Expanso json-flatten

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:56 PM UTC
• Version: 1.0.0

Overview

The skill mainly processes JSON, but its MCP mode exposes an unauthenticated HTTP endpoint on all network interfaces, so it needs review before use.

Install only if you understand the MCP mode. Prefer the CLI pipeline or bind the HTTP server to localhost, add authentication, and put request-size/rate limits in front of it before using it on any reachable host. Avoid deploying from the remote URL unless you trust that source at run time.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: pipeline-mcp.yaml:5

Finding

Unauthenticated HTTP Service Exposed on All Network Interfaces

Content

View full analysis

Vulnerability Details

File Location: pipeline-mcp.yaml:5-13
Vulnerability Type: Unauthenticated network exposure and missing request-size controls
Risk Level: Medium

yaml

http:
  enabled: true
  address: "0.0.0.0:${PORT:-8080}"

input:
  http_server:
    path: /flatten
    allowed_verbs: [POST]
    timeout: 30s

Technical Analysis

The MCP pipeline binds its HTTP listener to 0.0.0.0, making the service available through every network interface permitted by the deployment environment. No authentication, authorization, or network access restriction is configured for the /flatten endpoint.

The HTTP input also lacks an explicit request-body size limit. The CLI pipeline defines a one-megabyte buffer limit, but no equivalent control is present here. An unauthenticated, network-reachable client can therefore submit requests for JSON parsing and response generation. The pipeline includes the parsed input in root.original, so attacker-supplied content is reflected in the synchronous response.

Attack Path

1. An operator starts pipeline-mcp.yaml on a host or container whose configured port is reachable by an untrusted party.
2. The service listens on every interface at ${PORT:-8080}.
3. The attacker sends unauthenticated POST requests to /flatten.
4. The pipeline parses the supplied JSON, computes its keys, and returns the supplied object in the response.
5. The attacker repeats requests or supplies resource-intensive payloads to consume parsing, memory, connection, and response-bandwidth capacity.

This path depends on the deployment port being exposed to the attacker; the configuration alone does not prove public Internet reachability.

Impact Assessment

An attacker can invoke the pipeline without credentials and process arbitrary submitted JSON within the service's runtime privileges. The finding does not provide operating-system command execution or privilege escala ...[truncated 324 chars]

Remediation

View remediation

Remediation Suggestions

• Bind to 127.0.0.1 by default when remote access is not explicitly required.
• Require authenticated requests and enforce authorization appropriate to the deployment.
• Place remotely accessible deployments behind a reverse proxy or gateway that provides TLS, authentication, request-body limits, rate limiting, and connection limits.
• Configure an explicit, conservative maximum HTTP request-body size comparable to the CLI pipeline's one-megabyte limit.
• Add concurrency limits, request-rate limits, and bounded parsing time and memory.
• Restrict network ingress through firewall rules, security groups, or container network policies.
• Avoid returning root.original unless reflecting the complete submitted object is required.
• Document that direct public exposure of the listener is unsafe without compensating access controls.
• Add tests confirming rejection of unauthenticated, oversized, and excessive requests.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.