📦

jsonlogic

Name: jsonlogic
Author: valeryia-piatrova

コンテンツリビジョン r1 高リスク 🌐 ネットワークアクセス📁 ファイルシステムへのアクセス⚙️ 外部コマンド⚡ スクリプトを含む

Build and Test JsonLogic Business Rules

Business conditions can produce unexpected results when field names, missing values, or library behavior differ. This skill builds JsonLogic rules and guides targeted verification.

対応: Claude Codex Code(CC)

⚠️ 38 不十分

Maintain this Skill? Claim it ⚠️ 38 不十分

インストール前に停止して確認を求めてください。

計画を確認し、ファイルを変更する前にユーザーの明示的な同意を得てください。

自分のエージェントでインストール

このリクエストをエージェントにコピーしてください。正規の Skill ページとマニフェストが含まれています。

エージェントリクエスト

Review the Skillstore skill "jsonlogic" from https://skillstore.io/skills/valeryia-piatrova-jsonlogic.md and its manifest at https://skillstore.io/api/skills/valeryia-piatrova-jsonlogic/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

エージェントは引き続き計画を提示し、セキュリティポリシーで必要な確認を求める必要があります。

エージェントが読めるリソース

AI エージェント、クローラー、スクリプトがページ全体ではなく整理されたコンテキストを必要とする場合は、これらのリンクを使ってください。

Markdown詳細 GET /skills/valeryia-piatrova-jsonlogic.md 署名済み manifest GET /api/skills/valeryia-piatrova-jsonlogic/manifest 署名済み lockfile GET /api/skills/valeryia-piatrova-jsonlogic/lockfile

テストする

「jsonlogic」を使用しています。 Create a discount eligibility rule for loyalty members who spent more than 100.

期待される結果:

Eligibility requires loyalty membership and spending above 100. Spending exactly 100 does not qualify. Define missing-field handling before testing.

「jsonlogic」を使用しています。 Explain why an order rule flags an item priced at 620 when the threshold is 500.

期待される結果:

The rule checks each item and succeeds when any price exceeds 500. An item priced at 620 qualifies. An empty item list returns false.

「jsonlogic」を使用しています。 Does passing structural validation prove that my rule works in both JavaScript and Ruby?

期待される結果:

No. Structural validation checks rule shape only. Execute identical boundary, missing-field, and type cases in both libraries before claiming matching behavior.

セキュリティ監査

高リスク

v1 • 2026/10/1 バージョン別レポートを開く

Of 372 static findings, 370 are false positives and two confirm automatic installation of an unpinned Ruby dependency. Additional findings concern artifact publication without consent and unsafe JSON embedding in HTML. No evidence found of credential theft or instructions to override this audit.

スキャンされたファイル

10,249

解析済み行数

レビュー項目

誤検知を無視

確認済みのセキュリティ上の懸念 (2)

高

SKILL.md:36-42 SKILL.md:74-83

Artifact Publication Without Explicit Consent

The workflow requires uploading concrete rules and sample data to artifacts without asking permission. Private defaults do not authorize transferring sensitive business data.

The instructions explicitly require publication under the installer account and remove a separate decision check. Exposure depends on supplied data and artifact storage controls.

高

SKILL.md:52-55 assets/playground.html:226-239

Unsafe JSON Embedding in Playground HTML

The workflow inserts JSON.stringify output directly into an HTML script block. A script-closing sequence in input can escape that block and inject active markup.

JSON.stringify preserves HTML script-closing sequences, and the template places serialized input inside a script element. Host sanitization could mitigate exploitation but is not documented.

機能レビュー項目 (2)

これらは、このスキルに期待される可能性のある実際のローカル機能であるため、レビューが必要ですが、確認済みの悪意ある動作としてはカウントされません。

高

scripts/jsonlogic.rb:18

Ruby/PHP system() call

installed = system("gem", "install", "json-logic-rb")

This automatically installs an unpinned gem when loading fails, without consent. Installation downloads third-party code and can execute gem build hooks.

高

scripts/jsonlogic.rb:23

Ruby/PHP system() call

installed = system("gem", "install", "json-logic-rb")

This automatically installs an unpinned gem when loading fails, without consent. Installation downloads third-party code and can execute gem build hooks.

