Security audit

Enterprise Knowledge Base Manager

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a real knowledge-base manager, but its privacy and access-control claims do not match behavior that can send enterprise document text and queries to external APIs and share/delete data across agents.

Review before installing in any environment with confidential documents. Treat uploaded document text, search queries, and reranked passages as potentially transmitted to DashScope, OpenAI, or any configured compatible endpoint. Do not rely on the documented access-control/isolation claims without adding external controls, run it under a restricted account/virtual environment, protect API keys, validate or lock provider endpoints, and keep backups before using delete/reset commands.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: src/document_processor.py:149
Finding: Cloud transmission of document and query content contradicts local-data claims
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: src/embedder.py:108
Finding: Unvalidated custom embedding endpoint can receive API credentials and knowledge-base content
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: src/manager.py:36
Finding: Shared knowledge-base operations lack user, tenant, and role authorization
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: requirements.txt:9
Finding: Non-reproducible dependency installation expands supply-chain exposure
Content: View full analysis
=0.4.0,<0.5.0 # LLM and embedding API client openai>=1.0.0,<2.0.0 # PDF document parsing pypdf2>=3.0.0,<4.0.0 # Word document parsing python-docx>=1.0.0,<2.0.0 # Markdown document parsing markdown>=3.4.0,<4.0.0 ``` The same production installation also includes development and optional packages: ```text # Unit testing framework pytest>=7.4.0,<8.0.0 # Property testing hypothesis>=6.90.0,<7.0.0 # Code formatter black>=23.0.0,<24.0.0 # Code linting flake8>=6.0.0,<7.0.0 # Type checking mypy>=1.5.0,<2.0.0 # Faster JSON parsing ujson>=5.8.0,<6.0.0 # Faster HTTP requests httpx>=0.24.0,<1.0.0 # Memory optimization psutil>=5.9.0,<6.0.0 ``` ### Technical Analysis Version ranges make installation results dependent on the state of package indexes at installation time. Two users installing the same Skill at different times may receive different package versions and transitive dependency graphs. No lockfile or package hashes are supplied. Consequently, pip cannot verify that the installed artifacts are the exact artifacts reviewed by the Skill publisher. Installing development and optional tools in the default environment also increases the number of packages and installation hooks that must be trusted. The audit did not identify a known malicious package name or prove that a current dependency is compromised. The confirmed weakness is the absence of reproducible, integrity-verified dependency resolution and the unnecessarily broad default in ...[truncated 1144 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (89)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · .gitignore (reported line 29)May include surrounding context.
text
*.db # Environment .env .env.local # Documents

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · .gitignore (reported line 30)May include surrounding context.
text
# Environment .env .env.local # Documents documents/

