Skills jsonlogic

📦

jsonlogic

Name: jsonlogic
Author: valeryia-piatrova

Content revision r1 High Risk 🌐 Network access📁 Filesystem access⚙️ External commands⚡ Contains scripts

Build and Test JsonLogic Business Rules

Business conditions can produce unexpected results when field names, missing values, or library behavior differ. This skill builds JsonLogic rules and guides targeted verification.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "jsonlogic" from https://skillstore.io/skills/valeryia-piatrova-jsonlogic.md and its manifest at https://skillstore.io/api/skills/valeryia-piatrova-jsonlogic/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/valeryia-piatrova-jsonlogic.md Signed manifest GET /api/skills/valeryia-piatrova-jsonlogic/manifest Signed lockfile GET /api/skills/valeryia-piatrova-jsonlogic/lockfile

Test it

Using "jsonlogic". Create a discount eligibility rule for loyalty members who spent more than 100.

Expected outcome:

Eligibility requires loyalty membership and spending above 100. Spending exactly 100 does not qualify. Define missing-field handling before testing.

Using "jsonlogic". Explain why an order rule flags an item priced at 620 when the threshold is 500.

Expected outcome:

The rule checks each item and succeeds when any price exceeds 500. An item priced at 620 qualifies. An empty item list returns false.

Using "jsonlogic". Does passing structural validation prove that my rule works in both JavaScript and Ruby?

Expected outcome:

No. Structural validation checks rule shape only. Execute identical boundary, missing-field, and type cases in both libraries before claiming matching behavior.

Security Audit

High Risk

v1 • 10/1/2026 Open versioned report

Of 372 static findings, 370 are false positives and two confirm automatic installation of an unpinned Ruby dependency. Additional findings concern artifact publication without consent and unsafe JSON embedding in HTML. No evidence found of credential theft or instructions to override this audit.

Files scanned

10,249

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

High

SKILL.md:36-42 SKILL.md:74-83

Artifact Publication Without Explicit Consent

The workflow requires uploading concrete rules and sample data to artifacts without asking permission. Private defaults do not authorize transferring sensitive business data.

The instructions explicitly require publication under the installer account and remove a separate decision check. Exposure depends on supplied data and artifact storage controls.

High

SKILL.md:52-55 assets/playground.html:226-239

Unsafe JSON Embedding in Playground HTML

The workflow inserts JSON.stringify output directly into an HTML script block. A script-closing sequence in input can escape that block and inject active markup.

JSON.stringify preserves HTML script-closing sequences, and the template places serialized input inside a script element. Host sanitization could mitigate exploitation but is not documented.

Capability review items (2)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

scripts/jsonlogic.rb:18

Ruby/PHP system() call

installed = system("gem", "install", "json-logic-rb")

This automatically installs an unpinned gem when loading fails, without consent. Installation downloads third-party code and can execute gem build hooks.

High

scripts/jsonlogic.rb:23

Ruby/PHP system() call

installed = system("gem", "install", "json-logic-rb")

This automatically installs an unpinned gem when loading fails, without consent. Installation downloads third-party code and can execute gem build hooks.

Risk Factors

🌐 Network access (15)

assets/playground.html:113 docs/installing.md:14 docs/installing.md:18 docs/installing.md:27 docs/installing.md:31 docs/installing.md:38 docs/installing.md:42 docs/installing.md:49 docs/installing.md:53 docs/installing.md:60 docs/installing.md:64 README.md:14 references/tests/community/additional.json:2 references/tests/community/chained.json:2 SKILL.md:10

📁 Filesystem access (17)

docs/installing.md:18 docs/installing.md:31 docs/installing.md:42 docs/installing.md:53 docs/installing.md:64 docs/installing.md:68 docs/installing.md:18 docs/installing.md:31 docs/installing.md:42 docs/installing.md:53 docs/installing.md:64 docs/installing.md:68 README.md:14 README.md:14 references/operations.md:27 references/tests/community/scopes.json:61 references/tests/community/scopes.json:64

⚙️ External commands (30)

⚡ Contains scripts (50)

Audited by: codex

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/valeryia-piatrova-jsonlogic/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/valeryia-piatrova-jsonlogic/security.svg)](https://skillstore.io/skills/valeryia-piatrova-jsonlogic?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/valeryia-piatrova-jsonlogic?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/valeryia-piatrova-jsonlogic/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/valeryia-piatrova-jsonlogic.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

valeryia-piatrova. (2026). jsonlogic security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/valeryia-piatrova-jsonlogic/audits/1

BibTeX citation

@techreport{valeryia-piatrova-valeryia-piatrova-jsonlogic-2026,
  author = {valeryia-piatrova},
  title = {jsonlogic security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/valeryia-piatrova-jsonlogic/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "jsonlogic security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "valeryia-piatrova"
date-released: "2026-10-01"
url: "https://skillstore.io/skills/valeryia-piatrova-jsonlogic/audits/1"
identifiers:
  - type: other
    value: "skillstore:valeryia-piatrova-jsonlogic:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

100

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Encode Eligibility Conditions

Turn product requirements into explicit rules with documented inputs, outputs, and missing-field behavior.

Debug Application Rules

Reproduce unexpected results, identify coercion or operator issues, and verify corrections against representative data.

Compare Rule Implementations

Test identical inputs across frontend and backend libraries to identify unsupported operators and behavior differences.

Try These Prompts

Explain a Rule

Explain this JsonLogic rule: [rule]. Describe each operator, required fields, returned values, and missing-field behavior. Do not publish an artifact.

Create a Business Rule

Create a JsonLogic rule for [condition] using [schema or synthetic sample]. Explain assumptions and expected outcomes. Keep all data local.

Debug and Verify

Debug [rule] with [synthetic input] in [library and version]. Expected: [result]. Add boundary tests and request permission before installing dependencies or publishing.

Compare Library Behavior

Compare [rule] in [library A] and [library B] using identical synthetic cases. Cover missing values, coercion, and empty arrays. Separate observed from unverified results.

Best Practices

Provide a schema or synthetic sample and specify the target library and version.
Test normal cases, exact boundaries, missing fields, unexpected types, and empty arrays in the actual evaluator.
Use redacted inputs and explicitly approve dependency installation or artifact publication before either occurs.

Avoid

Treating structural validation or a playground result as proof of production correctness.
Assuming all libraries support the same extensions, truthiness rules, and type coercion.
Providing secrets or production records for automatic artifact publication.

Frequently Asked Questions

What is JsonLogic?

JsonLogic represents conditional rules as JSON objects. Libraries evaluate those rules against supplied data.

Which AI tools can use this skill?

The report lists Claude, Codex, and Claude Code. Execution and artifact support depend on the client and available tools.

Which evaluator is used by default?

The default runner uses Ruby and json-logic-rb. You can request a specific library; other runtimes and dependencies must be available separately.

Can it validate rules without executing them?

Yes. The bundled Ruby validator checks structure using standard libraries. It does not establish business correctness or target-library compatibility.

Does the playground match every library?

No. It uses a bundled JavaScript subset with a Ruby truthiness mode. Verify important results in your selected implementation.

Does using the skill require network access?

Reading references and structural validation can work offline. Missing gem installation, hosted artifact publication, and external playground fonts require network access.