📦

jsonlogic

Name: jsonlogic
Author: valeryia-piatrova

Ревизия содержимого r1 Высокий риск 🌐 Доступ к сети📁 Доступ к файловой системе⚙️ Внешние команды⚡ Содержит скрипты

Build and Test JsonLogic Business Rules

Business conditions can produce unexpected results when field names, missing values, or library behavior differ. This skill builds JsonLogic rules and guides targeted verification.

Поддерживает: Claude Codex Code(CC)

⚠️ 38 Плохо

Maintain this Skill? Claim it ⚠️ 38 Плохо

Остановитесь и запросите подтверждение перед установкой.

Проверьте план и получите явное согласие пользователя перед изменением файлов.

Установить с помощью моего Агента

Скопируйте этот запрос в своего Агента. Он содержит каноническую страницу Skill и манифест.

Запрос агента

Review the Skillstore skill "jsonlogic" from https://skillstore.io/skills/valeryia-piatrova-jsonlogic.md and its manifest at https://skillstore.io/api/skills/valeryia-piatrova-jsonlogic/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Ваш Агент по-прежнему должен показать план и запросить все подтверждения, требуемые политикой безопасности.

Ресурсы для AI-агентов

Используйте эти ссылки, когда AI-агенту, crawler или script нужен чистый контекст вместо полной страницы.

Markdown-детали GET /skills/valeryia-piatrova-jsonlogic.md Подписанный manifest GET /api/skills/valeryia-piatrova-jsonlogic/manifest Подписанный lockfile GET /api/skills/valeryia-piatrova-jsonlogic/lockfile

Протестировать

Использование «jsonlogic». Create a discount eligibility rule for loyalty members who spent more than 100.

Ожидаемый результат:

Eligibility requires loyalty membership and spending above 100. Spending exactly 100 does not qualify. Define missing-field handling before testing.

Использование «jsonlogic». Explain why an order rule flags an item priced at 620 when the threshold is 500.

Ожидаемый результат:

The rule checks each item and succeeds when any price exceeds 500. An item priced at 620 qualifies. An empty item list returns false.

Использование «jsonlogic». Does passing structural validation prove that my rule works in both JavaScript and Ruby?

Ожидаемый результат:

No. Structural validation checks rule shape only. Execute identical boundary, missing-field, and type cases in both libraries before claiming matching behavior.

Аудит безопасности

Высокий риск

v1 • 01.10.2026 Открыть версионный отчет

Of 372 static findings, 370 are false positives and two confirm automatic installation of an unpinned Ruby dependency. Additional findings concern artifact publication without consent and unsafe JSON embedding in HTML. No evidence found of credential theft or instructions to override this audit.

Просканировано файлов

10,249

Проанализировано строк

Пункты проверки

Ложные срабатывания проигнорированы

Подтверждённые проблемы безопасности (2)

Высокий

SKILL.md:36-42 SKILL.md:74-83

Artifact Publication Without Explicit Consent

The workflow requires uploading concrete rules and sample data to artifacts without asking permission. Private defaults do not authorize transferring sensitive business data.

The instructions explicitly require publication under the installer account and remove a separate decision check. Exposure depends on supplied data and artifact storage controls.

Высокий

SKILL.md:52-55 assets/playground.html:226-239

Unsafe JSON Embedding in Playground HTML

The workflow inserts JSON.stringify output directly into an HTML script block. A script-closing sequence in input can escape that block and inject active markup.

JSON.stringify preserves HTML script-closing sequences, and the template places serialized input inside a script element. Host sanitization could mitigate exploitation but is not documented.

Пункты проверки возможностей (2)

Это реальные локальные возможности, которые могут ожидаться для этого навыка, поэтому они требуют проверки, но не считаются подтверждённым вредоносным поведением.

Высокий

scripts/jsonlogic.rb:18

Ruby/PHP system() call

installed = system("gem", "install", "json-logic-rb")

This automatically installs an unpinned gem when loading fails, without consent. Installation downloads third-party code and can execute gem build hooks.

Высокий

scripts/jsonlogic.rb:23

Ruby/PHP system() call

installed = system("gem", "install", "json-logic-rb")

This automatically installs an unpinned gem when loading fails, without consent. Installation downloads third-party code and can execute gem build hooks.

