📦

jsonlogic

Name: jsonlogic
Author: valeryia-piatrova

Revisão do conteúdo r1 Risco alto 🌐 Acesso à rede📁 Acesso ao sistema de arquivos⚙️ Comandos externos⚡ Contém scripts

Build and Test JsonLogic Business Rules

Business conditions can produce unexpected results when field names, missing values, or library behavior differ. This skill builds JsonLogic rules and guides targeted verification.

Suporta: Claude Codex Code(CC)

⚠️ 38 Ruim

Pare e solicite confirmação antes de instalar.

Revise o plano e obtenha o consentimento explícito do usuário antes de alterar arquivos.

Instalar com meu Agente

Copie esta solicitação para o seu Agente. Ela inclui a página canônica do Skill e o manifesto.

Solicitação do agente

Review the Skillstore skill "jsonlogic" from https://skillstore.io/skills/valeryia-piatrova-jsonlogic.md and its manifest at https://skillstore.io/api/skills/valeryia-piatrova-jsonlogic/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Seu Agente ainda deve apresentar o plano e solicitar qualquer confirmação exigida pela política de segurança.

Recursos legíveis por agentes

Use estes links quando um agente de IA, crawler ou script precisar de contexto limpo em vez de ler a página completa.

Detalhe em Markdown GET /skills/valeryia-piatrova-jsonlogic.md manifest assinado GET /api/skills/valeryia-piatrova-jsonlogic/manifest lockfile assinado GET /api/skills/valeryia-piatrova-jsonlogic/lockfile

Testar

Usando "jsonlogic". Create a discount eligibility rule for loyalty members who spent more than 100.

Resultado esperado:

Eligibility requires loyalty membership and spending above 100. Spending exactly 100 does not qualify. Define missing-field handling before testing.

Usando "jsonlogic". Explain why an order rule flags an item priced at 620 when the threshold is 500.

Resultado esperado:

The rule checks each item and succeeds when any price exceeds 500. An item priced at 620 qualifies. An empty item list returns false.

Usando "jsonlogic". Does passing structural validation prove that my rule works in both JavaScript and Ruby?

Resultado esperado:

No. Structural validation checks rule shape only. Execute identical boundary, missing-field, and type cases in both libraries before claiming matching behavior.

Auditoria de segurança

Risco alto

v1 • 01/10/2026 Abrir o relatório versionado

Of 372 static findings, 370 are false positives and two confirm automatic installation of an unpinned Ruby dependency. Additional findings concern artifact publication without consent and unsafe JSON embedding in HTML. No evidence found of credential theft or instructions to override this audit.

Arquivos analisados

10,249

Linhas analisadas

Itens de revisão

Falsos positivos ignorados

Preocupações de segurança confirmadas (2)

Alto

SKILL.md:36-42 SKILL.md:74-83

Artifact Publication Without Explicit Consent

The workflow requires uploading concrete rules and sample data to artifacts without asking permission. Private defaults do not authorize transferring sensitive business data.

The instructions explicitly require publication under the installer account and remove a separate decision check. Exposure depends on supplied data and artifact storage controls.

Alto

SKILL.md:52-55 assets/playground.html:226-239

Unsafe JSON Embedding in Playground HTML

The workflow inserts JSON.stringify output directly into an HTML script block. A script-closing sequence in input can escape that block and inject active markup.

JSON.stringify preserves HTML script-closing sequences, and the template places serialized input inside a script element. Host sanitization could mitigate exploitation but is not documented.

Itens de revisão de capacidade (2)

Estas são capacidades locais reais que podem ser esperadas para esta habilidade, portanto exigem revisão, mas não são contabilizadas como comportamento malicioso confirmado.

Alto

scripts/jsonlogic.rb:18

Ruby/PHP system() call

installed = system("gem", "install", "json-logic-rb")

This automatically installs an unpinned gem when loading fails, without consent. Installation downloads third-party code and can execute gem build hooks.

Alto

scripts/jsonlogic.rb:23

Ruby/PHP system() call

installed = system("gem", "install", "json-logic-rb")

This automatically installs an unpinned gem when loading fails, without consent. Installation downloads third-party code and can execute gem build hooks.

