ClawHub
Back to skill

Security audit

Json Yaml Converter Free

Security checks for vulnerabilities and agentic risk

Overview

This is a local JSON/YAML conversion skill whose file and command examples mostly fit its purpose, with a few safety-quality issues users should handle carefully.

Install only if you are comfortable with a skill that can guide local reads, writes, and command execution for config conversion. Use it on explicit JSON/YAML tasks, write to new output paths unless you intend to overwrite files, prefer `yaml.safe_dump`/`yaml.safe_dump_all`, and install PyYAML in a controlled environment with a pinned version where possible.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:254
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 254
Vulnerability Type: Unpinned and unverified package installation
Risk Level: Medium

Vulnerable code snippet:

shell
pip install pyyaml

Technical Analysis

The Skill directs the Agent to install PyYAML without specifying an exact version, verifying a package hash, selecting a trusted package index, or requiring an isolated environment. Consequently, installation results may change over time and depend on the package repository and resolver state at execution time.

If a malicious or compromised release is selected, attacker-controlled code could execute during source-package build operations or when the installed module is imported. The instruction does not itself prove that the legitimate PyYAML package is malicious, but its unpinned and unverified supply-chain handling creates an avoidable dependency risk.

Attack Path

  1. A user or Agent follows the dependency installation instruction.
  2. The package manager resolves the latest available PyYAML release from its configured package index.
  3. The configured index, selected release, or dependency-delivery channel is compromised or serves an unsafe artifact.
  4. Attacker-controlled code executes during package build or subsequent import.
  5. The code operates with the same operating-system permissions and environment access as the Agent or user running the conversion workflow.

Impact Assessment

Successful exploitation could provide access to files, environment variables, credentials, and network resources available to the invoking process. It could also modify conversion results or other user-writable files. This instruction does not grant elevated privileges by itself; the maximum scope is normally limited to the permissions of the account performing installation or execution.

Remediation
View remediation

Remediation Suggestions

  • Pin PyYAML to a reviewed, exact version rather than resolving an unrestricted latest release.
  • Store dependencies in a lock file or hash-locked requirements file, for example:
    shell
    python -m pip install --require-hashes -r requirements.txt
  • Include approved SHA-256 hashes for every permitted distribution artifact.
  • Explicitly use an organization-approved package index and disable untrusted extra indexes.
  • Install dependencies inside a dedicated virtual environment with no administrative privileges.
  • Prefer reviewed binary wheels where appropriate, reducing exposure to source-package build execution.
  • Add automated dependency scanning and a controlled process for reviewing version upgrades.

T09 · Insecure Skill Coding Practices

Note
Location
SKILL.md:110
Finding

Unsafe YAML Serializer Contradicts the Declared Safe-Mode Policy

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 110-119
Vulnerability Type: Unsafe serialization pattern
Risk Level: Low

Vulnerable code snippet:

python
yaml.dump(data, indent=2, default_flow_style=False)
yaml.dump(data, indent=4, default_flow_style=False)
yaml.dump(data, default_flow_style=True)
yaml.dump(data, default_flow_style=False, indent=2)

The same unsafe pattern also appears in the primary conversion examples at lines 61-68 and 324-331.

Technical Analysis

The Skill states that safe YAML loading and dumping should be used, but its executable examples call yaml.dump rather than yaml.safe_dump. General-purpose dumping may serialize custom Python objects using implementation-specific YAML tags.

Serialization by yaml.dump does not execute the serialized object on its own. The security risk arises when the generated YAML contains Python-specific object tags and is subsequently processed by another component using an unsafe YAML loader. The examples therefore encourage a pattern that is inconsistent with the Skill's declared security controls and can create unsafe downstream artifacts when the template is reused with non-primitive Python objects.

Attack Path

  1. A developer or Agent copies one of the documented yaml.dump templates.
  2. The template is extended or reused with attacker-influenced data containing custom Python objects rather than only JSON-compatible primitive values.
  3. The general-purpose dumper emits Python-specific YAML tags into the output.
  4. A downstream application consumes that output using an unsafe loader such as an unrestricted yaml.load.
  5. The downstream loader constructs attacker-influenced Python objects and may trigger harmful behavior, depending on the available classes and loader configuration.

This path requires both non-primitive objects at serialization time and an unsafe downstream loader; ordinary conversion of strictly parse ...[truncated 572 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace every yaml.dump call with yaml.safe_dump.
  • Replace yaml.dump_all with yaml.safe_dump_all in multi-document examples.
  • Ensure all loading examples continue to use yaml.safe_load or yaml.safe_load_all.
  • Restrict conversion inputs to JSON-compatible primitives: mappings, lists, strings, numbers, booleans, and null values.
  • Add tests that reject Python-specific YAML tags such as !!python/object.
  • Add a round-trip test that loads every generated document with yaml.safe_load.
  • Keep documentation and executable examples aligned so that the stated safe-mode policy is enforced by the code users are instructed to run.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Vague Triggers

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The activation language is extremely broad, covering generic file handling, document conversion, format conversion, and content extraction. In agent ecosystems, overbroad trigger phrases can cause the skill to be invoked for many unrelated requests, increasing the chance that its exec/write-capable instructions run in contexts the user did not intend, which expands the attack surface for prompt-injection and unsafe file operations.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The coverage-keyword section enumerates an excessively wide set of scene keywords, including vague terms unrelated to strict JSON/YAML conversion. Because the skill also declares read/write/exec capabilities, broad matching can cause accidental routing into a tool-enabled workflow, making prompt-injection, unintended file modification, and privilege misuse more likely in otherwise routine conversations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The examples instruct reading from and writing to local files and the skill advertises exec capability, but they do not prominently warn that these actions can modify user data. In an agent setting, this can lead users to approve or trigger local file operations without understanding the side effects, especially when combined with broad activation language and automation-oriented framing.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

L100 and L206 state that the agent should default to yaml.safe_load/yaml.safe_dump and avoid unsafe dump/load patterns. Yet the executable examples at L61-L67, L110-L119, and L164 use yaml.dump or yaml.dump_all rather than the documented safe_dump variants, creating a direct contradiction between stated safety guidance and shown implementation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest description at L009-L010 explicitly frames the free skill around "单文件处理". However, L198 says the agent can help convert all JSON files under ./conf and provide a shell-loop batch conversion example, which goes beyond the claimed single-file scope even if described as a template.

Content

No source excerpt is available for this finding.