Security audit

JSON修复工具专业版

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a JSON repair tool, but it needs review because it can run commands, automatically change many files, and includes loosely scoped callback/API behavior.

Install only if you want an agent to perform local JSON repair with read/write and command execution access. Use it on a limited directory first, require preview and backups before applying changes, avoid untrusted custom script rules, and do not provide callback URLs or external rule sources unless you trust the destination and know what data will be sent.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The skill claims script rules are safely sandboxed and cannot access the file system or network, but the skill itself requests unrestricted `exec` capability and documents shell/CLI execution paths. That mismatch can mislead users and agents into trusting unverified isolation while executing arbitrary local commands, which is especially dangerous in a file-modifying automation tool.

Context-Inappropriate Capability

Low

Confidence: 71% confidence
Finding: The documented `callback_url` introduces an external communication path that is not clearly necessary for a local JSON repair workflow. Unnecessary outbound callbacks can enable data exfiltration, SSRF-like behavior, or accidental transmission of file names, repair results, or sensitive content to attacker-controlled endpoints.

Description-Behavior Mismatch

Low

Confidence: 64% confidence
Finding: The skill’s scope expands from local JSON repair into generic API integration and external service handling, which increases the effective privilege and attack surface beyond the stated purpose. This kind of scope creep makes unsafe tool use more likely because users may invoke networking or automation behaviors they would not expect from a repair utility.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The natural-language trigger is broad enough that normal conversation about scanning, repairing, or reports could invoke file-modifying behavior without a precise, intentional request. In a skill with read/write/exec access and batch directory operations, ambiguous activation materially increases the risk of unintended bulk changes.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The 'use when' guidance is framed broadly around efficiency, automation, and workflow optimization rather than narrowly around JSON repair. That broad framing encourages use outside the intended domain, increasing the chance that an agent applies privileged file and command capabilities in unrelated contexts.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill advertises batch repair and rollback capabilities without an upfront, prominent warning that they can recursively alter large numbers of files and overwrite prior state. In a tool with write access, understated risk communication can lead to destructive use, especially when combined with broad triggering and automation-oriented positioning.

Static analysis

No suspicious patterns detected.