Security audit

standard-book-learning

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent book-note workflow, but it embeds Neo4j credentials and performs under-scoped database/file writes that need review before installation.

Review this skill before installing. Rotate or remove the embedded Neo4j credential, require runtime secrets, validate and parameterize Cypher inputs, use a least-privileged Neo4j account, and run in preview/dry-run mode before allowing it to write Obsidian files or mutate a database.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Note

Location: script/note-generator-script.py:76
Finding: Fixed Third-Party Attribution Injected into Generated Reports
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: script/neo4j-importer-script.py:15
Finding: Hard-Coded Plaintext Neo4j Credentials
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: script/neo4j-cypher-generator-script.py:156
Finding: Cypher Injection Through Unvalidated Relationship Types and Property Values
Content: View full analysis
(b)" ) ``` Another property is interpolated without escaping: ```python if concept.get('importance'): props.append(f"importance: '{concept['importance']}'") ``` ### Technical Analysis The generator constructs executable Cypher by concatenating values from `relationships` and `concepts`. The relationship type is inserted directly into the relationship syntax without validation or an allowlist. A malicious value can therefore alter the structure of the generated query rather than remaining data. The `importance` property is also embedded inside a quoted Cypher literal without escaping. Other string fields use a custom escaping function, but manual escaping is less robust than proper query parameters and does not protect structural identifiers such as relationship types. The documented importer posts each generated `statement` to Neo4j. The Python importer currently simulates execution, but the included PowerShell importer and documented workflow provide a real execution sink. The vulnerability becomes directly exploitable when generated batches are passed to that implementation or another real importer. ### Attack Path 1. An attacker controls or influences a `relationships` or `concepts` input object. 2. The attacker supplies a crafted `type` value containing Cypher syntax, or a crafted unescaped property value. 3. `generate_bat ...[truncated 1173 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: book-extractor.md:377
Finding: Unpinned Third-Party Dependency Installation Instructions
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (28)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The file embeds a plaintext Neo4j username and password, which is a direct credential exposure. Anyone with access to the skill content can reuse those credentials to access or modify the database, and the surrounding context makes this especially dangerous because the same document also describes write-capable import operations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill instructions, file names, templates, and examples are entirely in Chinese, which effectively imposes a specific language on users and downstream outputs. There is no indication that users may choose another language or that the Chinese-only format is required for a region-specific compliance reason.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill explicitly creates directories and later overwrites progress files, but it does not clearly warn the user that local files under F:\Obsidian will be created or modified. This can cause unintended data loss or integrity issues, especially because update_progress_file writes back to an existing markdown file and the workflow is designed to run automatically across many chapters.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The workflow sends extracted book content, concepts, and relationships into Neo4j-related components without a clear privacy or integrity notice. Even if the Neo4j instance is local, this still propagates potentially sensitive copyrighted or private content into another system, increasing exposure and the risk of unintended retention, corruption, or later exfiltration.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill is explicitly designed to read local files from a fixed drive path and emit full chapter contents plus path metadata in structured output. Without a prominent warning, users may unknowingly expose sensitive local documents, document names, filesystem structure, or copyrighted/full-text content to downstream modules or logs.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The skill instructions, operational sections, and examples are written entirely in Chinese, which effectively imposes a language choice on users and operators. There is no statement that the skill is region-specific, no opt-in for language preference, and no alternative locale guidance.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill is explicitly designed to execute batches of database-modifying Cypher statements, but it does not include a clear warning that running it will mutate the target Neo4j instance or require explicit confirmation. In an agent setting, that increases the risk of unintended destructive or unauthorized data changes if upstream input is wrong, malicious, or insufficiently reviewed.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The recovery strategy explicitly says duplicate-node style errors should be recorded as warnings and later batches should continue. In the actual batch handler at L087-L096, any non-empty errors array causes the batch to be returned as unsuccessful, with no branching for ConstraintViolationError or warning-only handling.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The error recovery section states that temporary network failures will be retried up to 3 times with a 1-second interval. However, the only execution function shown at L066-L116 performs a single Invoke-WebRequest inside one try/catch and immediately returns on exception, with no retry loop or delay.