{
  "skill_name": "yara-rule-authoring",
  "skill_path": "/workspace/skills/trailofbits-skills/plugins/yara-authoring/skills/yara-rule-authoring",
  "skill_directory": "/workspace/skills/trailofbits-skills/plugins/yara-authoring/skills/yara-rule-authoring",
  "is_safe": false,
  "max_severity": "CRITICAL",
  "findings_count": 19,
  "findings": [
    {
      "id": "MANIFEST_MISSING_LICENSE_c5ae9be793",
      "rule_id": "MANIFEST_MISSING_LICENSE",
      "category": "policy_violation",
      "severity": "LOW",
      "title": "Skill does not specify a license",
      "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": null,
      "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)",
      "analyzer": "static",
      "metadata": {
        "meta_reviewed": true
      }
    },
    {
      "id": "OBFUSCATION_XOR_ENCODING_4cd9430e62",
      "rule_id": "OBFUSCATION_XOR_ENCODING",
      "category": "obfuscation",
      "severity": "HIGH",
      "title": "XOR operations often used for obfuscation",
      "description": "Pattern detected: xor",
      "file_path": "scripts/yara_lint.py",
      "line_number": 424,
      "snippet": "# xor without range",
      "remediation": "Remove XOR encoding unless clearly justified",
      "analyzer": "static",
      "metadata": {
        "matched_pattern": "\\bxor\\b",
        "matched_text": "xor",
        "aitech": "AITech-9.1",
        "aitech_name": "Model or Agentic System Manipulation",
        "scanner_category": "SUSPICIOUS CODE",
        "meta_reviewed": true
      }
    },
    {
      "id": "OBFUSCATION_XOR_ENCODING_1b4d9ccccd",
      "rule_id": "OBFUSCATION_XOR_ENCODING",
      "category": "obfuscation",
      "severity": "HIGH",
      "title": "XOR operations often used for obfuscation",
      "description": "Pattern detected: xor",
      "file_path": "scripts/yara_lint.py",
      "line_number": 425,
      "snippet": "if \"xor\" in modifiers and not any(\"xor(\" in str(m) for m in modifiers):",
      "remediation": "Remove XOR encoding unless clearly justified",
      "analyzer": "static",
      "metadata": {
        "matched_pattern": "\\bxor\\b",
        "matched_text": "xor",
        "aitech": "AITech-9.1",
        "aitech_name": "Model or Agentic System Manipulation",
        "scanner_category": "SUSPICIOUS CODE",
        "meta_reviewed": true
      }
    },
    {
      "id": "OBFUSCATION_XOR_ENCODING_6827459b40",
      "rule_id": "OBFUSCATION_XOR_ENCODING",
      "category": "obfuscation",
      "severity": "HIGH",
      "title": "XOR operations often used for obfuscation",
      "description": "Pattern detected: xor",
      "file_path": "scripts/yara_lint.py",
      "line_number": 430,
      "snippet": "message=f\"String {string_id} uses 'xor' without range; generates 255 patterns\",",
      "remediation": "Remove XOR encoding unless clearly justified",
      "analyzer": "static",
      "metadata": {
        "matched_pattern": "\\bxor\\b",
        "matched_text": "xor",
        "aitech": "AITech-9.1",
        "aitech_name": "Model or Agentic System Manipulation",
        "scanner_category": "SUSPICIOUS CODE",
        "meta_reviewed": true
      }
    },
    {
      "id": "YARA_script_injection_088cc1a7fd",
      "rule_id": "YARA_script_injection",
      "category": "command_injection",
      "severity": "CRITICAL",
      "title": "INJECTION ATTACK detected by YARA",
      "description": "Detects embedded scripting payloads (JS, VBScript, etc.) in MCP tool descriptions: # ",
      "file_path": "scripts/atom_analyzer.py",
      "line_number": 1,
      "snippet": "# /// script",
      "remediation": "Review and remove injection attack pattern",
      "analyzer": "static",
      "metadata": {
        "yara_rule": "script_injection",
        "yara_namespace": "script_injection",
        "matched_string": "$markdown_heading",
