knowledge-intake

• Outcome: Review
• Latest audit: Aug 26, 2026 · 1:31 PM UTC
• Version: 1.9.19

Overview

This skill is a Review item because it can persist research, publish summaries to GitHub by default, and direct code or skill changes without tight boundaries.

Install only if you want this agent to maintain a persistent knowledge corpus and potentially publish or apply selected knowledge. Before using it, disable default publishing, require explicit yes-style confirmation for GitHub posts and repository edits, review generated content for private URLs or local paths, and avoid auto-accept outside a sandbox.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill expands from knowledge intake into external publication by instructing use of GitHub Discussions via GraphQL and the `gh` CLI. That creates an unnecessary outbound side effect for an ingestion workflow and can expose internal or unreviewed content to a public or shared destination if the user consents casually or defaults are followed.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The documented routing allows direct codebase modification, ADR creation, skill updates, module creation, and agent enhancement, which exceeds the stated purpose of intake and curation. This broadens the blast radius from passive knowledge processing to active repository and behavior changes based on external content, increasing the risk of prompt-injection-driven or low-review modifications.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The automation guidance includes an `--auto-accept` path that performs non-interactive writes to the corpus, drafts, and audit logs. This defeats the earlier human-in-the-loop framing and enables unattended ingestion of potentially poisoned, low-quality, or sensitive external content into persistent storage.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The skill claims the current implementation is fully human-in-the-loop, but later documents a non-interactive `--auto-accept` workflow. This contradiction can mislead reviewers and operators about actual safety properties, resulting in deployment under false assumptions about required human approval.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: This module adds an outbound publication capability to GitHub Discussions, which expands the skill from internal knowledge intake/curation into external dissemination. In context, that creates a real risk of unintentionally publishing locally stored corpus summaries, source URLs, tags, and file paths to a broader audience without a strong purpose limitation or explicit privacy gate.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The trigger list includes broad terms such as knowledge-management, intake, evaluation, curation, papers, and docs, making accidental activation likely during ordinary conversation. Overbroad triggering increases the chance that external content processing, storage, or follow-on actions occur in contexts where the user did not intend to invoke this workflow.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill documents automatic queueing of research sessions into persistent files without an explicit user warning or consent step for storing session-derived data. This can capture sensitive prompts, research topics, URLs, or derived notes into the repository unexpectedly, creating privacy and data governance risks.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The body template explicitly includes summary content, source references, tags, and the local corpus path, but the module provides no privacy warning or review step before publishing them to GitHub Discussions. Because this skill handles ingested external resources and cross-session knowledge, the absence of a clear disclosure and sanitization step materially increases the chance of leaking sensitive internal context, private URLs, or proprietary research into a public or broadly accessible repository discussion.

Self-Modification

High

• Category: Rogue Agent

Content

- Workflow optimizations
- Learning/evaluation methods (like Franklin Protocol)

**Action**: Update skills, create modules, enhance agents

### Routing Decision Tree

• Confidence: 96% confidence
• Finding: The skill explicitly authorizes updating skills, creating modules, and enhancing agents based on ingested knowledge, which is a self-modification capability. In the context of processing external resources, this is especially dangerous because untrusted content can indirectly steer changes to the system's own behavior, persistence, or future decision-making.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.