Факторы риска

🌐 Доступ к сети (15)

assets/playground.html:113 docs/installing.md:14 docs/installing.md:18 docs/installing.md:27 docs/installing.md:31 docs/installing.md:38 docs/installing.md:42 docs/installing.md:49 docs/installing.md:53 docs/installing.md:60 docs/installing.md:64 README.md:14 references/tests/community/additional.json:2 references/tests/community/chained.json:2 SKILL.md:10

📁 Доступ к файловой системе (17)

docs/installing.md:18 docs/installing.md:31 docs/installing.md:42 docs/installing.md:53 docs/installing.md:64 docs/installing.md:68 docs/installing.md:18 docs/installing.md:31 docs/installing.md:42 docs/installing.md:53 docs/installing.md:64 docs/installing.md:68 README.md:14 README.md:14 references/operations.md:27 references/tests/community/scopes.json:61 references/tests/community/scopes.json:64

⚙️ Внешние команды (30)

⚡ Содержит скрипты (50)

Аудитор:: codex

Поделиться и цитировать этот отчет

Делитесь версионным отчетом об оценке, нейтральным значком, встраиваемой карточкой и цитатами. Skillstore публикует доказательства, не решая, безопасен ли этот Skill.

Открыть версионный отчет

Копировать ссылку на отчёт

https://skillstore.io/skills/valeryia-piatrova-jsonlogic/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Значок Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/valeryia-piatrova-jsonlogic/security.svg)](https://skillstore.io/skills/valeryia-piatrova-jsonlogic?utm_source=security_passport_badge)

Значок HTML

<a href="https://skillstore.io/skills/valeryia-piatrova-jsonlogic?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/valeryia-piatrova-jsonlogic/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Встраиваемая карточка

<iframe src="https://skillstore.io/embed/skills/valeryia-piatrova-jsonlogic.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Академические ссылки (APA · BibTeX · CFF)

Цитата APA

valeryia-piatrova. (2026). jsonlogic security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/valeryia-piatrova-jsonlogic/audits/1

Цитата BibTeX

@techreport{valeryia-piatrova-valeryia-piatrova-jsonlogic-2026,
  author = {valeryia-piatrova},
  title = {jsonlogic security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/valeryia-piatrova-jsonlogic/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "jsonlogic security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "valeryia-piatrova"
date-released: "2026-10-01"
url: "https://skillstore.io/skills/valeryia-piatrova-jsonlogic/audits/1"
identifiers:
  - type: other
    value: "skillstore:valeryia-piatrova-jsonlogic:audit:1"
    description: "Skillstore immutable audit report identifier"

Оценка Skillstore

Почему такая оценка Достоверность доказательств: Средний

100

Архитектура

Сопровождаемость

Контент

Сообщество

Соответствие спецификации

Что вы можете построить

Encode Eligibility Conditions

Turn product requirements into explicit rules with documented inputs, outputs, and missing-field behavior.

Debug Application Rules

Reproduce unexpected results, identify coercion or operator issues, and verify corrections against representative data.

Compare Rule Implementations

Test identical inputs across frontend and backend libraries to identify unsupported operators and behavior differences.

Попробуйте эти промпты

Explain a Rule

Explain this JsonLogic rule: [rule]. Describe each operator, required fields, returned values, and missing-field behavior. Do not publish an artifact.

Create a Business Rule

Create a JsonLogic rule for [condition] using [schema or synthetic sample]. Explain assumptions and expected outcomes. Keep all data local.

Debug and Verify

Debug [rule] with [synthetic input] in [library and version]. Expected: [result]. Add boundary tests and request permission before installing dependencies or publishing.

Compare Library Behavior

Compare [rule] in [library A] and [library B] using identical synthetic cases. Cover missing values, coercion, and empty arrays. Separate observed from unverified results.

Лучшие практики

Provide a schema or synthetic sample and specify the target library and version.
Test normal cases, exact boundaries, missing fields, unexpected types, and empty arrays in the actual evaluator.
Use redacted inputs and explicitly approve dependency installation or artifact publication before either occurs.

Избегать

Treating structural validation or a playground result as proof of production correctness.
Assuming all libraries support the same extensions, truthiness rules, and type coercion.
Providing secrets or production records for automatic artifact publication.

Часто задаваемые вопросы

What is JsonLogic?

JsonLogic represents conditional rules as JSON objects. Libraries evaluate those rules against supplied data.

Which AI tools can use this skill?

The report lists Claude, Codex, and Claude Code. Execution and artifact support depend on the client and available tools.

Which evaluator is used by default?

The default runner uses Ruby and json-logic-rb. You can request a specific library; other runtimes and dependencies must be available separately.

Can it validate rules without executing them?

Yes. The bundled Ruby validator checks structure using standard libraries. It does not establish business correctness or target-library compatibility.

Does the playground match every library?

No. It uses a bundled JavaScript subset with a Ruby truthiness mode. Verify important results in your selected implementation.

Does using the skill require network access?

Reading references and structural validation can work offline. Missing gem installation, hosted artifact publication, and external playground fonts require network access.