Security audit

Project Knowledge Graph

Security checks for vulnerabilities and agentic risk

Overview

The skill is a mostly disclosed cross-project knowledge indexer, but it needs review because it persistently indexes broad private project content and has remote-host and mutable-container risks.

Install only if you intentionally want a persistent cross-project index of local project notes, plans, architecture docs, and skill files. Run the dry-run first, narrow PROJECT_ROOTS before indexing, keep KNOWLEDGE_FALKORDB_HOST on localhost unless you deliberately accept sending document contents to that server, and prefer a digest-pinned FalkorDB image.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: project-knowledge-index.py:32
Finding: Arbitrary Remote FalkorDB Configuration Can Expose Sensitive Project Documents
Content: View full analysis
$hash THEN $mtime ELSE c.mtime END, " " c.text = CASE WHEN c.hash <> $hash THEN $text ELSE c.text END, " " c.hash = CASE WHEN c.hash <> $hash THEN $hash ELSE c.hash END, " " c.source_file = $source_file " "RETURN c.hash" ) result = g.query( merge_query, params={ "cid": doc["project"] + "::" + doc["rel_path ...[truncated 3016 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:72
Finding: Canonical Setup Uses a Mutable FalkorDB Container Image
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 222)May include surrounding context.
md
s/*.md`, project memory files, `docs/architecture/*.md`, `docs/features/*.md`, `SKILL.md`, etc. It does NOT crawl `node_modules/`.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Although marketed as a local cross-project knowledge graph, the code permits overriding the FalkorDB host via environment variable and sending indexed project artifacts to a remote server after only an interactive prompt. Because the indexed corpus includes recaps, plans, architecture docs, memory files, and skills across multiple projects, this creates a clear data-exfiltration path for potentially sensitive internal information.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill documents broad read access across multiple project directories and Hermes skills, but it does not declare an explicit tool/permission scope. In an agent environment, missing scope metadata can cause the skill to be invoked with broader-than-expected file access, increasing the risk of unintended cross-project data exposure.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill lists trigger phrases but does not define when they apply, whether they are limited to trusted contexts, or whether cross-project access requires confirmation. In context, this ambiguity is more dangerous because the skill reads many project artifacts and Hermes skills, so accidental invocation can expose unrelated project data.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger regexes are broad enough to match ordinary user conversation such as 'what did we learn' or 'search across project'. That can cause unintended activation of a skill that reads across multiple projects and indexes sensitive local documentation, expanding data access beyond user intent.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The setup instructions run a mutable Docker image tag (falkordb/falkordb:latest). Mutable tags can change over time, so a later pull may fetch a compromised or unexpected image, turning local indexing into code execution inside an attacker-controlled container.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The documentation instructs users to pull falkordb/falkordb:latest before discovering its digest. Pulling latest first still trusts a mutable tag and can retrieve a malicious or altered image before any pinning occurs.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: At L260 the documentation says the indexer 'does not track deletions — it only adds and updates,' which conveys a no-deletion behavior. But L271-L281 and L334-L337 document an explicit delete command capable of removing project-, type-, or all chunks from the graph. This is an active contradiction in the documented behavior, not just an omission.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The rebuild instructions again use docker run with a mutable latest image. Repeated examples normalize insecure operational practice and increase the chance that users redeploy from an untrusted updated image during maintenance or recovery.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This re-index workflow includes another docker run example that relies on a mutable image tag. Because recovery procedures are often executed under time pressure, they are especially likely to be followed verbatim, making supply-chain compromise more plausible.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 75% confidence
Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 75% confidence
Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill metadata describes indexing and querying a local knowledge graph, but the implementation also exposes destructive deletion capabilities. Hidden or undocumented destructive behavior increases the chance that users or higher-level agents invoke the skill under incomplete assumptions, causing unintended loss of indexed project knowledge across one or all projects.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The delete command can remove all chunks, or all chunks for a project/type, without any confirmation, dry-run preview, or explicit danger banner. In an agent context, this is more dangerous because a mistaken tool invocation or prompt-manipulated action could irreversibly wipe the knowledge corpus and disrupt cross-project retrieval.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The document recommends running falkordb/falkordb:latest, which is a mutable tag and can resolve to different image contents over time. That creates supply-chain and reproducibility risk: a future pull could introduce unexpected behavior, vulnerable software, or a compromised image without any change to this documentation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: L102-L104 correctly describe --restart=unless-stopped, but L205 says the container 'starts on boot automatically (--restart=always),' which contradicts the documented run command at L84-L89 and the earlier explanation. The comments describe different restart policies for the same setup.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.