{
  "skill_name": "testing-handbook-generator",
  "skill_path": "/workspace/skills/trailofbits-skills/plugins/testing-handbook-skills/skills/testing-handbook-generator",
  "skill_directory": "/workspace/skills/trailofbits-skills/plugins/testing-handbook-skills/skills/testing-handbook-generator",
  "is_safe": true,
  "max_severity": "MEDIUM",
  "findings_count": 3,
  "findings": [
    {
      "id": "MANIFEST_MISSING_LICENSE_c5ae9be793",
      "rule_id": "MANIFEST_MISSING_LICENSE",
      "category": "policy_violation",
      "severity": "LOW",
      "title": "Skill does not specify a license",
      "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": null,
      "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)",
      "analyzer": "static",
      "metadata": {
        "meta_reviewed": true
      }
    },
    {
      "id": "YARA_transitive_trust_abuse_48868e3b81",
      "rule_id": "YARA_transitive_trust_abuse",
      "category": "transitive_trust_abuse",
      "severity": "MEDIUM",
      "title": "TRANSITIVE TRUST ABUSE detected by YARA",
      "description": "Detects skills that delegate trust to untrusted external content: run scripts",
      "file_path": "SKILL.md",
      "line_number": 238,
      "snippet": "- [ ] `README.md` Skills Cross-Reference graph updated",
      "remediation": "Review and remove transitive trust abuse pattern",
      "analyzer": "static",
      "metadata": {
        "yara_rule": "transitive_trust_abuse",
        "yara_namespace": "transitive_trust_abuse",
        "matched_string": "$execute_inline",
        "threat_type": "TRANSITIVE TRUST ABUSE",
        "meta_reviewed": true
      }
    },
    {
      "id": "YARA_transitive_trust_abuse_db9b7991b4",
      "rule_id": "YARA_transitive_trust_abuse",
      "category": "transitive_trust_abuse",
      "severity": "MEDIUM",
      "title": "TRANSITIVE TRUST ABUSE detected by YARA",
      "description": "Detects skills that delegate trust to untrusted external content: run scripts",
      "file_path": "SKILL.md",
      "line_number": 256,
      "snippet": "| [testing-handbook-skills](plugins/testing-handbook-skills/) | Meta-skill that generates skills from the Testing Handbook | Pawe\u0142 P\u0142atek |",
      "remediation": "Review and remove transitive trust abuse pattern",
      "analyzer": "static",
      "metadata": {
        "yara_rule": "transitive_trust_abuse",
        "yara_namespace": "transitive_trust_abuse",
        "matched_string": "$execute_inline",
        "threat_type": "TRANSITIVE TRUST ABUSE",
        "meta_reviewed": true
      }
    }
  ],
  "scan_duration_seconds": 15.235170125961304,
  "duration_ms": 15235,
  "analyzers_used": [
    "static_analyzer",
    "llm_analyzer",
    "meta_analyzer"
  ],
  "timestamp": "2026-02-08T09:14:28.481690"
}