Security audit

LLM-Wiki-skills

Security checks for vulnerabilities and agentic risk

Overview

This wiki skill set is mostly coherent, but it asks for broad shell/write authority and uses very broad triggers that could cause unexpected persistent wiki changes.

Install only if you want an agent to maintain a persistent local wiki. Before use, restrict it to a specific wiki directory and approved source folder, require confirmation before any file creation or edits, and remove or avoid Bash access unless a future workflow has a specific shell-only need.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:5
Finding: Unnecessary Shell Capability Across Wiki Skills<![CDATA[ ## Vulnerability Details **File Locations**: - `SKILL.md:5` - `skills/wiki-ingest/SKILL.md:5` - `skills/wiki-init/SKILL.md:5` - `skills/wiki-lint/SKILL.md:5` - `skills/wiki-maintain/SKILL.md:5` - `skills/wiki-query/SKILL.md:5` **Vulnerability Type**: Excessive tool permissions and violation of least privilege **Risk Level**: Medium ### Vulnerable Configuration The following capability declaration appears in all six affected files: ```yaml compatibility: Write, Read, Glob, Grep, Bash ``` For example, the complete relevant frontmatter in the root Skill is: ```yaml --- name: wiki-knowledge-base description: | LLM-powered personal wiki knowledge base system. Use this when user wants to build and maintain a persistent wiki using LLMs following the LLM Wiki pattern (karpathy/442a6bf555914893e9891c11519de94f). This system implements: wiki initialization (two-layer architecture - wiki content and schema), source ingestion with cross-reference maintenance, querying with synthesis and citations, health checking (lint), and schema management. Source files are stored externally (e.g., in project's raw/ folder), not copied into the wiki. Perfect for: personal knowledge management, research wikis, reading companions, team knowledge bases. Triggers on: wiki knowledge base, LLM wiki, personal wiki, build wiki, knowledge management, or any mention of organizing accumulated knowledge with an LLM. compatibility: Write, Read, Glob, Grep, Bash --- ``` The same excessive capability is declared by each sub-skill: ```yaml compatibility: Write, Read, Glob, Grep, Bash ``` ### Technical Analysis The documented workflows only require Markdown file discovery, reading, searching, creation, and modification. No Skill defines a shell command, executable script, package installation procedure, or other operation that inherently requires Bash. Granting Bash access therefore violates the principle of least privilege. Shell access has a substantially broader security boundar ...[truncated 2457 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `Bash` from the compatibility declaration in all affected files: ```yaml compatibility: Write, Read, Glob, Grep ``` 2. Apply the change to: - `SKILL.md` - `skills/wiki-ingest/SKILL.md` - `skills/wiki-init/SKILL.md` - `skills/wiki-lint/SKILL.md` - `skills/wiki-maintain/SKILL.md` - `skills/wiki-query/SKILL.md` 3. Restrict `Read` and `Write` operations to explicit, user-approved locations: - The selected `wiki/` directory. - The specific external source files or source directory approved by the user. 4. Validate and normalize paths before reading or writing: - Reject path traversal such as `../`. - Resolve symbolic links before enforcing directory boundaries. - Avoid following links outside approved roots. - Require confirmation before overwriting, deleting, or renaming existing files. 5. Treat ingested documents and wiki pages as untrusted data rather than executable instructions. Explicitly state that commands or Agent directives embedded in source content must not be followed. 6. If a future feature genuinely requires shell execution, expose a narrowly scoped operation instead of unrestricted Bash. Use fixed commands, validated arguments, a restricted working directory, and explicit user confirmation. ]]>

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (32)

Vague Triggers

High

Confidence: 97% confidence
Finding: The frontmatter description says to use this skill for broad terms like 'check', 'maintenance', 'clean up', or 'verify wiki quality', which can match many unrelated requests and trigger write-capable behavior unexpectedly. In a skill with Write/Bash compatibility, overbroad activation increases the chance of unintended file modifications or unnecessary scanning of the workspace.

