Expanso json-validate

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:56 PM UTC
• Version: 1.0.0

Overview

The skill appears to validate JSON as described, but its MCP mode exposes an unauthenticated HTTP service on all network interfaces by default.

Install only if you are comfortable with the MCP mode opening a network-reachable validation endpoint. Prefer CLI mode for local validation, or run the MCP server bound to localhost with firewall/resource limits and a pinned, trusted expanso-edge version.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: pipeline-mcp.yaml:13
• Finding: Unauthenticated HTTP Validation Service Exposed on All Network Interfaces## Vulnerability Details **File Location**: `pipeline-mcp.yaml:13-20` **Vulnerability Type**: Unauthenticated network service exposure **Risk Level**: Medium ```yaml http: enabled: true address: "0.0.0.0:${PORT:-8080}" input: http_server: path: /validate allowed_verbs: [POST] ``` ### Technical Analysis The MCP pipeline binds its HTTP service to `0.0.0.0`, making the validation endpoint accessible through every network interface available to the host. The configuration does not define authentication, authorization, or a trusted-source restriction. Although the endpoint only validates JSON, remote accessibility unnecessarily expands the attack surface. Any host capable of reaching the configured port can invoke parsing and response-generation operations. The endpoint is therefore exposed beyond the local use case presented by the skill. ### Attack Path 1. An operator starts the MCP pipeline using its default address and port. 2. The service listens on all network interfaces at port `8080`. 3. An attacker identifies a network path to that port. 4. The attacker sends repeated `POST` requests to `/validate` without credentials. 5. The service accepts and processes each request, consuming parsing, memory, serialization, and connection resources. ### Impact Assessment An attacker does not obtain operating-system privileges or direct access to credentials through this issue. However, any network-reachable party can use the service without authorization. This can enable unauthorized resource consumption and contribute to denial of service, particularly when combined with the absence of an explicit HTTP request-size limit. The affected scope includes the validation process and the CPU, memory, connection, and network resources available to it.
• Remediation: ## Remediation Suggestions - Bind to `127.0.0.1` by default for local MCP operation. - Require an explicit configuration change before permitting external network exposure. - Add authentication and authorization when remote access is required. - Restrict ingress through host or network firewall rules. - Apply per-client rate limits, request concurrency limits, and connection limits. - Document that binding to `0.0.0.0` exposes the service to other reachable systems.