        "threat_type": "INJECTION ATTACK",
        "meta_reviewed": true
      }
    },
    {
      "id": "YARA_script_injection_1cde4207a6",
      "rule_id": "YARA_script_injection",
      "category": "command_injection",
      "severity": "CRITICAL",
      "title": "INJECTION ATTACK detected by YARA",
      "description": "Detects embedded scripting payloads (JS, VBScript, etc.) in MCP tool descriptions: \\033[91m",
      "file_path": "scripts/atom_analyzer.py",
      "line_number": 455,
      "snippet": "print(f\"\\033[91mYARA-X compilation error in {file_path}:\\033[0m {e}\", file=sys.stderr)",
      "remediation": "Review and remove injection attack pattern",
      "analyzer": "static",
      "metadata": {
        "yara_rule": "script_injection",
        "yara_namespace": "script_injection",
        "matched_string": "$ansi_deception",
        "threat_type": "INJECTION ATTACK",
        "meta_reviewed": true
      }
    },
    {
      "id": "YARA_script_injection_1cde4207a6",
      "rule_id": "YARA_script_injection",
      "category": "command_injection",
      "severity": "CRITICAL",
      "title": "INJECTION ATTACK detected by YARA",
      "description": "Detects embedded scripting payloads (JS, VBScript, etc.) in MCP tool descriptions: \\033[0m",
      "file_path": "scripts/atom_analyzer.py",
      "line_number": 455,
      "snippet": "print(f\"\\033[91mYARA-X compilation error in {file_path}:\\033[0m {e}\", file=sys.stderr)",
      "remediation": "Review and remove injection attack pattern",
      "analyzer": "static",
      "metadata": {
        "yara_rule": "script_injection",
        "yara_namespace": "script_injection",
        "matched_string": "$ansi_deception",
        "threat_type": "INJECTION ATTACK",
        "meta_reviewed": true
      }
    },
    {
      "id": "YARA_script_injection_ecad5fb6d0",
      "rule_id": "YARA_script_injection",
      "category": "command_injection",
      "severity": "CRITICAL",
      "title": "INJECTION ATTACK detected by YARA",
      "description": "Detects embedded scripting payloads (JS, VBScript, etc.) in MCP tool descriptions: \\033[1m",
      "file_path": "scripts/atom_analyzer.py",
      "line_number": 466,
      "snippet": "print(f\"\\n\\033[1m{rule_name}\\033[0m\")",
      "remediation": "Review and remove injection attack pattern",
      "analyzer": "static",
      "metadata": {
        "yara_rule": "script_injection",
        "yara_namespace": "script_injection",
        "matched_string": "$ansi_deception",
        "threat_type": "INJECTION ATTACK",
        "meta_reviewed": true
      }
    },
    {
      "id": "YARA_script_injection_ecad5fb6d0",
      "rule_id": "YARA_script_injection",
      "category": "command_injection",
      "severity": "CRITICAL",
      "title": "INJECTION ATTACK detected by YARA",
      "description": "Detects embedded scripting payloads (JS, VBScript, etc.) in MCP tool descriptions: \\033[0m",
      "file_path": "scripts/atom_analyzer.py",
      "line_number": 466,
      "snippet": "print(f\"\\n\\033[1m{rule_name}\\033[0m\")",
      "remediation": "Review and remove injection attack pattern",
      "analyzer": "static",
      "metadata": {
        "yara_rule": "script_injection",
        "yara_namespace": "script_injection",
        "matched_string": "$ansi_deception",
        "threat_type": "INJECTION ATTACK",
        "meta_reviewed": true
      }
    },
    {
      "id": "YARA_script_injection_c4b941e75f",
      "rule_id": "YARA_script_injection",
      "category": "command_injection",
      "severity": "CRITICAL",
      "title": "INJECTION ATTACK detected by YARA",
      "description": "Detects embedded scripting payloads (JS, VBScript, etc.) in MCP tool descriptions: \\033[91m",
      "file_path": "scripts/atom_analyzer.py",
      "line_number": 480,
