ClawHub
Back to skill

Security audit

Jrv Yaml Toolkit

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward local YAML utility with disclosed file operations and only minor documentation gaps.

Install only if you want a local YAML/JSON command-line helper. Review output paths before using --output, especially on important configuration files, and do not rely on full multi-document YAML support outside the validate command.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill description is incomplete relative to the documented behavior: it can modify YAML via set, enumerate keys, and emit minified output, while claiming multi-document support more broadly than is justified. Description-behavior mismatches are dangerous because they can cause users or higher-level agents to invoke state-changing or broader-capability operations under the false assumption that the skill is read-only or more constrained than it really is.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill advertises commands that read from files and can write output to a user-specified file, but it does not declare any tool scope or permissions boundary in the skill metadata. In an agent environment, undeclared file read/write capability increases the chance of unintended data access or modification because the caller cannot easily reason about what filesystem actions the skill may perform.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The module docstring presents the script as a full-featured YAML toolkit with commands implying broad YAML handling, while the manifest context also states support for multi-document YAML. In code, only cmd_validate loads all YAML documents; the general-purpose loaders and most commands operate on a single document via yaml.safe_load, contradicting the advertised support in the documentation context.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest explicitly says the toolkit supports multi-document YAML, and validate does parse all documents with yaml.safe_load_all. However, the shared loaders used by format, conversion, query, set, merge, lint, keys, and minify call yaml.safe_load, which reads only a single document and does not implement multi-document handling for those features.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The documentation states that output can be written to a file but does not warn about overwriting existing files or modifying user data. In practice this can lead to accidental clobbering of configuration files or unintended persistence of transformed data, especially when the skill is used by automation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.