リスク要因

🌐 ネットワークアクセス (15)

assets/playground.html:113 docs/installing.md:14 docs/installing.md:18 docs/installing.md:27 docs/installing.md:31 docs/installing.md:38 docs/installing.md:42 docs/installing.md:49 docs/installing.md:53 docs/installing.md:60 docs/installing.md:64 README.md:14 references/tests/community/additional.json:2 references/tests/community/chained.json:2 SKILL.md:10

📁 ファイルシステムへのアクセス (17)

docs/installing.md:18 docs/installing.md:31 docs/installing.md:42 docs/installing.md:53 docs/installing.md:64 docs/installing.md:68 docs/installing.md:18 docs/installing.md:31 docs/installing.md:42 docs/installing.md:53 docs/installing.md:64 docs/installing.md:68 README.md:14 README.md:14 references/operations.md:27 references/tests/community/scopes.json:61 references/tests/community/scopes.json:64

⚙️ 外部コマンド (30)

⚡ スクリプトを含む (50)

監査者: codex

このレポートを共有・引用

バージョン付き評価レポート、中立的なバッジ、埋め込みカード、引用を共有できます。Skillstore は証拠を報告しますが、この Skill が安全かどうかは判断しません。

バージョン別レポートを開く

レポートリンクをコピー

https://skillstore.io/skills/valeryia-piatrova-jsonlogic/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdownバッジ

[![Skillstore security assessment](https://skillstore.io/badges/skills/valeryia-piatrova-jsonlogic/security.svg)](https://skillstore.io/skills/valeryia-piatrova-jsonlogic?utm_source=security_passport_badge)

HTMLバッジ

<a href="https://skillstore.io/skills/valeryia-piatrova-jsonlogic?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/valeryia-piatrova-jsonlogic/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

埋め込みカード

<iframe src="https://skillstore.io/embed/skills/valeryia-piatrova-jsonlogic.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学術引用 (APA · BibTeX · CFF)

APA形式の引用

valeryia-piatrova. (2026). jsonlogic security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/valeryia-piatrova-jsonlogic/audits/1

BibTeX形式の引用

@techreport{valeryia-piatrova-valeryia-piatrova-jsonlogic-2026,
  author = {valeryia-piatrova},
  title = {jsonlogic security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/valeryia-piatrova-jsonlogic/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "jsonlogic security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "valeryia-piatrova"
date-released: "2026-10-01"
url: "https://skillstore.io/skills/valeryia-piatrova-jsonlogic/audits/1"
identifiers:
  - type: other
    value: "skillstore:valeryia-piatrova-jsonlogic:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore スコア

このスコアの理由証拠の信頼度: 中

100

アーキテクチャ

保守性

コンテンツ

コミュニティ

仕様準拠

作成できるもの

Encode Eligibility Conditions

Turn product requirements into explicit rules with documented inputs, outputs, and missing-field behavior.

Debug Application Rules

Reproduce unexpected results, identify coercion or operator issues, and verify corrections against representative data.

Compare Rule Implementations

Test identical inputs across frontend and backend libraries to identify unsupported operators and behavior differences.

これらのプロンプトを試す

Explain a Rule

Explain this JsonLogic rule: [rule]. Describe each operator, required fields, returned values, and missing-field behavior. Do not publish an artifact.

Create a Business Rule

Create a JsonLogic rule for [condition] using [schema or synthetic sample]. Explain assumptions and expected outcomes. Keep all data local.

Debug and Verify

Debug [rule] with [synthetic input] in [library and version]. Expected: [result]. Add boundary tests and request permission before installing dependencies or publishing.

Compare Library Behavior

Compare [rule] in [library A] and [library B] using identical synthetic cases. Cover missing values, coercion, and empty arrays. Separate observed from unverified results.

ベストプラクティス

Provide a schema or synthetic sample and specify the target library and version.
Test normal cases, exact boundaries, missing fields, unexpected types, and empty arrays in the actual evaluator.
Use redacted inputs and explicitly approve dependency installation or artifact publication before either occurs.

回避

Treating structural validation or a playground result as proof of production correctness.
Assuming all libraries support the same extensions, truthiness rules, and type coercion.
Providing secrets or production records for automatic artifact publication.

よくある質問

What is JsonLogic?

JsonLogic represents conditional rules as JSON objects. Libraries evaluate those rules against supplied data.

Which AI tools can use this skill?

The report lists Claude, Codex, and Claude Code. Execution and artifact support depend on the client and available tools.

Which evaluator is used by default?

The default runner uses Ruby and json-logic-rb. You can request a specific library; other runtimes and dependencies must be available separately.

Can it validate rules without executing them?

Yes. The bundled Ruby validator checks structure using standard libraries. It does not establish business correctness or target-library compatibility.

Does the playground match every library?

No. It uses a bundled JavaScript subset with a Ruby truthiness mode. Verify important results in your selected implementation.

Does using the skill require network access?

Reading references and structural validation can work offline. Missing gem installation, hosted artifact publication, and external playground fonts require network access.