      "snippet": "color = \"\\033[91m\"",
      "remediation": "Review and remove injection attack pattern",
      "analyzer": "static",
      "metadata": {
        "yara_rule": "script_injection",
        "yara_namespace": "script_injection",
        "matched_string": "$ansi_deception",
        "threat_type": "INJECTION ATTACK",
        "meta_reviewed": true
      }
    },
    {
      "id": "YARA_script_injection_0e57935f76",
      "rule_id": "YARA_script_injection",
      "category": "command_injection",
      "severity": "CRITICAL",
      "title": "INJECTION ATTACK detected by YARA",
      "description": "Detects embedded scripting payloads (JS, VBScript, etc.) in MCP tool descriptions: \\033[93m",
      "file_path": "scripts/atom_analyzer.py",
      "line_number": 482,
      "snippet": "color = \"\\033[93m\"",
      "remediation": "Review and remove injection attack pattern",
      "analyzer": "static",
      "metadata": {
        "yara_rule": "script_injection",
        "yara_namespace": "script_injection",
        "matched_string": "$ansi_deception",
        "threat_type": "INJECTION ATTACK",
        "meta_reviewed": true
      }
    },
    {
      "id": "YARA_script_injection_9f29359eb9",
      "rule_id": "YARA_script_injection",
      "category": "command_injection",
      "severity": "CRITICAL",
      "title": "INJECTION ATTACK detected by YARA",
      "description": "Detects embedded scripting payloads (JS, VBScript, etc.) in MCP tool descriptions: \\033[94m",
      "file_path": "scripts/atom_analyzer.py",
      "line_number": 484,
      "snippet": "color = \"\\033[94m\"",
      "remediation": "Review and remove injection attack pattern",
      "analyzer": "static",
      "metadata": {
        "yara_rule": "script_injection",
        "yara_namespace": "script_injection",
        "matched_string": "$ansi_deception",
        "threat_type": "INJECTION ATTACK",
        "meta_reviewed": true
      }
    },
    {
      "id": "YARA_script_injection_4e21c91506",
      "rule_id": "YARA_script_injection",
      "category": "command_injection",
      "severity": "CRITICAL",
      "title": "INJECTION ATTACK detected by YARA",
      "description": "Detects embedded scripting payloads (JS, VBScript, etc.) in MCP tool descriptions: \\033[0m",
      "file_path": "scripts/atom_analyzer.py",
      "line_number": 486,
      "snippet": "print(f\"    {color}{issue.severity.upper()}\\033[0m: {issue.message}\")",
      "remediation": "Review and remove injection attack pattern",
      "analyzer": "static",
      "metadata": {
        "yara_rule": "script_injection",
        "yara_namespace": "script_injection",
        "matched_string": "$ansi_deception",
        "threat_type": "INJECTION ATTACK",
        "meta_reviewed": true
      }
    },
    {
      "id": "YARA_script_injection_3a545543a6",
      "rule_id": "YARA_script_injection",
      "category": "command_injection",
      "severity": "CRITICAL",
      "title": "INJECTION ATTACK detected by YARA",
      "description": "Detects embedded scripting payloads (JS, VBScript, etc.) in MCP tool descriptions: # ",
      "file_path": "scripts/yara_lint.py",
      "line_number": 1,
      "snippet": "# /// script",
      "remediation": "Review and remove injection attack pattern",
      "analyzer": "static",
      "metadata": {
        "yara_rule": "script_injection",
        "yara_namespace": "script_injection",
        "matched_string": "$markdown_heading",
        "threat_type": "INJECTION ATTACK",
        "meta_reviewed": true
      }
    },
    {
      "id": "YARA_script_injection_3c0ab31885",
      "rule_id": "YARA_script_injection",
      "category": "command_injection",
      "severity": "CRITICAL",
      "title": "INJECTION ATTACK detected by YARA",
      "description": "Detects embedded scripting payloads (JS, VBScript, etc.) in MCP tool descriptions: \\033[91m",
