{
  "skill_name": "meta-ads",
  "skill_path": "/home/runner/work/skill-scanner-test/skill-scanner-test/scripts/../skills/hoodini-ai-agents-skills/skills/meta-ads",
  "is_safe": false,
  "max_severity": "CRITICAL",
  "findings_count": 13,
  "findings": [
    {
      "id": "CROSSFILE_ENV_VAR_EXFILTRATION_440c703d79",
      "rule_id": "BEHAVIOR_CROSSFILE_ENV_VAR_EXFILTRATION",
      "category": "data_exfiltration",
      "severity": "CRITICAL",
      "title": "Cross-file env var exfiltration: 3 files",
      "description": "Environment variable access with network calls in scripts/exchange_token.py, scripts/meta_client.py",
      "file_path": null,
      "line_number": null,
      "snippet": null,
      "remediation": "Review data flow across files: scripts/create_campaign.py, scripts/meta_client.py, scripts/exchange_token.py",
      "analyzer": "behavioral",
      "metadata": {
        "files_involved": [
          "scripts/create_campaign.py",
          "scripts/meta_client.py",
          "scripts/exchange_token.py"
        ],
        "threat_type": "env_var_exfiltration",
        "evidence": {
          "env_var_files": [
            "scripts/exchange_token.py",
            "scripts/meta_client.py"
          ],
          "network_files": [
            "scripts/exchange_token.py",
            "scripts/meta_client.py",
            "scripts/create_campaign.py"
          ]
        }
      }
    },
    {
      "id": "CROSSFILE_EXFILTRATION_CHAIN_fb89d06e72",
      "rule_id": "BEHAVIOR_CROSSFILE_EXFILTRATION_CHAIN",
      "category": "data_exfiltration",
      "severity": "CRITICAL",
      "title": "Cross-file exfiltration chain: 3 files",
      "description": "Multi-file exfiltration chain detected: scripts/exchange_token.py, scripts/meta_client.py collect data \u2192 encode \u2192 scripts/exchange_token.py, scripts/meta_client.py, scripts/create_campaign.py transmit to network",
      "file_path": null,
      "line_number": null,
      "snippet": null,
      "remediation": "Review data flow across files: scripts/create_campaign.py, scripts/meta_client.py, scripts/exchange_token.py",
      "analyzer": "behavioral",
      "metadata": {
        "files_involved": [
          "scripts/create_campaign.py",
          "scripts/meta_client.py",
          "scripts/exchange_token.py"
        ],
        "threat_type": "exfiltration_chain",
        "evidence": {
          "collection_files": [
            "scripts/exchange_token.py",
            "scripts/meta_client.py"
          ],
          "encoding_files": [],
          "network_files": [
            "scripts/exchange_token.py",
            "scripts/meta_client.py",
            "scripts/create_campaign.py"
          ]
        }
      }
    },
    {
      "id": "TOOL_MISMATCH_NETWORK_110ee0d566",
      "rule_id": "TOOL_ABUSE_UNDECLARED_NETWORK",
      "category": "unauthorized_tool_use",
      "severity": "MEDIUM",
      "title": "Undeclared network usage",
      "description": "Skill code uses network libraries but doesn't declare network requirement",
      "file_path": "../skills/hoodini-ai-agents-skills/skills/meta-ads/SKILL.md",
      "line_number": null,
      "snippet": null,
      "remediation": "Declare network usage in compatibility field or remove network calls",
      "analyzer": "static",
      "metadata": {}
    },
    {
      "id": "ENV_VAR_EXFILTRATION_374692c089",
      "rule_id": "BEHAVIOR_ENV_VAR_EXFILTRATION",
      "category": "data_exfiltration",
      "severity": "CRITICAL",
      "title": "Environment variable access with network calls detected",
      "description": "Script accesses environment variables and makes network calls in ../skills/hoodini-ai-agents-skills/skills/meta-ads/scripts/exchange_token.py",
      "file_path": "../skills/hoodini-ai-agents-skills/skills/meta-ads/scripts/exchange_token.py",
