Json To Api

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:27 AM UTC
• Version: 1.0.1

Overview

This skill is a documentation-only API design helper for turning user-provided JSON into REST/OpenAPI guidance, with no evidence of hidden execution, persistence, credential use, or data exfiltration.

This skill appears safe to install for drafting REST endpoints and OpenAPI schemas from JSON. Review generated API specs before use, especially DELETE/update endpoints, because they are design suggestions and should match your real authorization, data model, and business rules. The publisher should clean up stale names in references and tests to reduce confusion.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 59)May include surrounding context.

md

| JSON 形状 | API 设计 |
|------------|------------|
| 用户对象数组 | `GET /users`（列表），`POST /users`（创建） |
| 带 ID 的单个对象 | `GET /users/{id}`，`PUT /users/{id}`，`DELETE /users/{id}` |
| 嵌套 address 对象 | `GET /users/{id}/addresses` 作为子资源 |
| 可选 phone 字段 | 在 schema 中标记 `nullable: true`，不是 required |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README_zh.md (reported line 59)May include surrounding context.

md

| JSON 形状 | API 设计 |
|------------|------------|
| 用户对象数组 | `GET /users`（列表），`POST /users`（创建） |
| 带 ID 的单个对象 | `GET /users/{id}`，`PUT /users/{id}`，`DELETE /users/{id}` |
| 嵌套 address 对象 | `GET /users/{id}/addresses` 作为子资源 |
| 可选 phone 字段 | 在 schema 中标记 `nullable: true`，不是 required |

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

There is a clear description-behavior mismatch. The declared purpose is an API-design skill triggered by user-supplied JSON and requests for endpoint/OpenAPI/schema generation. The actual code instead implements automated repository tests for skill submission quality and metadata compliance. Its primary purpose is linting/validation of skill assets, not transforming JSON into REST API definitions. These capabilities are materially different and unrelated to the declared triggers.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 14)May include surrounding context.

md

User has JSON data and needs a proper API contract — not just a data dump, but endpoints, HTTP methods, status codes, and request/response schemas. This skill analyzes JSON structure and produces a production-ready OpenAPI 3.0 spec.

**When triggered:** JSON data + API design/create endpoint/write OpenAPI intent.

## Features

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger criteria are broad enough to match many ordinary API-design requests, which can cause the skill to activate outside a narrowly intended scope. In an agent system, overbroad activation can lead to incorrect routing, unintended processing of user data, or the skill influencing conversations where a different tool or no tool should be used.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The docstring says this is an auto-generated test suite for skill 'user-provides-json', but the code derives and validates the actual skill from the surrounding repository files and directory structure rather than that named skill. This is an active documentation contradiction that can mislead maintainers about the file's intended target.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The test unconditionally requires README_zh.md, which embeds a specific locale requirement into the skill's validation logic. This is a natural-language policy concern because it forces Chinese-language support regardless of user choice or any documented region-specific need.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The file contains a natural-language policy constraint that mandates English for the SKILL.md body. This forces a specific language choice and does not present it as optional or justified by a documented locale-specific need.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This line explicitly requires English for documentation, which is a language policy restriction. Under the policy, forcing a specific language without opt-in or clear justification should be flagged.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

该文件主体内容均为中文，作为技能说明会引导该技能在特定语言环境下被理解和使用，但文档中没有说明这是可选语言版本或在运行时支持用户选择语言。虽然 L03 提供了英文 README 链接，但正文未明确说明技能输出或交互语言由用户决定，因此仍存在轻微的语言/locale 策略歧义。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The reference file identifies the skill as user-provides-json while the metadata names it json-to-api, creating a documentation/identity mismatch. This can confuse reviewers, tooling, or downstream systems that rely on consistent skill naming, potentially causing the wrong references to be associated with the skill or allowing risky content to evade expected scrutiny.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The main runner prints 'TEST SUITE -- skill-factory', which does not match either the manifest skill name or the file's apparent purpose of validating the current skill package contents. This creates intent confusion in runtime output about what is actually being tested.

Content

No source excerpt is available for this finding.