","article":"5(1)(d)","title":"Predictive policing solely from profiling","principle":"fairness","verdict":"pass","score":4,"rawScore":0,"evidence":[],"rules":[{"rule":"detect_crime_risk_scoring_from_profile","matched":0,"weight":1}],"rationale":"Composite raw score 0.00 (0/1 rules matched).","confidence":0.55,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-5/1e-facial-scraping","regulationId":"eu-ai-act-2024-08","article":"5(1)(e)","title":"Untargeted facial image scraping for face databases","principle":"privacy","verdict":"pass","score":4,"rawScore":0,"evidence":[],"rules":[{"rule":"detect_face_image_scraping","matched":0,"weight":1}],"rationale":"Composite raw score 0.00 (0/1 rules matched).","confidence":0.55,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-5/1f-emotion-workplace-edu","regulationId":"eu-ai-act-2024-08","article":"5(1)(f)","title":"Emotion recognition in workplace and education","principle":"privacy","verdict":"pass","score":4,"rawScore":0,"evidence":[],"rules":[{"rule":"detect_emotion_recognition_in_workplace_education","matched":0,"weight":1}],"rationale":"Composite raw score 0.00 (0/1 rules matched).","confidence":0.55,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-5/1g-biometric-categorisation","regulationId":"eu-ai-act-2024-08","article":"5(1)(g)","title":"Biometric categorisation by protected attributes","principle":"fairness","verdict":"pass","score":4,"rawScore":0,"evidence":[],"rules":[{"rule":"detect_biometric_categorisation_by_protected_attrs","matched":0,"weight":1}],"rationale":"Composite raw score 0.00 (0/1 rules matched).","confidence":0.55,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-5/1h-realtime-rbi","regulationId":"eu-ai-act-2024-08","article":"5(1)(h)","title":"Real-time remote biometric identification in public spaces","principle":"privacy","verdict":"external","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"Deployment context (public space, real-time, law enforcement use, judicial\nauthorisation) is operational, not knowable from code. Always external.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-9/risk-management","regulationId":"eu-ai-act-2024-08","article":"9","title":"Risk management system established, implemented, documented","principle":"safety","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-10/data-governance","regulationId":"eu-ai-act-2024-08","article":"10","title":"Data and data governance practices documented","principle":"privacy","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-11/technical-documentation","regulationId":"eu-ai-act-2024-08","article":"11","title":"Technical documentation drawn up before placing on market","principle":"auditability","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-12/p1-automatic-logs","regulationId":"eu-ai-act-2024-08","article":"12(1)","title":"Automatic recording of events over the lifetime","principle":"auditability","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-12/p2-traceability","regulationId":"eu-ai-act-2024-08","article":"12(2)","title":"Logging ensures traceability appropriate to risk","principle":"auditability","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-13/deployer-instructions","regulationId":"eu-ai-act-2024-08","article":"13","title":"Transparent operation and instructions for use","principle":"transparency","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-14/p1-oversight-measures","regulationId":"eu-ai-act-2024-08","article":"14(1)","title":"Effective human oversight designed and built-in","principle":"human-oversight","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-14/p4d-stop-button","regulationId":"eu-ai-act-2024-08","article":"14(4)(d)","title":"Interrupt / stop function reachable by overseer","principle":"human-oversight","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-14/p4e-override","regulationId":"eu-ai-act-2024-08","article":"14(4)(e)","title":"Ability to override / reverse the system's output","principle":"human-oversight","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-15/p1-accuracy","regulationId":"eu-ai-act-2024-08","article":"15(1)","title":"Appropriate level of accuracy declared and tested","principle":"safety","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-15/p4-robustness","regulationId":"eu-ai-act-2024-08","article":"15(4)","title":"Resilience to errors, faults, inconsistencies","principle":"safety","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-15/p5-cybersecurity","regulationId":"eu-ai-act-2024-08","article":"15(5)","title":"Cybersecurity