Security audit
Security checks across malware telemetry and agentic risk
The JSON tool itself is straightforward, but the package also includes an under-documented CI verifier that can run Python files from target folders, so it warrants Review before installation.
Install only if you trust the publisher and intend to use the JSON CLI. Avoid running ci/verify_product.py on untrusted folders or in environments with secrets unless it is sandboxed; the core json_tools.py appears consistent with the advertised local JSON operations.
def has_self_test(fp):
r = subprocess.run([sys.executable, fp, "self-test"], capture_output=True, text=True, timeout=30)
return r.returncode == 0 and "PASS" in r.stdouttests = [os.path.join(folder, f) for f in os.listdir(folder)
if (f.startswith("test_") or f.endswith("_test.py")) and f.endswith(".py")]
if tests:
st_ok = all(subprocess.run([sys.executable, t], capture_output=True, text=True,
timeout=30).returncode == 0 for t in tests)
st_note = f"{len(tests)} test_*.py"
elif re.search(r"(?im)^test\s*:", skill_txt):VirusTotal findings are pending for this skill version.
No suspicious patterns detected.