Canvas Json Handler Free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:29 AM UTC
• Version: 1.0.0

Overview

This skill mostly documents JSON Canvas editing, but it asks for command execution and broad activation beyond what that purpose clearly needs.

Install only if you are comfortable granting this skill more authority than basic Canvas file editing requires. Prefer running it with command execution disabled or approval-gated, and use it only on user-selected .canvas files in a constrained workspace.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:16

Finding

Unnecessary Arbitrary Command-Execution Permission

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 16-23
Vulnerability Type: Excessive tool permissions and ambiguous duplicate configuration
Risk Level: Medium

yaml

tools:
- - read
- exec
homepage: https://skillhub.cn
pricing_tier: L3
pricing_model: per_use
suggested_price: 29.9
tools: ["read", "write", "exec"]

Technical Analysis

The skill declares unrestricted exec access even though its documented purpose is limited to reading, writing, and validating JSON Canvas files. These operations do not inherently require arbitrary operating-system command execution.

Granting exec violates the principle of least privilege by exposing a general command-execution channel that is substantially more powerful than the skill's legitimate functionality. The file also defines the tools key twice. YAML parsers may retain the first value, retain the last value, or reject duplicate keys, making the effective permissions ambiguous across platforms. Under either listed configuration, exec remains available.

The document contains no executable implementation or direct malicious command. Exploitation therefore depends on the hosting agent granting the declared capability and subsequently processing an unsafe instruction or attacker-controlled input.

Attack Path

1. An agent platform loads SKILL.md and interprets one of the duplicated tools declarations.
2. The platform grants the skill access to the exec tool.
3. The skill processes user-controlled or otherwise untrusted content during a Canvas operation.
4. Malicious or unsafe instructions induce the agent to invoke exec rather than limiting activity to structured file operations.
5. The resulting command executes with the operating-system privileges and environmental access available to the hosting agent.

Impact Assessment

Successful exploitation could permit command execution with the privileges of the agent process. Dep ...[truncated 501 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove exec from the declared tool set and retain only the minimum capabilities needed:

   yaml

   tools:
     - read
     - write
   

2. Consolidate the duplicate tools entries into one canonical YAML key so permission handling is deterministic.
3. Restrict read and write access to explicit user-selected .canvas files or a dedicated workspace directory.
4. Validate file extensions, normalize paths, and reject traversal outside the approved workspace.
5. If command execution becomes necessary for a future feature, expose a narrowly scoped operation with a fixed executable and fixed argument schema rather than unrestricted shell access.
6. Require explicit user approval for any future command or network operation and run it in a sandbox with minimal filesystem, environment, and network access.
7. Add automated metadata validation that rejects duplicate YAML keys and flags tools not justified by the skill's declared functionality.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill manifest and description claim a narrow purpose of local JSON Canvas file handling, but the text broadens activation to generic data analysis, reporting, statistical insight, visualization, and later introduces callback behavior. This scope expansion can cause an agent to invoke the skill in contexts far beyond its declared trust boundary, increasing the chance of unintended file or command execution under an overly broad pretext.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation wording is overly broad and ambiguous, including scenarios unrelated to JSON Canvas handling. Broad triggers make accidental or opportunistic invocation more likely, which is especially risky because the skill exposes read/write/exec tools that can affect local files and system state.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Documenting a callback_url adds a network-capable workflow that is not justified by the skill’s stated local canvas-processing role. In an agent environment with exec/write capabilities, this can enable data exfiltration, SSRF-like requests, or unexpected outbound communication triggered under the guise of normal file processing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill instructs file read/write and exec-backed operations without clearly warning that these actions can modify local files or run system commands. In agent settings, missing safety disclosure increases the risk of silent destructive changes, unsafe command execution, or misuse by users who believe the skill is purely declarative documentation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The natural-language description injects English directive text ("Use when") into an otherwise Chinese skill description, implying a fixed language style rather than offering user language preference. This can violate language/locale expectations when the skill does not state that users may choose their preferred language.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The error-handling section advises testing network connectivity with ping and checking firewall/proxy settings. Network diagnostics are not justified by the stated purpose of creating, editing, and validating JSON Canvas files, and suggest ancillary capabilities outside the skill's declared domain.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.