semantic-pkm-creator

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:29 AM UTC
• Version: 0.3.2

Overview

This skill is a Markdown-only knowledge-extraction workflow that writes expected local YAML/progress files and does not show hidden execution, credential access, networking, or persistence.

Install only where you are comfortable letting the agent create or update the named YAML and progress files. Review the round-one skeleton before approving round two, as the skill itself instructs.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Whitespace Padding

Medium

• Category: Prompt Injection

Content

definition has a source and stays within 50 words; there are no isolated concepts; and every concept
has two to six relations.

| Layer   | Meaning                                                          | Question                   | Valid form                                                                                          |
| ------- | ---------------------------------------------------------------- | -------------------------- | --------------------------------------------------------------------------------------------------- |
| Concept | Class: executable action                                         | Which method should I use? | IPO preserves independent logic; decomposition records stages, sub-concepts, and why each is needed |
| Entity  | Instance: identifiable person, tool, product, or named framework | What did I use?            | “I used X,” where X is not an action                                                                |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

two to six per concept. If one element still works without the other, use reference rather than
dependency.

| Type          | Direction                            | Use when                                                                                |
| ------------- | ------------------------------------ | --------------------------------------------------------------------------------------- |
| contains      | concept → concept or entity → entity | whole and part                                                                          |
| depends-on    | concept → concept                    | execution is impossible without the target                                              |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Natural-Language Policy Violations

Low

• Confidence: 83% confidence
• Finding: The metadata sets `language: en`, which indicates an English-only locale preference. The file does not mention any user-selectable language option or explain a justified locale restriction, so this appears to impose a language choice without opt-in.

Missing User Warnings

Low

• Confidence: 95% confidence
• Finding: The markdown states that the skill will output `sce-scenes.yaml`, `sce-concepts.yaml`, `sce-entities.yaml`, and update `_sce-round1-progress.md`, which are file-writing operations affecting user data and workspace state. However, it does not include any explicit warning or cautionary note about creating or overwriting files in the chosen directory.

Static analysis

No suspicious patterns detected.