Security audit
Security checks for vulnerabilities and agentic risk
This is a straightforward JSON formatter/validator that reads user-specified JSON and only writes output when the user chooses an output path.
Before installing, note that using --output writes to disk and can overwrite the chosen destination file. Prefer stdout or a new output filename when formatting important JSON files.
The skill documentation describes file read/write behavior but does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization ambiguity where an agent or platform may permit broader filesystem access than users expect, increasing the risk of unintended file disclosure or overwrite.
This markdown file documents a behavior that affects user data by allowing output to be written to a specified file, including an example that saves results to a file. Under the markdown-specific warning criterion, there is no explicit user warning about file modification or overwrite risk.
The file includes a Chinese usage scenario and expected output alongside English documentation, but it does not state that multilingual use is optional or that the skill is intended for a specific locale. Under the policy rule, forcing or assuming a language/locale without user opt-in can be a natural-language policy concern.
