{
  "skill_name": "fuzzing-dictionary",
  "skill_path": "/workspace/skills/trailofbits-skills/plugins/testing-handbook-skills/skills/fuzzing-dictionary",
  "skill_directory": "/workspace/skills/trailofbits-skills/plugins/testing-handbook-skills/skills/fuzzing-dictionary",
  "is_safe": false,
  "max_severity": "CRITICAL",
  "findings_count": 4,
  "findings": [
    {
      "id": "MANIFEST_MISSING_LICENSE_c5ae9be793",
      "rule_id": "MANIFEST_MISSING_LICENSE",
      "category": "policy_violation",
      "severity": "LOW",
      "title": "Skill does not specify a license",
      "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": null,
      "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)",
      "analyzer": "static",
      "metadata": {
        "meta_reviewed": true
      }
    },
    {
      "id": "YARA_credential_harvesting_afe6acd220",
      "rule_id": "YARA_credential_harvesting",
      "category": "hardcoded_secrets",
      "severity": "CRITICAL",
      "title": "CREDENTIAL HARVESTING detected by YARA",
      "description": "Detects potential exposure of sensitive information like API keys, passwords, tokens, and certificates: export AFL_LLVM_DICT2FILE",
      "file_path": "SKILL.md",
      "line_number": 172,
      "snippet": "export AFL_LLVM_DICT2FILE=auto.dict",
      "remediation": "Review and remove credential harvesting pattern",
      "analyzer": "static",
      "metadata": {
        "yara_rule": "credential_harvesting",
        "yara_namespace": "credential_harvesting",
        "matched_string": "$leak_param",
        "threat_type": "CREDENTIAL HARVESTING",
        "meta_reviewed": true
      }
    },
    {
      "id": "llm_finding_fuzzing-dictionary_0",
      "rule_id": "LLM_DATA_EXFILTRATION",
      "category": "data_exfiltration",
      "severity": "LOW",
      "title": "Missing Optional Metadata Fields",
      "description": "The skill manifest is missing optional metadata fields including 'license', 'compatibility', and 'allowed-tools'. While these fields are optional per the agent skills specification, their absence reduces transparency about the skill's requirements and restrictions.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "license: Not specified\ncompatibility: Not specified\nallowed-tools: Not specified",
      "remediation": "Add optional metadata fields to improve transparency: specify a license (e.g., MIT, Apache-2.0), document compatibility requirements, and declare allowed-tools if the skill expects to use specific agent capabilities.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "This skill appears to be a documentation-focused educational resource about fuzzing dictionaries rather than an executable skill with active code. The security posture is generally safe with only minor documentation and metadata completeness issues. No active threats were detected - there are no scripts, no network calls, no data exfiltration attempts, no prompt injection, and no malicious code. The skill provides legitimate technical guidance on using fuzzing dictionaries with tools like libFuzzer, AFL++, and cargo-fuzz. The primary concerns are informational: missing optional metadata fields and incomplete documentation with references to files not included in the package.",
        "primary_threats": [],
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "scanner_category": "SECURITY VIOLATION",
        "meta_reviewed": true
      }
    },
    {
      "id": "llm_finding_fuzzing-dictionary_1",
      "rule_id": "LLM_DATA_EXFILTRATION",
      "category": "data_exfiltration",
      "severity": "LOW",
      "title": "Referenced Files Not Found in Package",
      "description": "The skill instructions reference four files (harness.py, header.py, string.py, binary.py) that are not included in the skill package. While the instructions appear to be incomplete (Step 2 cuts off mid-sentence), these missing files could indicate incomplete packaging or documentation issues.",
      "file_path": null,
      "line_number": null,
      "snippet": "Files referenced in instructions: harness.py, header.py, string.py, binary.py - all marked as 'not found'",
      "remediation": "Either include the referenced files in the skill package, remove references to non-existent files, or clearly document that these are example filenames that users should create themselves.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "This skill appears to be a documentation-focused educational resource about fuzzing dictionaries rather than an executable skill with active code. The security posture is generally safe with only minor documentation and metadata completeness issues. No active threats were detected - there are no scripts, no network calls, no data exfiltration attempts, no prompt injection, and no malicious code. The skill provides legitimate technical guidance on using fuzzing dictionaries with tools like libFuzzer, AFL++, and cargo-fuzz. The primary concerns are informational: missing optional metadata fields and incomplete documentation with references to files not included in the package.",
        "primary_threats": [],
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "scanner_category": "SECURITY VIOLATION",
        "meta_reviewed": true
      }
    }
  ],
  "scan_duration_seconds": 12.288715362548828,
  "duration_ms": 12288,
  "analyzers_used": [
    "static_analyzer",
    "llm_analyzer",
    "meta_analyzer"
  ],
  "timestamp": "2026-02-08T07:12:16.828278"
}