本地知识库智能问答

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:48 AM UTC
• Version: 1.0.0

Overview

This appears to be a real cloud-backed knowledge-base tool, but it needs Review because private documents, queries, and API keys can be sent to configurable cloud endpoints and sensitive results are stored locally without strong safeguards.

Install only if you are comfortable sending selected documents and questions to Alibaba Cloud services. Use a dedicated low-privilege DashVector/Bailian key, verify the DashVector endpoint before each knowledge base is used, avoid confidential or regulated documents unless approved, and inspect or clear generated config.json and scripts/query_result.json files after use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/upload_to_vector.py:249

Finding

Unvalidated DashVector Endpoint Can Receive API Credentials and Private Documents

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/query_knowledge_base.py:287

Finding

Private Query Results Are Persisted in a Predictable Shared File

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/init_knowledge_base.py:49

Finding

Knowledge-Base Name Allows Writes Outside the Selected Workspace

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/init_knowledge_base.py:24

Finding

Cloud API Keys Are Stored in Plaintext Without Permission Hardening

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: SKILL.md:27

Finding

Third-Party Python Dependencies Are Installed Without Version or Integrity Pinning

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill is presented as a local knowledge-base QA capability, but the documentation authorizes remote API use and advertises capabilities that are inconsistent with the described behavior. This mismatch can mislead users and calling agents about what data leaves the machine and what actions will actually occur, undermining informed consent and safe routing.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The upload/index workflow states that documents are processed, embedded, and uploaded to Bailian and DashVector, but it does not provide a clear user-facing warning that document content leaves the local environment. For a personal knowledge-base skill, this omission can cause inadvertent exposure of sensitive files to external cloud APIs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README explicitly tells users their local documents will be uploaded to Alibaba Cloud DashVector and processed by Alibaba embedding services, but it does not clearly warn that document contents and derived embeddings leave the local machine and are sent to third-party cloud services. In a knowledge-base skill aimed at teachers using personal notes and course materials, this can lead to unintended disclosure of sensitive, proprietary, or regulated content if users assume the workflow is local-only.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill clearly instructs the agent to read local files, write reports/mindmaps, and call remote services, yet it declares no explicit tool scope or permissions boundary. That makes the effective authority ambiguous and increases the chance of over-broad tool use, unexpected file access, or network exfiltration beyond what a user would reasonably infer.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger list contains broad phrases like '帮我写报告', '根据文档', and '有新文件', which could match ordinary conversations and cause accidental invocation. Because this skill can read files, write artifacts, and contact remote APIs, unintended triggering increases the chance of privacy-impacting or confusing actions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill frames itself as managing a local knowledge base, but core functionality depends on DashVector and Bailian cloud services. This is dangerous because users may assume documents remain local, while indexing and querying can transmit sensitive content or embeddings to third-party infrastructure.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Allowing unrestricted web search as a fallback extends the skill beyond answering from the user's local knowledge base and can introduce untrusted external content into answers. In a skill that may handle private documents, this also raises the risk that user queries or document-derived context are sent to outside services without clear necessity.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/partition_list.py (reported line 56)May include surrounding context.

python

pname = p.get("name", "unknown")

        query_url = f"{endpoint}/v1/collections/{collection}/query"
        q = requests.post(query_url, headers={
            "dashvector-auth-token": api_key,
            "Content-Type": "application/json"
        }, json={

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill is presented as a local knowledge-base QA tool, but it transmits the user's question text to an external embedding API and then queries an external DashVector service. In a knowledge-base context, queries often contain sensitive business, personal, or proprietary information, so this creates a confidentiality and transparency risk if users expect processing to remain local.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

This request sends raw query text to an external embedding endpoint, which constitutes outbound transmission of potentially sensitive user input. Because the skill context is document QA over personal or organizational knowledge bases, user queries may themselves reveal confidential topics, names, incidents, or document contents.

Content

Scanner excerpt · scripts/query_knowledge_base.py (reported line 99)May include surrounding context.

python

}

    try:
        response = requests.post(url, headers=headers, json=payload, timeout=30)
        if response.status_code == 200:
            result = response.json()
            return result["data"][0]["embedding"]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This request transmits embeddings and partition-scoped retrieval requests to an external vector database service. Even when raw documents are not sent here, embeddings and metadata-backed retrieval over a remote collection can expose sensitive knowledge-base content patterns and return confidential excerpts from externally hosted infrastructure.

Content

Scanner excerpt · scripts/query_knowledge_base.py (reported line 138)May include surrounding context.

python

}

    try:
        response = requests.post(url, headers=headers, json=payload, timeout=30)
        resp_data = response.json()

        if resp_data.get("code") == 0:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script extracts full document chunks from local knowledge-base files and sends them to external cloud APIs for embedding generation and vector storage. In a knowledge-base skill this may be intended functionality, but it is still a real data-exposure risk because sensitive personal or corporate document content can leave the local environment without any consent gate, classification check, redaction, or explicit disclosure in the script flow.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

This outbound request sends extracted text chunks to the Bailian embeddings endpoint, constituting external transmission of potentially sensitive document contents. Given the skill's purpose, the transmission is expected, but the lack of notice, consent, or content-sensitivity controls makes it a genuine confidentiality risk.

Content

Scanner excerpt · scripts/upload_to_vector.py (reported line 234)May include surrounding context.

python

"encoding_format": "float"
        }
        try:
            response = requests.post(url, headers=headers, json=payload, timeout=30)
            if response.status_code == 200:
                result = response.json()
                embedding = result["data"][0]["embedding"]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/upload_to_vector.py (reported line 265)May include surrounding context.

python

payload = {"name": partition_name}
    try:
        response = requests.post(url, headers=headers, json=payload, timeout=30)
        resp_data = response.json()
        if response.status_code == 200 and resp_data.get("code") == 0:
            return True, f"Partition '{partition_name}' created"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

This request uploads document records and vectors to DashVector, including chunk content in the fields payload, so sensitive source material is transmitted to an external service. In the knowledge-base context this is operationally relevant rather than overtly malicious, but it still creates a real confidentiality and compliance risk if users assume the knowledge base remains local.

Content

Scanner excerpt · scripts/upload_to_vector.py (reported line 290)May include surrounding context.

python

for attempt in range(max_retries):
        try:
            resp = requests.post(url, headers=headers, json=payload, timeout=60)
            last_resp = resp

            if resp.status_code == 200:

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The markdown states that the AI will automatically generate and save reports to MyNotes/reports/ and MyNotes/mindmaps/, but it does not explicitly warn users that new files will be written into their workspace. For markdown-file review, user-facing documentation should disclose behaviors that modify local data or files.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The natural-language strings in the template instruct the user exclusively in Chinese, including the top-level comment and credential acquisition instructions. Because the file provides no language choice, opt-in, or stated region-specific justification, this appears to violate the language/locale policy criteria.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The auto-discovery logic searches the current directory, subdirectories, and a parent directory for any folder containing raw_docs/ and config.json, which can cause the script to operate on an unintended knowledge base outside the user's immediate target. In a multi-project or shared workspace, this broad discovery increases the chance of accidental access to unrelated sensitive document collections.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The code loads API keys from configuration and immediately uses them in Authorization headers for external requests. There is no accompanying comment, docstring warning, or user-facing notice about the need to protect these credentials or that the script will use them for network transmission.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.