{
  "skill_name": "local-llm-router",
  "skill_path": "/home/runner/work/skill-scanner-test/skill-scanner-test/scripts/../skills/hoodini-ai-agents-skills/skills/local-llm-router",
  "is_safe": true,
  "max_severity": "MEDIUM",
  "findings_count": 3,
  "findings": [
    {
      "id": "MANIFEST_MISSING_LICENSE_c5ae9be793",
      "rule_id": "MANIFEST_MISSING_LICENSE",
      "category": "policy_violation",
      "severity": "INFO",
      "title": "Skill does not specify a license",
      "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": null,
      "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)",
      "analyzer": "static",
      "metadata": {}
    },
    {
      "id": "MDBLOCK_PYTHON_SUBPROCESS_bd7dbd12fd",
      "rule_id": "MDBLOCK_PYTHON_SUBPROCESS",
      "category": "command_injection",
      "severity": "MEDIUM",
      "title": "Python code block executes shell commands",
      "description": "Code block in SKILL.md at line 99 contains potentially dangerous Python code.",
      "file_path": "SKILL.md",
      "line_number": 99,
      "snippet": "self.process = subprocess.Popen(",
      "remediation": "Review the code block for security implications.",
      "analyzer": "behavioral",
      "metadata": {
        "from_code_block": true,
        "block_language": "python"
      }
    },
    {
      "id": "PIPELINE_TAINT_f857058413",
      "rule_id": "PIPELINE_TAINT_FLOW",
      "category": "command_injection",
      "severity": "LOW",
      "title": "Dangerous data flow in command pipeline",
      "description": "Pipeline downloads data from the network and executes it: `curl -fsSL https://ollama.ai/install.sh | sh`. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.)",
      "file_path": "references/model-matrix.md",
      "line_number": 2,
      "snippet": "curl -fsSL https://ollama.ai/install.sh | sh",
      "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution.",
      "analyzer": "pipeline",
      "metadata": {
        "pipeline": "curl -fsSL https://ollama.ai/install.sh | sh",
        "source_taints": [
          "NETWORK_DATA"
        ],
        "sink_command": "sh",
        "chain_length": 2,
        "in_documentation": true
      }
    }
  ],
  "scan_duration_seconds": 0.3622729778289795,
  "duration_ms": 362,
  "analyzers_used": [
    "static_analyzer",
    "bytecode",
    "pipeline",
    "behavioral_analyzer",
    "trigger_analyzer"
  ],
  "timestamp": "2026-05-09T01:41:47.135428+00:00",
  "scan_metadata": {
    "policy_name": "default",
    "policy_version": "1.0",
    "policy_preset_base": "balanced",
    "policy_fingerprint_sha256": "90696022f7fc8c307edfd13e2d4713f9d14042a147f48a3c7c7fde921dc2a686"
  }
}