📦

jsonlogic

Name: jsonlogic
Author: valeryia-piatrova

Revisión del contenido r1 Riesgo alto 🌐 Acceso a red📁 Acceso al sistema de archivos⚙️ Comandos externos⚡ Contiene scripts

Build and Test JsonLogic Business Rules

Business conditions can produce unexpected results when field names, missing values, or library behavior differ. This skill builds JsonLogic rules and guides targeted verification.

Compatible con: Claude Codex Code(CC)

⚠️ 38 Deficiente

Maintain this Skill? Claim it ⚠️ 38 Deficiente

Detente y solicita confirmación antes de instalar.

Revisa el plan y obtén el consentimiento explícito del usuario antes de modificar archivos.

Instalar con mi Agente

Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.

Solicitud de agente

Review the Skillstore skill "jsonlogic" from https://skillstore.io/skills/valeryia-piatrova-jsonlogic.md and its manifest at https://skillstore.io/api/skills/valeryia-piatrova-jsonlogic/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.

Recursos legibles por agentes

Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.

Detalle Markdown GET /skills/valeryia-piatrova-jsonlogic.md Manifest firmado GET /api/skills/valeryia-piatrova-jsonlogic/manifest Lockfile firmado GET /api/skills/valeryia-piatrova-jsonlogic/lockfile

Pruébalo

Usando "jsonlogic". Create a discount eligibility rule for loyalty members who spent more than 100.

Resultado esperado:

Eligibility requires loyalty membership and spending above 100. Spending exactly 100 does not qualify. Define missing-field handling before testing.

Usando "jsonlogic". Explain why an order rule flags an item priced at 620 when the threshold is 500.

Resultado esperado:

The rule checks each item and succeeds when any price exceeds 500. An item priced at 620 qualifies. An empty item list returns false.

Usando "jsonlogic". Does passing structural validation prove that my rule works in both JavaScript and Ruby?

Resultado esperado:

No. Structural validation checks rule shape only. Execute identical boundary, missing-field, and type cases in both libraries before claiming matching behavior.

Auditoría de seguridad

Riesgo alto

v1 • 1/10/2026 Abrir el informe versionado

Of 372 static findings, 370 are false positives and two confirm automatic installation of an unpinned Ruby dependency. Additional findings concern artifact publication without consent and unsafe JSON embedding in HTML. No evidence found of credential theft or instructions to override this audit.

Archivos escaneados

10,249

Líneas analizadas

Elementos de revisión

Falsos positivos ignorados

Preocupaciones de seguridad confirmadas (2)

Alto

SKILL.md:36-42 SKILL.md:74-83

Artifact Publication Without Explicit Consent

The workflow requires uploading concrete rules and sample data to artifacts without asking permission. Private defaults do not authorize transferring sensitive business data.

The instructions explicitly require publication under the installer account and remove a separate decision check. Exposure depends on supplied data and artifact storage controls.

Alto

SKILL.md:52-55 assets/playground.html:226-239

Unsafe JSON Embedding in Playground HTML

The workflow inserts JSON.stringify output directly into an HTML script block. A script-closing sequence in input can escape that block and inject active markup.

JSON.stringify preserves HTML script-closing sequences, and the template places serialized input inside a script element. Host sanitization could mitigate exploitation but is not documented.

Elementos de revisión de capacidades (2)

Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.

Alto

scripts/jsonlogic.rb:18

Ruby/PHP system() call

installed = system("gem", "install", "json-logic-rb")

This automatically installs an unpinned gem when loading fails, without consent. Installation downloads third-party code and can execute gem build hooks.

Alto

scripts/jsonlogic.rb:23

Ruby/PHP system() call

installed = system("gem", "install", "json-logic-rb")

This automatically installs an unpinned gem when loading fails, without consent. Installation downloads third-party code and can execute gem build hooks.

Factores de riesgo

🌐 Acceso a red (15)

assets/playground.html:113 docs/installing.md:14 docs/installing.md:18 docs/installing.md:27 docs/installing.md:31 docs/installing.md:38 docs/installing.md:42 docs/installing.md:49 docs/installing.md:53 docs/installing.md:60 docs/installing.md:64 README.md:14 references/tests/community/additional.json:2 references/tests/community/chained.json:2 SKILL.md:10

📁 Acceso al sistema de archivos (17)

docs/installing.md:18 docs/installing.md:31 docs/installing.md:42 docs/installing.md:53 docs/installing.md:64 docs/installing.md:68 docs/installing.md:18 docs/installing.md:31 docs/installing.md:42 docs/installing.md:53 docs/installing.md:64 docs/installing.md:68 README.md:14 README.md:14 references/operations.md:27 references/tests/community/scopes.json:61 references/tests/community/scopes.json:64

⚙️ Comandos externos (30)

⚡ Contiene scripts (50)

Auditado por: codex

Compartir y citar este informe

Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.

