JSON Processor

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:46 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward local JSON utility with expected file read/write behavior and no evidence of hidden, persistent, networked, or deceptive actions.

Install only if you are comfortable with a local command-line JSON helper that reads the files you point it at and can write output files when requested. Avoid running validation on untrusted schemas with complex regex patterns, and do not use this as a security-critical JSON Schema validator without fixing the noted validation bugs.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/json_processor.py:123

Finding

Unbounded Regular Expression Evaluation Enables Denial of Service

Content

View full analysis

Vulnerability Details

File Location: scripts/json_processor.py, lines 123-125
Vulnerability Type: Regular expression denial of service through an untrusted schema pattern
Risk Level: Medium

Vulnerable Code:

python

      # pattern check (string)
      if "pattern" in schema_node and isinstance(value, str):
          if not re.search(schema_node["pattern"], value):
              errors.append(f"{path}: '{value}' does not match pattern {schema_node['pattern']}")

Technical Analysis

The validator passes a pattern from a user-supplied JSON schema directly to Python's backtracking regular-expression engine. It also allows the subject string to originate from user-supplied JSON. No limits are imposed on pattern complexity, input length, or matching time.

A pattern with catastrophic backtracking, such as (a+)+$, can require exponentially increasing CPU time when matched against a long near-matching string. Python's standard re.search() does not provide a timeout for this operation. An invalid pattern can also raise an uncaught re.error and terminate the command.

Attack Path

1. An attacker supplies or influences a schema consumed by the validate command.
2. The schema defines a pathological expression in a pattern field, such as (a+)+$.
3. The attacker supplies a corresponding JSON string containing many a characters followed by a nonmatching character.
4. validate_schema() passes both values to unrestricted re.search().
5. The regular-expression engine performs excessive backtracking, consuming CPU and delaying or preventing command completion. Alternatively, a malformed expression causes an uncaught exception.

Impact Assessment

Successful exploitation can exhaust CPU time or crash the JSON validation process. In an Agent or service that invokes this utility automatically, this could delay workflows, consume worker capacity, or cause repeated job failures.

The v ...[truncated 218 chars]

Remediation

View remediation

Remediation Suggestions

• Treat schema patterns as untrusted input and enforce conservative maximum lengths for both patterns and subject strings.
• Reject unsupported or suspiciously complex constructs before evaluation.
• Catch re.error and report an ordinary schema-validation error rather than terminating the process.
• When validation of untrusted patterns is required, use a regular-expression engine with guaranteed linear-time behavior or enforceable execution limits.
• Consider performing pattern matching in an isolated worker with strict CPU and wall-clock limits.
• Add regression tests using malformed patterns and known catastrophic-backtracking examples.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/json_processor.py:110

Finding

Boolean Values Bypass Number and Integer Schema Type Validation

Content

View full analysis

Vulnerability Details

File Location: scripts/json_processor.py, lines 110-119
Vulnerability Type: Incorrect JSON Schema type validation
Risk Level: Low

Vulnerable Code:

python

      # type check
      if "type" in schema_node:
          type_map = {
              "string": str, "number": (int, float),
              "integer": int, "boolean": bool,
              "array": list, "object": dict, "null": type(None),
          }
          expected = type_map.get(schema_node["type"])
          if expected and not isinstance(value, expected):
              expected_str = schema_node["type"]
              errors.append(f"{path}: expected {expected_str}, got {type(value).__name__}")

Technical Analysis

Python's bool type is a subclass of int. Consequently, isinstance(True, int) and isinstance(False, int) both return True. The tuple used for the number type also contains int, so boolean values are accepted as both JSON Schema integer and number values.

This behavior conflicts with JSON Schema semantics, where booleans and numbers are distinct types. The validator can therefore produce a false successful-validation result for structurally invalid data.

Attack Path

1. A schema declares a security-relevant field as integer or number.
2. An attacker submits true or false as the field value.
3. validate_schema() maps the expected type to int or (int, float).
4. Python's isinstance() accepts the boolean because bool inherits from int.
5. No type error is recorded, and the tool may report that the document conforms to the schema.
6. A downstream consumer that relies on this validation may process data with an unexpected type or apply boolean-to-integer coercion.

Impact Assessment

The issue compromises validation integrity and can allow invalid input to pass a numeric type gate. The practical impact depends on how callers use the validation ...[truncated 304 chars]

Remediation

View remediation

Remediation Suggestions

• Handle numeric schema types explicitly instead of relying solely on Python inheritance:

  python

  if schema_type == "integer":
      valid = isinstance(value, int) and not isinstance(value, bool)
  elif schema_type == "number":
      valid = isinstance(value, (int, float)) and not isinstance(value, bool)
  

• Keep the existing dedicated boolean check for actual boolean values.
• Add tests confirming that true and false fail integer and number schemas.
• Add boundary tests for valid integers, floating-point values, booleans, null values, and strings to ensure behavior remains consistent with the documented JSON Schema subset.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill documentation exposes commands that can write files, such as formatting JSON with an --output path, but the skill manifest does not declare any tool scope restrictions like permissions or allowed-tools. Without explicit scoping, an agent may invoke the skill with broader filesystem access than intended, increasing the chance of unintended file overwrite or modification when processing untrusted paths.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.