Security audit

Output Schema Guard（结构化输出校验护栏）

Security checks for vulnerabilities and agentic risk

Overview

This local JSON-checking helper has no hidden network or background activity, but its validation guarantees and permission descriptions need correction.

Use only schema and input files you intend the helper to read. Its no-filesystem declaration is inaccurate. It supports a limited custom schema format, can crash on unexpected input shapes, and reports successful process exit even when validation fails. Check the returned pass value and use a more complete validator before relying on it to protect important downstream operations. The scanner's material coverage gaps were independently reviewed.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The manifest denies filesystem access while exposing a file-input interface and directing agents to invoke a local script, creating an inconsistent permission boundary. If a host relies on these declarations without enforcing them, local reads could occur outside the advertised scope; returning a parser diagnostic rather than repair guidance is a separate quality issue, not independently evidence of a security vulnerability.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The supplied document exposes a file argument and Read tooling despite declaring filesystem access false, supporting the underlying permission-mismatch concern. The specific schema.json and out.jsonl command examples cited by the finding are absent from this source, and the mismatch alone does not demonstrate malicious access or exfiltration.
Content: No source excerpt is available for this finding.

Valid JSON with an unexpected root type can cause an uncaught exception instead of a validation result and repair hint.

Medium

Category: Excessive Agency
Confidence: 98% confidence
Finding: The validator performs membership tests and string-key indexing without first requiring a dictionary root. Valid JSON such as a numeric root, or an array containing a configured field name, can raise an uncaught TypeError and interrupt processing, creating an availability risk when this guard handles untrusted model output.
Content: No source excerpt is available for this finding.

The CLI reads local files despite the manifest explicitly denying filesystem access.

Medium

Category: Excessive Agency
Confidence: 99% confidence
Finding: The CLI reads the caller-supplied schema path and optional input-file path without an application-level path restriction, contradicting the stated no-filesystem boundary. If untrusted callers control these arguments and the host grants filesystem access, they can cause reads of files accessible to the process; this code does not establish network exfiltration or unrestricted disclosure of file contents.
Content: No source excerpt is available for this finding.

The activation list includes broad phrases such as “输出格式” (output format) and “字段缺失” (missing fields) without requiring an LLM JSON-validation context.

Low

Category: Trigger Abuse
Confidence: 88% confidence
Finding: These phrases can occur in ordinary document-formatting or data-completeness requests unrelated to validating structured model output. Although the purpose describes LLM schema validation, the standalone “When to use” list does not explicitly constrain these triggers to that context.
Content: No source excerpt is available for this finding.