Expanso json-pretty

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:56 PM UTC
• Version: 1.0.0

Overview

This is a simple JSON formatter with a real but limited network-exposure caution for its optional server mode.

Install is reasonable for local JSON formatting. If you use the MCP/server pipeline, bind it to localhost or put it behind access controls, resource limits, and request-size limits before exposing it on a shared or public network.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: pipeline-mcp.yaml:5

Finding

Unauthenticated Network-Wide JSON Endpoint Lacks an Input-Size Limit

Content

View full analysis

Vulnerability Details

File Location: pipeline-mcp.yaml:5-12
Vulnerability Type: Unrestricted network exposure and resource exhaustion
Risk Level: Medium

yaml

http:
  enabled: true
  address: "0.0.0.0:${PORT:-8080}"

input:
  http_server:
    path: /format
    allowed_verbs: [POST]
    timeout: 30s

Technical Analysis

The MCP pipeline binds its HTTP service to all available network interfaces and exposes an unauthenticated POST /format endpoint. No request-body size limit is configured for this endpoint. The submitted content is subsequently parsed and formatted as JSON by the mapping processor in pipeline-mcp.yaml:16-19.

Unlike the CLI pipeline, which limits buffered input to 10 MiB, the HTTP pipeline does not declare an equivalent limit. A reachable client can therefore submit oversized or deeply nested JSON documents that consume substantial memory and CPU while being buffered, parsed, and serialized. The 30-second request timeout does not itself impose a body-size, rate, concurrency, or computational-complexity limit.

Attack Path

1. An attacker identifies a deployment where the default service port, normally TCP 8080, is reachable.
2. The attacker sends an oversized or deeply nested JSON payload to POST /format.
3. The service buffers and parses the attacker-controlled document.
4. The formatting operation constructs a serialized representation, potentially increasing peak memory consumption.
5. The attacker repeats requests or sends them concurrently to exhaust memory or CPU and degrade or terminate the service.

Impact Assessment

Successful exploitation does not grant system privileges or direct access to credentials. Its primary impact is availability loss within the process or container running the pipeline. Depending on deployment-level resource isolation and restart policies, an attacker may cause request latency, process termination, repeated restarts, or de ...[truncated 53 chars]

Remediation

View remediation

Remediation Suggestions

• Bind the service to 127.0.0.1 by default unless remote access is explicitly required.
• Configure a strict HTTP request-body limit appropriate for JSON formatting, no greater than the CLI pipeline's 10 MiB limit unless justified.
• Require authentication or network-level access control for remotely exposed deployments.
• Apply rate limits, request concurrency limits, and per-client quotas at the service or reverse-proxy layer.
• Run the pipeline with explicit memory and CPU limits so resource exhaustion remains isolated.
• Reject excessive JSON nesting depth and unusually complex documents before formatting.
• Return controlled errors for oversized or malformed input without including sensitive implementation details.
• Add automated tests covering oversized payload rejection, excessive nesting, concurrent requests, and unauthenticated remote access controls.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.