ClawHub
Back to skill

Security audit

JSON检查工具

Security checks for vulnerabilities and agentic risk

Overview

This JSON linting skill is not clearly malicious, but it asks for broader execution, write, and API key use than its stated local syntax-checking purpose explains.

Review before installing. Use it only in a trusted workspace, do not provide an API key unless the publisher clearly explains why it is required and what data is sent, and prefer running JSON validation with explicit user-approved files and commands.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The skill claims a local JSON syntax checker requires an API key and LLM API support, which is inconsistent with the described functionality and can mislead users into exposing unnecessary secrets to a workflow that should not need them. This kind of capability inflation is dangerous because it normalizes secret collection and creates an avoidable path for credential exposure or unnecessary network-dependent execution.

Intent-Code Divergence

Medium
Confidence
93% confidence
Finding
The documentation asserts that only whitelisted commands are executed, but no whitelist or constrained execution behavior is actually defined while the skill advertises generic exec capability. This discrepancy can cause operators to trust the skill more than warranted, increasing the chance that arbitrary or overly broad commands are run under a false sense of safety.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
A JSON syntax validation skill should not need broad exec and write permissions for its core purpose, so these capabilities materially expand the attack surface beyond the stated task. In agent environments, unjustified command execution and file modification can be abused to alter workspace contents, run arbitrary programs, or pivot into credential and data exposure.

Static analysis

No suspicious patterns detected.