{ "skill_name": "azure-storage-blob-java", "skill_path": "/workspace/skills/microsoft-agent-skills/.github/skills/azure-storage-blob-java", "skill_directory": "/workspace/skills/microsoft-agent-skills/.github/skills/azure-storage-blob-java", "is_safe": true, "max_severity": "LOW", "findings_count": 5, "findings": [ { "id": "MANIFEST_MISSING_LICENSE_c5ae9be793", "rule_id": "MANIFEST_MISSING_LICENSE", "category": "policy_violation", "severity": "LOW", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "file_path": "SKILL.md", "line_number": null, "snippet": null, "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)", "analyzer": "static", "metadata": { "meta_reviewed": true } }, { "id": "llm_finding_azure-storage-blob-java_0", "rule_id": "LLM_DATA_EXFILTRATION", "category": "data_exfiltration", "severity": "LOW", "title": "Missing License Information", "description": "The skill does not specify a license in the YAML manifest. While not a direct security threat, this creates legal ambiguity about usage rights and redistribution, which could expose users to intellectual property risks.", "file_path": "SKILL.md", "line_number": null, "snippet": "license: Not specified", "remediation": "Add a license field to the YAML frontmatter (e.g., license: MIT, Apache-2.0, or proprietary)", "analyzer": "llm", "metadata": { "model": "claude-sonnet-4-5-20250929", "overall_assessment": "This skill is a documentation-only reference for the Azure Storage Blob SDK for Java. It contains no executable code, no scripts, and no malicious patterns. The skill provides legitimate code examples and API documentation for working with Azure Blob Storage in Java applications. All identified issues are LOW severity and relate to missing optional metadata fields and incomplete documentation artifacts. There are no security threats such as data exfiltration, prompt injection, credential theft, or command injection. The skill appears to be a safe, informational resource for developers working with Azure Blob Storage.", "primary_threats": [], "aitech": "AITech-8.2", "aitech_name": "Data Exfiltration / Exposure", "aisubtech": "AISubtech-8.2.3", "aisubtech_name": "Data Exfiltration via Agent Tooling", "scanner_category": "SECURITY VIOLATION", "meta_reviewed": true } }, { "id": "llm_finding_azure-storage-blob-java_1", "rule_id": "LLM_SOCIAL_ENGINEERING", "category": "social_engineering", "severity": "LOW", "title": "Missing Compatibility Information", "description": "The skill does not declare compatibility information (e.g., which Claude environments it works in). This is informational metadata that helps users understand where the skill can be used.", "file_path": "SKILL.md", "line_number": null, "snippet": "compatibility: Not specified", "remediation": "Add compatibility field to YAML frontmatter specifying supported environments (e.g., compatibility: Works in Claude.ai, Claude Code, API)", "analyzer": "llm", "metadata": { "model": "claude-sonnet-4-5-20250929", "overall_assessment": "This skill is a documentation-only reference for the Azure Storage Blob SDK for Java. It contains no executable code, no scripts, and no malicious patterns. The skill provides legitimate code examples and API documentation for working with Azure Blob Storage in Java applications. All identified issues are LOW severity and relate to missing optional metadata fields and incomplete documentation artifacts. There are no security threats such as data exfiltration, prompt injection, credential theft, or command injection. The skill appears to be a safe, informational resource for developers working with Azure Blob Storage.", "primary_threats": [], "aitech": "AITech-2.1", "aitech_name": "Social Engineering", "aisubtech": null, "aisubtech_name": null, "scanner_category": "SOCIAL ENGINEERING", "meta_reviewed": true } }, { "id": "llm_finding_azure-storage-blob-java_2", "rule_id": "LLM_UNAUTHORIZED_TOOL_USE", "category": "unauthorized_tool_use", "severity": "LOW", "title": "Missing allowed-tools Declaration", "description": "The skill does not specify allowed-tools in the manifest. While this field is optional per the agent skills specification, declaring it helps users understand which agent capabilities the skill requires and provides transparency about tool usage.", "file_path": "SKILL.md", "line_number": null, "snippet": "allowed-tools: Not specified", "remediation": "Add allowed-tools field to YAML frontmatter to declare which agent tools this skill uses (e.g., allowed-tools: [Read, Write, Bash] if the skill needs to read documentation, write code, or execute Java/Maven commands)", "analyzer": "llm", "metadata": { "model": "claude-sonnet-4-5-20250929", "overall_assessment": "This skill is a documentation-only reference for the Azure Storage Blob SDK for Java. It contains no executable code, no scripts, and no malicious patterns. The skill provides legitimate code examples and API documentation for working with Azure Blob Storage in Java applications. All identified issues are LOW severity and relate to missing optional metadata fields and incomplete documentation artifacts. There are no security threats such as data exfiltration, prompt injection, credential theft, or command injection. The skill appears to be a safe, informational resource for developers working with Azure Blob Storage.", "primary_threats": [], "aitech": "AITech-12.1", "aitech_name": "Tool Exploitation", "aisubtech": "AISubtech-12.1.2", "aisubtech_name": "Tool Poisoning", "scanner_category": "SUSPICIOUS CODE EXECUTION", "meta_reviewed": true } }, { "id": "llm_finding_azure-storage-blob-java_3", "rule_id": "LLM_DATA_EXFILTRATION", "category": "data_exfiltration", "severity": "LOW", "title": "Referenced Files Not Found in Package", "description": "The skill instructions reference three Python files (File.py, Stream.py, URL.py) that are not included in the skill package. These appear to be incomplete documentation artifacts rather than actual code files. While not a security threat, this indicates incomplete or malformed skill packaging.", "file_path": "SKILL.md", "line_number": null, "snippet": "Files referenced in instructions: File.py, Stream.py, URL.py - all marked as 'not found'", "remediation": "Either include the referenced files in the skill package or remove the references from the documentation. If these are meant to be example filenames, clarify this in the documentation.", "analyzer": "llm", "metadata": { "model": "claude-sonnet-4-5-20250929", "overall_assessment": "This skill is a documentation-only reference for the Azure Storage Blob SDK for Java. It contains no executable code, no scripts, and no malicious patterns. The skill provides legitimate code examples and API documentation for working with Azure Blob Storage in Java applications. All identified issues are LOW severity and relate to missing optional metadata fields and incomplete documentation artifacts. There are no security threats such as data exfiltration, prompt injection, credential theft, or command injection. The skill appears to be a safe, informational resource for developers working with Azure Blob Storage.", "primary_threats": [], "aitech": "AITech-8.2", "aitech_name": "Data Exfiltration / Exposure", "aisubtech": "AISubtech-8.2.3", "aisubtech_name": "Data Exfiltration via Agent Tooling", "scanner_category": "SECURITY VIOLATION", "meta_reviewed": true } } ], "scan_duration_seconds": 17.346503019332886, "duration_ms": 17346, "analyzers_used": [ "static_analyzer", "behavioral_analyzer", "llm_analyzer", "trigger_analyzer", "meta_analyzer" ], "timestamp": "2026-02-05T16:31:57.501594" }