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill explicitly specifies writing generated notes to a local filesystem path under F:\Obsidian\<书名>\... without any user consent, safety notice, or constraints on when file writes are allowed. In an agent setting, instructions that normalize persistent file creation can cause unintended local writes, overwrite existing notes, or enable path manipulation if fields like book title or chapter title are not sanitized by the downstream script.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This code file contains natural-language strings such as the module docstring, function docstrings, error messages, and console output entirely in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The skill's natural-language docstrings, status messages, generated markdown content, and output labels are consistently hard-coded in Chinese, indicating a fixed language choice. There is no visible option for the user to select language or locale, and no documented justification that this is a region-specific skill.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The module docstring and class/method documentation describe coordinating a book learning process, generating notes, and tracking progress. The code also performs graph-database imports via neo4j_importer.import_batches, which is a distinct persistence capability and not clearly implied by a generic 'coordinator' purpose when no manifest is available to justify database modification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This code automatically creates and overwrites markdown files under F:\Obsidian\{book_title} as part of start_learning, including the progress file and final summary report. Although there are print statements after or during execution, there is no upfront user-facing warning, confirmation, or docstring disclosure at the entrypoint that running the skill will modify files in the user's notes directory.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This code file contains user-facing natural-language descriptions and comments in Chinese only, including the module docstring and method documentation. Under the policy, forcing a specific language without user opt-in or a documented justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The file’s user-facing natural-language descriptions and logs are primarily written in Chinese, including the module docstring and runtime messages, but there is no indication that the user can choose language or that the skill is intended only for a Chinese-speaking environment. This creates a locale policy concern because the skill appears to impose a specific language by default.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The code claims to verify a Neo4j import, but _verify_import does not query the database and instead sets imported counts equal to expected counts derived from the input batches. This can falsely report success even when no data was written, causing operators or downstream automation to trust an import that never actually happened or only partially completed.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This code file contains natural-language descriptions and output strings exclusively in Chinese, including the module docstring and runtime messages. Under the policy, forcing a specific language without user opt-in or a justified locale scope is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The class docstring and note template headings are user-visible content and are hardcoded in Chinese. The file does not provide an alternative language option or indicate that the skill is restricted to a Chinese-speaking audience.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The entire skill description, prompts, and expected interaction are presented in Chinese, which can amount to a language policy constraint if users are not given an explicit choice. The file does not state that the locale is region-specific or provide an opt-in mechanism for Chinese-language operation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The batching table states that concept batches should contain 3-5 items and relationship batches 2-3 items, implying a required invariant. However, the sample output and example later in the file produce a concept batch with count 2 and 1 and relationship batches with count 1, so the documented rule contradicts the demonstrated behavior.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The checklist requires every concept batch to have 3-5 items and every relationship batch 2-3 items. Yet the output examples include concept batches of 1 and 2 items and relationship batches of 1 item, so the validation guidance actively conflicts with the documented/generated behavior.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The note claims both CREATE INDEX IF NOT EXISTS and IF NOT EXISTS are used to ensure idempotency. But the example concept-import statements at L362 and L488 use plain CREATE for nodes, and no IF NOT EXISTS pattern is shown for entity creation, so the documentation overstates what the code/examples do.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill's title, purpose, and operational instructions are presented in Chinese, which effectively imposes a language choice on users without documented opt-in. Under the stated policy, forcing a specific language without giving the user a choice is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The function claims to validate the book path and even defines a restrictive path pattern, but never enforces it. As a result, any existing .docx or .pdf path is accepted, which can let an attacker steer the workflow to unexpected files, causing unauthorized reads and subsequent writes into note storage and Neo4j based on attacker-chosen content.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.