Security audit

JSON格式化工具

Security checks for vulnerabilities and agentic risk

Overview

This JSON formatting skill appears to be a generic template with broader permissions and credential guidance than its stated purpose needs.

Review this skill before installing. It is not clearly malicious, but for a JSON formatter it asks for broad agent tools and tells users to configure an API key without explaining why. Prefer a version that limits itself to formatting, validation, minification, and path extraction, and avoid providing credentials unless a specific trusted service is documented.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The skill is presented as a JSON formatting/validation utility, but later documentation discusses command execution, exec capability, permissions, and command failures. This mismatch can cause an agent or operator to over-trust the skill and permit broader execution behavior than the declared purpose justifies, increasing the chance of unsafe tool use or privilege expansion.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: A local JSON formatter should not ordinarily require an API key, yet the skill states that an API key is required and provides export instructions. This inconsistency can mislead users into injecting sensitive credentials into the environment unnecessarily, creating avoidable secret exposure risk without a clear functional need.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The activation description is overly broad and ties this skill to generic data analysis, reporting, statistics, and visualization tasks rather than narrowly to JSON formatting. Broad triggers can cause the agent to invoke this skill in unrelated contexts, especially since the tool list includes read, write, and exec, increasing the blast radius of an otherwise simple utility.

Vague Triggers

Low

Confidence: 74% confidence
Finding: The manifest lacks precise trigger phrases and clear exclusion conditions, making activation ambiguous. In an agent ecosystem, vague invocation boundaries can lead to accidental selection of a skill with broader tool permissions than the user intended.

Natural-Language Policy Violations

Medium

Confidence: 71% confidence
Finding: The skill advertises a fixed Chinese interaction mode without user choice or opt-in. While not directly enabling code execution, forcing a language mode can reduce user visibility into prompts, outputs, or warnings and may contribute to misuse or misunderstanding in multilingual environments.

Static analysis

No suspicious patterns detected.