Security audit
Security checks for vulnerabilities and agentic risk
This is a simple local JSON-query helper with some packaging and documentation rough edges, but no evidence of hidden, persistent, destructive, or exfiltrating behavior.
Install only if you are comfortable with a local Python CLI reading JSON files you explicitly point it at. Expect some packaging friction because the documented command names do not fully match the shipped files, and review the Chinese documentation or translate it before use if needed.
The title and all user-facing documentation are written exclusively in Chinese, with no indication that other languages are supported or that the locale restriction is optional. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the constraint is clearly documented and justified.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def test_cli_basic_query(self):
import subprocess
result = subprocess.run(
['python3', 'jsonq', self.temp_file.name, 'users[0].name'],
capture_output=True,
text=True
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def test_cli_invalid_file(self):
import subprocess
result = subprocess.run(
['python3', 'jsonq', 'nonexistent.json', 'name'],
capture_output=True,
text=True
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
bad_file.write('not valid json')
bad_file.close()
result = subprocess.run(
['python3', 'jsonq', bad_file.name, 'name'],
capture_output=True,
text=True
The module-level documentation states '50+ test cases', but the visible test methods in this file appear to total fewer than 50. This is an active documentation mismatch about what the file contains, which can mislead reviewers about the implemented test scope.
With no manifest available, the skill's purpose is unknown, so launching external processes is not justified by any declared scope. The test code invokes python3 jsonq via subprocess.run, which adds execution capability beyond simple in-process unit testing behavior.
No suspicious patterns detected.