{
  "skill": {
    "name": "systematic-debugging",
    "source": "skills/systematic-debugging",
    "scanned_at": "2026-08-28T03:35:25.125165+00:00"
  },
  "risk_assessment": {
    "score": 52,
    "severity": "HIGH",
    "recommendation": "DO_NOT_INSTALL",
    "max_issue_severity": "HIGH"
  },
  "components": [
    {
      "path": "CREATION-LOG.md",
      "type": "markdown",
      "lines": 119,
      "executable": false,
      "size_bytes": 4257,
      "source_url": null,
      "source_identity": null,
      "source_digest": null
    },
    {
      "path": "SKILL.md",
      "type": "markdown",
      "lines": 283,
      "executable": false,
      "size_bytes": 9465,
      "source_url": null,
      "source_identity": null,
      "source_digest": null
    },
    {
      "path": "condition-based-waiting-example.ts",
      "type": "typescript",
      "lines": 158,
      "executable": true,
      "size_bytes": 5054,
      "source_url": null,
      "source_identity": null,
      "source_digest": null
    },
    {
      "path": "condition-based-waiting.md",
      "type": "markdown",
      "lines": 115,
      "executable": false,
      "size_bytes": 3516,
      "source_url": null,
      "source_identity": null,
      "source_digest": null
    },
    {
      "path": "defense-in-depth.md",
      "type": "markdown",
      "lines": 122,
      "executable": false,
      "size_bytes": 3650,
      "source_url": null,
      "source_identity": null,
      "source_digest": null
    },
    {
      "path": "find-polluter.sh",
      "type": "shell",
      "lines": 72,
      "executable": true,
      "size_bytes": 1986,
      "source_url": null,
      "source_identity": null,
      "source_digest": null
    },
    {
      "path": "root-cause-tracing.md",
      "type": "markdown",
      "lines": 169,
      "executable": false,
      "size_bytes": 5316,
      "source_url": null,
      "source_identity": null,
      "source_digest": null
    },
    {
      "path": "test-academic.md",
      "type": "markdown",
      "lines": 14,
      "executable": false,
      "size_bytes": 653,
      "source_url": null,
      "source_identity": null,
      "source_digest": null
    },
    {
      "path": "test-pressure-1.md",
      "type": "markdown",
      "lines": 58,
      "executable": false,
      "size_bytes": 1900,
      "source_url": null,
      "source_identity": null,
      "source_digest": null
    },
    {
      "path": "test-pressure-2.md",
      "type": "markdown",
      "lines": 68,
      "executable": false,
      "size_bytes": 2283,
      "source_url": null,
      "source_identity": null,
      "source_digest": null
    },
    {
      "path": "test-pressure-3.md",
      "type": "markdown",
      "lines": 69,
      "executable": false,
      "size_bytes": 2692,
      "source_url": null,
      "source_identity": null,
      "source_digest": null
    }
  ],
  "structured_summaries": [],
  "issues": [
    {
      "id": "PE3",
      "finding_id": "finding-f7219066325b40d5848d564c02687c27",
      "category": "Privilege Escalation",
      "pattern": "Credential Access",
      "severity": "HIGH",
      "confidence": 0.7,
      "location": {
        "file": "SKILL.md",
        "start_line": 98,
        "end_line": null
      },
      "finding": "Keychain",
      "explanation": "Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.",
      "remediation": "Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.",
      "code_snippet": "   env | grep IDENTITY || echo \"IDENTITY not in environment\"\n\n   # Layer 3: Signing script\n   echo \"=== Keychain state: ===\"\n   security list-keychains\n   security find-identity -v\n",
      "intent": null,
      "tags": [
        "Privilege Escalation"
      ],
      "evidence": {},
      "match_fingerprint": "044e59b8cb232d8d2a59d6f4b1e8fe2b50ce1a35abe47e0398df30fd491b561c",
      "occurrences": [
        {
          "file": "SKILL.md",
          "start_line": 98,
          "end_line": null
        }
      ]
    },
    {
      "id": "PE3",
      "finding_id": "finding-33ee759b7e5f4a7facb62740807270c2",
      "category": "Privilege Escalation",
      "pattern": "Credential Access",
      "severity": "HIGH",
      "confidence": 0.7,
      "location": {
        "file": "SKILL.md",
        "start_line": 99,
        "end_line": null
      },
      "finding": "keychain",
      "explanation": "Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.",
      "remediation": "Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.",
      "code_snippet": "\n   # Layer 3: Signing script\n   echo \"=== Keychain state: ===\"\n   security list-keychains\n   security find-identity -v\n\n   # Layer 4: Actual signing",
      "intent": null,
      "tags": [
        "Privilege Escalation"
      ],
      "evidence": {},
      "match_fingerprint": "cf159af5f3c5aa20214f7ff51b2ec06e8190ff1ab76c35f09188a749bd35c424",
