JSON检查工具

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:00 AM UTC
• Version: 1.0.1

Overview

This JSON-linting skill has no embedded malicious payload, but it asks for and describes broader powers than a simple JSON validator needs.

Review this skill before installing. It may be acceptable only in a tightly sandboxed workspace where you are comfortable granting command execution and write access; for ordinary JSON syntax checks, prefer a read-only validator or require the skill to remove write/API behavior and constrain any command execution.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:20

Finding

Excessive Tool Permissions for Read-Only JSON Validation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:20-23
Vulnerability Type: Excessive tool permissions and violation of least privilege
Risk Level: Medium

Vulnerable Code

yaml

tools:
- read
- exec
- write

The requested capabilities are further corroborated by SKILL.md:224-226, which advertises generic file writing, external API integration, and system command execution.

Technical Analysis

The skill's stated purpose is to locate JSON files, validate their syntax, and return a report. This operation ordinarily requires only read access and a constrained JSON parser.

Instead, the skill requests unrestricted exec and write capabilities in addition to read. The document also describes generic command execution, external-service integration, and support for writing multiple file formats. These permissions materially exceed the minimum capabilities required for read-only JSON validation.

No implementation, command allowlist, path restriction, endpoint allowlist, symlink policy, or technical sandbox control is provided. The statement that commands run in a sandbox is descriptive and does not establish an enforceable security boundary. Consequently, an agent that trusts this metadata may grant the skill capabilities that could be used for operations unrelated to JSON validation.

The reviewed file contains no concrete malicious command or payload. Therefore, this finding represents an unsafe privilege boundary and capability exposure rather than evidence that the excessive permissions are currently being exploited.

Attack Path

1. A user or agent loads the JSON-linter skill.
2. Based on the declared tool requirements, the agent grants read, write, and exec access.
3. The skill uses read access to enumerate and inspect workspace files.
4. The unnecessarily granted write capability could modify, overwrite, or create workspace files.
5. The unnecessarily granted execution capability could invoke commands outside the leg ...[truncated 1028 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the write permission because syntax validation should be read-only.
2. Avoid unrestricted exec; use a built-in JSON parser or a narrowly scoped validation tool instead.
3. If command execution is unavoidable, enforce a fixed command allowlist and pass file paths as structured arguments rather than concatenating user input into shell commands.
4. Restrict scanning to paths explicitly selected by the user and confined to the workspace root.
5. Reject path traversal and symlink escapes, and exclude credential files, secret stores, and other sensitive locations by default.
6. Remove external API integration unless it is essential to JSON validation. If retained, document and allowlist all destinations, minimize transmitted data, and require explicit user consent.
7. Add a deterministic implementation that can be reviewed, including its parser, path-handling behavior, error handling, and output-generation logic.
8. Enforce least privilege at the host-agent level even if skill metadata requests broader tools.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description includes overly broad invocation guidance such as efficiency improvement, automation, batch processing, and workflow optimization, which are not specific to JSON linting. In an agent setting, vague trigger conditions can cause the skill to be invoked outside its intended scope, increasing the chance that its exec/write capabilities are used in contexts where a user expected only narrow validation behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The invocation guidance is ambiguous and lacks concrete triggers or boundaries, making it unclear when the skill should or should not be used. Because the skill also advertises privileged capabilities elsewhere, this ambiguity increases the risk of unintended activation in broader operational contexts, which can lead to unnecessary command execution or access to sensitive workspace content.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The output contract describes a simple JSON validation report, but the rest of the skill documentation references command execution and network/server interactions. This inconsistency can mislead users and higher-level agents into assuming the skill is passive and deterministic when it may actually perform side effects, making abuse or unexpected behavior harder to detect.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill markets itself as a JSON syntax validator, but its documented capabilities include file writing, external API integration, and system command execution. This mismatch creates a dangerous trust gap: users or calling agents may grant broader permissions than expected, enabling actions well beyond read-only linting and increasing the risk of command execution, data exfiltration, or unintended file modification.

Content

No source excerpt is available for this finding.