      "line_number": null,
      "snippet": null,
      "remediation": "Remove environment variable harvesting or network transmission",
      "analyzer": "behavioral",
      "metadata": {
        "has_network": true,
        "has_env_access": true,
        "suspicious_urls": []
      }
    },
    {
      "id": "ENV_VAR_HARVESTING_95d20b2240",
      "rule_id": "BEHAVIOR_ENV_VAR_HARVESTING",
      "category": "data_exfiltration",
      "severity": "MEDIUM",
      "title": "Environment variable harvesting detected",
      "description": "Script iterates through environment variables in ../skills/hoodini-ai-agents-skills/skills/meta-ads/scripts/exchange_token.py",
      "file_path": "../skills/hoodini-ai-agents-skills/skills/meta-ads/scripts/exchange_token.py",
      "line_number": null,
      "snippet": null,
      "remediation": "Remove environment variable collection unless explicitly required and documented",
      "analyzer": "behavioral",
      "metadata": {}
    },
    {
      "id": "ENV_VAR_EXFILTRATION_a1280600bd",
      "rule_id": "BEHAVIOR_ENV_VAR_EXFILTRATION",
      "category": "data_exfiltration",
      "severity": "CRITICAL",
      "title": "Environment variable access with network calls detected",
      "description": "Script accesses environment variables and makes network calls in ../skills/hoodini-ai-agents-skills/skills/meta-ads/scripts/meta_client.py",
      "file_path": "../skills/hoodini-ai-agents-skills/skills/meta-ads/scripts/meta_client.py",
      "line_number": null,
      "snippet": null,
      "remediation": "Remove environment variable harvesting or network transmission",
      "analyzer": "behavioral",
      "metadata": {
        "has_network": true,
        "has_env_access": true,
        "suspicious_urls": []
      }
    },
    {
      "id": "ENV_VAR_HARVESTING_e23c108d6c",
      "rule_id": "BEHAVIOR_ENV_VAR_HARVESTING",
      "category": "data_exfiltration",
      "severity": "MEDIUM",
      "title": "Environment variable harvesting detected",
      "description": "Script iterates through environment variables in ../skills/hoodini-ai-agents-skills/skills/meta-ads/scripts/meta_client.py",
      "file_path": "../skills/hoodini-ai-agents-skills/skills/meta-ads/scripts/meta_client.py",
      "line_number": null,
      "snippet": null,
      "remediation": "Remove environment variable collection unless explicitly required and documented",
      "analyzer": "behavioral",
      "metadata": {}
    },
    {
      "id": "MANIFEST_MISSING_LICENSE_c5ae9be793",
      "rule_id": "MANIFEST_MISSING_LICENSE",
      "category": "policy_violation",
      "severity": "INFO",
      "title": "Skill does not specify a license",
      "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": null,
      "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)",
      "analyzer": "static",
      "metadata": {}
    },
    {
      "id": "DATA_EXFIL_NETWORK_REQUESTS_b4b9a0a8e5",
      "rule_id": "DATA_EXFIL_NETWORK_REQUESTS",
      "category": "data_exfiltration",
      "severity": "MEDIUM",
      "title": "Outbound network request primitives that can transmit data externally",
      "description": "Pattern detected: requests.post(",
      "file_path": "scripts/create_campaign.py",
      "line_number": 108,
      "snippet": "resp = requests.post(url, data=data, files=files, timeout=120)",
      "remediation": "Ensure network operations are necessary and document allowed destinations",
      "analyzer": "static",
      "metadata": {
        "matched_pattern": "requests\\.(?:get|post|put|delete|patch|request)\\s*\\(",
        "matched_text": "requests.post(",
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "scanner_category": "SECURITY VIOLATION"
      }
    },
    {
      "id": "DATA_EXFIL_NETWORK_REQUESTS_8ac296e016",
