json-tools
Warn
Audited by Gen Agent Trust Hub on Mar 1, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The
json.jsfile contains afilterArrayfunction that utilizes thenew Functionconstructor to evaluate strings provided as command-line arguments. This allows for arbitrary JavaScript execution if a malicious filter string is passed to the script. - [COMMAND_EXECUTION]: The
SKILL.mdfile contains numerous examples of executing shell commands viapython3 -c,node -e, andjq. These patterns represent a risk of command injection if the input data or arguments provided to these tools are not strictly sanitized. - [EXTERNAL_DOWNLOADS]: Examples in
SKILL.mddemonstrate fetching data from external URLs usingcurl(e.g.,api.example.com/data), which introduces the risk of the agent interacting with and processing untrusted remote content.
Audit Metadata