ClawHub
Back to skill

Security audit

Json Formatter Pro

Security checks for vulnerabilities and agentic risk

Overview

This is a local JSON utility skill with some overstated documentation, but no evidence of hidden access, persistence, exfiltration, or destructive behavior.

Install only if you need a simple local JSON helper. Treat its advertised JSONPath/JMESPath and syntax-highlighting claims as inaccurate unless the publisher updates the implementation or documentation.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The code generally aligns with a JSON utility purpose: it formats, minifies, validates, and extracts/query data from JSON. However, the declared description overstates several capabilities. There is no JMESPath library or parser, no syntax-highlighting logic, and the query implementation is only a simplistic dot-splitting extractor with minimal list handling rather than robust JSONPath support. Additionally, the code exposes diff and sort operations that are not mentioned in the declared purpose. Because the declared feature set does not accurately represent important implemented and missing capabilities, this is a mismatch.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest description advertises built-in JMESPath query and JSONPath support, but the implementation only provides a very limited 'Simple JSONPath-like query' that splits on dots and strips brackets/wildcards. There is no JMESPath engine or full JSONPath support in the code, so the documented querying behavior materially exceeds the actual implementation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The README includes key descriptive and usage-section text in Chinese, such as the standalone description and feature labels, without stating that language selection is optional. This can violate a language/locale policy when a skill presents a fixed language experience without user opt-in.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill description says the toolkit includes syntax highlighting, but this script only parses, reformats, validates, queries, diffs, and sorts JSON strings. No code emits colorized output, token styling, or any other syntax-highlighting behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
75% confidence
Finding

The top-level docstring presents the tool as a broad 'JSON Formatter Pro' supporting advanced operations, while the inline comment in the query function reveals that querying is only a 'Simple JSONPath-like query'. This is an active documentation mismatch because the high-level documentation implies more capable query behavior than the code actually provides.

Content

No source excerpt is available for this finding.