{
  "skill_name": "streme-launcher",
  "skill_path": "/workspace/skills/clawhub-streme-launcher",
  "skill_directory": "/workspace/skills/clawhub-streme-launcher",
  "is_safe": true,
  "max_severity": "MEDIUM",
  "findings_count": 1,
  "findings": [
    {
      "id": "llm_finding_streme-launcher_0",
      "rule_id": "LLM_DATA_EXFILTRATION",
      "category": "data_exfiltration",
      "severity": "MEDIUM",
      "title": "Hardcoded Private Key Risk in Code Examples",
      "description": "The instruction body contains TypeScript examples that import 'privateKeyToAccount' from 'viem/accounts', suggesting users will handle private keys directly. While no actual private keys are hardcoded, the pattern encourages insecure key management practices. Users may hardcode private keys in their implementation following these examples, leading to credential exposure.",
      "file_path": "SKILL.md",
      "line_number": 7,
      "snippet": "import { privateKeyToAccount } from 'viem/accounts';",
      "remediation": "Add explicit warnings about private key security. Recommend using environment variables, hardware wallets, or secure key management services. Include example: 'const account = privateKeyToAccount(process.env.PRIVATE_KEY as `0x${string}`);' with security best practices documentation.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "The Streme Token Launcher skill is a specialized tool for deploying tokens on the Base blockchain via Streme contracts. The skill itself does not contain malicious code, scripts, or direct security threats. However, it has several security and documentation concerns: (1) Code examples encourage direct private key handling without adequate security warnings, (2) Missing critical manifest metadata reduces transparency, (3) Incomplete documentation with broken file references, and (4) Lack of security guidance for external API credential management. The skill appears legitimate in purpose but needs improved security documentation and complete metadata to help users implement it safely. No data exfiltration, prompt injection, or command injection threats detected. Primary risks are around user implementation security rather than the skill itself being malicious.",
        "primary_threats": [
          "Credential Management Risks",
          "Missing Metadata Transparency",
          "Incomplete Documentation"
        ],
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "scanner_category": "SECURITY VIOLATION",
        "meta_validated": true,
        "meta_confidence": "HIGH",
        "meta_confidence_reason": "The code examples clearly demonstrate private key handling without security guidance. This is a well-documented security risk in blockchain development where developers frequently hardcode keys.",
        "meta_exploitability": "Medium - Requires user to follow insecure practices, but examples make this likely",
        "meta_impact": "High - Exposed private keys lead to complete wallet compromise and fund theft"
      }
    }
  ],
  "scan_duration_seconds": 25.014419555664062,
  "duration_ms": 25014,
  "analyzers_used": [
    "static_analyzer",
    "llm_analyzer",
    "meta_analyzer"
  ],
  "timestamp": "2026-02-07T20:48:58.692768"
}