{
  "skill_name": "use-dom",
  "skill_path": "/workspace/skills/expo-skills/plugins/expo-app-design/skills/use-dom",
  "skill_directory": "/workspace/skills/expo-skills/plugins/expo-app-design/skills/use-dom",
  "is_safe": true,
  "max_severity": "LOW",
  "findings_count": 2,
  "findings": [
    {
      "id": "llm_finding_use-dom_0",
      "rule_id": "LLM_DATA_EXFILTRATION",
      "category": "data_exfiltration",
      "severity": "LOW",
      "title": "Missing Optional Metadata Fields",
      "description": "The skill manifest is missing optional fields 'compatibility' and 'allowed-tools'. While these fields are not required per the agent skills specification, their absence makes it harder to assess the skill's intended usage context and tool requirements. This is informational only and does not indicate a security threat.",
      "file_path": "SKILL.md",
      "line_number": 1,
      "snippet": "compatibility: Not specified\nallowed-tools: Not specified",
      "remediation": "Consider adding 'compatibility' field to specify supported platforms (e.g., 'Claude.ai, Claude Code, API') and 'allowed-tools' field to declare which agent tools this skill expects to use (e.g., [Read, Write, Python]).",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "This skill appears to be SAFE. It is a documentation/tutorial skill that teaches developers how to use Expo DOM components to integrate web code into React Native applications. The skill contains only instructional markdown content with code examples and no executable scripts. There are no signs of malicious behavior, data exfiltration, prompt injection, or other security threats. The missing optional metadata fields and referenced files are minor documentation issues that do not pose security risks. The skill's purpose (teaching Expo DOM component usage) matches its description, and the content is purely educational.",
        "primary_threats": [],
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "scanner_category": "SECURITY VIOLATION",
        "meta_reviewed": true
      }
    },
    {
      "id": "llm_finding_use-dom_1",
      "rule_id": "LLM_DATA_EXFILTRATION",
      "category": "data_exfiltration",
      "severity": "LOW",
      "title": "Referenced Files Not Found in Package",
      "description": "The skill instructions reference multiple files (the.py, DOMComponent.py, CodeBlock.py, WebChart.py, Native.py, SyntaxHighlighter.py, and image files) that are not included in the skill package. These appear to be example filenames used in code snippets rather than actual dependencies. However, missing referenced files could indicate incomplete packaging or documentation issues.",
      "file_path": null,
      "line_number": null,
      "snippet": "Files referenced but not found: the.py, DOMComponent.py, CodeBlock.py, templates/logo.png, native.py, assets/logo.png, WebChart.py, Native.py, SyntaxHighlighter.py, references/logo.png",
      "remediation": "If these are example filenames for documentation purposes, clarify this in the instructions. If these are actual required files, include them in the skill package. Consider using more obvious placeholder names like 'example.tsx' or 'YourComponent.tsx' to avoid confusion.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "This skill appears to be SAFE. It is a documentation/tutorial skill that teaches developers how to use Expo DOM components to integrate web code into React Native applications. The skill contains only instructional markdown content with code examples and no executable scripts. There are no signs of malicious behavior, data exfiltration, prompt injection, or other security threats. The missing optional metadata fields and referenced files are minor documentation issues that do not pose security risks. The skill's purpose (teaching Expo DOM component usage) matches its description, and the content is purely educational.",
        "primary_threats": [],
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "scanner_category": "SECURITY VIOLATION",
        "meta_reviewed": true
      }
    }
  ],
  "scan_duration_seconds": 14.018906831741333,
  "duration_ms": 14018,
  "analyzers_used": [
    "static_analyzer",
    "llm_analyzer",
    "meta_analyzer"
  ],
  "timestamp": "2026-02-07T22:12:29.768942"
}