JSON Wizard

• Outcome: Pass
• Latest audit: Sep 14, 2026 · 11:05 PM UTC
• Version: 1.0.0

Overview

This is a straightforward JSON/YAML formatting utility with disclosed, user-directed file reading and no hidden persistence, network access, or destructive behavior.

Install this like a normal local formatting tool, preferably in a virtual environment, and pin PyYAML to a reviewed version if reproducible builds matter. Use --file only with files you intentionally want the formatter to read.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned PyYAML Dependency Permits Unreviewed Supply-Chain Updates

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1
Additional Location: README.md:14-16
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable dependency declaration:

text

pyyaml>=6.0

Related installation instructions:

bash

pip install pyyaml

Technical Analysis

The dependency constraint accepts any PyYAML release at or above version 6.0, while the documentation installs the latest release available from the configured package index. Neither installation method specifies an exact reviewed version or verifies distribution integrity with cryptographic hashes.

Consequently, dependency resolution is not reproducible and may install code that was never reviewed with this project. If a future PyYAML distribution or the package source used by pip is compromised or substituted, package-controlled build or installation logic could execute during installation. The project does not contain evidence of intentional exploitation, malicious dependency naming, or an unsafe custom package index; this finding concerns the uncontrolled dependency resolution policy.

Attack Path

1. An attacker compromises a future permitted PyYAML release, its distribution artifacts, or the package index configured in the victim's environment.
2. A user installs dependencies using pip install -r requirements.txt or follows the documented pip install pyyaml command.
3. pip resolves and downloads the attacker-controlled distribution because no exact version or integrity hash is required.
4. Malicious package build or installation behavior executes under the privileges of the user running pip.
5. The installed dependency may subsequently execute malicious behavior when imported by scripts/json_formatter.py.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the account or build environment installing or ...[truncated 470 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin PyYAML to an exact, reviewed version, for example:

   text

   PyYAML==REVIEWED_VERSION
   

2. Generate and require cryptographic hashes for all accepted distributions:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

3. Maintain the pinned dependency through a controlled update process that includes vulnerability scanning, release-note review, and automated tests.
4. Document use of an approved package index and configure CI/CD environments to reject unexpected or untrusted indexes.
5. Update README.md so its installation command uses the same pinned, hash-verified dependency specification rather than installing the latest available release.
6. Install dependencies in an isolated virtual environment or container under a non-privileged account to limit the impact of a compromised package.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill advertises file-path based input via the --file option and examples indicate the script can read local files, but the manifest declares no permissions or allowed-tools scope. That mismatch can lead to over-broad or implicit file access expectations, making it harder to enforce least privilege and increasing the chance the skill is used to read unintended local files.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill description is presented in Chinese at L03 while the rest of the surrounding audit context is language-neutral, and the file does not state that the skill is intended only for Chinese-speaking users or provide any language opt-in. This can violate language/locale policy because it imposes a specific language without user choice or justification.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency is specified as pyyaml>=6.0, which is not pinned to an exact version and allows different environments to install different releases over time. This weakens build reproducibility and can unintentionally introduce vulnerable or breaking versions through future dependency resolution.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

pyyaml>=6.0

Unverifiable Dependency: pyyaml has 8 known advisory(ies) (CVE-2019-20477 (Deserialization of Untrusted Data in PyYAML); CVE-2020-1747 (Improper Input Validation in PyYAML); CVE-2020-14343 (Improper Input Validation in PyYAML) +5 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

PyYAML has a history of security advisories, and because the manifest does not pin an exact version, it is not possible to verify whether deployments will consistently avoid affected releases. In a tool that explicitly parses and converts JSON/YAML, this matters more because the dependency is likely exercised on user-supplied data, increasing exposure if an unsafe or vulnerable release is installed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.