JSON Utils

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:55 AM UTC
• Version: 1.0.0

Overview

This is a local JSON utility skill with disclosed, purpose-aligned behavior and no evidence of hidden access, persistence, or data exfiltration.

Install it in a virtual environment and consider pinning dependency versions before use. Treat validate_tool_output.py as a convenience validator unless you require strict JSON Schema enforcement; use json_schema_validator.py for full schema validation. Non-German users should expect German-heavy documentation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20

Finding

Unpinned Third-Party Dependencies Create a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:20
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code:

bash

pip install pydantic json-repair jsonschema

Technical Analysis

The documented installation command installs three third-party packages without version constraints or cryptographic hash verification. The project does not provide a lockfile or a hash-locked requirements file.

As a result, installation resolves mutable package versions from the Python package index configured in the executing environment. The installed artifacts may differ between executions. This creates exposure to compromised upstream releases, malicious package-index configuration, and unexpected dependency changes. These packages are imported and trusted by the project’s Python scripts, so malicious dependency code could execute during package installation, build processing, or module import.

Attack Path

1. A user or Agent follows the installation instruction in SKILL.md.
2. pip queries the environment’s configured package index and resolves unspecified package versions.
3. An attacker compromises a future upstream release or influences the configured index to return a malicious distribution.
4. The malicious package executes code during installation or when one of the project scripts imports it.
5. That code runs with the privileges of the user executing pip or the Skill.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the installing or runtime user account. Depending on that account’s permissions, malicious dependency code could read or modify accessible files, access environment variables and credentials, alter the Python environment, or initiate network connections.

The project itself does not request elevated privileges, install persistence, access credentials, or execute remote payloads. Therefore, the dire ...[truncated 113 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the inline unpinned installation command with a reviewed dependency file containing exact versions.
2. Generate and verify cryptographic hashes for every direct and transitive dependency.
3. Install with hash enforcement, for example:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

4. Use a dependency-locking workflow such as pip-tools to produce deterministic dependency sets.
5. Document an approved package index and avoid inheriting untrusted index or extra-index configuration.
6. Recommend installation in a dedicated virtual environment under a non-privileged user.
7. Add automated dependency vulnerability and provenance checks to the release process.
8. Periodically review and deliberately update pinned versions rather than automatically resolving the latest releases.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The core implemented behavior substantially matches parts of the description: it repairs malformed JSON, parses JSON from plain text or markdown code blocks, validates with Pydantic models, extracts JSON from mixed text, and offers safe fallback parsing and tool-call validation. However, several explicitly declared capabilities are absent from the code. There is no JSON Schema validation library usage or schema-validation function, and there is no logic for batch processing multiple files or handling NDJSON/JSON-Lines records. The CLI only accepts a single input string or one file path. Because these missing capabilities are specifically advertised as key use cases, this is a material description-to-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence

Finding

The declared description promises a broad, robust JSON-processing capability set: repair of unreliable LLM JSON, validation against Pydantic models or JSON Schema, batch/NDJSON support, mixed-text JSON extraction, and safe tool-call parsing. The supplied code chunk is much narrower. It mainly loads a schema, validates parsed JSON with the jsonschema library, converts Pydantic models to JSON Schema, and offers a CLI for validating a single input. It does rely on an imported parse_json function for parsing/repair, so some repair functionality may exist indirectly, but the code shown does not implement the broader declared features such as batch processing, NDJSON support, mixed-text extraction, or tool-call fallback handling. Because the declared purpose materially overstates the behavior present in this chunk, this is a mismatch.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code file contains natural-language text that forces a specific language for documentation and user-facing behavior, such as the module docstring and many inline descriptions. Under the policy, language constraints should either be optional for the user or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script advertises schema-based validation but only maps a small subset of JSON Schema types into a dynamically created Pydantic model. It ignores many security-relevant constraints such as enum, pattern, additionalProperties, nested schema rules, numeric/string bounds, and composition keywords, so malformed or policy-violating tool output may be accepted as valid. In a skill meant for robust tool-call validation, this mismatch is more dangerous because downstream agents may trust the validator as an enforcement boundary.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file contains substantial user-facing documentation in German while other parts are in English, but it does not state that the skill is intentionally German-only or give users a language/locale choice. That can violate language/locale policy expectations because the skill implicitly forces mixed-language usage without opt-in.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest describes this skill as a local JSON parsing, validation, batch processing, and repair utility. In contrast, the documentation explicitly directs users to WebSearch integration for API documentation and response validation, which introduces network-oriented behavior outside the JSON-only purpose described in the manifest.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

These examples present WebSearch-driven API documentation lookup, response validation, schema generation, and endpoint batch validation as part of the usage narrative. That goes beyond the manifest's stated purpose of robust JSON processing and may mislead users about the actual scope of this skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file presents the API reference entirely in German, including descriptions, parameter explanations, and examples. The policy requires avoiding forced language or locale constraints unless the user is given a choice or the regional limitation is explicitly justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code file contains natural-language documentation strings in German ('mit Pydantic Validation', 'Für robuste Verarbeitung von LLM-Outputs') while providing no indication that the skill is intentionally German-only or that users can opt into another language. Under the policy rule, forcing a specific language without opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This Python file contains natural-language descriptions and CLI/help text in German, including the module docstring and multiple user-facing strings. Because the skill forces a specific language without any opt-in or justification that it is intentionally German-only, it conflicts with the language/locale policy criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This Python file contains natural-language documentation in German (for example the module docstring and later comments/help text), while nothing indicates the skill is intentionally region-specific or that users can opt into this locale. The policy for this audit flags forced language or locale behavior when no choice or justification is provided.

Content

No source excerpt is available for this finding.