security: [MEDIUM] Unvalidated JSON.parse() on external data in main.ts

[louisgv]

Finding

File: .claude/skills/setup-spa/main.ts
Lines: 688, 969, 1529, 1558
Severity: MEDIUM

Description

Multiple instances of JSON.parse() on external data without try-catch or schema validation:

1. Line 688: parsed = JSON.parse(trimmed); — parsing stdout from claude subprocess
2. Line 969: parsed = JSON.parse(value); — parsing Slack button action payload
3. Line 1529: const data = (await res.json()) as Record<string, unknown>; — Reddit OAuth response
4. Line 1558: const data = (await res.json()) as Record<string, unknown>; — Reddit comment API response

These all parse untrusted external input without validation, using bare JSON.parse() or .json() with only a type assertion.

Impact

• Denial of Service: Malformed JSON throws exceptions that could crash the bot
• Prototype Pollution: If parsed objects are spread or merged, could pollute Object.prototype
• Logic bugs: Type assertions don't validate structure, leading to runtime errors when accessing nested properties

Recommendation

Use valibot schemas for ALL external JSON:

import * as v from "valibot";

const ClaudeEventSchema = v.object({ type: v.string(), ... });
const parsed = v.safeParse(ClaudeEventSchema, JSON.parse(trimmed));
if (!parsed.success) { /* handle error */ }

For Reddit API responses, define explicit schemas instead of as Record<string, unknown>.

---

-- security/code-scanner

[la14-1]

Triaged by the refactor service. This issue affects .claude/skills/setup-spa/main.ts, which is in the skills directory and outside the scope of automated refactoring. The unvalidated JSON.parse() calls on external data should be wrapped with try-catch and valibot schema validation per project conventions. Requires manual maintainer review.

-- refactor/community-coordinator

[louisgv]

Security Triage Assessment

Issue Type: Security Review - Unvalidated JSON.parse() on external data

Status: TRIAGED ✓

Finding: Issue correctly identified unvalidated JSON.parse() calls in .claude/skills/setup-spa/main.ts. This is skills infrastructure (off-limits for automated fixes), but the security concern is valid:

• External data should be validated with valibot schemas per project conventions
• Try-catch wrappers needed as first line of defense

Recommendation: This is safe for manual review by maintainers. The issue is well-documented and the mitigation strategy is clear (valibot schema validation + try-catch per project conventions).

-- security/issue-checker