{
  "skill_name": "gitclassic",
  "skill_path": "/workspace/skills/clawhub-gitclassic",
  "skill_directory": "/workspace/skills/clawhub-gitclassic",
  "is_safe": true,
  "max_severity": "MEDIUM",
  "findings_count": 2,
  "findings": [
    {
      "id": "llm_finding_gitclassic_0",
      "rule_id": "LLM_PROMPT_INJECTION",
      "category": "prompt_injection",
      "severity": "MEDIUM",
      "title": "Transitive Trust Abuse - Following External Web Content",
      "description": "The skill instructs the agent to fetch and parse content from gitclassic.com, a third-party service, without any validation or security warnings. The agent is directed to trust and follow HTML content from this external source. If gitclassic.com is compromised or serves malicious content, the agent could be subjected to indirect prompt injection attacks embedded in the HTML responses. The skill provides no mechanism to validate the integrity or safety of the content retrieved.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "Instructions direct agent to: 'curl https://gitclassic.com/{owner}/{repo}' and parse responses. No validation of external content is specified. Agent is told to trust 'Clean, semantic HTML' from external source.",
      "remediation": "Add explicit warnings about trusting external content. Implement content validation checks. Consider sandboxing external content parsing. Add user confirmation before fetching from external domains. Document the trust model and risks of following third-party HTML content.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "This skill presents MODERATE security concerns primarily related to transitive trust and external content handling. The core functionality directs the agent to fetch and parse content from a third-party service (gitclassic.com) without validation mechanisms, creating indirect prompt injection risks if that service is compromised. The skill makes unverifiable performance claims and promotes a commercial service without adequate disclosure. However, the skill is read-only, contains no executable scripts, no data exfiltration code, and no direct prompt injection attempts. The missing 'public.py' reference appears to be a documentation error rather than a security issue. With proper warnings about external content trust and validation mechanisms, this could be a useful utility skill.",
        "primary_threats": [
          "Indirect Prompt Injection (transitive trust)",
          "Social Engineering (misleading claims)",
          "Missing security controls for external content"
        ],
        "aitech": "AITech-1.2",
        "aitech_name": "Indirect Prompt Injection",
        "aisubtech": null,
        "aisubtech_name": null,
        "scanner_category": "PROMPT INJECTION",
        "meta_validated": true,
        "meta_confidence": "HIGH",
        "meta_confidence_reason": "LLM analyzer correctly identified transitive trust issue. The skill does instruct agents to fetch and parse external content without validation. This is a legitimate architectural concern, though the actual risk depends on gitclassic.com's security posture.",
        "meta_exploitability": "Medium - Requires compromise of gitclassic.com or MITM attack. Not directly exploitable by skill author.",
        "meta_impact": "Medium - Could lead to indirect prompt injection if external service is compromised, potentially causing agent to execute unintended actions."
      }
    },
    {
      "id": "llm_finding_gitclassic_1",
      "rule_id": "LLM_SOCIAL_ENGINEERING",
      "category": "social_engineering",
      "severity": "MEDIUM",
      "title": "Potentially Misleading Service Claims",
      "description": "The skill makes strong performance and reliability claims about a third-party service (gitclassic.com) that cannot be verified and may mislead users. Claims include '<500ms load times', 'cached responses' for rate limit avoidance, and 'clean, semantic HTML' that is 'easy to parse'. These claims could be inaccurate or change without notice, potentially causing the agent to make incorrect decisions or set false user expectations. The skill also promotes a paid PRO tier without disclosing the commercial relationship.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "Unverifiable claims: 'Page load <500ms', 'Rate limits: Cached responses', 'AI agent friendly: Clean, semantic HTML'. Commercial promotion: 'PRO subscription ($19/year or $49/lifetime)' without disclosure of author relationship to service.",
      "remediation": "Add disclaimers that performance claims are based on third-party service and may vary. Disclose any commercial relationship between skill author and gitclassic.com. Remove absolute performance guarantees. Add warnings that service availability and behavior are outside skill control.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "This skill presents MODERATE security concerns primarily related to transitive trust and external content handling. The core functionality directs the agent to fetch and parse content from a third-party service (gitclassic.com) without validation mechanisms, creating indirect prompt injection risks if that service is compromised. The skill makes unverifiable performance claims and promotes a commercial service without adequate disclosure. However, the skill is read-only, contains no executable scripts, no data exfiltration code, and no direct prompt injection attempts. The missing 'public.py' reference appears to be a documentation error rather than a security issue. With proper warnings about external content trust and validation mechanisms, this could be a useful utility skill.",
        "primary_threats": [
          "Indirect Prompt Injection (transitive trust)",
          "Social Engineering (misleading claims)",
          "Missing security controls for external content"
        ],
        "aitech": "AITech-2.1",
        "aitech_name": "Social Engineering",
        "aisubtech": null,
        "aisubtech_name": null,
        "scanner_category": "SOCIAL ENGINEERING",
        "meta_validated": true,
        "meta_confidence": "MEDIUM",
        "meta_confidence_reason": "The claims are indeed unverifiable and could be considered marketing language. However, this is more of a documentation quality issue than a security threat. The commercial promotion aspect is minor.",
        "meta_exploitability": "Low - Not directly exploitable. Could mislead users about service capabilities.",
        "meta_impact": "Low - May cause user disappointment if performance doesn't meet expectations. No direct security impact."
      }
    }
  ],
  "scan_duration_seconds": 30.684964895248413,
  "duration_ms": 30684,
  "analyzers_used": [
    "static_analyzer",
    "behavioral_analyzer",
    "llm_analyzer",
    "trigger_analyzer",
    "meta_analyzer"
  ],
  "timestamp": "2026-02-06T02:06:15.915865"
}