Abrir el informe versionado

Copiar enlace del informe

https://skillstore.io/skills/valeryia-piatrova-jsonlogic/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Insignia Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/valeryia-piatrova-jsonlogic/security.svg)](https://skillstore.io/skills/valeryia-piatrova-jsonlogic?utm_source=security_passport_badge)

Insignia HTML

<a href="https://skillstore.io/skills/valeryia-piatrova-jsonlogic?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/valeryia-piatrova-jsonlogic/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Tarjeta para insertar

<iframe src="https://skillstore.io/embed/skills/valeryia-piatrova-jsonlogic.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citas académicas (APA · BibTeX · CFF)

Cita APA

valeryia-piatrova. (2026). jsonlogic security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/valeryia-piatrova-jsonlogic/audits/1

Cita BibTeX

@techreport{valeryia-piatrova-valeryia-piatrova-jsonlogic-2026,
  author = {valeryia-piatrova},
  title = {jsonlogic security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/valeryia-piatrova-jsonlogic/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "jsonlogic security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "valeryia-piatrova"
date-released: "2026-10-01"
url: "https://skillstore.io/skills/valeryia-piatrova-jsonlogic/audits/1"
identifiers:
  - type: other
    value: "skillstore:valeryia-piatrova-jsonlogic:audit:1"
    description: "Skillstore immutable audit report identifier"

Puntuación de Skillstore

Por qué esta puntuación Confianza de la evidencia: Medio

100

Arquitectura

Mantenibilidad

Contenido

Comunidad

Cumplimiento de la especificación

Lo que puedes crear

Encode Eligibility Conditions

Turn product requirements into explicit rules with documented inputs, outputs, and missing-field behavior.

Debug Application Rules

Reproduce unexpected results, identify coercion or operator issues, and verify corrections against representative data.

Compare Rule Implementations

Test identical inputs across frontend and backend libraries to identify unsupported operators and behavior differences.

Prueba estos prompts

Explain a Rule

Explain this JsonLogic rule: [rule]. Describe each operator, required fields, returned values, and missing-field behavior. Do not publish an artifact.

Create a Business Rule

Create a JsonLogic rule for [condition] using [schema or synthetic sample]. Explain assumptions and expected outcomes. Keep all data local.

Debug and Verify

Debug [rule] with [synthetic input] in [library and version]. Expected: [result]. Add boundary tests and request permission before installing dependencies or publishing.

Compare Library Behavior

Compare [rule] in [library A] and [library B] using identical synthetic cases. Cover missing values, coercion, and empty arrays. Separate observed from unverified results.

Mejores prácticas

Provide a schema or synthetic sample and specify the target library and version.
Test normal cases, exact boundaries, missing fields, unexpected types, and empty arrays in the actual evaluator.
Use redacted inputs and explicitly approve dependency installation or artifact publication before either occurs.

Evitar

Treating structural validation or a playground result as proof of production correctness.
Assuming all libraries support the same extensions, truthiness rules, and type coercion.
Providing secrets or production records for automatic artifact publication.

Preguntas frecuentes

What is JsonLogic?

JsonLogic represents conditional rules as JSON objects. Libraries evaluate those rules against supplied data.

Which AI tools can use this skill?

The report lists Claude, Codex, and Claude Code. Execution and artifact support depend on the client and available tools.

Which evaluator is used by default?

The default runner uses Ruby and json-logic-rb. You can request a specific library; other runtimes and dependencies must be available separately.

Can it validate rules without executing them?

Yes. The bundled Ruby validator checks structure using standard libraries. It does not establish business correctness or target-library compatibility.

Does the playground match every library?

No. It uses a bundled JavaScript subset with a Ruby truthiness mode. Verify important results in your selected implementation.

Does using the skill require network access?

Reading references and structural validation can work offline. Missing gem installation, hosted artifact publication, and external playground fonts require network access.