ClawHub
Back to skill

Security audit

JSON解析器

Security checks for vulnerabilities and agentic risk

Overview

This JSON parser skill is not clearly malicious, but it asks for broad read, write, and command-execution authority that is not well scoped to JSON parsing.

Install only if you are comfortable granting this skill broad file and command capabilities. Prefer running it in a sandbox, avoid sensitive JSON or credentials, and require explicit approval before any file writes, API calls, or shell commands.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:23
Finding

Excessive Tool Permissions for a Documentation-Only JSON Parsing Skill

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:23-26
Vulnerability Type: Excessive tool permissions and violation of least privilege
Risk Level: Medium

Vulnerable Code

yaml
tools:
- read
- exec
- write

The declared permissions are also associated with broad filesystem, API, and command-execution capabilities at SKILL.md:245-247 and SKILL.md:252-254.

Technical Analysis

The skill declares general-purpose read, exec, and write tools even though its stated purpose is parsing, validating, flattening, and converting JSON data. Arbitrary command execution is not necessary for that purpose, while unrestricted filesystem access exceeds the minimum permissions ordinarily required.

The project contains no executable parser, path restrictions, command allowlist, sandbox configuration, or other enforceable controls limiting how these tools may be used. The security guidance at SKILL.md:238 recommends executing only allowlisted commands, but this is advisory documentation rather than a technical enforcement mechanism.

Because the package consists solely of SKILL.md, the advertised parsing classes and examples are not implemented locally. A host that automatically grants the declared tools could therefore expose powerful system capabilities without receiving a corresponding implementation that constrains them to JSON-processing operations.

Attack Path

  1. An Agent host loads the skill and grants the declared read, exec, and write capabilities.
  2. A user supplies attacker-controlled JSON, filenames, contextual instructions, or content containing instructions that influence the Agent's tool choices.
  3. The Agent interprets the request as requiring file processing or command execution.
  4. Because no path restrictions or executable allowlist are enforced by the skill, the Agent may read files outside the intended input scope, execute an unnecessary system command, or write to an ...[truncated 1117 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the exec permission because ordinary JSON parsing does not require shell or system-command execution.
  2. Restrict read access to files explicitly selected or uploaded by the user.
  3. Restrict write access to a dedicated output directory or a user-approved destination.
  4. Require explicit confirmation before overwriting an existing file.
  5. Implement JSON parsing through a standard memory-safe JSON library rather than shell commands.
  6. Add enforceable path canonicalization and deny traversal outside approved input and output roots.
  7. If command execution is genuinely required, define a host-enforced allowlist of fixed executables and arguments; never concatenate user-controlled input into a command string.
  8. Remove API and command-execution capability claims unless those features are implemented and documented with specific endpoints, authorization requirements, and security boundaries.
  9. Add an actual parser implementation and tests covering malformed JSON, oversized or deeply nested input, path traversal, unsafe output filenames, and overwrite behavior.
  10. Rely on host-level sandboxing, network restrictions, minimal operating-system privileges, and per-operation approval as defense-in-depth controls.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

A JSON parsing and validation skill does not inherently require shell/command execution, yet the document classifies it as MD+execute() and includes exec in its tools. Unnecessary execution capability expands the attack surface substantially, enabling command injection, environment inspection, or harmful local actions if the agent routes user-controlled input into those operations.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill is primarily marketed as a JSON parser/validator, but later advertises unrelated capabilities such as command execution, file handling, and external service access. This capability mismatch is dangerous because it can cause an agent or user to invoke a seemingly low-risk parsing skill that actually has much broader side effects, including executing commands or modifying data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The activation language is broad enough to match generic data analysis, reporting, statistics, and visualization requests rather than narrowly scoped JSON parsing tasks. Over-broad routing increases the likelihood that the skill is invoked in contexts where its extra tools (read/write/exec) are unnecessary, amplifying the chance of unintended side effects or misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The markdown advertises file writing, external API calls, and command execution without prominent user-facing disclosure of the associated risks or operational impact. In an agent ecosystem, insufficient warning about side-effecting capabilities can cause users and orchestrators to treat the skill as passive data processing when it may alter files, contact services, or run commands.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The skill claims external API integration even though its stated role is local JSON parsing/validation. Unnecessary network or external service access can expose parsed data to third parties, create hidden exfiltration paths, and mislead users into trusting a local parser with sensitive construction, BIM, or IoT data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.