JSON Render Table

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:57 PM UTC
• Version: 0.2.0

Overview

The skill does what it claims, but it can automatically install unpinned global npm and Playwright tooling, which is a persistent host change that deserves review before use.

Install or use this only in a controlled environment where you are comfortable with npm and Playwright downloads. Prefer preinstalling reviewed, pinned versions locally or in a sandbox, and do not let an agent run the global install commands without explicit approval.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned Third-Party Package Installation and Execution

Content

View full analysis

/dev/null 2>&1; then npm i -g json-render-cli fi ``` ### Technical Analysis The skill instructs the agent to install `json-render-cli` from the npm registry without specifying a reviewed version or verifying package integrity. The installation is global, so it modifies the agent user's shared execution environment rather than an isolated project environment. The Chromium installation instruction also invokes `playwright` through `npx` without pinning a version. Depending on the local environment and npm configuration, `npx` may resolve and execute package code obtained from the registry. npm package installation can execute package lifecycle scripts. Consequently, the effective code executed by this skill is not limited to the files included in the audited project. It can change whenever a new package version is published. A compromised maintainer account, malicious package release, dependency compromise, or unexpected upstream change could therefore result in arbitrary code execution. No evidence indicates that the currently named packages are malicious. The vulnerability is the unpinned and globally installed supply-chain dependency. ### Attack Path 1. A user invokes the table-rendering skill on a system where `json-render` is unavailable, or Chromium needs to be installed. 2. The agent follows the documented setup instructions. 3. `npm i -g json-render-cli` retrieves the latest registry-selected package version and its transitive dependencies. Altern ...[truncated 1227 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (6)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md

- Keep viewport width close to the sum of column widths and avoid large horizontal slack.
- Start from a compact viewport height and expand only when clipping appears.

## Output Rules

- Prefer `-o /tmp/<name>.png` for image delivery.
- Use `-o stdout` only when caller explicitly asks for Base64.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The skill instructs the agent to run npx playwright install chromium without pinning a specific package version. Using unpinned npx causes execution of whatever version is current at runtime, which weakens supply-chain integrity and can lead to unexpected or malicious code execution if the package or its dependencies are compromised. In this skill context, the command is part of setup/troubleshooting guidance, so it is plausibly benign but still operationally risky.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

This troubleshooting instruction again tells the agent to execute npx playwright install chromium without version pinning. Repeating the unpinned network-fetched execution path increases the chance that an agent will invoke mutable external code, creating a supply-chain exposure rather than a deterministic install flow. The skill is about rendering images, so this behavior is not core to the business logic and can be tightened safely.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest describes a skill for rendering compact generic data tables from arbitrary structured rows/columns, but this template hard-codes a specific six-column ticket schema: ID, Priority, Status, Assignee, Updated, and Topic. That indicates behavior oriented toward issue/ticket snapshots rather than a generic table renderer.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The template instructs the agent to run npm i -g json-render-cli automatically if the binary is missing, which causes code from the public npm ecosystem to be installed and made executable on the host. This expands the trust boundary to a mutable third-party package source and can lead to supply-chain compromise, unexpected lifecycle-script execution, or persistent modification of the environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Presenting a global npm installation command without warning or disclosure encourages silent execution of a host-modifying operation that fetches and runs untrusted package code. In an agent context, this is especially risky because the step is framed as routine setup, making it more likely to be executed non-interactively without scrutiny or approval.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.