{
  "skill_name": "hugging-face-model-trainer",
  "skill_path": "/workspace/skills/huggingface-skills/skills/hugging-face-model-trainer",
  "skill_directory": "/workspace/skills/huggingface-skills/skills/hugging-face-model-trainer",
  "is_safe": true,
  "max_severity": "MEDIUM",
  "findings_count": 14,
  "findings": [
    {
      "id": "TOOL_ABUSE_SYSTEM_PACKAGE_INSTALL_6ad23b4867",
      "rule_id": "TOOL_ABUSE_SYSTEM_PACKAGE_INSTALL",
      "category": "unauthorized_tool_use",
      "severity": "MEDIUM",
      "title": "Attempting to install system packages with elevated privileges",
      "description": "Pattern detected: sudo apt-get install",
      "file_path": "scripts/convert_to_gguf.py",
      "line_number": 27,
      "snippet": "- Ubuntu/Debian: sudo apt-get update && sudo apt-get install -y build-essential cmake",
      "remediation": "Use user-level installs without sudo. Document if system install is necessary",
      "analyzer": "static",
      "metadata": {
        "matched_pattern": "sudo\\s+apt-get\\s+install",
        "matched_text": "sudo apt-get install",
        "aitech": "AITech-12.1",
        "aitech_name": "Tool Exploitation",
        "scanner_category": "SECURITY VIOLATION",
        "meta_reviewed": true
      }
    },
    {
      "id": "TOOL_ABUSE_SYSTEM_PACKAGE_INSTALL_37606e09ff",
      "rule_id": "TOOL_ABUSE_SYSTEM_PACKAGE_INSTALL",
      "category": "unauthorized_tool_use",
      "severity": "MEDIUM",
      "title": "Attempting to install system packages with elevated privileges",
      "description": "Pattern detected: sudo yum install",
      "file_path": "scripts/convert_to_gguf.py",
      "line_number": 28,
      "snippet": "- RHEL/CentOS: sudo yum groupinstall -y \"Development Tools\" && sudo yum install -y cmake",
      "remediation": "Use user-level installs without sudo. Document if system install is necessary",
      "analyzer": "static",
      "metadata": {
        "matched_pattern": "sudo\\s+yum\\s+install",
        "matched_text": "sudo yum install",
        "aitech": "AITech-12.1",
        "aitech_name": "Tool Exploitation",
        "scanner_category": "SECURITY VIOLATION",
        "meta_reviewed": true
      }
    },
    {
      "id": "TOOL_ABUSE_SYSTEM_PACKAGE_INSTALL_e1f1d40522",
      "rule_id": "TOOL_ABUSE_SYSTEM_PACKAGE_INSTALL",
      "category": "unauthorized_tool_use",
      "severity": "MEDIUM",
      "title": "Attempting to install system packages with elevated privileges",
      "description": "Pattern detected: sudo apt-get install",
      "file_path": "scripts/convert_to_gguf.py",
      "line_number": 57,
      "snippet": "print(\"     Ubuntu/Debian: sudo apt-get install git\")",
      "remediation": "Use user-level installs without sudo. Document if system install is necessary",
      "analyzer": "static",
      "metadata": {
        "matched_pattern": "sudo\\s+apt-get\\s+install",
        "matched_text": "sudo apt-get install",
        "aitech": "AITech-12.1",
        "aitech_name": "Tool Exploitation",
        "scanner_category": "SECURITY VIOLATION",
        "meta_reviewed": true
      }
    },
    {
      "id": "TOOL_ABUSE_SYSTEM_PACKAGE_INSTALL_072c032a26",
      "rule_id": "TOOL_ABUSE_SYSTEM_PACKAGE_INSTALL",
      "category": "unauthorized_tool_use",
      "severity": "MEDIUM",
      "title": "Attempting to install system packages with elevated privileges",
      "description": "Pattern detected: sudo yum install",
      "file_path": "scripts/convert_to_gguf.py",
      "line_number": 58,
      "snippet": "print(\"     RHEL/CentOS: sudo yum install git\")",
      "remediation": "Use user-level installs without sudo. Document if system install is necessary",
      "analyzer": "static",
      "metadata": {
        "matched_pattern": "sudo\\s+yum\\s+install",
        "matched_text": "sudo yum install",
        "aitech": "AITech-12.1",
        "aitech_name": "Tool Exploitation",
        "scanner_category": "SECURITY VIOLATION",
        "meta_reviewed": true
      }
    },
    {
      "id": "TOOL_ABUSE_SYSTEM_PACKAGE_INSTALL_aa121dfcdd",
