Security audit

Json Validator Free

Security checks across malware telemetry and agentic risk

Overview

This is mainly a local JSON validation guide, but its scope and permissions are broader than the stated free single-file validator purpose.

Install only if you want a Markdown-based local JSON validation helper, and keep use limited to explicitly named JSON files. Require confirmation before any file write, do not use callback URLs for local validation, and treat batch validation or recursive config scanning as outside the free skill's safe default scope.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill is presented as a local JSON validator, but its manifest broadens recommended use to data analysis, reporting, statistics, and visualization workflows unrelated to validation. This scope inflation can cause an agent to invoke the skill in inappropriate contexts and then use read/write/exec powers beyond the user's actual need, increasing the chance of unnecessary file access or command execution.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The free edition claims to support only single-file validation, yet the documentation tells the agent to 'validate all configuration files' and generate reports. This inconsistency can mislead an agent into performing broader filesystem enumeration and batch processing than intended, which is risky given the presence of read/write/exec capabilities.

Context-Inappropriate Capability

Low

Confidence: 82% confidence
Finding: Introducing a callback_url parameter in a skill described as fully local JSON validation creates unnecessary ambiguity about outbound communications. Even without explicit callback code, this pattern can normalize collecting or propagating network endpoints, which increases the risk of future exfiltration-oriented extensions or unsafe agent behavior.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The skill says the free version does not provide automatic repair, yet earlier instructs the agent to output repaired JSON directly. This contradiction can lead an agent to modify or rewrite user data despite the stated safety boundary, especially in a skill that includes write and exec capabilities.

Vague Triggers

High

Confidence: 96% confidence
Finding: An overly broad invocation condition makes the skill eligible for many tasks unrelated to JSON validation. In an agentic environment, this is dangerous because it can cause inappropriate activation of a tool with read/write/exec permissions, expanding attack surface and enabling unintended file or command operations under a misleadingly simple utility label.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The example trigger phrase asking to validate 'all configuration files' is too broad for a single-file JSON validator and can prompt sweeping file discovery or bulk processing. In the context of available read/write/exec tools, that mismatch increases the risk of excessive filesystem access beyond the minimal task scope.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.