jbvc/json-to-llm-context
Turn JSON or PostgreSQL jsonb payloads into compact readable context for LLMs. Use when a user wants to compress JSON, reduce token usage, summarize API responses, or convert structured data into model-friendly text without dumping raw paths.
68
85%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
High
Do not use without reviewing
Security
1 high severity finding. You should review these findings carefully before considering using this skill.
W007: Insecure credential handling detected in skill instructions.
What this means
The skill handles credentials insecurely by requiring the agent to include secret values verbatim in its generated output. This exposes credentials in the agent’s context and conversation history, creating a risk of data exfiltration.
Why it was flagged
This skill instructs the agent to convert arbitrary JSON/jsonb fields into readable summaries (and even has options like --preserve and --show-paths that force keeping exact fields/values) but gives no guidance to redact or avoid emitting sensitive fields, so secrets present in the input could be output verbatim.
Where we found it
write_output function emitting all JSON fields to stdout/file without redaction
command · 3 sites
The script processes arbitrary JSON/jsonb input and outputs all fields (including potentially sensitive ones like passwords, API keys, tokens, secrets) to stdout or a file via write_output(), with no redaction, filtering, or guidance to avoid emitting sensitive fields. The --preserve and --show-paths options even force keeping exact fields/values.
scripts/json_to_readable_context.py
188
def write_output(output: str, output_path: str | None) -> None:
scripts/json_to_readable_context.py
192
sys.stdout.write(output + "\n")
scripts/json_to_readable_context.py
1011
write_output(output, args.output)
- Audited
- Security analysis