Json Parse Engine Free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:32 AM UTC
• Version: 1.0.0

Overview

This JSON parsing skill is mostly purpose-aligned, but it requests broad command and file-writing authority and includes an unexplained callback URL despite claiming local-only processing.

Review before installing. Use this only in a sandbox or workspace where local command execution and possible file writes are acceptable, avoid sensitive JSON unless the platform blocks network callbacks, and prefer a version that removes write permission, narrows invocation triggers, and documents or removes callback behavior.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:16

Finding

Excessive and Ambiguous Tool Permissions Violate Least Privilege

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 16-23
Vulnerability Type: Excessive tool permissions and ambiguous configuration
Risk Level: Medium

Vulnerable Code

yaml

tools:
- - read
- exec
homepage: https://skillhub.cn
pricing_tier: L2
pricing_model: per_use
suggested_price: 19.9
tools: ["read", "write", "exec"]

Technical Analysis

The skill declares the tools key twice. The first declaration requests read and exec, while the second requests read, write, and exec. Duplicate YAML keys are handled inconsistently: some parsers reject them, while others silently retain the last value. In parsers that apply last-key-wins behavior, the skill receives all three capabilities, including filesystem write access.

The documented purpose is parsing, flattening, extracting, and validating JSON. Although reading a user-selected file and invoking a constrained parser may support that purpose, the documentation does not identify a legitimate requirement for unrestricted filesystem writes. General-purpose command execution is also broader than necessary when the operation can be implemented through a fixed, reviewed parser or a constrained runtime interface.

The package contains no parser implementation or executable script, so the agent is expected to translate the Markdown instructions into commands dynamically. This increases the security significance of broad exec permissions because there is no bundled implementation that constrains executable operations or validates arguments.

Attack Path

1. The skill is loaded by an agent platform that interprets the final tools declaration and grants read, write, and exec.
2. A user supplies an untrusted JSON file, path, or parsing request containing instructions or content intended to influence the agent's command construction.
3. Because the skill provides no fixed parser implementation, the agent dynamically creates shel ...[truncated 1279 chars]

Remediation

View remediation

Remediation Suggestions

1. Define the tools key exactly once so permission handling is deterministic across YAML parsers.
2. Remove write unless a specific documented feature requires file output.
3. Replace unrestricted exec with a dedicated JSON-parsing tool or a bundled, reviewed script exposed through a constrained interface.
4. If command execution is unavoidable, restrict it to an allowlisted executable and fixed operation modes. Pass JSON input through standard input or safely encoded arguments rather than interpolating it into shell commands.
5. Limit file reads to paths explicitly selected by the user and enforce canonical-path checks against an approved workspace.
6. Run parsing in a sandbox with resource limits, no network access, a read-only filesystem where possible, and no access to secrets or sensitive host directories.
7. Validate the skill manifest in continuous integration and reject duplicate YAML keys or permissions not mapped to documented functionality.
8. Add a concrete parser implementation with tests for malicious filenames, oversized input, deeply nested JSON, and shell metacharacters.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The description says to use the skill whenever doing data analysis, report generation, statistical insights, or data visualization, which are broad everyday work contexts rather than specific invocation triggers. It does not clearly distinguish when this skill should be selected versus other generic data-processing skills, nor provide exclusion examples beyond real-time streaming.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The declared permissions include write access even though the documented functionality is limited to reading, parsing, flattening, extracting, and validating JSON. Unnecessary write capability violates least privilege and could be abused to alter files, drop artifacts, or overwrite user data if the skill or prompting is misused.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill exposes write and exec capabilities but does not clearly warn users that it can modify files or run system commands. Because the skill is framed as a lightweight parser, users may authorize it under false assumptions, increasing the chance of unintended system-impacting actions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill describes itself as a fully local JSON parsing tool with no external service dependence, yet it accepts a callback_url parameter for asynchronous completion notification. That creates an undocumented outbound communication path that can leak parsed data, metadata, or execution status to attacker-controlled endpoints and contradicts user expectations about local-only processing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The callback_url parameter introduces possible outbound transmission, but the skill does not warn users that data or status may be sent over the network. In the context of a local JSON parser, this hidden network sink is more dangerous because users would reasonably expect all processing to remain local.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The display name and summary are presented only in Chinese, and the body of the skill is primarily Chinese-language content. There is no indication that the skill is region-specific or that users can opt into a preferred language, which may conflict with language/locale choice expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.