      "file_path": "scripts/yara_lint.py",
      "line_number": 547,
      "snippet": "red = \"\\033[91m\"",
      "remediation": "Review and remove injection attack pattern",
      "analyzer": "static",
      "metadata": {
        "yara_rule": "script_injection",
        "yara_namespace": "script_injection",
        "matched_string": "$ansi_deception",
        "threat_type": "INJECTION ATTACK",
        "meta_reviewed": true
      }
    },
    {
      "id": "YARA_script_injection_c24a8ab612",
      "rule_id": "YARA_script_injection",
      "category": "command_injection",
      "severity": "CRITICAL",
      "title": "INJECTION ATTACK detected by YARA",
      "description": "Detects embedded scripting payloads (JS, VBScript, etc.) in MCP tool descriptions: \\033[93m",
      "file_path": "scripts/yara_lint.py",
      "line_number": 548,
      "snippet": "yellow = \"\\033[93m\"",
      "remediation": "Review and remove injection attack pattern",
      "analyzer": "static",
      "metadata": {
        "yara_rule": "script_injection",
        "yara_namespace": "script_injection",
        "matched_string": "$ansi_deception",
        "threat_type": "INJECTION ATTACK",
        "meta_reviewed": true
      }
    },
    {
      "id": "YARA_script_injection_59e10506cb",
      "rule_id": "YARA_script_injection",
      "category": "command_injection",
      "severity": "CRITICAL",
      "title": "INJECTION ATTACK detected by YARA",
      "description": "Detects embedded scripting payloads (JS, VBScript, etc.) in MCP tool descriptions: \\033[94m",
      "file_path": "scripts/yara_lint.py",
      "line_number": 549,
      "snippet": "blue = \"\\033[94m\"",
      "remediation": "Review and remove injection attack pattern",
      "analyzer": "static",
      "metadata": {
        "yara_rule": "script_injection",
        "yara_namespace": "script_injection",
        "matched_string": "$ansi_deception",
        "threat_type": "INJECTION ATTACK",
        "meta_reviewed": true
      }
    },
    {
      "id": "YARA_script_injection_218d714d71",
      "rule_id": "YARA_script_injection",
      "category": "command_injection",
      "severity": "CRITICAL",
      "title": "INJECTION ATTACK detected by YARA",
      "description": "Detects embedded scripting payloads (JS, VBScript, etc.) in MCP tool descriptions: \\033[0m",
      "file_path": "scripts/yara_lint.py",
      "line_number": 550,
      "snippet": "reset = \"\\033[0m\"",
      "remediation": "Review and remove injection attack pattern",
      "analyzer": "static",
      "metadata": {
        "yara_rule": "script_injection",
        "yara_namespace": "script_injection",
        "matched_string": "$ansi_deception",
        "threat_type": "INJECTION ATTACK",
        "meta_reviewed": true
      }
    },
    {
      "id": "YARA_script_injection_aa754cc3e7",
      "rule_id": "YARA_script_injection",
      "category": "command_injection",
      "severity": "CRITICAL",
      "title": "INJECTION ATTACK detected by YARA",
      "description": "Detects embedded scripting payloads (JS, VBScript, etc.) in MCP tool descriptions: \\033[1m",
      "file_path": "scripts/yara_lint.py",
      "line_number": 551,
      "snippet": "bold = \"\\033[1m\"",
      "remediation": "Review and remove injection attack pattern",
      "analyzer": "static",
      "metadata": {
        "yara_rule": "script_injection",
        "yara_namespace": "script_injection",
        "matched_string": "$ansi_deception",
        "threat_type": "INJECTION ATTACK",
        "meta_reviewed": true
      }
    }
  ],
  "scan_duration_seconds": 7.306838750839233,
  "duration_ms": 7306,
  "analyzers_used": [
    "static_analyzer",
    "llm_analyzer",
    "meta_analyzer"
  ],
  "timestamp": "2026-02-08T10:27:33.246038"
}