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The use of subprocess or external command execution is materially more sensitive than the declared KB-management purpose suggests. If command execution is present but undocumented, reviewers may underestimate the skill's ability to affect the host system, increasing the chance of unsafe deployment or prompt-triggered command invocation.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The use of subprocess or external command execution is materially more sensitive than the declared KB-management purpose suggests. If command execution is present but undocumented, reviewers may underestimate the skill's ability to affect the host system, increasing the chance of unsafe deployment or prompt-triggered command invocation.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The use of subprocess or external command execution is materially more sensitive than the declared KB-management purpose suggests. If command execution is present but undocumented, reviewers may underestimate the skill's ability to affect the host system, increasing the chance of unsafe deployment or prompt-triggered command invocation.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The use of subprocess or external command execution is materially more sensitive than the declared KB-management purpose suggests. If command execution is present but undocumented, reviewers may underestimate the skill's ability to affect the host system, increasing the chance of unsafe deployment or prompt-triggered command invocation.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The use of subprocess or external command execution is materially more sensitive than the declared KB-management purpose suggests. If command execution is present but undocumented, reviewers may underestimate the skill's ability to affect the host system, increasing the chance of unsafe deployment or prompt-triggered command invocation.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The use of subprocess or external command execution is materially more sensitive than the declared KB-management purpose suggests. If command execution is present but undocumented, reviewers may underestimate the skill's ability to affect the host system, increasing the chance of unsafe deployment or prompt-triggered command invocation.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The use of subprocess or external command execution is materially more sensitive than the declared KB-management purpose suggests. If command execution is present but undocumented, reviewers may underestimate the skill's ability to affect the host system, increasing the chance of unsafe deployment or prompt-triggered command invocation.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The use of subprocess or external command execution is materially more sensitive than the declared KB-management purpose suggests. If command execution is present but undocumented, reviewers may underestimate the skill's ability to affect the host system, increasing the chance of unsafe deployment or prompt-triggered command invocation.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The use of subprocess or external command execution is materially more sensitive than the declared KB-management purpose suggests. If command execution is present but undocumented, reviewers may underestimate the skill's ability to affect the host system, increasing the chance of unsafe deployment or prompt-triggered command invocation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation claims all data remains local and is not uploaded to the cloud, yet it also instructs users to configure external embedding providers such as DashScope or OpenAI. This is materially misleading because document text or chunks sent for embeddings/reranking may leave the local environment, creating confidentiality and compliance risk for enterprise data.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The code sends both the user query and candidate document text to an external reranker via gte_reranker.rerank(). Because the skill is for enterprise knowledge-base management and business Q&A, those texts may contain internal policies, proprietary data, or sensitive user prompts, making this an actual exfiltration risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The external reranker call explicitly transmits the query and candidate document texts without any visible disclosure, consent, or data-minimization controls. In a corporate KB product, this materially increases the chance of leaking sensitive internal content to a third-party API provider.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code allows a caller to set an arbitrary base_url for the embedding API client, which can redirect all embedded text to any third-party endpoint. In a knowledge-base skill, that may include internal documents, company policies, or user queries, creating a clear exfiltration path and weakening trust boundaries around sensitive enterprise data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The database reset troubleshooting step instructs users to forcibly remove the local database path and reinitialize it, but does not warn that all indexed content will be lost. Because this skill manages enterprise knowledge, accidental execution could erase operational data and require costly reprocessing or re-upload of source documents.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The quickstart documents recursive force-delete commands for the vector database and document store without any explicit warning that the operation is irreversible. In a knowledge-base management skill, operators are likely to run maintenance commands directly, so missing deletion warnings can realistically cause accidental permanent loss of indexed documents and business knowledge.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The README claims all data remains local and is not uploaded to the cloud, yet the documented use of DashScope or OpenAI implies document text or derived content may be sent to external providers for embeddings or generation. This is dangerous because users may upload confidential enterprise documents under a false privacy assumption, creating compliance, confidentiality, and third-party data exposure risks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The setup instructions direct users to configure external provider API keys but omit a clear warning that uploaded documents, extracted text, and user queries may be sent to those providers. In an enterprise knowledge-base context, this omission is significant because operators may ingest internal policies, HR data, or other sensitive material without informed consent about third-party processing.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The README asserts that API keys are encrypted, but the documented configuration uses plain environment variables and provides no evidence of encryption at rest or secret-management controls. This can mislead operators into storing sensitive credentials under weaker assumptions than actually implemented, increasing the chance of credential exposure through host compromise, shell history, process inspection, or misconfigured environment dumps.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill advertises capabilities that imply shell execution, environment access, and filesystem reads/writes, but it does not declare any explicit tool scope or permission boundaries. This creates an authorization gap where a host agent may invoke a broadly capable skill without clear least-privilege constraints, increasing the risk of unintended file modification, command execution, or secret exposure.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill is configured to always load and its description says it should activate for broad classes of business questions, without tight scope constraints. Overbroad triggering can cause the agent to route ordinary conversation or sensitive prompts through a skill that has filesystem, environment, and possible network capabilities, expanding the attack surface and increasing chances of unintended data access.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: Instructing the system to activate on direct questions without strong scope limitations creates ambiguous trigger behavior. In context, this is more dangerous because the skill handles enterprise documents and may consult shared KB data or remote APIs, so casual questions could unintentionally expose or process sensitive internal information.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Automatic document search for any direct question is an overly broad activation policy that can silently pull enterprise knowledge into responses. In a shared system-level KB context, that increases the risk of over-disclosure, inappropriate cross-context retrieval, and unnecessary transmission of query/content to external model providers if configured.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file claims per-instance storage isolation while separately stating that all skills automatically share a fixed system-level data directory. In a multi-agent enterprise setting, shared storage can permit unintended cross-skill or cross-user data access, weakening tenant isolation and confidentiality assumptions.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: main.py:171

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: query_kb.py:43

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: QUICKSTART.md:185

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/chat_interface.py:42

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/document_processor.py:52

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/embedder.py:112

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/retriever.py:132