Security audit

JSON工具箱(专业版)

Security checks for vulnerabilities and agentic risk

Overview

This is a Markdown-only JSON helper, but it asks for broad read/write/exec authority and describes loosely scoped API, credential, and security-scanning behavior beyond a normal JSON toolkit.

Install only if you are comfortable with an agent using this skill in broad development contexts and potentially reading/writing files, running commands, and connecting to unspecified APIs. Prefer a narrower JSON-only skill unless you specifically need these automation features, and require explicit approval before command execution, file mutation, or any API key use.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The skill presents technically incorrect security guidance by claiming that standard JSON.parse on a JSON string containing a __proto__ key will directly pollute Object.prototype. This can mislead users into misunderstanding the real risk surface and implementing ineffective defenses, which is dangerous in a skill that markets itself as providing parsing security and secure JSON handling.

Description-Behavior Mismatch

Medium

Confidence: 84% confidence
Finding: The skill claims to be a JSON toolkit but advertises unrelated high-risk capabilities such as CVE correlation, compliance auditing, asset risk scoring, and threat-intelligence subscriptions. This scope inflation can cause an agent or user to overtrust the skill, invoke it in inappropriate contexts, or assume it is authorized to perform broader security operations than its stated purpose justifies.

Context-Inappropriate Capability

Medium

Confidence: 82% confidence
Finding: The documentation introduces external API integration and network-oriented behavior that is not necessary for a JSON-toolkit skill, increasing the chance of unexpected outbound connections, credential use, or data disclosure. In an agent setting, unjustified network capability broadens the attack surface and can lead to exfiltration or misuse of ambient credentials.

Vague Triggers

High

Confidence: 92% confidence
Finding: The invocation guidance is extremely broad, covering code generation, programming assistance, debugging, testing, and deployment, which creates weak trigger boundaries for an agent skill that also declares read, write, and exec capabilities. Overly permissive activation conditions can cause the skill to be selected in many contexts where command execution or file operations are unnecessary, increasing the risk of unintended destructive actions or data exposure.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill declares file read/write and command execution capabilities without prominent upfront warnings about the operational and security impact of those actions. In an agent ecosystem, this can normalize powerful side-effecting behavior and cause users or orchestrators to underestimate the risk of filesystem modification, arbitrary command execution, or downstream access to sensitive data.

Static analysis

No suspicious patterns detected.