JSON Render Table

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:57 PM UTC
• Version: 0.2.0

Overview

The skill does what it claims, but it can automatically install unpinned global npm and Playwright tooling, which is a persistent host change that deserves review before use.

Install or use this only in a controlled environment where you are comfortable with npm and Playwright downloads. Prefer preinstalling reviewed, pinned versions locally or in a sandbox, and do not let an agent run the global install commands without explicit approval.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15
• Finding: Unpinned Third-Party Package Installation and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:15` and `references/compact-table-template.md:14-16` **Vulnerability Type**: Unpinned npm dependencies and unsafe global package installation **Risk Level**: Medium ### Vulnerable Code `SKILL.md:15`: ```text 1. Ensure `json-render` is available. If missing, run `npm i -g json-render-cli`; if Chromium is missing, run `npx playwright install chromium`. ``` `references/compact-table-template.md:14-16`: ```bash if ! command -v json-render >/dev/null 2>&1; then npm i -g json-render-cli fi ``` ### Technical Analysis The skill instructs the agent to install `json-render-cli` from the npm registry without specifying a reviewed version or verifying package integrity. The installation is global, so it modifies the agent user's shared execution environment rather than an isolated project environment. The Chromium installation instruction also invokes `playwright` through `npx` without pinning a version. Depending on the local environment and npm configuration, `npx` may resolve and execute package code obtained from the registry. npm package installation can execute package lifecycle scripts. Consequently, the effective code executed by this skill is not limited to the files included in the audited project. It can change whenever a new package version is published. A compromised maintainer account, malicious package release, dependency compromise, or unexpected upstream change could therefore result in arbitrary code execution. No evidence indicates that the currently named packages are malicious. The vulnerability is the unpinned and globally installed supply-chain dependency. ### Attack Path 1. A user invokes the table-rendering skill on a system where `json-render` is unavailable, or Chromium needs to be installed. 2. The agent follows the documented setup instructions. 3. `npm i -g json-render-cli` retrieves the latest registry-selected package version and its transitive dependencies. Altern ...[truncated 1227 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin exact reviewed versions of all tools, including `json-render-cli` and Playwright. 2. Maintain a lockfile containing resolved versions and integrity hashes. 3. Install dependencies locally in a dedicated project directory rather than with `npm i -g`. 4. Invoke the pinned local binary through an explicit path or a package script instead of relying on global command resolution. 5. Run installation and rendering inside a restricted container or sandbox with minimal filesystem, environment, and network access. 6. Disable npm lifecycle scripts with `--ignore-scripts` where compatible with the selected packages. 7. If lifecycle scripts are required, review them and their transitive dependencies before allowing execution. 8. Configure npm to use an approved registry and verify package provenance or signatures where supported. 9. Replace implicit `npx playwright` resolution with an explicitly pinned local Playwright dependency. 10. Document a controlled installation procedure and fail safely when the approved dependency version is unavailable rather than installing the latest release automatically. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (6)

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

- Keep viewport width close to the sum of column widths and avoid large horizontal slack.
- Start from a compact viewport height and expand only when clipping appears.

## Output Rules

- Prefer `-o /tmp/<name>.png` for image delivery.
- Use `-o stdout` only when caller explicitly asks for Base64.

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The skill instructs the agent to run `npx playwright install chromium` without pinning a specific package version. Using unpinned `npx` causes execution of whatever version is current at runtime, which weakens supply-chain integrity and can lead to unexpected or malicious code execution if the package or its dependencies are compromised. In this skill context, the command is part of setup/troubleshooting guidance, so it is plausibly benign but still operationally risky.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: This troubleshooting instruction again tells the agent to execute `npx playwright install chromium` without version pinning. Repeating the unpinned network-fetched execution path increases the chance that an agent will invoke mutable external code, creating a supply-chain exposure rather than a deterministic install flow. The skill is about rendering images, so this behavior is not core to the business logic and can be tightened safely.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The manifest describes a skill for rendering compact generic data tables from arbitrary structured rows/columns, but this template hard-codes a specific six-column ticket schema: ID, Priority, Status, Assignee, Updated, and Topic. That indicates behavior oriented toward issue/ticket snapshots rather than a generic table renderer.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The template instructs the agent to run `npm i -g json-render-cli` automatically if the binary is missing, which causes code from the public npm ecosystem to be installed and made executable on the host. This expands the trust boundary to a mutable third-party package source and can lead to supply-chain compromise, unexpected lifecycle-script execution, or persistent modification of the environment.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Presenting a global npm installation command without warning or disclosure encourages silent execution of a host-modifying operation that fetches and runs untrusted package code. In an agent context, this is especially risky because the step is framed as routine setup, making it more likely to be executed non-interactively without scrutiny or approval.

Static analysis

No suspicious patterns detected.