Security audit
Security checks across malware telemetry and agentic risk
This is a mostly coherent read-only enterprise knowledge-base reader, but it needs review because it can automatically read shared internal KB data and sends query text to external embedding providers despite local-only wording.
Review before installing in any environment with confidential KB content. Only use it if users are allowed to query the shared enterprise knowledge base and if sending query text to DashScope/OpenAI-compatible embedding services is acceptable. Use dedicated API keys, restrict access to the kb-data directory, clarify the local-only documentation, and pin dependencies or use a lockfile for managed deployments.
# 知识库只读查询器依赖 chromadb>=0.4.15 openai>=1.3.0 dashscope>=1.14.0 numpy>=1.24.0
# 知识库只读查询器依赖 chromadb>=0.4.15 openai>=1.3.0 dashscope>=1.14.0 numpy>=1.24.0 sentence-transformers>=2.2.2
# 知识库只读查询器依赖 chromadb>=0.4.15 openai>=1.3.0 dashscope>=1.14.0 numpy>=1.24.0 sentence-transformers>=2.2.2 jieba>=0.42.1
chromadb>=0.4.15 openai>=1.3.0 dashscope>=1.14.0 numpy>=1.24.0 sentence-transformers>=2.2.2 jieba>=0.42.1 rank-bm25>=0.2.2
openai>=1.3.0 dashscope>=1.14.0 numpy>=1.24.0 sentence-transformers>=2.2.2 jieba>=0.42.1 rank-bm25>=0.2.2
dashscope>=1.14.0 numpy>=1.24.0 sentence-transformers>=2.2.2 jieba>=0.42.1 rank-bm25>=0.2.2
numpy>=1.24.0 sentence-transformers>=2.2.2 jieba>=0.42.1 rank-bm25>=0.2.2
65/65 vendors flagged this skill as clean.