      "occurrences": [
        {
          "file": "SKILL.md",
          "start_line": 99,
          "end_line": null
        }
      ]
    },
    {
      "id": "E4",
      "finding_id": "finding-3fbc747f2fd540488d1de0220420ca87",
      "category": "Data Exfiltration",
      "pattern": "Context Leakage",
      "severity": "HIGH",
      "confidence": 0.75,
      "location": {
        "file": "defense-in-depth.md",
        "start_line": 73,
        "end_line": null
      },
      "finding": "Capture context",
      "explanation": "Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.",
      "remediation": "Remove any code that sends prompts, responses, or session data externally. Preserve user privacy; never exfiltrate conversation content.",
      "code_snippet": "```\n\n### Layer 4: Debug Instrumentation\n**Purpose:** Capture context for forensics\n\n```typescript\nasync function gitInit(directory: string) {",
      "intent": null,
      "tags": [
        "Data Exfiltration"
      ],
      "evidence": {},
      "match_fingerprint": "4a0c4f991eca111ef87cbb11c732000bea934c1f174d9cb57f6e3b63a4d417e9",
      "occurrences": [
        {
          "file": "defense-in-depth.md",
          "start_line": 73,
          "end_line": null
        }
      ]
    },
    {
      "id": "EA4",
      "finding_id": "finding-585ee6660d0047be8576dc727a84a860",
      "category": "Excessive Agency",
      "pattern": "Unbounded Resource Access",
      "severity": "MEDIUM",
      "confidence": 0.75,
      "location": {
        "file": "condition-based-waiting.md",
        "start_line": 89,
        "end_line": null
      },
      "finding": "Loop forever",
      "explanation": "Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.",
      "remediation": "Set explicit rate limits, timeouts, and resource quotas for API calls, file operations, and compute. Implement circuit breakers for runaway loops.",
      "code_snippet": "**❌ Polling too fast:** `setTimeout(check, 1)` - wastes CPU\n**✅ Fix:** Poll every 10ms\n\n**❌ No timeout:** Loop forever if condition never met\n**✅ Fix:** Always include timeout with clear error\n\n**❌ Stale data:** Cache state before loop",
      "intent": null,
      "tags": [
        "Excessive Agency"
      ],
      "evidence": {},
      "match_fingerprint": "593f247d88c70be4da3e30c34afe81f5fcf45d714cf136b7335177335f5dcd0a",
      "occurrences": [
        {
          "file": "condition-based-waiting.md",
          "start_line": 89,
          "end_line": null
        }
      ]
    }
  ],
  "suppressed_count": 0,
  "suppressed": [],
  "metadata": {
    "has_executable_scripts": true,
    "skillspector_version": "2.10.0",
    "llm_requested": false,
    "llm_available": false,
    "meta_analysis_applied": false,
    "inference_usage": [],
    "filtering_mode": "heuristic"
  },
  "execution_successful": true,
  "analysis_completeness": {
    "total_components": 11,
    "scanned_components": 11,
    "coverage_percent": 100.0,
    "is_complete": false,
    "status": "partial",
    "execution_successful": true,
    "fully_inspected_files": 11,
    "partially_inspected_files": 0,
    "entirely_uninspected_files": 0,
    "ledger_exceptions": [
      {
        "outcome": "partial",
        "phase": "reference_resolution",
        "reason_code": "reference_unresolved",
        "message": "A local path-like reference could not be resolved unambiguously.",
        "path": "SKILL.md",
        "start_line": 79,
        "end_line": 79,
        "fatal": false
      },
      {
        "outcome": "partial",
        "phase": "reference_resolution",
        "reason_code": "reference_unresolved",
        "message": "A local path-like reference could not be resolved unambiguously.",
        "path": "SKILL.md",
        "start_line": 201,
        "end_line": 201,
        "fatal": false
      },
      {
        "outcome": "partial",
        "phase": "reference_resolution",
        "reason_code": "reference_unresolved",
        "message": "A local path-like reference could not be resolved unambiguously.",
        "path": "SKILL.md",
        "start_line": 273,
        "end_line": 273,
        "fatal": false
      }
    ],
    "scope_exclusions": [],
    "analyzer_statuses": [
      {
        "analyzer_id": "artifact_integrity",
        "status": "completed",
        "planned_work": 11,
        "completed": 11,
        "partial": 0,
        "skipped": 0,
        "failed": 0,
        "unaccounted": 0
      },
      {
        "analyzer_id": "behavioral_ast",
        "status": "not_applicable",
        "planned_work": 0,
        "completed": 0,
        "partial": 0,
        "skipped": 0,
        "failed": 0,
        "unaccounted": 0,
        "reason_code": "no_applicable_files",
        "message": "No files matched this analyzer's applicability contract."
