{
  "skill_name": "hugging-face-tool-builder",
  "skill_path": "/workspace/skills/huggingface-skills/skills/hugging-face-tool-builder",
  "skill_directory": "/workspace/skills/huggingface-skills/skills/hugging-face-tool-builder",
  "is_safe": false,
  "max_severity": "CRITICAL",
  "findings_count": 12,
  "findings": [
    {
      "id": "MANIFEST_MISSING_LICENSE_c5ae9be793",
      "rule_id": "MANIFEST_MISSING_LICENSE",
      "category": "policy_violation",
      "severity": "LOW",
      "title": "Skill does not specify a license",
      "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": null,
      "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)",
      "analyzer": "static",
      "metadata": {
        "meta_reviewed": true
      }
    },
    {
      "id": "DATA_EXFIL_NETWORK_REQUESTS_ca7285b326",
      "rule_id": "DATA_EXFIL_NETWORK_REQUESTS",
      "category": "data_exfiltration",
      "severity": "MEDIUM",
      "title": "HTTP client library imports that enable external communication",
      "description": "Pattern detected: import urllib.request",
      "file_path": "references/baseline_hf_api.py",
      "line_number": 13,
      "snippet": "import urllib.request",
      "remediation": "Ensure network access is necessary and documented. Review all URLs",
      "analyzer": "static",
      "metadata": {
        "matched_pattern": "import\\s+urllib\\.request",
        "matched_text": "import urllib.request",
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "scanner_category": "SECURITY VIOLATION",
        "meta_reviewed": true
      }
    },
    {
      "id": "DATA_EXFIL_ENV_VARS_d2ccc6036b",
      "rule_id": "DATA_EXFIL_ENV_VARS",
      "category": "data_exfiltration",
      "severity": "MEDIUM",
      "title": "Reading environment variables that may contain secrets",
      "description": "Pattern detected: os.getenv(\"HF_TOKEN",
      "file_path": "references/baseline_hf_api.py",
      "line_number": 46,
      "snippet": "token = os.getenv(\"HF_TOKEN\")",
      "remediation": "Minimize access to environment variables. Document why needed",
      "analyzer": "static",
      "metadata": {
        "matched_pattern": "os\\.getenv\\s*\\([^)]*(?:KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL)",
        "matched_text": "os.getenv(\"HF_TOKEN",
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "scanner_category": "SECURITY VIOLATION",
        "meta_reviewed": true
      }
    },
    {
      "id": "TOOL_MISMATCH_NETWORK_95cdd4fc5d",
      "rule_id": "TOOL_ABUSE_UNDECLARED_NETWORK",
      "category": "unauthorized_tool_use",
      "severity": "MEDIUM",
      "title": "Undeclared network usage",
      "description": "Skill code uses network libraries but doesn't declare network requirement",
      "file_path": null,
      "line_number": null,
      "snippet": null,
      "remediation": "Declare network usage in compatibility field or remove network calls",
      "analyzer": "static",
      "metadata": {
        "meta_reviewed": true
      }
    },
    {
      "id": "DATA_EXFIL_NETWORK_REQUESTS_ca7285b326",
      "rule_id": "DATA_EXFIL_NETWORK_REQUESTS",
      "category": "data_exfiltration",
      "severity": "MEDIUM",
      "title": "HTTP client library imports that enable external communication",
      "description": "Pattern detected: import urllib.request",
      "file_path": "references/baseline_hf_api.py",
      "line_number": 13,
      "snippet": "import urllib.request",
      "remediation": "Ensure network access is necessary and documented. Review all URLs",
      "analyzer": "static",
      "metadata": {
        "matched_pattern": "import\\s+urllib\\.request",
        "matched_text": "import urllib.request",
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "scanner_category": "SECURITY VIOLATION",
        "reference_depth": 0,
        "meta_reviewed": true
      }
    },
    {
      "id": "DATA_EXFIL_ENV_VARS_d2ccc6036b",
      "rule_id": "DATA_EXFIL_ENV_VARS",
      "category": "data_exfiltration",
      "severity": "MEDIUM",
      "title": "Reading environment variables that may contain secrets",
      "description": "Pattern detected: os.getenv(\"HF_TOKEN",
      "file_path": "references/baseline_hf_api.py",
      "line_number": 46,
      "snippet": "token = os.getenv(\"HF_TOKEN\")",
      "remediation": "Minimize access to environment variables. Document why needed",
      "analyzer": "static",
      "metadata": {
        "matched_pattern": "os\\.getenv\\s*\\([^)]*(?:KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL)",
        "matched_text": "os.getenv(\"HF_TOKEN",
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "scanner_category": "SECURITY VIOLATION",
        "reference_depth": 0,
        "meta_reviewed": true
      }
    },
    {
      "id": "YARA_script_injection_6dd5502983",
      "rule_id": "YARA_script_injection",
      "category": "command_injection",
      "severity": "CRITICAL",
      "title": "INJECTION ATTACK detected by YARA",
      "description": "Detects embedded scripting payloads (JS, VBScript, etc.) in MCP tool descriptions: \\033[0;31m",
      "file_path": "references/find_models_by_paper.sh",
      "line_number": 10,
      "snippet": "RED='\\033[0;31m'",
      "remediation": "Review and remove injection attack pattern",
      "analyzer": "static",
      "metadata": {
        "yara_rule": "script_injection",
        "yara_namespace": "script_injection",
        "matched_string": "$ansi_deception",
        "threat_type": "INJECTION ATTACK",
        "meta_reviewed": true
      }
    },
    {
