Json Validator Free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:20 AM UTC
• Version: 1.0.0

Overview

This JSON validator is mostly a local Markdown-based helper, but it asks for broad read/write/exec authority and uses unrelated activation language that could route non-JSON tasks through it.

Install only if you intend to use it for JSON validation. Review or narrow its activation wording and tool permissions before enabling it broadly, especially the write permission and generic data-analysis triggers. Use strict JSON mode by default, and install json5 only deliberately in an isolated environment if JSON5/JSONC parsing is needed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:188

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:188 and SKILL.md:289
Vulnerability Type: Unpinned package installation from a third-party registry
Risk Level: Medium

Vulnerable Code

At line 188:

python

import json5  # pip install json5

At line 289:

markdown

| json5 | Python library | Optional | `pip install json5` (JSON5-compatible parsing) |

Technical Analysis

The Skill instructs the Agent or user to install json5 without specifying an audited version or validating the package artifact with a cryptographic hash. Consequently, the installed code can vary over time even though the reviewed Skill remains unchanged.

Package installation and subsequent import can execute third-party code in the local Python environment. If the package registry, maintainer account, release process, or selected package version is compromised, following this instruction could introduce malicious code into the Agent environment.

This is a supply-chain weakness rather than evidence that the current json5 package is malicious. The dependency is optional and only needed for JSON5 compatibility, so installation should not occur during ordinary strict JSON validation.

Attack Path

1. An attacker compromises the upstream package, its maintainer account, or the relevant package-distribution channel.
2. A malicious or otherwise compromised release becomes the version selected by the unpinned pip install json5 command.
3. The Agent follows the Skill instructions and installs the dependency without version or hash verification.
4. Malicious package code executes during installation or when json5 is imported.
5. The code operates with the privileges of the Agent or user running Python.

Impact Assessment

Successful exploitation could provide code execution within the Agent's Python environment. The resulting scope would be limited by the operating-system account and sandbox controls un ...[truncated 522 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin json5 to a specifically reviewed version rather than installing the latest available release:

   text

   json5==<reviewed-version>
   

2. Store dependencies in a lock file or requirements file with cryptographic hashes, and install them using hash enforcement:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

3. Review and record the package source, maintainer, release artifact, license, and transitive dependencies before approving the pinned version.
4. Require explicit user confirmation before installing any package; do not install dependencies automatically when the Skill is loaded.
5. Install the package in an isolated virtual environment with minimal filesystem and network privileges.
6. Keep strict JSON validation on the Python standard library path, and only enable the optional JSON5 dependency when the user explicitly requests JSON5 parsing.
7. Update SKILL.md so every installation example references the same pinned, verified dependency specification.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill description uses an overly broad activation condition unrelated to JSON validation, which can make the agent select this skill for many generic analytics tasks. Because the skill advertises exec, write, and read capabilities, over-broad routing materially raises the risk of unnecessary privileged actions in contexts that do not need this tool.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The coverage keyword list contains vague, high-recall trigger phrases such as general workflow and analysis terms, making accidental invocation likely. In an agent ecosystem, this can hijack unrelated user requests toward a skill that has stronger-than-necessary tool permissions, expanding attack surface and enabling prompt-routing abuse.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill is branded as a lightweight JSON validator, but its manifest expands activation to broad data-analysis, reporting, statistics, and visualization scenarios unrelated to JSON validation. That mismatch can cause the agent to invoke a skill with read/write/exec capabilities in contexts where it is not the best-scoped tool, increasing the chance of unnecessary file access or command execution.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The FAQ first states that JSON5/JSONC mode does not modify original files, then says the tool provides conversion scripts to produce standard JSON, and elsewhere says free edition only gives repair suggestions rather than automated changes. That creates an intent-level contradiction about whether the free skill performs only advisory validation or also supplies transformation capability.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The copyright section states the skill was '完全中文化表达' for Chinese developers, which signals a fixed language choice rather than offering users a locale option. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is clearly justified and documented as mandatory.

Content

No source excerpt is available for this finding.