ClawHub
Back to skill

Security audit

Json Tools

Security checks for vulnerabilities and agentic risk

Overview

The bundled JSON tool looks mostly local and purpose-aligned, but the install instructions tell users to download and run mutable remote Python code that may differ from the reviewed package.

Install only from the reviewed bundled file or a pinned, verified release. Avoid following the current curl-from-main instruction, and do not run ci/verify_product.py against untrusted folders outside a sandbox.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:32
Finding

Mutable Remote Python Payload Is Downloaded and Subsequently Executed

Content
View full analysis
Remediation
View remediation
/json_tools.py" echo " json_tools.py" | sha256sum --check - ``` 4. Prefer signed release artifacts and document signature verification. 5. Ensure `SKILL.md` and `README.md` use identical, secure installation instructions. 6. Clarify that the tool operates offline only after trusted installation; the current installation process itself requires network access. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
ci/verify_product.py:37
Finding

Product Verification Harness Executes Python from Untrusted Input Folders

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (10)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

This finding indicates the skill performs CI/product verification tasks, reads metadata files, compiles Python, executes scripts/tests, scans for secrets, and invokes another checker despite presenting itself as a JSON utility. In the context of an agent skill, concealed execution and filesystem inspection are materially more dangerous than a normal feature mismatch because they can broaden access to source trees, credentials, and arbitrary code paths under the guise of benign data processing.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

This finding indicates the skill performs CI/product verification tasks, reads metadata files, compiles Python, executes scripts/tests, scans for secrets, and invokes another checker despite presenting itself as a JSON utility. In the context of an agent skill, concealed execution and filesystem inspection are materially more dangerous than a normal feature mismatch because they can broaden access to source trees, credentials, and arbitrary code paths under the guise of benign data processing.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill advertises commands that operate on local files and invokes Python via shell, but the manifest does not declare any explicit tool scope such as allowed-tools or permissions. In an agent environment, missing scope boundaries can cause the agent to grant broader-than-necessary file and shell access, increasing the chance of unintended repository reads, writes, or command execution.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
93% confidence
Finding

This code executes an arbitrary Python file from the target product folder as part of verification by invoking python <file> self-test. Because the file set comes from os.listdir(folder) and the harness is intended to inspect untrusted skills, a malicious skill author can place code in a .py file that runs during CI/local verification, resulting in arbitrary code execution on the verifier host.

Content

Scanner excerpt · ci/verify_product.py (reported line 37)May include surrounding context.

python
def has_self_test(fp):
    r = subprocess.run([sys.executable, fp, "self-test"], capture_output=True, text=True, timeout=30)
    return r.returncode == 0 and "PASS" in r.stdout

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · ci/verify_product.py (reported line 67)May include surrounding context.

python
all_ok &= axis(False, "frontmatter (no SKILL.md)")
        all_ok &= axis(False, "docs (no SKILL.md)")
    # 3 compiles
    comp_ok = all(subprocess.run([sys.executable, "-m", "py_compile", fp],
                                capture_output=True).returncode == 0 for fp in files)
    all_ok &= axis(comp_ok, "compiles (py_compile all .py)")
    # 4 self-test (any of 3 valid forms)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
95% confidence
Finding

This code executes any test_*.py or *_test.py file found in the target product folder during verification. In an adversarial skill ecosystem, an attacker can submit a crafted test file whose top-level code steals secrets, modifies the runner, or pivots further into the CI environment, making this a direct arbitrary code execution path.

Content

Scanner excerpt · ci/verify_product.py (reported line 79)May include surrounding context.

python
tests = [os.path.join(folder, f) for f in os.listdir(folder)
                 if (f.startswith("test_") or f.endswith("_test.py")) and f.endswith(".py")]
        if tests:
            st_ok = all(subprocess.run([sys.executable, t], capture_output=True, text=True,
                                      timeout=30).returncode == 0 for t in tests)
            st_note = f"{len(tests)} test_*.py"
        elif re.search(r"(?im)^test\s*:", skill_txt):

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · ci/verify_product.py (reported line 92)May include surrounding context.

python
# 7 deploy-ready
    ci = os.path.join(os.path.dirname(os.path.abspath(__file__)), "ci_check.py")
    if os.path.isfile(ci) and os.path.isfile(skill):
        r = subprocess.run([sys.executable, ci], cwd=folder, capture_output=True, text=True)
        all_ok &= axis(r.returncode == 0, "deploy-ready (ci/ci_check.py PASS)")
    else:
        all_ok &= axis(True, "deploy-ready (skipped)")

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest description limits the skill to validate, format, query, diff, filter, flatten, and merge JSON files. The README's quick start advertises an additional 'stats' subcommand, which expands behavior beyond the stated scope and is not mentioned in the manifest description.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest describes the skill as validating, formatting, querying, diffing, filtering, flattening, and merging JSON files, but the code also exposes a 'stats' command. This is an extra user-facing behavior beyond the stated scope, even though it remains JSON-related and local-only.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

This code writes merged JSON to a user-specified output path, but the only user-facing message appears after the write completes. While the function's purpose is to merge files, there is no pre-action warning, confirmation, or explicit disclosure in the command help/docstring that using --output will create or overwrite a file.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.