{
  "skill_name": "earnings-calendar",
  "skill_path": "/workspace/skills/clawhub-earnings-calendar",
  "skill_directory": "/workspace/skills/clawhub-earnings-calendar",
  "is_safe": true,
  "max_severity": "MEDIUM",
  "findings_count": 2,
  "findings": [
    {
      "id": "llm_finding_earnings-calendar_0",
      "rule_id": "LLM_DATA_EXFILTRATION",
      "category": "data_exfiltration",
      "severity": "MEDIUM",
      "title": "API Key Exposure Risk via User Prompt in Web Environment",
      "description": "The skill prompts users to enter their FMP API key directly during execution in web environments where no environment variable is available. This creates a risk of API key exposure through chat logs, session storage, or inadvertent sharing. While the skill states the key is 'stored only for current session', there is no evidence of secure handling, encryption, or automatic cleanup of the API key after use.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "#### 3.2 Prompt User for [API Key] (Web Environment)\n\nIf environment variable is not set, prompt user to provide API key interactively. The skill documentation states 'API key will be requested during skill execution (stored only for current session)' but does not specify secure handling mechanisms.",
      "remediation": "1. Add explicit warnings about API key security when prompting users\n2. Implement secure credential handling with automatic cleanup\n3. Recommend environment variable setup over interactive entry\n4. Consider using secure credential storage mechanisms\n5. Add documentation about API key rotation best practices",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "The earnings-calendar skill is a legitimate financial data retrieval tool with a clear, focused purpose. The skill uses the Financial Modeling Prep API to fetch upcoming earnings announcements for mid-cap and above US stocks. The code is well-structured, transparent, and does not contain malicious functionality such as data exfiltration, command injection, or prompt injection attempts. The primary security concern is the handling of API keys in web environments where users must provide credentials interactively, creating potential exposure risks. The skill also lacks some optional metadata fields and could benefit from improved rate limiting. Overall, this skill poses LOW to MEDIUM risk and is suitable for use with minor improvements to credential handling practices.",
        "primary_threats": [
          "API Key Exposure",
          "Missing Metadata",
          "Rate Limiting"
        ],
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "scanner_category": "SECURITY VIOLATION",
        "meta_validated": true,
        "meta_confidence": "HIGH",
        "meta_confidence_reason": "LLM analyzer correctly identified that API keys entered in chat sessions could be exposed through conversation sharing or logs. This is a legitimate concern for web environments, though the actual risk is LOW-MEDIUM given the free-tier API has limited value.",
        "meta_exploitability": "Low - Requires user to share conversation or have session intercepted",
        "meta_impact": "Low-Medium - Exposed free-tier API key allows 250 calls/day, limited financial impact"
      }
    },
    {
      "id": "llm_finding_earnings-calendar_2",
      "rule_id": "LLM_RESOURCE_ABUSE",
      "category": "resource_abuse",
      "severity": "LOW",
      "title": "Unbounded API Request Without Rate Limiting",
      "description": "The Python scripts make external API requests to Financial Modeling Prep without implementing client-side rate limiting or retry backoff mechanisms. While the FMP free tier has a 250 calls/day limit, the scripts do not implement protective measures against accidental rate limit exhaustion or handle rate limit errors gracefully. This could lead to service disruption if the skill is used repeatedly in a short time period.",
      "file_path": "scripts/fetch_earnings_fmp.py",
      "line_number": null,
      "snippet": "The fetch_earnings_calendar method makes direct requests.get() calls without rate limiting:\n\n```python\nresponse = requests.get(url, timeout=30)\nif response.status_code != 200:\n    print(f\"ERROR: FMP API request failed: {response.status_code}\", file=sys.stderr)\n    return None\n```\n\nNo retry logic, exponential backoff, or rate limit handling is implemented.",
      "remediation": "1. Implement client-side rate limiting to prevent API exhaustion\n2. Add exponential backoff for failed requests\n3. Handle HTTP 429 (Too Many Requests) responses gracefully\n4. Add request caching to reduce redundant API calls\n5. Document rate limit considerations in user-facing documentation",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "The earnings-calendar skill is a legitimate financial data retrieval tool with a clear, focused purpose. The skill uses the Financial Modeling Prep API to fetch upcoming earnings announcements for mid-cap and above US stocks. The code is well-structured, transparent, and does not contain malicious functionality such as data exfiltration, command injection, or prompt injection attempts. The primary security concern is the handling of API keys in web environments where users must provide credentials interactively, creating potential exposure risks. The skill also lacks some optional metadata fields and could benefit from improved rate limiting. Overall, this skill poses LOW to MEDIUM risk and is suitable for use with minor improvements to credential handling practices.",
        "primary_threats": [
          "API Key Exposure",
          "Missing Metadata",
          "Rate Limiting"
        ],
        "aitech": "AITech-13.3",
        "aitech_name": "Availability Disruption",
        "aisubtech": "AISubtech-13.3.2",
        "aisubtech_name": "Compute Exhaustion",
        "scanner_category": "RESOURCE ABUSE",
        "meta_validated": true,
        "meta_confidence": "MEDIUM",
        "meta_confidence_reason": "The script does detect 429 errors and provides user feedback, but lacks automatic retry logic. This is a best practice improvement rather than a critical security issue.",
        "meta_exploitability": "Low - Requires repeated manual execution to hit rate limits",
        "meta_impact": "Low - Service disruption only, no data loss or security breach"
      }
    }
  ],
  "scan_duration_seconds": 25.640073776245117,
  "duration_ms": 25640,
  "analyzers_used": [
    "static_analyzer",
    "behavioral_analyzer",
    "llm_analyzer",
    "trigger_analyzer",
    "meta_analyzer"
  ],
  "timestamp": "2026-02-06T00:36:38.991710"
}