      "id": "YARA_script_injection_e4f6374faa",
      "rule_id": "YARA_script_injection",
      "category": "command_injection",
      "severity": "CRITICAL",
      "title": "INJECTION ATTACK detected by YARA",
      "description": "Detects embedded scripting payloads (JS, VBScript, etc.) in MCP tool descriptions: \\033[0;32m",
      "file_path": "references/find_models_by_paper.sh",
      "line_number": 11,
      "snippet": "GREEN='\\033[0;32m'",
      "remediation": "Review and remove injection attack pattern",
      "analyzer": "static",
      "metadata": {
        "yara_rule": "script_injection",
        "yara_namespace": "script_injection",
        "matched_string": "$ansi_deception",
        "threat_type": "INJECTION ATTACK",
        "meta_reviewed": true
      }
    },
    {
      "id": "YARA_script_injection_7b83987049",
      "rule_id": "YARA_script_injection",
      "category": "command_injection",
      "severity": "CRITICAL",
      "title": "INJECTION ATTACK detected by YARA",
      "description": "Detects embedded scripting payloads (JS, VBScript, etc.) in MCP tool descriptions: \\033[1;33m",
      "file_path": "references/find_models_by_paper.sh",
      "line_number": 12,
      "snippet": "YELLOW='\\033[1;33m'",
      "remediation": "Review and remove injection attack pattern",
      "analyzer": "static",
      "metadata": {
        "yara_rule": "script_injection",
        "yara_namespace": "script_injection",
        "matched_string": "$ansi_deception",
        "threat_type": "INJECTION ATTACK",
        "meta_reviewed": true
      }
    },
    {
      "id": "YARA_script_injection_c09378a64a",
      "rule_id": "YARA_script_injection",
      "category": "command_injection",
      "severity": "CRITICAL",
      "title": "INJECTION ATTACK detected by YARA",
      "description": "Detects embedded scripting payloads (JS, VBScript, etc.) in MCP tool descriptions: \\033[0;34m",
      "file_path": "references/find_models_by_paper.sh",
      "line_number": 13,
      "snippet": "BLUE='\\033[0;34m'",
      "remediation": "Review and remove injection attack pattern",
      "analyzer": "static",
      "metadata": {
        "yara_rule": "script_injection",
        "yara_namespace": "script_injection",
        "matched_string": "$ansi_deception",
        "threat_type": "INJECTION ATTACK",
        "meta_reviewed": true
      }
    },
    {
      "id": "YARA_script_injection_fada1ece5e",
      "rule_id": "YARA_script_injection",
      "category": "command_injection",
      "severity": "CRITICAL",
      "title": "INJECTION ATTACK detected by YARA",
      "description": "Detects embedded scripting payloads (JS, VBScript, etc.) in MCP tool descriptions: \\033[0m",
      "file_path": "references/find_models_by_paper.sh",
      "line_number": 14,
      "snippet": "NC='\\033[0m' # No Color",
      "remediation": "Review and remove injection attack pattern",
      "analyzer": "static",
      "metadata": {
        "yara_rule": "script_injection",
        "yara_namespace": "script_injection",
        "matched_string": "$ansi_deception",
        "threat_type": "INJECTION ATTACK",
        "meta_reviewed": true
      }
    },
    {
      "id": "llm_finding_hugging-face-tool-builder_0",
      "rule_id": "LLM_SOCIAL_ENGINEERING",
      "category": "social_engineering",
      "severity": "LOW",
      "title": "Missing Optional Metadata Fields",
      "description": "The skill's YAML manifest is missing optional metadata fields (license, compatibility, allowed-tools). While these fields are optional per the agent skills specification, their absence reduces transparency about the skill's requirements and constraints. The missing 'allowed-tools' field means users cannot verify which agent tools the skill intends to use.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "license: Not specified\ncompatibility: Not specified\nallowed-tools: Not specified",
      "remediation": "Add optional metadata fields to improve transparency:\n- license: Specify the license (e.g., MIT, Apache-2.0)\n- compatibility: Document where the skill works (e.g., 'Claude.ai, Claude Code, API')\n- allowed-tools: Declare which tools are used (e.g., [Bash, Python, Read, Write])",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "The hugging-face-tool-builder skill is SAFE with minor documentation gaps. The skill creates reusable command-line scripts for interacting with the Hugging Face API. All scripts follow secure patterns: they use the HF_TOKEN environment variable for authentication (avoiding hardcoded secrets), include proper help documentation, handle errors gracefully, and perform legitimate API operations. The scripts read from internal reference files within the skill package (normal behavior for self-contained skills) and make authenticated API calls to huggingface.co (the legitimate service). No prompt injection, data exfiltration, command injection, or other security threats were detected. The only issue is missing optional metadata fields in the YAML manifest, which is a minor documentation concern rather than a security risk.",
        "primary_threats": [],
        "aitech": "AITech-2.1",
        "aitech_name": "Social Engineering",
        "aisubtech": null,
        "aisubtech_name": null,
        "scanner_category": "SOCIAL ENGINEERING",
        "meta_reviewed": true
      }
    }
  ],
  "scan_duration_seconds": 1399.67356467247,
  "duration_ms": 1399673,
  "analyzers_used": [
    "static_analyzer",
    "llm_analyzer",
    "meta_analyzer"
  ],
  "timestamp": "2026-02-08T00:13:54.562663"
}