      "rule_id": "DATA_EXFIL_NETWORK_REQUESTS",
      "category": "data_exfiltration",
      "severity": "MEDIUM",
      "title": "Outbound network request primitives that can transmit data externally",
      "description": "Pattern detected: requests.get(",
      "file_path": "scripts/exchange_token.py",
      "line_number": 47,
      "snippet": "resp = requests.get(url, params=params, timeout=30)",
      "remediation": "Ensure network operations are necessary and document allowed destinations",
      "analyzer": "static",
      "metadata": {
        "matched_pattern": "requests\\.(?:get|post|put|delete|patch|request)\\s*\\(",
        "matched_text": "requests.get(",
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "scanner_category": "SECURITY VIOLATION"
      }
    },
    {
      "id": "YARA_coercive_injection_generic_af1690a043",
      "rule_id": "YARA_coercive_injection_generic",
      "category": "prompt_injection",
      "severity": "CRITICAL",
      "title": "PROMPT INJECTION detected by YARA",
      "description": "Detects coercive prompt injections in tool description fields: hidden input",
      "file_path": "scripts/exchange_token.py",
      "line_number": 76,
      "snippet": "help=\"Short-lived user token. If omitted, you'll be prompted (hidden input).\",",
      "remediation": "Review and remove prompt injection pattern",
      "analyzer": "static",
      "metadata": {
        "yara_rule": "coercive_injection_generic",
        "yara_namespace": "coercive_injection_generic",
        "matched_string": "$hidden_param",
        "threat_type": "PROMPT INJECTION"
      }
    },
    {
      "id": "DATA_EXFIL_NETWORK_REQUESTS_97b89c5a3f",
      "rule_id": "DATA_EXFIL_NETWORK_REQUESTS",
      "category": "data_exfiltration",
      "severity": "MEDIUM",
      "title": "Outbound network request primitives that can transmit data externally",
      "description": "Pattern detected: requests.request(",
      "file_path": "scripts/meta_client.py",
      "line_number": 129,
      "snippet": "resp = requests.request(method, url, params=params, data=data, timeout=60)",
      "remediation": "Ensure network operations are necessary and document allowed destinations",
      "analyzer": "static",
      "metadata": {
        "matched_pattern": "requests\\.(?:get|post|put|delete|patch|request)\\s*\\(",
        "matched_text": "requests.request(",
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "scanner_category": "SECURITY VIOLATION"
      }
    },
    {
      "id": "DATA_EXFIL_NETWORK_REQUESTS_a71c17d907",
      "rule_id": "DATA_EXFIL_NETWORK_REQUESTS",
      "category": "data_exfiltration",
      "severity": "MEDIUM",
      "title": "Outbound network request primitives that can transmit data externally",
      "description": "Pattern detected: requests.get(",
      "file_path": "scripts/meta_client.py",
      "line_number": 189,
      "snippet": "resp = requests.get(next_url, timeout=60)",
      "remediation": "Ensure network operations are necessary and document allowed destinations",
      "analyzer": "static",
      "metadata": {
        "matched_pattern": "requests\\.(?:get|post|put|delete|patch|request)\\s*\\(",
        "matched_text": "requests.get(",
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "scanner_category": "SECURITY VIOLATION"
      }
    }
  ],
  "scan_duration_seconds": 17.24622869491577,
  "duration_ms": 17246,
  "analyzers_used": [
    "static_analyzer",
    "bytecode",
    "pipeline",
    "behavioral_analyzer",
    "trigger_analyzer"
  ],
  "timestamp": "2026-05-09T01:44:05.475605+00:00",
  "scan_metadata": {
    "policy_name": "default",
    "policy_version": "1.0",
    "policy_preset_base": "balanced",
    "policy_fingerprint_sha256": "90696022f7fc8c307edfd13e2d4713f9d14042a147f48a3c7c7fde921dc2a686"
  }
}