ClawHub
Back to skill

Security audit

Json Repair Kit

Security checks for vulnerabilities and agentic risk

Overview

This skill is a JSON repair tool, but it executes malformed JSON as JavaScript and can rewrite many files automatically, so it should be reviewed carefully before use.

Only use this skill on JSON files and directories you fully trust. Avoid running recursive repair on shared, downloaded, repository, or attacker-writable directories, and prefer a repair tool that uses a non-executing JSON5/JSONC parser with dry-run and explicit confirmation before overwriting files.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
index.js:14
Finding

Untrusted JavaScript Evaluation Without Resource Limits

Content
View full analysis

Vulnerability Details

File Location: index.js:14-26
Vulnerability Type: Untrusted code evaluation and denial of service
Risk Level: High

Vulnerable Code

js
const sandbox = {};
const script = new vm.Script('result = (' + content + ')');
const context = vm.createContext(sandbox);
script.runInContext(context);

const result = sandbox.result;

if (typeof result === 'function' || typeof result === 'symbol' || typeof result === 'undefined') {
  throw new Error('Result is not serializable data (function/symbol/undefined)');
}

return JSON.stringify(result, null, 2);

Technical Analysis

When standard JSON parsing fails, file contents are concatenated into a JavaScript expression and executed through Node.js vm.Script. The input is therefore treated as executable JavaScript rather than data.

The empty VM context limits ordinary access to host globals, but Node.js does not document node:vm as a security mechanism for running hostile code. More directly, script.runInContext(context) has no timeout. An attacker can supply an immediately invoked function containing an infinite loop and block the process indefinitely.

The top-level type check does not make the resulting object safe. The evaluated expression can create nested functions, getters, proxies, or a toJSON method. Such behavior may execute later when JSON.stringify traverses the result. Serialization itself has no timeout or resource limit.

The assertion in SKILL.md that the VM ensures no access to the global scope or process overstates the security guarantee and could cause callers to process untrusted files under an unsafe assumption.

Attack Path

  1. An attacker creates or modifies a .json file that is invalid under JSON.parse but valid as a JavaScript expression.
  2. A user invokes the utility directly with --file, or the recursive scanner encounters the file.
  3. JSON.parse fails, causing execution to fall back to vm.Script.
  4. The malicious expressi ...[truncated 950 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove JavaScript evaluation entirely and use a non-executing parser designed for JSON5, JSONC, or another explicitly supported loose-data grammar.
  2. Pin and audit any parser dependency before adding it to the package.
  3. Define the accepted syntax narrowly instead of accepting arbitrary JavaScript expressions.
  4. If VM evaluation must temporarily remain:
    • Set a short timeout on runInContext.
    • Disable string and WebAssembly code generation when creating the context.
    • Run parsing in a separate resource-limited worker process.
    • Enforce memory and CPU limits externally.
    • Reject functions, accessors, proxies, custom prototypes, and toJSON methods throughout the complete object graph.
    • Copy accepted values into plain, null-prototype data structures before serialization.
  5. Add adversarial tests for infinite loops, deeply nested input, getters, proxies, toJSON, excessive allocation, and known VM escape patterns.
  6. Revise SKILL.md so it does not characterize node:vm as a security sandbox.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
index.js:53
Finding

Recursive Directory Scan Follows Symbolic Links Outside the Selected Root

Content
View full analysis

Vulnerability Details

File Location: index.js:53-70
Vulnerability Type: Symbolic-link traversal and unintended file modification
Risk Level: Medium

Vulnerable Code

js
function scanDirectory(dir, recursive) {
  const files = fs.readdirSync(dir);
  for (const file of files) {
    const fullPath = path.join(dir, file);
    const stat = fs.statSync(fullPath);
    if (stat.isDirectory()) {
      if (recursive && file !== 'node_modules' && file !== '.git') {
        scanDirectory(fullPath, recursive);
      }
    } else if (file.endsWith('.json')) {
      // Check if valid JSON first
      try {
        JSON.parse(fs.readFileSync(fullPath, 'utf8'));
        // Valid, skip unless forced? For now, skip valid.
      } catch (e) {
        console.log(`Found invalid JSON: ${fullPath}`);
        processFile(fullPath, null, { backup: true });
      }
    }
  }
}

The out-of-scope file is subsequently overwritten by the following code at index.js:45-47:

js
if (options.backup !== false) {
  fs.copyFileSync(filePath, `${filePath}.bak`);
}
fs.writeFileSync(filePath, repaired);

Technical Analysis

fs.statSync follows symbolic links. Consequently, when recursive scanning is enabled, a directory symlink under the selected scan root is treated as an ordinary directory and traversed.

The implementation does not canonicalize the initial scan root or verify that each resolved file remains beneath it. An attacker who can create entries within the scanned tree can therefore redirect traversal to another directory accessible to the utility's operating-system account.

Invalid .json files reached through the link are passed to processFile, which creates an adjacent backup and overwrites the original file. Symbolic-link directory cycles can also cause unbounded recursion until the process fails from stack exhaustion or another resource limit.

Attack Path

  1. An attacker obtains write access to a directory that a more privileged user ...[truncated 1183 chars]
Remediation
View remediation

Remediation Suggestions

  1. Use fs.lstatSync or fs.promises.lstat and reject symbolic links before traversing directories or processing files.
  2. Resolve the initial root with fs.realpathSync, resolve every candidate, and verify that each candidate remains beneath the canonical root using a separator-aware containment check.
  3. Track visited directory identities, such as device and inode pairs, to prevent recursive cycles and duplicate traversal.
  4. Before writing, repeat containment and file-type validation to reduce time-of-check/time-of-use exposure.
  5. Open output files with flags that prevent unintended symbolic-link following where supported, and avoid overwriting non-regular files.
  6. Add tests covering directory symlinks to external locations, file symlinks, self-referential links, multi-directory cycles, and links changed concurrently during scanning.
  7. Consider requiring explicit opt-in before overwriting files discovered by recursive scanning.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The skill’s stated purpose is JSON repair, but it explicitly relies on Node.js evaluation of file content as JavaScript objects. That means a supposedly data-only input file can contain executable expressions, and users may not understand that repairing malformed JSON could execute attacker-controlled code or trigger side effects; the bulk recursive repair and in-place overwrite behavior further increases blast radius.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The fallback 'repair' path evaluates attacker-controlled file contents as JavaScript using vm.Script/runInContext rather than parsing data. Even in a vm context, JavaScript execution on untrusted input is unsafe and unnecessary for a JSON-repair utility, enabling execution of expressions, getters, prototype manipulation, or sandbox-escape primitives depending on runtime behavior and surrounding environment.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The comment labels the vm approach as a 'safe sandbox', which is misleading because the code still executes untrusted content as JavaScript. This false assurance increases risk by making reviewers and users more likely to trust dangerous behavior that is especially inappropriate in a tool advertised as JSON repair.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

Directory mode recursively scans directories and automatically rewrites every invalid .json file it finds in place, which exceeds the narrowly described behavior of repairing a specified malformed JSON file. In an agent/automation context, this broad mutation scope can cause unintended bulk changes, data loss, or corruption of files that merely fail strict JSON parsing but were not meant to be normalized by this tool.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.