{
  "skill_name": "firebase-apk-scanner",
  "skill_path": "./skills/trailofbits-skills/plugins/firebase-apk-scanner/skills/firebase-apk-scanner",
  "skill_directory": "./skills/trailofbits-skills/plugins/firebase-apk-scanner/skills/firebase-apk-scanner",
  "is_safe": false,
  "max_severity": "CRITICAL",
  "findings_count": 4,
  "findings": [
    {
      "id": "MANIFEST_MISSING_LICENSE_c5ae9be793",
      "rule_id": "MANIFEST_MISSING_LICENSE",
      "category": "policy_violation",
      "severity": "LOW",
      "title": "Skill does not specify a license",
      "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": null,
      "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)",
      "analyzer": "static",
      "metadata": {
        "meta_reviewed": true
      }
    },
    {
      "id": "SECRET_GOOGLE_API_97c7562206",
      "rule_id": "SECRET_GOOGLE_API",
      "category": "hardcoded_secrets",
      "severity": "CRITICAL",
      "title": "Google API key detected",
      "description": "Pattern detected: AIzaXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
      "file_path": "references/vulnerabilities.md",
      "line_number": 22,
      "snippet": "\"https://identitytoolkit.googleapis.com/v1/accounts:signUp?key=AIzaXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\"",
      "remediation": "Remove hardcoded Google API keys",
      "analyzer": "static",
      "metadata": {
        "matched_pattern": "AIza[A-Za-z0-9_-]{35}",
        "matched_text": "AIzaXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "scanner_category": "CREDENTIAL HARVESTING",
        "reference_depth": 0,
        "meta_reviewed": true
      }
    },
    {
      "id": "SECRET_GOOGLE_API_abc36afc8c",
      "rule_id": "SECRET_GOOGLE_API",
      "category": "hardcoded_secrets",
      "severity": "CRITICAL",
      "title": "Google API key detected",
      "description": "Pattern detected: AIzaXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
      "file_path": "references/vulnerabilities.md",
      "line_number": 596,
      "snippet": "curl -H \"x-goog-api-key: AIzaXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\" \\",
      "remediation": "Remove hardcoded Google API keys",
      "analyzer": "static",
      "metadata": {
        "matched_pattern": "AIza[A-Za-z0-9_-]{35}",
        "matched_text": "AIzaXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "scanner_category": "CREDENTIAL HARVESTING",
        "reference_depth": 0,
        "meta_reviewed": true
      }
    },
    {
      "id": "SECRET_GOOGLE_API_39b1ebd4f8",
      "rule_id": "SECRET_GOOGLE_API",
      "category": "hardcoded_secrets",
      "severity": "CRITICAL",
      "title": "Google API key detected",
      "description": "Pattern detected: AIzaSyA1B2C3D4E5F6G7H8I9J0K1L2M3N4O5P6Q",
      "file_path": "references/vulnerabilities.md",
      "line_number": 742,
      "snippet": "Example: AIzaSyA1B2C3D4E5F6G7H8I9J0K1L2M3N4O5P6Q",
      "remediation": "Remove hardcoded Google API keys",
      "analyzer": "static",
      "metadata": {
        "matched_pattern": "AIza[A-Za-z0-9_-]{35}",
        "matched_text": "AIzaSyA1B2C3D4E5F6G7H8I9J0K1L2M3N4O5P6Q",
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "scanner_category": "CREDENTIAL HARVESTING",
        "reference_depth": 0,
        "meta_reviewed": true
      }
    }
  ],
  "scan_duration_seconds": 0.4308438301086426,
  "duration_ms": 430,
  "analyzers_used": [
    "static_analyzer",
    "behavioral_analyzer",
    "llm_analyzer",
    "trigger_analyzer",
    "meta_analyzer"
  ],
  "timestamp": "2026-02-03T14:13:33.496587"
}