{
  "skill_name": "calendar",
  "skill_path": "/workspace/skills/clawhub-calendar",
  "skill_directory": "/workspace/skills/clawhub-calendar",
  "is_safe": true,
  "max_severity": "MEDIUM",
  "findings_count": 1,
  "findings": [
    {
      "id": "llm_finding_calendar_0",
      "rule_id": "LLM_SOCIAL_ENGINEERING",
      "category": "social_engineering",
      "severity": "MEDIUM",
      "title": "Misleading Description - No Implementation Provided",
      "description": "The skill claims to provide 'Calendar management and scheduling' with features like 'Create events', 'Schedule meetings', 'Set reminders', and 'Calendar sync' across multiple providers (Google Calendar, Apple Calendar, Outlook Calendar). However, no script files or implementation code are provided. This is a deceptive skill that cannot perform any of its advertised functionality. Users may believe they are getting calendar integration capabilities when the skill has no actual implementation.",
      "file_path": null,
      "line_number": null,
      "snippet": "Description claims: 'Calendar management and scheduling. Create events, manage meetings, and sync across calendar providers.' Features listed: 'Create events, Schedule meetings, Set reminders, View availability, Recurring events, Calendar sync'. Supported Providers: 'Google Calendar, Apple Calendar, Outlook Calendar'. But: 'No script files found.'",
      "remediation": "Either implement the advertised calendar functionality with appropriate Python/Bash scripts that integrate with calendar APIs, or update the description to accurately reflect that this is a template/placeholder skill with no current implementation. If this is intentionally a stub, clearly mark it as such in the description.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "This skill is a non-functional placeholder that misleadingly advertises calendar management capabilities without any implementation. The primary security concern is social engineering (AITech-2.1) - the skill's description and feature list create false expectations about its capabilities, which could lead users to believe they have calendar integration when they do not. This is a MEDIUM severity issue because it involves deceptive metadata that misrepresents the skill's functionality. Additionally, there are several LOW severity issues related to missing optional metadata fields (license, compatibility, allowed-tools) and unused dependency specifications. No actual security threats like data exfiltration, prompt injection, or command injection are present since there is no executable code. However, the deceptive nature of the skill's claims warrants attention.",
        "primary_threats": [
          "Social Engineering (Deceptive Description)",
          "Missing Metadata"
        ],
        "aitech": "AITech-2.1",
        "aitech_name": "Social Engineering",
        "aisubtech": null,
        "aisubtech_name": null,
        "scanner_category": "SOCIAL ENGINEERING",
        "meta_validated": true,
        "meta_confidence": "HIGH",
        "meta_confidence_reason": "The skill package definitively contains no script files or implementation code, yet makes specific claims about functionality and provider support. This is objectively misleading.",
        "meta_exploitability": "Low - This is a deceptive placeholder rather than an active attack. Users may waste time trying to use non-existent functionality.",
        "meta_impact": "Medium - Users may believe they have calendar integration capabilities when they don't, potentially leading to missed meetings or scheduling failures if they rely on this skill."
      }
    }
  ],
  "scan_duration_seconds": 22.473392009735107,
  "duration_ms": 22473,
  "analyzers_used": [
    "static_analyzer",
    "behavioral_analyzer",
    "llm_analyzer",
    "trigger_analyzer",
    "meta_analyzer"
  ],
  "timestamp": "2026-02-05T21:12:44.756130"
}