{
  "skill_name": "eslint-gen",
  "skill_path": "/workspace/skills/clawhub-eslint-gen",
  "skill_directory": "/workspace/skills/clawhub-eslint-gen",
  "is_safe": true,
  "max_severity": "MEDIUM",
  "findings_count": 1,
  "findings": [
    {
      "id": "llm_finding_eslint-gen_0",
      "rule_id": "LLM_SOCIAL_ENGINEERING",
      "category": "social_engineering",
      "severity": "MEDIUM",
      "title": "Deceptive Skill Description - Not an Agent Skill",
      "description": "This skill claims to be an ESLint config generator but is actually just documentation for an external npm package (npx ai-eslint-config). The skill contains no executable code, scripts, or agent instructions. It misleads users into thinking it's a functional agent skill when it's merely promotional content for an external tool. The skill cannot perform any of the claimed functionality without the external npm package.",
      "file_path": "SKILL.md",
      "line_number": 1,
      "snippet": "Quick Start section shows: 'npx ai-eslint-config .' - This is an external npm package call, not agent functionality. The skill contains zero Python/Bash scripts despite claiming to 'scan your codebase' and 'generate configs'.",
      "remediation": "Either: (1) Remove this skill as it provides no agent functionality, or (2) Implement actual Python/Bash scripts that perform ESLint config generation using agent tools (Read, Glob, Write), or (3) Clearly label this as documentation/reference material, not an executable skill.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "This skill is fundamentally misrepresented. It claims to be an ESLint config generator but contains no executable code or agent instructions - it's merely documentation for an external npm package (npx ai-eslint-config). The skill cannot perform any of its claimed functionality without external dependencies. It references missing Python files, contains promotional marketing content inappropriate for agent skills, and has incomplete metadata. The primary issue is deceptive packaging: this is not a functional agent skill but rather promotional material for an external tool. Users expecting agent-executable functionality will be misled. The skill should either be removed, completely reimplemented with actual agent scripts, or clearly relabeled as reference documentation.",
        "primary_threats": [
          "Deceptive skill description",
          "Missing functional implementation",
          "Promotional content masquerading as agent skill",
          "Incomplete metadata"
        ],
        "aitech": "AITech-2.1",
        "aitech_name": "Social Engineering",
        "aisubtech": null,
        "aisubtech_name": null,
        "scanner_category": "SOCIAL ENGINEERING",
        "meta_validated": true,
        "meta_confidence": "HIGH",
        "meta_confidence_reason": "The skill package contains zero executable code for agents (no Python/Bash scripts in scripts/ directory, no agent instructions). All functionality depends on external npm package. This is objectively not a functional agent skill despite being packaged as one.",
        "meta_exploitability": "N/A - This is a packaging/labeling issue, not a security exploit",
        "meta_impact": "Medium - Users are misled about skill capabilities, wasting time trying to use non-functional skill. Damages trust in skill ecosystem."
      }
    }
  ],
  "scan_duration_seconds": 25.46467399597168,
  "duration_ms": 25464,
  "analyzers_used": [
    "static_analyzer",
    "behavioral_analyzer",
    "llm_analyzer",
    "trigger_analyzer",
    "meta_analyzer"
  ],
  "timestamp": "2026-02-06T00:48:44.444917"
}