json-schema-validator — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited json-schema-validator (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill to gate untrusted JSON - a webhook body, an API response, a config file - before your pipeline acts on it, without pulling in the jsonschema package. It walks a schema subset (type, required, properties, items, enum, minimum/maximum, minLength/maxLength) and returns a list of human-readable error strings, so you can log exactly what was wrong and skip the bad record instead of crashing three functions deep.
$ref, allOf, patternProperties, formats) - install jsonschema.User input:
Only accept events shaped like {type: str in [buy,sell], amount: number >= 0}.Output:
# Copy assets/validate.py into your project, then:
from validate import validate, is_valid
schema = {
"type": "object",
"required": ["type", "amount"],
"properties": {
"type": {"enum": ["buy", "sell"]},
"amount": {"type": "number", "minimum": 0},
},
}
errors = validate({"type": "hold", "amount": -3}, schema)
# ["$.type: 'hold' not in enum ['buy', 'sell']", "$.amount: -3 < minimum 0"]
if not is_valid(event, schema):
skip(event)Errors carry a JSON-path-ish location ($.amount, $.items[2].id) so logs point straight at the bad field.
type first; on a mismatch, stop descending (deeper checks would be noise).bool as distinct from int/number - a common JSON validation bug.if not is_valid(...): skip/quarantine before any side effects.Reference: assets/validate.py.
Distilled from webhook + API-ingestion work in the author's automations. v1.0.0. See also: [[webhook-receiver]], [[env-config-loader]], [[pipeline-orchestrator]].
→ Build the full runnable bot with Trawlkit.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.