measures appropriate to circumstances","principle":"security-governance","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-26/p6-keep-logs","regulationId":"eu-ai-act-2024-08","article":"26(6)","title":"Deployer log-retention capability supported","principle":"accountability","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-50/p1-ai-disclosure","regulationId":"eu-ai-act-2024-08","article":"50(1)","title":"Users informed they are interacting with an AI","principle":"transparency","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-50/p2-synthetic-content","regulationId":"eu-ai-act-2024-08","article":"50(2)","title":"AI-generated content marked as such, machine-readable","principle":"transparency","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-50/p3-emotion-biometric-disclosure","regulationId":"eu-ai-act-2024-08","article":"50(3)","title":"Emotion recognition / biometric categorisation disclosure","principle":"transparency","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-50/p4-deepfake-disclosure","regulationId":"eu-ai-act-2024-08","article":"50(4)","title":"Deepfake content labelled as artificially generated","principle":"transparency","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"nist-ai-rmf/govern-1.4","regulationId":"nist-ai-rmf-1.0","article":"GOVERN 1.4","title":"Risk management process documented and accountable","principle":"accountability","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"nist-ai-rmf/govern-1.5","regulationId":"nist-ai-rmf-1.0","article":"GOVERN 1.5","title":"Ongoing monitoring and periodic review of risk management","principle":"accountability","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"nist-ai-rmf/map-1.1","regulationId":"nist-ai-rmf-1.0","article":"MAP 1.1","title":"Context of use established and understood","principle":"auditability","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"nist-ai-rmf/map-3.4","regulationId":"nist-ai-rmf-1.0","article":"MAP 3.4","title":"Risks and benefits to people identified","principle":"safety","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"nist-ai-rmf/measure-2.3","regulationId":"nist-ai-rmf-1.0","article":"MEASURE 2.3","title":"AI system performance evaluated and documented","principle":"safety","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"nist-ai-rmf/measure-2.7","regulationId":"nist-ai-rmf-1.0","article":"MEASURE 2.7","title":"Security and resilience evaluated","principle":"security-governance","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"nist-ai-rmf/measure-2.8","regulationId":"nist-ai-rmf-1.0","article":"MEASURE 2.8","title":"Privacy risk of the AI system evaluated","principle":"privacy","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"nist-ai-rmf/measure-2.11","regulationId":"nist-ai-rmf-1.0","article":"MEASURE 2.11","title":"Fairness and bias evaluated","principle":"fairness","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"nist-ai-rmf/manage-2.3","regulationId":"nist-ai-rmf-1.0","article":"MANAGE 2.3","title":"Mechanisms to supersede or deactivate AI systems","principle":"human-oversight","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"nist-ai-rmf/manage-4.1","regulationId":"nist-ai-rmf-1.0","article":"MANAGE 4.1","title":"Post-deployment monitoring, appeal and override, change management","principle":"auditability","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"}],"grade":{"overallScore":4,"perRegulation":[{"regulationId":"eu-ai-act-2024-08","scoreAvg":4,"passCount":7,"partialCount":0,"failCount":0,"externalCount":1,"naCount":17},{"regulationId":"nist-ai-rmf-1.0","scoreAvg":null,"passCount":0,"partialCount":0,"failCount":0,"externalCount":0,"naCount":10}]},"bundleHash":"3f39eda48e7c6565f24a4c4e4eea7c92b286870845826890d47ea5c7fa00a1aa","checkerVersion":"v0.1.0","regulationsVersions":{"eu-ai-act-2024-08":"ee8568c60676d1c60c00393077dc7b9753628a16bb96049d6caa384b93516239","nist-ai-rmf-1.0":"b36616651114a74e212e4416e72f3d320d3ea46e1c93d7d3919cd44b5f71f762"},"startedAt":"2026-05-20T19:15:19.008Z","completedAt":"2026-05-20T19:15:31.204Z","durationMs":12196,"externalControls":[{"clauseId":"eu-ai-act/art-5/1h-realtime-rbi","article":"5(1)(h)","title":"Real-time remote biometric identification in public spaces","note":"Deployment context (public space, real-time, law enforcement use, judicial\nauthorisation) is operational, not knowable from code. Always external."}]}}