      },
      {
        "analyzer_id": "behavioral_taint_tracking",
        "status": "not_applicable",
        "planned_work": 0,
        "completed": 0,
        "partial": 0,
        "skipped": 0,
        "failed": 0,
        "unaccounted": 0,
        "reason_code": "no_applicable_files",
        "message": "No files matched this analyzer's applicability contract."
      },
      {
        "analyzer_id": "mcp_least_privilege",
        "status": "completed",
        "planned_work": 3,
        "completed": 3,
        "partial": 0,
        "skipped": 0,
        "failed": 0,
        "unaccounted": 0
      },
      {
        "analyzer_id": "mcp_rug_pull",
        "status": "completed",
        "planned_work": 11,
        "completed": 11,
        "partial": 0,
        "skipped": 0,
        "failed": 0,
        "unaccounted": 0
      },
      {
        "analyzer_id": "mcp_tool_poisoning",
        "status": "completed",
        "planned_work": 1,
        "completed": 1,
        "partial": 0,
        "skipped": 0,
        "failed": 0,
        "unaccounted": 0
      },
      {
        "analyzer_id": "meta_analyzer",
        "status": "disabled",
        "planned_work": 0,
        "completed": 0,
        "partial": 0,
        "skipped": 0,
        "failed": 0,
        "unaccounted": 0,
        "reason_code": "disabled_by_configuration",
        "message": "Analyzer was disabled by the requested configuration."
      },
      {
        "analyzer_id": "static_patterns_agent_snooping",
        "status": "completed",
        "planned_work": 11,
        "completed": 11,
        "partial": 0,
        "skipped": 0,
        "failed": 0,
        "unaccounted": 0
      },
      {
        "analyzer_id": "static_patterns_anti_refusal",
        "status": "completed",
        "planned_work": 11,
        "completed": 11,
        "partial": 0,
        "skipped": 0,
        "failed": 0,
        "unaccounted": 0
      },
      {
        "analyzer_id": "static_patterns_data_exfiltration",
        "status": "completed",
        "planned_work": 11,
        "completed": 11,
        "partial": 0,
        "skipped": 0,
        "failed": 0,
        "unaccounted": 0
      },
      {
        "analyzer_id": "static_patterns_deserialization",
        "status": "completed",
        "planned_work": 11,
        "completed": 11,
        "partial": 0,
        "skipped": 0,
        "failed": 0,
        "unaccounted": 0
      },
      {
        "analyzer_id": "static_patterns_excessive_agency",
        "status": "completed",
        "planned_work": 11,
        "completed": 11,
        "partial": 0,
        "skipped": 0,
        "failed": 0,
        "unaccounted": 0
      },
      {
        "analyzer_id": "static_patterns_harmful_content",
        "status": "completed",
        "planned_work": 11,
        "completed": 11,
        "partial": 0,
        "skipped": 0,
        "failed": 0,
        "unaccounted": 0
      },
      {
        "analyzer_id": "static_patterns_memory_poisoning",
        "status": "completed",
        "planned_work": 11,
        "completed": 11,
        "partial": 0,
        "skipped": 0,
        "failed": 0,
        "unaccounted": 0
      },
      {
        "analyzer_id": "static_patterns_output_handling",
        "status": "completed",
        "planned_work": 11,
        "completed": 11,
        "partial": 0,
        "skipped": 0,
        "failed": 0,
        "unaccounted": 0
      },
      {
        "analyzer_id": "static_patterns_privilege_escalation",
        "status": "completed",
        "planned_work": 11,
        "completed": 11,
        "partial": 0,
        "skipped": 0,
        "failed": 0,
        "unaccounted": 0
      },
      {
        "analyzer_id": "static_patterns_prompt_injection",
        "status": "completed",
        "planned_work": 11,
