Security audit

Analyze Json Data

Security checks for vulnerabilities and agentic risk

Overview

This skill is a small local JSON-to-OpenAPI helper with rough documentation, but no evidence of hidden access, persistence, exfiltration, or destructive behavior.

Install only if you are comfortable giving the skill the JSON files you explicitly choose to process. Prefer running the script with an explicit output path and review generated OpenAPI output before using it; the README should be treated as incomplete because it still has placeholders and vague mode descriptions.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose says the skill should analyze JSON data and produce API design/OpenAPI output. However, the code chunk is clearly an automated repository validation script for a skill package. Its functions read SKILL.md, parse YAML frontmatter, check description formatting, ensure required sections like Modes/Do not/Quality Bar exist, verify ancillary files such as README_zh.md and CONTRIBUTING.md, scan for secrets, and summarize test results. None of this behavior corresponds to JSON analysis or API specification generation. This is a material purpose mismatch, not merely supporting infrastructure, because the code’s primary function is unrelated compliance/testing behavior.
Content: No source excerpt is available for this finding.

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 80% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Content: Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.
md
- Do not make up facts or claim actions were taken that were not - Do not hardcode API keys — use `os.getenv("API_KEY")` instead - Do not store sensitive user data beyond the current session - Do not exceed token budget without warning the user first - Do not activate for off-topic requests — return a brief decline message ### Do

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file states 'Keep SKILL.md body in English,' which imposes a specific language requirement as a policy. Under the natural-language policy rules, forcing a language without offering user choice or documenting a justified locale constraint is a violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The 'Language' standard requires the SKILL.md body and reference docs to be in English, which is a natural-language policy constraint. The file does not present this as optional or provide a documented justification for the restriction.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The README leaves the trigger condition as a literal placeholder ('When triggered: [trigger condition]'), so users and orchestrators are not told when this skill should activate. In an agent setting, ambiguous activation criteria can cause the skill to run in unintended contexts, potentially processing sensitive JSON or producing API artifacts when it should not.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The README advertises a '--mode write' operation against an input JSON file but provides no warning about whether the command modifies files, generates new artifacts, overwrites outputs, or calls external services. In a developer-agent environment, undocumented write behavior increases the risk of unintended file changes, destructive overwrites, or disclosure through generated outputs.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This markdown file states the trigger as "[trigger condition]", which is not an actual invocation rule and leaves activation behavior undefined. The lack of concrete trigger phrases, scope, or exclusions makes the skill's activation ambiguous and increases the risk of unintended invocation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: Documenting a write mode without any warning that it may modify user files increases the risk of unintended destructive actions, especially in an agent context where users may rely on README guidance to run commands safely. The skill’s purpose includes transforming input data and generating artifacts, so undisclosed write behavior can lead to accidental overwrites, data loss, or unsafe trust in the tool’s side effects.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The activation condition is broad and underspecified: 'Use when (1) Analyze JSON data and generate a structured API design document or OpenAPI specification.' It does not define boundaries such as accepted input sources, whether repository scanning is allowed, or when the skill should refuse unrelated requests, which can cause overbroad invocation and accidental handling of data or tasks outside intended scope.
Content: No source excerpt is available for this finding.

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.
md
- Do not make up facts or claim actions were taken that were not - Do not hardcode API keys — use `os.getenv("API_KEY")` instead - Do not store sensitive user data beyond the current session - Do not exceed token budget without warning the user first - Do not activate for off-topic requests — return a brief decline message ### Do

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Most of the file checks frontmatter formatting, license fields, README presence, contributing docs, .gitignore, shebangs, and document structure in SKILL.md/README files. These operations do not align with the manifest's claimed purpose of analyzing JSON and producing API design or OpenAPI output, indicating the code implements a generic skill-repository QA harness instead.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill manifest says this skill is for analyzing JSON data and generating a structured API design document or OpenAPI specification. In contrast, this test file walks the local test directory and scans files for hardcoded secret patterns, which is a repository hygiene/compliance capability rather than an expected implementation detail of JSON analysis.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The test explicitly requires a file named README_zh.md to exist, which imposes a specific language/locale requirement in code. This is a natural-language policy concern because it mandates Chinese-language support without any visible opt-in, user choice, or region-specific justification in this file.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 71% confidence
Finding: The file is presented as a Chinese README, but key operational text such as the title, summary, and feature descriptions remain in English, creating an implicit language constraint or inconsistency without explanation. The policy requires avoiding forced language behavior unless the user is given a choice or the locale limitation is documented and justified.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file documentation explicitly says this is an "Auto-generated test suite for skill: analyze-json-data," but the implemented behavior is a broad metadata/documentation compliance suite rather than tests for JSON analysis or OpenAPI generation. This creates an intent mismatch between the named skill purpose and what the documented test suite actually verifies.
Content: No source excerpt is available for this finding.