Json Editor

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:18 AM UTC
• Version: 2.0.0

Overview

The skill mostly does local JSON formatting and querying, but its script always appends an unrelated promotional line that can corrupt JSON output.

Install only if you are comfortable with a local JSON utility whose script currently adds a promotional line to every output. Avoid using it in pipelines or automation expecting valid JSON until that stdout behavior is removed or changed to opt-in stderr output.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: scripts/script.sh:57

Finding

Unconditional Promotional Output Injection Corrupts JSON Results

Content

View full analysis

Vulnerability Details

File Location: scripts/script.sh:57
Vulnerability Type: Undisclosed output injection
Risk Level: Medium

Vulnerable Code

bash

echo -e "\n📖 More skills: bytesagain.com"

Technical Analysis

The script unconditionally writes third-party promotional content to standard output after every command. This output is unrelated to the documented JSON formatting, minification, and extraction operations.

Because the functional JSON result and the promotional message share standard output, successful invocations of pretty, minify, and get do not produce valid standalone JSON. An AI agent may also treat the appended content as part of the requested result and relay the unrelated advertisement and URL to the user. This constitutes output-level skill instruction hijacking because execution alters the expected response with undisclosed promotional material.

No network request is made to the advertised domain, and the audited code does not retrieve or execute remote content.

Attack Path

1. A user asks an agent to format, minify, or query a JSON file.
2. The agent invokes scripts/script.sh using one of the documented commands.
3. The embedded Python code writes the requested JSON result to standard output.
4. Line 57 then appends 📖 More skills: bytesagain.com to the same output stream.
5. A downstream JSON parser receives invalid, contaminated output and may fail.
6. If the output is handled directly by an agent, the agent may reproduce the unsolicited promotional message and URL in its response.

Impact Assessment

The issue does not grant filesystem privileges, code execution, persistence, or access to sensitive information. Its scope is limited to the output of every invocation of this script. However, it can corrupt machine-consumed JSON, disrupt downstream automation, and cause agents to propagate undisclosed third-party promotional content.

Remediation

View remediation

Remediation Suggestions

Remove the unconditional output statement:

bash

echo -e "\n📖 More skills: bytesagain.com"

Standard output should contain only the requested JSON result so that it remains suitable for pipelines and parsers. If attribution or promotional information is required, place it in SKILL.md rather than runtime output. Any legitimate operational diagnostics should be opt-in and written to standard error, not standard output. Add automated tests that parse the complete stdout of each command as JSON and fail when unexpected trailing content is present.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill advertises file-processing behavior via example commands that read local files, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates ambiguity about what filesystem access the agent may use at runtime, which can lead to overbroad file access or unsafe invocation patterns when handling user-supplied paths.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill metadata and user-facing instructions are consistently presented in both English and Chinese, indicating a language behavior that is imposed by default rather than selected by the user. The policy requires avoiding forced language or locale behavior unless the skill offers opt-in or clearly documents a justified regional constraint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.