Json Toolkit Free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:24 AM UTC
• Version: 1.0.0

Overview

This looks like a JSON guidance skill, but it asks for write and command-execution authority despite saying it is pure Markdown and does not need exec.

Review before installing. The content is mostly JSON best-practice guidance and I found no exfiltration, persistence, or destructive code, but the package should not need write or command-execution permissions. Prefer a version that removes duplicate tools metadata and limits permissions to read-only guidance unless you explicitly need mutating JSON file operations.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:38

Finding

Unnecessary Filesystem Write and Command Execution Permissions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 38–45
Vulnerability Type: Excessive tool permissions and ambiguous duplicate permission declarations
Risk Level: Medium

Vulnerable Code

yaml

tools:
- - read
  - exec
homepage: https://skillhub.cn
pricing_tier: "L1-入门级"
pricing_model: per_use
suggested_price: "9.9 CNY/per_use"
tools: ["read", "write", "exec"]

Technical Analysis

The Skill declares read, write, and exec capabilities even though it identifies itself elsewhere as a pure Markdown instruction guide that does not require command-line execution. JSON formatting and design guidance do not inherently require unrestricted filesystem modification or command execution.

The tools property is also declared twice. Duplicate YAML keys have parser-dependent behavior: some parsers retain the first value, others retain the last, and strict parsers may reject the document. A parser retaining the final declaration would expose all three tools, including write and exec.

This violates least-privilege principles. Although the reviewed file contains no malicious executable payload, granting these unnecessary capabilities increases the impact of malicious or untrusted instructions encountered while the Skill is active.

Attack Path

1. An agent loads the Skill metadata.
2. Its YAML parser resolves the duplicate tools keys, potentially selecting the final declaration.
3. The platform grants the Skill access to filesystem reads, filesystem writes, and command execution.
4. Untrusted task content or later injected instructions direct the agent to invoke those tools.
5. The agent may read accessible local information, modify files, or execute commands under the privileges of the hosting process.

This path depends on the host platform using the metadata to authorize tools and on attacker-controlled instructions reaching the agent; the audited Skill does not itself contai ...[truncated 603 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the duplicate tools declarations and define the property only once.
2. Remove write and exec, because the documented functionality is a Markdown-based JSON guidance resource and does not require them.
3. If platform metadata requires a tool declaration, specify only the narrowest capability genuinely needed, such as read-only access to explicitly approved input.
4. Enforce tool permissions independently at the platform level rather than trusting Skill metadata alone.
5. Validate the front matter with a strict YAML parser or schema that rejects duplicate keys.
6. Remove the unrelated recommendation to run ping at SKILL.md:262, because the Skill has no documented network operation and does not need command execution.
7. Add automated checks that reject Markdown-only Skills requesting filesystem-write or command-execution capabilities without a documented and reviewed justification.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation explicitly classifies the skill as pure Markdown with no need for exec, while the manifest grants both exec and write tools. This contradiction is dangerous because it obscures the real privilege level of the skill, potentially causing reviewers or agents to trust a capability set that can execute commands or modify files despite claims to the contrary.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Exec capability is not justified by the stated purpose of providing JSON handling guidance and best practices. Unnecessary execution privileges expand the attack surface: if an agent follows misleading or future-added instructions, it could run local commands unrelated to the user’s intent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill is described as a guidance-only JSON best-practices document, but the body advertises operational actions such as create, modify, import, export, save, and convert. This mismatch can cause an agent or user to treat the skill as non-invasive while it implicitly authorizes state-changing behavior, increasing the risk of unintended file or data modification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill advertises operations like modify, import, export, save, and convert without clearly warning that these may alter user data or produce side effects. In a supposedly guidance-oriented skill, omission of modification warnings can mislead users and downstream agents into performing data-changing actions without adequate consent or review.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger condition says to use the skill for data analysis, report generation, statistical insights, and visualization, which does not match the skill’s JSON schema and formatting purpose. Overbroad triggers can cause an agent to invoke the skill in inappropriate contexts, increasing the chance of unintended actions or misleading outputs under mismatched authority.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The error-handling section advises running ping and troubleshooting network connectivity, which is outside the expected scope of a JSON-formatting and validation guide. While not severe by itself, this normalizes operational command execution and broadens the skill’s implied behavior beyond its declared domain.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.