        "completed": 11,
        "partial": 0,
        "skipped": 0,
        "failed": 0,
        "unaccounted": 0
      },
      {
        "analyzer_id": "static_patterns_rogue_agent",
        "status": "completed",
        "planned_work": 11,
        "completed": 11,
        "partial": 0,
        "skipped": 0,
        "failed": 0,
        "unaccounted": 0
      },
      {
        "analyzer_id": "static_patterns_ssrf",
        "status": "completed",
        "planned_work": 11,
        "completed": 11,
        "partial": 0,
        "skipped": 0,
        "failed": 0,
        "unaccounted": 0
      },
      {
        "analyzer_id": "static_patterns_supply_chain",
        "status": "completed",
        "planned_work": 11,
        "completed": 11,
        "partial": 0,
        "skipped": 0,
        "failed": 0,
        "unaccounted": 0
      },
      {
        "analyzer_id": "static_patterns_system_prompt_leakage",
        "status": "completed",
        "planned_work": 11,
        "completed": 11,
        "partial": 0,
        "skipped": 0,
        "failed": 0,
        "unaccounted": 0
      },
      {
        "analyzer_id": "static_patterns_tool_misuse",
        "status": "completed",
        "planned_work": 11,
        "completed": 11,
        "partial": 0,
        "skipped": 0,
        "failed": 0,
        "unaccounted": 0
      },
      {
        "analyzer_id": "static_yara",
        "status": "completed",
        "planned_work": 11,
        "completed": 11,
        "partial": 0,
        "skipped": 0,
        "failed": 0,
        "unaccounted": 0
      }
    ],
    "references": [
      {
        "source_path": "SKILL.md",
        "line": 79,
        "column": 15,
        "evidence": "- Verify environment/config propagation",
        "target_path": null,
        "status": "missing",
        "disposition": "partial"
      },
      {
        "source_path": "SKILL.md",
        "line": 112,
        "column": 9,
        "evidence": "See `root-cause-tracing.md` in this directory for the complete backward tracing technique.",
        "target_path": "root-cause-tracing.md",
        "status": "resolved",
        "disposition": "analyzed"
      },
      {
        "source_path": "SKILL.md",
        "line": 201,
        "column": 34,
        "evidence": "- Each fix reveals new shared state/coupling/problem in different place",
        "target_path": null,
        "status": "missing",
        "disposition": "partial"
      },
      {
        "source_path": "SKILL.md",
        "line": 273,
        "column": 8,
        "evidence": "4. Add monitoring/logging for future investigation",
        "target_path": null,
        "status": "missing",
        "disposition": "partial"
      },
      {
        "source_path": "SKILL.md",
        "line": 281,
        "column": 6,
        "evidence": "- **`root-cause-tracing.md`** - Trace bugs backward through call stack to find original trigger",
        "target_path": "root-cause-tracing.md",
        "status": "resolved",
        "disposition": "analyzed"
      },
      {
        "source_path": "SKILL.md",
        "line": 282,
        "column": 6,
        "evidence": "- **`defense-in-depth.md`** - Add validation at multiple layers after finding root cause",
        "target_path": "defense-in-depth.md",
        "status": "resolved",
        "disposition": "analyzed"
      },
      {
        "source_path": "SKILL.md",
        "line": 283,
        "column": 6,
        "evidence": "- **`condition-based-waiting.md`** - Replace arbitrary timeouts with condition polling",
        "target_path": "condition-based-waiting.md",
        "status": "resolved",
        "disposition": "analyzed"
      }
    ],
    "limitations": [],
    "findings_before_filtering": 4,
    "findings_after_filtering": 4
  }
}