ClawHub
Back to skill

Security audit

Json Formatter Pro

Security checks for vulnerabilities and agentic risk

Overview

This is a simple local JSON formatter and validator whose file access matches its stated purpose.

Install if you are comfortable with a local tool reading JSON files you point it at and writing formatted output to paths you choose. Avoid using it on sensitive JSON unless you trust the publisher, and be careful not to overwrite important files with the output option.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

Natural-Language Policy Violations

Low
Confidence
92% confidence
Finding
The file mixes English documentation with one scenario written entirely in Chinese, but it does not state that the skill is multilingual or give users a language/locale choice. Under the language/locale policy, forcing or assuming a specific language without opt-in can be a natural-language policy issue.

Static analysis

No suspicious patterns detected.