T09 · Insecure Skill Coding Practices

Warning

• Location: pipeline-mcp.yaml:17
• Finding: HTTP Endpoint Does Not Define a Request Body Size Limit## Vulnerability Details **File Location**: `pipeline-mcp.yaml:17-21` **Vulnerability Type**: Unbounded HTTP input processing **Risk Level**: Medium ```yaml input: http_server: path: /validate allowed_verbs: [POST] timeout: 30s ``` ### Technical Analysis The HTTP input configuration defines a request timeout but does not define a maximum request or body size. The pipeline subsequently hashes, measures, parses, retains, and potentially returns the submitted JSON content. In contrast, the CLI pipeline explicitly sets a 10 MiB input buffer limit. No equivalent protection is present in the HTTP pipeline. A timeout alone does not reliably constrain memory use or computational cost after a request body has been received. Oversized or deeply nested JSON can increase buffering, hashing, parsing, and response-serialization costs. ### Attack Path 1. An attacker reaches the `/validate` HTTP endpoint. 2. The attacker submits an oversized JSON document or content with excessive structural nesting. 3. The service receives the body without an explicit configured size limit. 4. The pipeline hashes the input, calculates its length, attempts JSON parsing, and may retain the parsed representation. 5. For valid input, the service also serializes the parsed content into the response. 6. Repeated or concurrent requests increase CPU and memory pressure and may degrade or interrupt service. ### Impact Assessment Successful exploitation can exhaust or significantly consume memory, CPU time, network bandwidth, and request-processing capacity. This may cause increased latency, process termination, or denial of service for legitimate users. No privilege escalation or direct host compromise is established by the reviewed code. The impact is primarily availability loss within the pipeline process and potentially the host if the process is not resource-isolated.
• Remediation: ## Remediation Suggestions - Configure a strict maximum HTTP request-body size appropriate for the intended use case. - Reject oversized requests before hashing or JSON parsing. - Enforce maximum JSON nesting depth and structural complexity where supported. - Add request concurrency limits and per-client rate limits. - Run the service with container or operating-system CPU and memory limits. - Return a clear client error, such as HTTP `413 Payload Too Large`, for rejected bodies. - Apply equivalent input constraints consistently across CLI and HTTP modes.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:7
• Finding: Documentation Installs an Unpinned Executable Dependency## Vulnerability Details **File Location**: `SKILL.md:7-8` **Vulnerability Type**: Unpinned third-party executable dependency **Risk Level**: Medium ```markdown - Expanso Edge installed (`expanso-edge` binary in PATH) - Install via: `clawhub install expanso-edge` ``` ### Technical Analysis The documented installation command identifies the `expanso-edge` dependency only by package name. It does not pin an audited version, integrity digest, immutable artifact reference, or signature. Because this dependency is the executable used to run the pipeline, changes to the package delivered under that identifier directly affect the skill's execution environment. A compromised registry entry, publisher account, package ownership change, or unsafe future release could introduce behavior that was not included in this audit. No malicious dependency is present in the reviewed project, and no current compromise was demonstrated. The weakness is the absence of controls that ensure users install the same reviewed dependency version. ### Attack Path 1. An attacker compromises the package publisher, distribution account, or relevant package-delivery infrastructure, or causes an unsafe future version to be published. 2. A user follows the documented unversioned installation command. 3. The package manager resolves the identifier to the modified release. 4. The user invokes `expanso-edge` to run the skill pipelines. 5. The modified executable runs with the privileges of that user and can perform actions beyond the behavior visible in the reviewed YAML files. ### Impact Assessment The potential impact depends on the privileges of the user running the installed executable. A compromised dependency could access data and resources available to that account, alter pipeline behavior, communicate externally, or execute arbitrary code. The project itself does not demonstrate such compromise. The finding concerns avoidable supply-chain exposu ...[truncated 68 chars]
• Remediation: ## Remediation Suggestions - Pin the dependency to a specific audited version. - Provide and verify a cryptographic checksum or signed artifact. - Document the expected publisher and authoritative distribution source. - Prefer immutable artifact references rather than a mutable package name or latest-version resolution. - Define a controlled upgrade process in which new versions are reviewed and tested before adoption. - Where supported, use lock files, signature verification, and provenance attestations to make installation reproducible.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

External Transmission

Medium

• Category: Data Exfiltration

Content

PORT=8080 expanso-edge run pipeline-mcp.yaml &

# Make request
curl -X POST http://localhost:8080/validate \
  -H "Content-Type: application/json" \
  -d '{"json": "{\"key\": \"value\", \"array\": [1, 2, 3]}"}'
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

#
# Usage:
#   PORT=8080 expanso-edge run pipeline-mcp.yaml &
#   curl -X POST http://localhost:8080/validate \
#     -d '{"json": "{\"key\": \"value\"}"}'

name: "json-validate-mcp"

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The comments and backend description explicitly state the skill runs locally without API calls, yet the component list includes `http_server`. This inconsistency is security-relevant because operators may deploy the skill under the false assumption that it has no network-exposed interface, resulting in weaker review, monitoring, or isolation than a network-capable skill should receive.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The manifest claims the skill performs pure local JSON validation with no API calls, but it declares an HTTP server input component. Exposing an HTTP server expands the attack surface by allowing remote or local network-triggered invocation, which is unnecessary for the stated functionality and can lead to unintended access paths, abuse, or integration bypasses if the runtime binds to a reachable interface.

Static analysis

No suspicious patterns detected.