Security audit

JSON画布工具

Security checks for vulnerabilities and agentic risk

Overview

This JSON Canvas skill is not clearly malicious, but it asks for and advertises broader command, file, API, and integration capabilities than its canvas-editing purpose supports.

Review this skill before installing. Use it only for trusted JSON Canvas files, avoid giving it API keys or unrelated integration tasks, and prefer running it in an environment where command execution and broad file access are constrained.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill is presented as a JSON Canvas editor, but its manifest also advertises broad API integration, webhook/system connection, and other generic automation use cases unrelated to canvas editing. This kind of scope inflation can cause an agent to invoke the skill in far broader contexts than intended, increasing the chance of unnecessary file, network, or execution access through the declared tool set.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The documentation introduces command execution capability for a skill whose stated purpose is editing JSON Canvas files, without showing why shell access is required. In an agent environment, normalizing command execution for a simple document-editing skill expands the attack surface and can encourage unsafe use of the exec tool for user-influenced inputs.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The skill claims external API integration capabilities unrelated to local JSON Canvas editing, which broadens the implied trust boundary from local file handling to network interaction. This can lead agents or users to supply secrets or invoke the skill in integration workflows it was not narrowly designed to perform, increasing risk of misuse and data exposure.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The feature list advertises generic file handling, external API calls, and system command execution beyond the skill's stated canvas-editing purpose. This mismatch is dangerous because broad capability claims combined with tools like exec, read, grep, and glob can cause overbroad invocation and increase opportunities for prompt-induced misuse or unintended access.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The broad 'Use when' language overlaps with many generic file-processing and integration tasks, making the skill eligible for invocation outside its narrow intended purpose. In agentic systems, overly broad activation criteria are dangerous because they increase the chance that a skill with powerful tools is selected in contexts where its behavior is unnecessary or unsafe.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The feature summary describes vague automation and content-processing capabilities without clear operational boundaries. When paired with powerful tools, ambiguous capability descriptions can facilitate overreach, making it easier for malicious or simply unsafe prompts to steer the skill into tasks beyond safe canvas manipulation.

Static analysis

No suspicious patterns detected.