      "rule_id": "TOOL_ABUSE_SYSTEM_PACKAGE_INSTALL",
      "category": "unauthorized_tool_use",
      "severity": "MEDIUM",
      "title": "Attempting to install system packages with elevated privileges",
      "description": "Pattern detected: sudo apt-get install",
      "file_path": "scripts/convert_to_gguf.py",
      "line_number": 68,
      "snippet": "print(\"     Ubuntu/Debian: sudo apt-get install build-essential cmake\")",
      "remediation": "Use user-level installs without sudo. Document if system install is necessary",
      "analyzer": "static",
      "metadata": {
        "matched_pattern": "sudo\\s+apt-get\\s+install",
        "matched_text": "sudo apt-get install",
        "aitech": "AITech-12.1",
        "aitech_name": "Tool Exploitation",
        "scanner_category": "SECURITY VIOLATION",
        "meta_reviewed": true
      }
    },
    {
      "id": "TOOL_ABUSE_SYSTEM_PACKAGE_INSTALL_7f84ff7c9e",
      "rule_id": "TOOL_ABUSE_SYSTEM_PACKAGE_INSTALL",
      "category": "unauthorized_tool_use",
      "severity": "MEDIUM",
      "title": "Attempting to install system packages with elevated privileges",
      "description": "Pattern detected: sudo yum install",
      "file_path": "scripts/convert_to_gguf.py",
      "line_number": 69,
      "snippet": "print(\"     RHEL/CentOS: sudo yum groupinstall 'Development Tools' && sudo yum install cmake\")",
      "remediation": "Use user-level installs without sudo. Document if system install is necessary",
      "analyzer": "static",
      "metadata": {
        "matched_pattern": "sudo\\s+yum\\s+install",
        "matched_text": "sudo yum install",
        "aitech": "AITech-12.1",
        "aitech_name": "Tool Exploitation",
        "scanner_category": "SECURITY VIOLATION",
        "meta_reviewed": true
      }
    },
    {
      "id": "DATA_EXFIL_NETWORK_REQUESTS_919d965913",
      "rule_id": "DATA_EXFIL_NETWORK_REQUESTS",
      "category": "data_exfiltration",
      "severity": "MEDIUM",
      "title": "HTTP client library imports that enable external communication",
      "description": "Pattern detected: import urllib.request",
      "file_path": "scripts/dataset_inspector.py",
      "line_number": 24,
      "snippet": "import urllib.request",
      "remediation": "Ensure network access is necessary and documented. Review all URLs",
      "analyzer": "static",
      "metadata": {
        "matched_pattern": "import\\s+urllib\\.request",
        "matched_text": "import urllib.request",
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "scanner_category": "SECURITY VIOLATION",
        "meta_reviewed": true
      }
    },
    {
      "id": "TOOL_MISMATCH_NETWORK_7080120861",
      "rule_id": "TOOL_ABUSE_UNDECLARED_NETWORK",
      "category": "unauthorized_tool_use",
      "severity": "MEDIUM",
      "title": "Undeclared network usage",
      "description": "Skill code uses network libraries but doesn't declare network requirement",
      "file_path": null,
      "line_number": null,
      "snippet": null,
      "remediation": "Declare network usage in compatibility field or remove network calls",
      "analyzer": "static",
      "metadata": {
        "meta_reviewed": true
      }
    },
    {
      "id": "DESC_BEHAVIOR_MISMATCH_75cb5daae4",
      "rule_id": "SOCIAL_ENG_MISLEADING_DESC",
      "category": "social_engineering",
      "severity": "MEDIUM",
      "title": "Potential description-behavior mismatch",
      "description": "Skill performs actions not reflected in its description",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": null,
      "remediation": "Ensure description accurately reflects all skill capabilities",
      "analyzer": "static",
      "metadata": {
        "meta_reviewed": true
      }
    },
    {
      "id": "YARA_transitive_trust_abuse_bd417c8bf4",
      "rule_id": "YARA_transitive_trust_abuse",
      "category": "transitive_trust_abuse",
      "severity": "MEDIUM",
      "title": "TRANSITIVE TRUST ABUSE detected by YARA",
