Security audit

XML转JSON工具

Security checks for vulnerabilities and agentic risk

Overview

The skill is framed as an XML-to-JSON converter, but it also advertises broad file, API, command execution, credential, and deployment capabilities without clear limits.

Review this skill carefully before installing. It may be appropriate only if you expect an Expanso Edge, cloud/API-key-based workflow and are comfortable granting file access and possible command execution; do not use it on sensitive XML unless the destination service and execution behavior are clarified.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill is presented as a narrow XML-to-JSON converter, but its description expands into broad deployment, API, workflow, and execution-oriented capabilities. This mismatch can cause over-privileged invocation and user misunderstanding about what actions the skill may take, increasing the chance of unsafe tool use beyond the stated purpose.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: Documenting command execution for a simple XML-to-JSON transformation skill is unnecessarily powerful and expands the attack surface significantly. In an agent environment, this can normalize shell access for benign-looking requests and lead to file system changes, data exposure, or arbitrary command execution if the skill is invoked on untrusted input.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: External API integration is not justified by the stated XML-to-JSON purpose and creates unnecessary data egress risk. Users may supply sensitive XML assuming local conversion, while the skill language suggests remote service use without clear scoping, consent, or data-handling boundaries.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The activation language is broad enough to match generic development, debugging, and deployment requests instead of a tightly scoped XML-to-JSON use case. In agent routing contexts, this can cause the skill to be selected unexpectedly and expose users to file, API, or execution behaviors they did not intend to invoke.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The invocation instructions are vague and do not define clear boundaries for when the skill should or should not run. Ambiguous trigger scope is risky for agentic systems because it can lead to accidental activation with broader permissions than the user expects.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill advertises file reads/writes, API calls, and command execution without an upfront, prominent warning that these are impactful operations. In an agent setting, hiding such capabilities inside general feature text undermines informed consent and increases the risk of unexpected code execution, data modification, or exfiltration.

Static analysis

No suspicious patterns detected.