Vague Triggers

High

Confidence: 97% confidence
Finding: The trigger guidance is excessively broad, telling the agent to use the skill for common words like 'query', 'ask', 'question', 'compare', or 'analyze'. That can cause unintended activation in many normal conversations and, in this skill, may lead to unnecessary file reads and writes such as logging queries or creating wiki pages without the user clearly requesting wiki operations.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The README states that valuable answers can be written back into the Wiki, but it does not warn that this modifies persistent stored knowledge. In a persistent knowledge-base skill, silent write-back can cause accidental data corruption, contamination of trusted notes with hallucinated content, or unwanted retention of sensitive information.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The README encourages capturing webpages, papers, and articles into Obsidian and processing them with the skill, but provides no privacy or data-handling warning. This can lead users to ingest copyrighted, confidential, personal, or sensitive material into an LLM-mediated workflow without understanding retention, exposure, or downstream storage risks.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The example trigger "处理我在 Obsidian 中保存的新文章" is a plain-language request that could overlap with many normal conversations about handling saved articles. The README does not define specific activation phrases, boundaries, or negative examples to clarify when this skill should be invoked versus general assistance.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The skill description includes very broad trigger language such as 'knowledge management' and 'any mention of organizing accumulated knowledge with an LLM,' which can cause the agent to invoke this skill in loosely related contexts. Over-broad activation increases the chance the skill will read, write, or restructure files when a narrower or safer workflow would have been more appropriate.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The skill metadata declares very broad activation cues such as 'ingest', 'add source', 'process document', and 'update wiki with new content', which can match many ordinary requests outside a narrowly scoped wiki-ingestion workflow. In an agentic system, this can cause unintended invocation with write-capable tools, leading the agent to read arbitrary files and modify wiki content when the user did not clearly request this specific operation.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The 'When to Use This Skill' section uses ambiguous activation conditions like 'user mentions ingest, add source, process document' without requiring clear confirmation that the task targets this wiki system. Because the skill has Read, Glob, Grep, Bash, and Write compatibility, ambiguous routing increases the chance of unintended file discovery, source analysis, and persistent modifications across the repository.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The skill description includes very broad activation phrases such as 'organizing accumulated knowledge with an LLM' and 'personal wiki,' which can match many ordinary user requests that are not actually asking to initialize a wiki. In an agentic environment, overbroad triggers can cause the wrong skill to activate and perform write-capable setup actions, creating directories and files in contexts the user did not clearly intend.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The 'When to Use' section is ambiguous and repeats broad phrases without clear exclusions, which increases the chance of accidental invocation. Because this skill is compatible with Write and Bash and is designed to create filesystem structure, ambiguous activation guidance can translate into unintended state-changing actions rather than a harmless misclassification.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The 'When to Use' section repeats vague activation criteria like 'check', 'maintenance', 'find gaps', and 'clean up', without constraining them to an existing wiki or a user-approved scope. This makes the skill easier to invoke in contexts where the user did not intend a full wiki audit, leading to over-collection, excessive reads, or unintended edits.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: Step 5 instructs the agent to 'Create new pages for important missing concepts' during linting, but the skill does not clearly warn in advance that running lint can create files. A user asking for a health check may expect analysis only; silently turning diagnostic workflow into content creation can cause unauthorized repository changes and pollute the wiki with speculative pages.

Vague Triggers

Medium

Confidence: 97% confidence
Finding: The skill description includes broad activation phrases such as 'maintain', 'update rules', and 'modify wiki structure', which can overlap with routine user requests unrelated to this skill. Overbroad triggers increase the chance the agent invokes a write-capable schema-modification skill in the wrong context, leading to unintended file edits or policy changes.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The 'When to Use This Skill' section repeats broad terms like 'schema', 'conventions', and 'update rules' without defining boundaries or non-applicable cases. In a system that selects skills from natural-language descriptions, this ambiguity can cause accidental invocation and unnecessary modification of wiki configuration or content.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill description emphasizes answering questions but does not prominently disclose that the workflow may append to log.md and create new wiki pages. This mismatch can mislead upstream planners or users into treating the skill as read-only, resulting in unexpected persistent modifications to the knowledge base and audit/log files.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The 'When to Use' section uses ambiguous, high-frequency request types like summaries, analyses, and comparisons without constraining them to the wiki context. In practice, this increases the chance the agent invokes a stateful skill for ordinary requests, which is dangerous because the skill also prescribes persistent side effects including logging and optional creation of new pages.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: The file's explanatory content is written in Chinese, and the aliases on L03 are also Chinese, with no indication that language choice is optional or that the content is intentionally limited to a Chinese-speaking audience. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: This markdown file presents nearly all substantive content in Chinese, with only limited English headings/terms, and does not indicate that the user can choose another language. Under the natural-language policy rule, forcing a specific language without user opt-in is a policy concern unless the locale limitation is explicitly justified.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The main instructional content is written in Chinese, and the file does not indicate that the language choice is optional or that this page is intentionally scoped to a Chinese-language audience. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: The document body is written entirely in Chinese, while the title and source metadata are in English, indicating a language choice imposed by the skill content rather than a clearly documented locale-specific requirement. The policy explicitly flags language or locale constraints when they do not offer user opt-in or justification.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: This markdown source presents the paper summary entirely in Chinese while the source metadata and title are in English, and it does not state that the skill or content is intentionally Chinese-only. The policy explicitly flags language or locale constraints when a specific language is imposed without user opt-in or documented justification.

Natural-Language Policy Violations

Low

Confidence: 71% confidence
Finding: This file is entirely written in Chinese and does not itself state that it is intended only for Chinese-speaking users or that language choice is optional. While there is a link to an English README, this file alone does not present an explicit language choice within its instructions, which may be interpreted as a locale-specific default without opt-in.

Missing User Warnings

Low

Confidence: 87% confidence
Finding: The instructions direct the agent to create directories and files but do not prominently warn that the skill performs filesystem modifications. Even though the skill later says to ask for the wiki location first, the lack of an explicit modification warning reduces transparency and can lead to user surprise or unintended writes if the skill is auto-invoked.

Missing User Warnings

Low

Confidence: 90% confidence
Finding: The skill mandates appending a lint entry to log.md as part of execution, but this write side effect is not prominently disclosed as a default behavior. Even though logging is low risk, automatic file mutation can still surprise users, create noisy commits, and violate expectations for a simple verification run.

Natural-Language Policy Violations

Low

Confidence: 88% confidence
Finding: This markdown file mixes an English title with predominantly Chinese body content and does not indicate that the language choice is optional or user-selected. Under the stated policy, forcing a specific language or locale without user opt-in is a natural-language policy concern.

Static analysis

No suspicious patterns detected.