      "description": "Detects skills that delegate trust to untrusted external content: run scripts",
      "file_path": "SKILL.md",
      "line_number": 47,
      "snippet": "To run scripts locally (like `estimate_cost.py`), install dependencies:",
      "remediation": "Review and remove transitive trust abuse pattern",
      "analyzer": "static",
      "metadata": {
        "yara_rule": "transitive_trust_abuse",
        "yara_namespace": "transitive_trust_abuse",
        "matched_string": "$execute_inline",
        "threat_type": "TRANSITIVE TRUST ABUSE",
        "meta_reviewed": true
      }
    },
    {
      "id": "YARA_transitive_trust_abuse_5b6c327abe",
      "rule_id": "YARA_transitive_trust_abuse",
      "category": "transitive_trust_abuse",
      "severity": "MEDIUM",
      "title": "TRANSITIVE TRUST ABUSE detected by YARA",
      "description": "Detects skills that delegate trust to untrusted external content: run scripts",
      "file_path": "SKILL.md",
      "line_number": 416,
      "snippet": "--dataset trl-lib/Capybara \\",
      "remediation": "Review and remove transitive trust abuse pattern",
      "analyzer": "static",
      "metadata": {
        "yara_rule": "transitive_trust_abuse",
        "yara_namespace": "transitive_trust_abuse",
        "matched_string": "$execute_inline",
        "threat_type": "TRANSITIVE TRUST ABUSE",
        "meta_reviewed": true
      }
    },
    {
      "id": "YARA_code_execution_ac606a0992",
      "rule_id": "YARA_code_execution",
      "category": "command_injection",
      "severity": "MEDIUM",
      "title": "CODE EXECUTION detected by YARA",
      "description": "Detects dangerous code execution patterns in agent skills (Python/Bash): subprocess.run(",
      "file_path": "scripts/convert_to_gguf.py",
      "line_number": 63,
      "snippet": "has_make = subprocess.run([\"which\", \"make\"], capture_output=True).returncode == 0",
      "remediation": "Review and remove code execution pattern",
      "analyzer": "static",
      "metadata": {
        "yara_rule": "code_execution",
        "yara_namespace": "code_execution",
        "matched_string": "$python_system_calls",
        "threat_type": "CODE EXECUTION",
        "meta_reviewed": true
      }
    },
    {
      "id": "YARA_code_execution_d7615725c4",
      "rule_id": "YARA_code_execution",
      "category": "command_injection",
      "severity": "MEDIUM",
      "title": "CODE EXECUTION detected by YARA",
      "description": "Detects dangerous code execution patterns in agent skills (Python/Bash): subprocess.run(",
      "file_path": "scripts/convert_to_gguf.py",
      "line_number": 64,
      "snippet": "has_cmake = subprocess.run([\"which\", \"cmake\"], capture_output=True).returncode == 0",
      "remediation": "Review and remove code execution pattern",
      "analyzer": "static",
      "metadata": {
        "yara_rule": "code_execution",
        "yara_namespace": "code_execution",
        "matched_string": "$python_system_calls",
        "threat_type": "CODE EXECUTION",
        "meta_reviewed": true
      }
    },
    {
      "id": "YARA_code_execution_9fe87fb07a",
      "rule_id": "YARA_code_execution",
      "category": "command_injection",
      "severity": "MEDIUM",
      "title": "CODE EXECUTION detected by YARA",
      "description": "Detects dangerous code execution patterns in agent skills (Python/Bash): subprocess.run(",
      "file_path": "scripts/convert_to_gguf.py",
      "line_number": 81,
      "snippet": "result = subprocess.run(",
      "remediation": "Review and remove code execution pattern",
      "analyzer": "static",
      "metadata": {
        "yara_rule": "code_execution",
        "yara_namespace": "code_execution",
        "matched_string": "$python_system_calls",
        "threat_type": "CODE EXECUTION",
        "meta_reviewed": true
      }
    }
  ],
  "scan_duration_seconds": 1408.6172008514404,
  "duration_ms": 1408617,
  "analyzers_used": [
    "static_analyzer",
    "llm_analyzer",
    "meta_analyzer"
  ],
  "timestamp": "2026-02-07T23:39:02.275453"
}