{
  "skill_name": "aws-cdk-development",
  "skill_path": "/workspace/skills/zxkane-aws-skills/plugins/aws-cdk/skills/aws-cdk-development",
  "skill_directory": "/workspace/skills/zxkane-aws-skills/plugins/aws-cdk/skills/aws-cdk-development",
  "is_safe": true,
  "max_severity": "MEDIUM",
  "findings_count": 2,
  "findings": [
    {
      "id": "llm_finding_aws-cdk-development_0",
      "rule_id": "LLM_UNAUTHORIZED_TOOL_USE",
      "category": "unauthorized_tool_use",
      "severity": "MEDIUM",
      "title": "Overly Permissive Tool Access - Unrestricted Bash Commands",
      "description": "The skill declares allowed-tools with wildcard patterns that grant excessive permissions. Specifically, 'Bash(cdk *)' allows execution of ANY cdk command, 'Bash(npm *)' allows ANY npm command, 'Bash(npx *)' allows ANY npx command, and 'Bash(aws cloudformation *)' allows ANY CloudFormation command. This creates tool exploitation risks where malicious or unintended commands could be executed under the guise of legitimate CDK operations. For example, 'npm install' could install malicious packages, 'cdk destroy' could delete infrastructure, or 'aws cloudformation delete-stack' could remove critical resources.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "allowed-tools: mcp__cdk__*, mcp__aws-mcp__*, mcp__awsdocs__*, Bash(cdk *), Bash(npm *), Bash(npx *), Bash(aws cloudformation *), Bash(aws sts get-caller-identity)",
      "remediation": "Restrict allowed-tools to specific, necessary commands only. Instead of wildcards, enumerate exact commands needed: ['Bash(cdk synth)', 'Bash(cdk deploy)', 'Bash(cdk diff)', 'Bash(npm install)', 'Bash(aws cloudformation describe-stacks)', 'Bash(aws sts get-caller-identity)']. Avoid patterns that allow destructive operations like 'cdk destroy', 'npm uninstall', or 'aws cloudformation delete-stack' unless explicitly required and documented.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "The aws-cdk-development skill is generally well-structured for AWS CDK infrastructure development with appropriate educational content and validation tooling. However, it exhibits MEDIUM severity tool exploitation risks due to overly permissive Bash command wildcards that could allow destructive operations (cdk destroy, npm malicious installs, CloudFormation stack deletion). The skill correctly uses internal reference files (references/cdk-patterns.md) which is normal and expected behavior. Minor issues include missing license/compatibility metadata (LOW severity) and potential resource exhaustion in validation scripts without timeouts (LOW severity). No data exfiltration, credential theft, prompt injection, or hardcoded secrets were detected. The skill does not make external network calls or access sensitive credential files. The validation script is purely local analysis tooling.",
        "primary_threats": [
          "Tool Exploitation (overly permissive command wildcards)",
          "Missing metadata transparency",
          "Potential resource exhaustion in validation"
        ],
        "aitech": "AITech-12.1",
        "aitech_name": "Tool Exploitation",
        "aisubtech": "AISubtech-12.1.2",
        "aisubtech_name": "Tool Poisoning",
        "scanner_category": "SUSPICIOUS CODE EXECUTION",
        "meta_validated": true,
        "meta_confidence": "HIGH",
        "meta_confidence_reason": "LLM analyzer correctly identified that wildcard patterns allow destructive operations. This is a legitimate concern for CDK skills where 'cdk destroy' or 'npm install malicious-package' could cause significant damage. The skill's purpose requires some of these commands, but the wildcards are overly broad.",
        "meta_exploitability": "Medium - Requires agent to be tricked into executing destructive commands, but wildcards make this easier than explicit command lists",
        "meta_impact": "High - Could result in infrastructure deletion (cdk destroy), malicious package installation (npm install), or stack deletion (aws cloudformation delete-stack)"
      }
    },
    {
      "id": "llm_finding_aws-cdk-development_1",
      "rule_id": "LLM_SOCIAL_ENGINEERING",
      "category": "social_engineering",
      "severity": "LOW",
      "title": "Missing License and Compatibility Metadata",
      "description": "The skill manifest does not specify 'license' or 'compatibility' fields. While this is not a direct security threat, it represents incomplete metadata that could mislead users about usage rights and supported environments. Users cannot determine if the skill is safe to use in their legal/compliance context or whether it will work in their specific Claude environment (Claude.ai, Claude Code, API).",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "license: Not specified, compatibility: Not specified",
      "remediation": "Add explicit license field (e.g., 'license: MIT', 'license: Apache-2.0') and compatibility field (e.g., 'compatibility: Works in Claude.ai, Claude Code, API with AWS credentials') to the YAML frontmatter. This improves transparency and helps users make informed decisions about skill adoption.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "The aws-cdk-development skill is generally well-structured for AWS CDK infrastructure development with appropriate educational content and validation tooling. However, it exhibits MEDIUM severity tool exploitation risks due to overly permissive Bash command wildcards that could allow destructive operations (cdk destroy, npm malicious installs, CloudFormation stack deletion). The skill correctly uses internal reference files (references/cdk-patterns.md) which is normal and expected behavior. Minor issues include missing license/compatibility metadata (LOW severity) and potential resource exhaustion in validation scripts without timeouts (LOW severity). No data exfiltration, credential theft, prompt injection, or hardcoded secrets were detected. The skill does not make external network calls or access sensitive credential files. The validation script is purely local analysis tooling.",
        "primary_threats": [
          "Tool Exploitation (overly permissive command wildcards)",
          "Missing metadata transparency",
          "Potential resource exhaustion in validation"
        ],
        "aitech": "AITech-2.1",
        "aitech_name": "Social Engineering",
        "aisubtech": null,
        "aisubtech_name": null,
        "scanner_category": "SOCIAL ENGINEERING",
        "meta_validated": true,
        "meta_confidence": "HIGH",
        "meta_confidence_reason": "Missing metadata is objectively verifiable from the manifest. This is a transparency issue rather than a security threat.",
        "meta_exploitability": "N/A - Not exploitable, informational only",
        "meta_impact": "Low - Users cannot determine usage rights or environment compatibility"
      }
    }
  ],
  "scan_duration_seconds": 43.02697682380676,
  "duration_ms": 43026,
  "analyzers_used": [
    "static_analyzer",
    "behavioral_analyzer",
    "llm_analyzer",
    "trigger_analyzer",
    "meta_analyzer"
  ],
  "timestamp": "2026-02-06T06:33:49.370868"
}