{
  "skill_name": "database",
  "skill_path": "/workspace/skills/clawhub-database",
  "skill_directory": "/workspace/skills/clawhub-database",
  "is_safe": true,
  "max_severity": "MEDIUM",
  "findings_count": 1,
  "findings": [
    {
      "id": "llm_finding_database_0",
      "rule_id": "LLM_SOCIAL_ENGINEERING",
      "category": "social_engineering",
      "severity": "MEDIUM",
      "title": "Misleading Description - No Implementation Provided",
      "description": "The skill claims to provide 'Database management and queries' with support for PostgreSQL, MySQL, SQLite, MongoDB, and Redis, but contains NO implementation code (no Python or Bash scripts). The description promises features like 'Run SQL queries', 'Schema management', 'Data export/import', 'Backup and restore', and 'Performance monitoring', but there is no code to deliver these capabilities. This is deceptive metadata that misleads users about the skill's actual functionality.",
      "file_path": "SKILL.md",
      "line_number": 1,
      "snippet": "Description claims: 'Connect to SQL and NoSQL databases, run queries, and manage schemas' but script files show: 'No script files found.' The skill is an empty shell with no executable code.",
      "remediation": "Either: (1) Implement the promised database functionality with appropriate Python scripts using libraries like psycopg2, pymongo, redis-py, etc., OR (2) Remove this skill entirely as it provides no actual capability. If implemented, ensure proper input validation, parameterized queries to prevent SQL injection, and credential management best practices.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "This skill is a NON-FUNCTIONAL SHELL with deceptive metadata. It promises comprehensive database management capabilities across multiple database systems (PostgreSQL, MySQL, SQLite, MongoDB, Redis) but contains ZERO implementation code. The primary security concern is MISLEADING DESCRIPTION (AITech-2.1) - users may trust this skill to handle sensitive database operations, but it cannot deliver any functionality. Secondary concerns include missing security metadata (no allowed-tools declaration), absent provenance information (no license/compatibility), and unenforceable safety rules. The 'always: true' flag is inappropriate for a database tool. While there's no active malicious code (no data exfiltration, no command injection), the deceptive nature and lack of implementation make this skill unsuitable for use. If this is a template or work-in-progress, it should not be distributed. If implemented in the future, it would require careful security review for SQL injection prevention, credential management, and proper input validation.",
        "primary_threats": [
          "Misleading/Deceptive Metadata",
          "Missing Security Controls",
          "Non-Functional Implementation"
        ],
        "aitech": "AITech-2.1",
        "aitech_name": "Social Engineering",
        "aisubtech": null,
        "aisubtech_name": null,
        "scanner_category": "SOCIAL ENGINEERING",
        "meta_validated": true,
        "meta_confidence": "HIGH",
        "meta_confidence_reason": "Verified by examining the full skill content - there are literally zero script files (no Python, no Bash) to implement any of the claimed database operations. The LLM analyzer correctly identified this as deceptive metadata.",
        "meta_exploitability": "N/A - No code to exploit, but users may trust this skill for sensitive database operations",
        "meta_impact": "Medium - Users may attempt to use this skill for database operations and be confused when nothing works, or worse, assume it's working when it's not"
      }
    }
  ],
  "scan_duration_seconds": 31.61480164527893,
  "duration_ms": 31614,
  "analyzers_used": [
    "static_analyzer",
    "behavioral_analyzer",
    "llm_analyzer",
    "trigger_analyzer",
    "meta_analyzer"
  ],
  "timestamp": "2026-02-05T23:51:35.900772"
}