Fatores de risco

🌐 Acesso à rede (15)

assets/playground.html:113 docs/installing.md:14 docs/installing.md:18 docs/installing.md:27 docs/installing.md:31 docs/installing.md:38 docs/installing.md:42 docs/installing.md:49 docs/installing.md:53 docs/installing.md:60 docs/installing.md:64 README.md:14 references/tests/community/additional.json:2 references/tests/community/chained.json:2 SKILL.md:10

📁 Acesso ao sistema de arquivos (17)

docs/installing.md:18 docs/installing.md:31 docs/installing.md:42 docs/installing.md:53 docs/installing.md:64 docs/installing.md:68 docs/installing.md:18 docs/installing.md:31 docs/installing.md:42 docs/installing.md:53 docs/installing.md:64 docs/installing.md:68 README.md:14 README.md:14 references/operations.md:27 references/tests/community/scopes.json:61 references/tests/community/scopes.json:64

⚙️ Comandos externos (30)

⚡ Contém scripts (50)

Auditado por: codex

Compartilhar e citar este relatório

Compartilhe o relatório de avaliação versionado, o badge neutro, o cartão incorporável e as citações. A Skillstore apresenta evidências sem decidir se este Skill é seguro.

Abrir o relatório versionado

Copiar link do relatório

https://skillstore.io/skills/valeryia-piatrova-jsonlogic/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/valeryia-piatrova-jsonlogic/security.svg)](https://skillstore.io/skills/valeryia-piatrova-jsonlogic?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/valeryia-piatrova-jsonlogic?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/valeryia-piatrova-jsonlogic/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Cartão incorporável

<iframe src="https://skillstore.io/embed/skills/valeryia-piatrova-jsonlogic.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citações acadêmicas (APA · BibTeX · CFF)

Citação APA

valeryia-piatrova. (2026). jsonlogic security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/valeryia-piatrova-jsonlogic/audits/1

Citação BibTeX

@techreport{valeryia-piatrova-valeryia-piatrova-jsonlogic-2026,
  author = {valeryia-piatrova},
  title = {jsonlogic security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/valeryia-piatrova-jsonlogic/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "jsonlogic security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "valeryia-piatrova"
date-released: "2026-10-01"
url: "https://skillstore.io/skills/valeryia-piatrova-jsonlogic/audits/1"
identifiers:
  - type: other
    value: "skillstore:valeryia-piatrova-jsonlogic:audit:1"
    description: "Skillstore immutable audit report identifier"

Pontuação do Skillstore

Por que esta pontuação Confiança das evidências: Médio

100

Arquitetura

Manutenibilidade

Conteúdo

Comunidade

Conformidade com a especificação

O que você pode criar

Encode Eligibility Conditions

Turn product requirements into explicit rules with documented inputs, outputs, and missing-field behavior.

Debug Application Rules

Reproduce unexpected results, identify coercion or operator issues, and verify corrections against representative data.

Compare Rule Implementations

Test identical inputs across frontend and backend libraries to identify unsupported operators and behavior differences.

Teste estes prompts

Explain a Rule

Explain this JsonLogic rule: [rule]. Describe each operator, required fields, returned values, and missing-field behavior. Do not publish an artifact.

Create a Business Rule

Create a JsonLogic rule for [condition] using [schema or synthetic sample]. Explain assumptions and expected outcomes. Keep all data local.

Debug and Verify

Debug [rule] with [synthetic input] in [library and version]. Expected: [result]. Add boundary tests and request permission before installing dependencies or publishing.

Compare Library Behavior

Compare [rule] in [library A] and [library B] using identical synthetic cases. Cover missing values, coercion, and empty arrays. Separate observed from unverified results.

Boas práticas

Provide a schema or synthetic sample and specify the target library and version.
Test normal cases, exact boundaries, missing fields, unexpected types, and empty arrays in the actual evaluator.
Use redacted inputs and explicitly approve dependency installation or artifact publication before either occurs.

Evitar

Treating structural validation or a playground result as proof of production correctness.
Assuming all libraries support the same extensions, truthiness rules, and type coercion.
Providing secrets or production records for automatic artifact publication.

Perguntas frequentes

What is JsonLogic?

JsonLogic represents conditional rules as JSON objects. Libraries evaluate those rules against supplied data.

Which AI tools can use this skill?

The report lists Claude, Codex, and Claude Code. Execution and artifact support depend on the client and available tools.

Which evaluator is used by default?

The default runner uses Ruby and json-logic-rb. You can request a specific library; other runtimes and dependencies must be available separately.

Can it validate rules without executing them?

Yes. The bundled Ruby validator checks structure using standard libraries. It does not establish business correctness or target-library compatibility.

Does the playground match every library?

No. It uses a bundled JavaScript subset with a Ruby truthiness mode. Verify important results in your selected implementation.

Does using the skill require network access?

Reading references and structural validation can work offline. Missing gem installation, hosted artifact publication, and external playground fonts require network access.