ClawHub
Back to skill

Security audit

Jq Json Processor

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward jq helper skill with normal examples and standard install metadata; the main caution is that one example overwrites a JSON file if copied directly.

Install this if you want jq command examples. Use a trusted package manager for jq, and review any command that writes back to a file before running it, especially examples that use mv to replace the original JSON file.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill includes a command sequence that modifies a file by writing transformed content to a temporary file and then replacing the original. Although this is a common shell pattern, the documentation does not warn that it overwrites the source file, which can lead to accidental destructive changes or data loss if users run it on important files or with an incorrect jq filter. In this skill context, the risk is moderate because the skill is specifically about JSON file manipulation, so users are likely to copy commands directly.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.