T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:5- Finding
Unnecessary Shell Capability Across Wiki Skills
- Content
View full analysis
- Remediation
View remediation
Security audit
LLM-Wiki-skills
Security checks for vulnerabilities and agentic risk
Overview
This wiki skill set is mostly coherent, but it asks for broad shell/write authority and uses very broad triggers that could cause unexpected persistent wiki changes.
Install only if you want an agent to maintain a persistent local wiki. Before use, restrict it to a specific wiki directory and approved source folder, require confirmation before any file creation or edits, and remove or avoid Bash access unless a future workflow has a specific shell-only need.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (32)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The frontmatter description says to use this skill for broad terms like 'check', 'maintenance', 'clean up', or 'verify wiki quality', which can match many unrelated requests and trigger write-capable behavior unexpectedly. In a skill with Write/Bash compatibility, overbroad activation increases the chance of unintended file modifications or unnecessary scanning of the workspace.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger guidance is excessively broad, telling the agent to use the skill for common words like 'query', 'ask', 'question', 'compare', or 'analyze'. That can cause unintended activation in many normal conversations and, in this skill, may lead to unnecessary file reads and writes such as logging queries or creating wiki pages without the user clearly requesting wiki operations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The README states that valuable answers can be written back into the Wiki, but it does not warn that this modifies persistent stored knowledge. In a persistent knowledge-base skill, silent write-back can cause accidental data corruption, contamination of trusted notes with hallucinated content, or unwanted retention of sensitive information.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README encourages capturing webpages, papers, and articles into Obsidian and processing them with the skill, but provides no privacy or data-handling warning. This can lead users to ingest copyrighted, confidential, personal, or sensitive material into an LLM-mediated workflow without understanding retention, exposure, or downstream storage risks.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The example trigger "处理我在 Obsidian 中保存的新文章" is a plain-language request that could overlap with many normal conversations about handling saved articles. The README does not define specific activation phrases, boundaries, or negative examples to clarify when this skill should be invoked versus general assistance.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill description includes very broad trigger language such as 'knowledge management' and 'any mention of organizing accumulated knowledge with an LLM,' which can cause the agent to invoke this skill in loosely related contexts. Over-broad activation increases the chance the skill will read, write, or restructure files when a narrower or safer workflow would have been more appropriate.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill metadata declares very broad activation cues such as 'ingest', 'add source', 'process document', and 'update wiki with new content', which can match many ordinary requests outside a narrowly scoped wiki-ingestion workflow. In an agentic system, this can cause unintended invocation with write-capable tools, leading the agent to read arbitrary files and modify wiki content when the user did not clearly request this specific operation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The 'When to Use This Skill' section uses ambiguous activation conditions like 'user mentions ingest, add source, process document' without requiring clear confirmation that the task targets this wiki system. Because the skill has Read, Glob, Grep, Bash, and Write compatibility, ambiguous routing increases the chance of unintended file discovery, source analysis, and persistent modifications across the repository.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill description includes very broad activation phrases such as 'organizing accumulated knowledge with an LLM' and 'personal wiki,' which can match many ordinary user requests that are not actually asking to initialize a wiki. In an agentic environment, overbroad triggers can cause the wrong skill to activate and perform write-capable setup actions, creating directories and files in contexts the user did not clearly intend.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The 'When to Use' section is ambiguous and repeats broad phrases without clear exclusions, which increases the chance of accidental invocation. Because this skill is compatible with Write and Bash and is designed to create filesystem structure, ambiguous activation guidance can translate into unintended state-changing actions rather than a harmless misclassification.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The 'When to Use' section repeats vague activation criteria like 'check', 'maintenance', 'find gaps', and 'clean up', without constraining them to an existing wiki or a user-approved scope. This makes the skill easier to invoke in contexts where the user did not intend a full wiki audit, leading to over-collection, excessive reads, or unintended edits.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Step 5 instructs the agent to 'Create new pages for important missing concepts' during linting, but the skill does not clearly warn in advance that running lint can create files. A user asking for a health check may expect analysis only; silently turning diagnostic workflow into content creation can cause unauthorized repository changes and pollute the wiki with speculative pages.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill description includes broad activation phrases such as 'maintain', 'update rules', and 'modify wiki structure', which can overlap with routine user requests unrelated to this skill. Overbroad triggers increase the chance the agent invokes a write-capable schema-modification skill in the wrong context, leading to unintended file edits or policy changes.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The 'When to Use This Skill' section repeats broad terms like 'schema', 'conventions', and 'update rules' without defining boundaries or non-applicable cases. In a system that selects skills from natural-language descriptions, this ambiguity can cause accidental invocation and unnecessary modification of wiki configuration or content.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill description emphasizes answering questions but does not prominently disclose that the workflow may append to log.md and create new wiki pages. This mismatch can mislead upstream planners or users into treating the skill as read-only, resulting in unexpected persistent modifications to the knowledge base and audit/log files.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The 'When to Use' section uses ambiguous, high-frequency request types like summaries, analyses, and comparisons without constraining them to the wiki context. In practice, this increases the chance the agent invokes a stateful skill for ordinary requests, which is dangerous because the skill also prescribes persistent side effects including logging and optional creation of new pages.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The file's explanatory content is written in Chinese, and the aliases on L03 are also Chinese, with no indication that language choice is optional or that the content is intentionally limited to a Chinese-speaking audience. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file presents nearly all substantive content in Chinese, with only limited English headings/terms, and does not indicate that the user can choose another language. Under the natural-language policy rule, forcing a specific language without user opt-in is a policy concern unless the locale limitation is explicitly justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The main instructional content is written in Chinese, and the file does not indicate that the language choice is optional or that this page is intentionally scoped to a Chinese-language audience. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The document body is written entirely in Chinese, while the title and source metadata are in English, indicating a language choice imposed by the skill content rather than a clearly documented locale-specific requirement. The policy explicitly flags language or locale constraints when they do not offer user opt-in or justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown source presents the paper summary entirely in Chinese while the source metadata and title are in English, and it does not state that the skill or content is intentionally Chinese-only. The policy explicitly flags language or locale constraints when a specific language is imposed without user opt-in or documented justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 71% confidence
- Finding
This file is entirely written in Chinese and does not itself state that it is intended only for Chinese-speaking users or that language choice is optional. While there is a link to an English README, this file alone does not present an explicit language choice within its instructions, which may be interpreted as a locale-specific default without opt-in.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The instructions direct the agent to create directories and files but do not prominently warn that the skill performs filesystem modifications. Even though the skill later says to ask for the wiki location first, the lack of an explicit modification warning reduces transparency and can lead to user surprise or unintended writes if the skill is auto-invoked.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill mandates appending a lint entry to log.md as part of execution, but this write side effect is not prominently disclosed as a default behavior. Even though logging is low risk, automatic file mutation can still surprise users, create noisy commits, and violate expectations for a simple verification run.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file mixes an English title with predominantly Chinese body content and does not indicate that the language choice is optional or user-selected. Under the stated policy, forcing a specific language or locale without user opt-in is a natural-language policy concern.
- Content