Security audit

Enterprise Knowledge Base Reader

Security checks for vulnerabilities and agentic risk

Overview

This is a mostly coherent read-only enterprise knowledge-base reader, but it needs review because it can automatically read shared internal KB data and sends query text to external embedding providers despite local-only wording.

Review before installing in any environment with confidential KB content. Only use it if users are allowed to query the shared enterprise knowledge base and if sending query text to DashScope/OpenAI-compatible embedding services is acceptable. Use dedicated API keys, restrict access to the kb-data directory, clarify the local-only documentation, and pin dependencies or use a lockfile for managed deployments.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The manifest description says the skill must be prioritized for essentially any business, policy, FAQ, process, or project question, which is overly broad and can cause unnecessary invocation on sensitive or unrelated prompts. In context, this is more dangerous because the skill is marked always-load and reads enterprise knowledge-base content, increasing the chance of unintended retrieval or disclosure of internal information.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The function transmits arbitrary input text to an external API without any visible consent, policy gate, redaction, or sensitivity check. In an enterprise knowledge-base context, user queries or indexed text may contain internal business, HR, or project information, so silent off-box transmission creates a real confidentiality and compliance risk.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: Batch embedding amplifies the same issue by sending multiple texts in one request, increasing the volume of internal data disclosed to the third-party provider. If the batch contains knowledge-base documents, policy text, or employee information, a single call can expose a larger portion of enterprise content outside the local trust boundary.

Unpinned Dependencies

Low

Category: Supply Chain
Content: # 知识库只读查询器依赖 chromadb>=0.4.15 openai>=1.3.0 dashscope>=1.14.0 numpy>=1.24.0
Confidence: 92% confidence
Finding: Using a lower-bound-only specifier for chromadb allows future versions to be installed without review, which can introduce breaking changes or newly vulnerable releases into the supply chain. In a knowledge-base reader skill, this is relevant because the package may process retrieved enterprise content and networked data paths, increasing exposure if a compromised or unsafe version is resolved.

Unpinned Dependencies

Low

Category: Supply Chain
Content: # 知识库只读查询器依赖 chromadb>=0.4.15 openai>=1.3.0 dashscope>=1.14.0 numpy>=1.24.0 sentence-transformers>=2.2.2
Confidence: 93% confidence
Finding: Using openai>=1.3.0 permits installation of any later version, including releases with security regressions or incompatible auth/network behavior. Because this skill likely sends enterprise knowledge queries to an external model provider, uncontrolled upgrades can materially affect confidentiality, request handling, or dependency-chain risk.

Unpinned Dependencies

Low

Category: Supply Chain
Content: # 知识库只读查询器依赖 chromadb>=0.4.15 openai>=1.3.0 dashscope>=1.14.0 numpy>=1.24.0 sentence-transformers>=2.2.2 jieba>=0.42.1
Confidence: 92% confidence
Finding: A minimum-only version for dashscope leaves the environment open to silently consuming later package versions that may contain vulnerabilities or changed security-sensitive defaults. Given this skill appears to query business and policy data, dependency drift can increase supply-chain and data-handling risk.

Unpinned Dependencies

Low

Category: Supply Chain
Content: chromadb>=0.4.15 openai>=1.3.0 dashscope>=1.14.0 numpy>=1.24.0 sentence-transformers>=2.2.2 jieba>=0.42.1 rank-bm25>=0.2.2
Confidence: 96% confidence
Finding: Specifying numpy>=1.24.0 allows resolution to any newer release, including versions with undiscovered or later-disclosed vulnerabilities. As a foundational library used by embedding and retrieval components, compromise or instability here can have broad impact across the skill's processing pipeline.

Unpinned Dependencies

Low

Category: Supply Chain
Content: openai>=1.3.0 dashscope>=1.14.0 numpy>=1.24.0 sentence-transformers>=2.2.2 jieba>=0.42.1 rank-bm25>=0.2.2
Confidence: 90% confidence
Finding: sentence-transformers>=2.2.2 is unpinned, so deployments may pick up arbitrary newer versions with insecure transitive dependencies or changed model-loading behavior. In a knowledge retrieval skill that likely processes internal text and embeddings, this creates avoidable supply-chain risk.

Unpinned Dependencies

Low

Category: Supply Chain
Content: dashscope>=1.14.0 numpy>=1.24.0 sentence-transformers>=2.2.2 jieba>=0.42.1 rank-bm25>=0.2.2
Confidence: 89% confidence
Finding: jieba>=0.42.1 allows unreviewed future releases to be installed, introducing unnecessary supply-chain uncertainty. While the direct impact is lower than network-facing SDKs, it still weakens build reproducibility and can propagate vulnerable transitive packages.

Unpinned Dependencies

Low

Category: Supply Chain
Content: numpy>=1.24.0 sentence-transformers>=2.2.2 jieba>=0.42.1 rank-bm25>=0.2.2
Confidence: 89% confidence
Finding: rank-bm25>=0.2.2 is not pinned, enabling dependency drift and potentially pulling in unsafe or untested future versions. Although this package is typically lower risk, leaving it unconstrained still increases supply-chain exposure and reduces reproducibility.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/reader_interface.py:36