Security audit

Composer Json Validator

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local Composer JSON linter that reads a chosen composer.json file and reports issues, with no evidence of hidden network access, persistence, or destructive behavior.

Use this as a convenience linter, not a complete Composer security audit. Manually review Composer lifecycle scripts before running composer install or composer update, especially any script that invokes interpreters, shells, URLs, or downloaded content.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/composer_json_validator.py:67
Finding: Incomplete Detection of URL-Based Composer Script Execution
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/composer_json_validator.py:168
Finding: Malformed JSON Field Types Can Crash the Validator
Content: View full analysis
list: issues = [] require = data.get("require", {}) require_dev = data.get("require-dev", {}) # Rule 6: No duplicates between require and require-dev overlap = set(require.keys()) & set(require_dev.keys()) for pkg in sorted(overlap): issues.append(Issue("error", "dependencies", f"Package '{pkg}' appears in both require and require-dev")) # Rules 7, 8, 9, 10, 11 — iterate require has_php = False for pkg, version in require.items(): if pkg == "php": has_php = True # Rule 7: valid constraints issue = _check_version_constraint(pkg, version) if issue: issues.append(issue) # Rule 8: dev packages in require if pkg.lower() in DEV_PACKAGES: issues.append(Issue("warning", "dependencies", f"Dev package '{pkg}' found in require — should be in require-dev")) # Rule 9: wildcard versions (non-ext packages) if version.strip() == "*" and not pkg.startswith("ext-"): issues.append(Issue("warning", "dependencies", f"Package '{pkg}' uses wildcard '*' version constraint — be explicit")) # Rule 11: ext-* should not be * if pkg.startswith("ext-") and version.strip() == "*": issues.append(Issue("warning", "dependencies", f"Extension '{pkg}' uses wildcard '*' — specify an explicit constraint (e.g. '*' is acceptable for extensions, but document intent)")) ``` Related parsing code accepts any syntactically valid JSON value without schema validation: ```python with open(path, "r", encoding="utf-8") as f: return json.load(f), None ``` ### Technical Analysis The parser v ...[truncated 1971 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill invokes Python scripts and reads local files but does not declare any explicit tool restrictions such as allowed-tools or permissions. This creates an overbroad execution surface where an agent may permit shell access beyond the minimum needed, increasing the chance of command execution abuse or unintended file access if the skill is triggered in a sensitive context.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.