MyKnowledge

• Outcome: Review
• Latest audit: Jun 15, 2026 · 1:40 AM UTC
• Version: 1.4.89

Overview

This skill is a local knowledge-base tool, but it needs review because its optional hooks can automatically inspect messages and persist task records, with some consent and networking inconsistencies.

Install only if you are comfortable with local conversation-derived project notes being created. Before enabling hooks or auto-record, review the handler behavior, set auto_record explicitly to false unless wanted, disable automatic update checks if you require a no-network workflow, and avoid storing secrets or sensitive client data in recorded tasks.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (54)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill is presented as a documentation/knowledge-base helper, but it also describes automatic monitoring of incoming messages via hooks, background triggering, and state/config reads from the user's home directory. That mismatch is dangerous because users may invoke a seemingly harmless productivity skill without understanding that it can persistently inspect conversations and take actions without explicit per-use consent.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The README states the skill will not modify files outside `~/.myknowledge/`, but later documents export behavior that writes ZIP archives to `~/Downloads` by default. This is a trust-boundary and scope-of-write inconsistency: users may grant or rely on a stricter sandbox assumption than the skill actually uses, which can lead to unintended data disclosure or file writes outside the declared safe area.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The skill claims it only accesses a user-authorized path, but other sections instruct creating knowledge bases in the current project directory. This contradiction matters because it broadens the effective write scope beyond what the user is told, increasing the risk of unintended writes into active repositories or sensitive workspaces.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The skill is for local knowledge-base management, but it instructs the agent to perform periodic update checks based on an installation source and to load additional setup logic. That expands behavior beyond the declared purpose and can pressure the agent into source-resolution or update workflows that are not necessary for the user task, increasing attack surface and policy confusion.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The self-check and migration logic causes the agent to inspect installation state, internal files, and project migration conditions that are not essential to ordinary knowledge management. Even if intended as reliability features, these instructions broaden filesystem access and create opportunities for unintended disclosure or unsafe file operations outside the immediate user request.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: Instructioning the model to audit its own installation and verify internal file completeness is context-inappropriate for a document-management skill and encourages broad enumeration of local files. This can expose sensitive path information, normalize unnecessary access to unrelated files, and create a self-referential trust model that is hard to constrain safely.

Intent-Code Divergence

High

• Confidence: 95% confidence
• Finding: The prompt simultaneously forbids networking and instructs the agent to perform source-based update checks, creating a dangerous contradiction. In practice, ambiguous instructions like this can cause the model to overreach, attempt prohibited external lookups, or justify policy violations under the guise of maintenance.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The document introduces release and publishing automation to external platforms, which is materially outside the stated purpose of a knowledge-base/document-management skill. That scope expansion increases the attack surface by encouraging repository secrets, release credentials, and automated outbound actions that users would not reasonably expect from this skill context.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The documented workflow adds external publishing to ClawHub/SkillHub and optional Slack webhooks without clear justification tied to the skill's stated end-user purpose. Unnecessary third-party integrations increase opportunities for credential misuse, secret leakage, and unintended data exfiltration through automated notifications and release steps.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The hook claims privacy protection around auto-recording, but the implementation fails open: if the config file is missing, malformed, or unreadable, auto-recording still occurs. That can cause unintended capture and forwarding of user-derived content without an explicit opt-in, especially on first run or under configuration errors.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The guide describes a hook that inspects every received user message and may automatically create knowledge artifacts in the background. This expands the skill from an explicit user-invoked documentation tool into implicit message surveillance and action-taking, which can cause unauthorized processing of sensitive content and unintended file creation.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The documentation promises users will be informed and that files will not be created silently, but the sample handler immediately calls ctx.agent.execute on qualifying messages without any notification or consent step in code. This mismatch is dangerous because users and reviewers may rely on the stated safety property while the implementation performs background actions automatically.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The skill instructs the assistant to delete a persistent state file to force re-onboarding, which is a filesystem-modifying action outside the user-facing knowledge-management purpose unless explicitly confirmed and explained. Even if intended for reset, deleting config/state without a clear warning and safer recovery path can cause loss of preferences and unexpected behavior.

Context-Inappropriate Capability

Low

• Confidence: 78% confidence
• Finding: The onboarding flow collects or auto-detects which AI assistant platform the user is using, but that behavior is not clearly necessary for creating knowledge bases or managing documents as described in the manifest. Unnecessary environment detection expands data collection and can enable fingerprinting or platform-specific branching without informed user consent.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The skill defines automatic update checks that reach external services such as GitHub, which exceeds the narrowly stated knowledge-management purpose and introduces unsolicited outbound network activity. Even if only version metadata is fetched, this can expose usage timing, IP address, installation source, and environment details through package-manager or repository queries without clear user consent.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The documented behavior includes package-manager and repository update operations unrelated to core knowledge-base functionality, expanding the skill's capabilities into software management. This broadens attack surface and can condition users to approve commands like git pull or tool-specific upgrades that modify local code or dependencies.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The auto-record trigger criteria are broad, subjective keywords like "分析", "开发", and "长期", which can cause the skill to persist user conversations and task details without sufficiently specific user intent. Because this skill is explicitly used for knowledge management and project documentation, those conversations are likely to include sensitive business, personal, or project information, increasing privacy and data-minimization risk.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The documented 'smart task tracking' can auto-create a knowledge base and requirement record when the AI merely detects a 'complex task,' which is an imprecise trigger. In a documentation-management skill, broad autonomous triggering can cause over-collection of user content, unintended persistence of sensitive requests, and state changes without clear user intent.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README advertises automatic recording of conversation content but does not present a prominent just-in-time privacy warning at the point the feature is introduced. Because this skill manages personal knowledge, requirements, and project documentation, silent or poorly signposted conversation capture increases the risk of storing secrets, personal data, or sensitive business content without sufficiently informed consent.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The automatic activation rules are broad enough to match ordinary user requests such as analysis, design, or research, which can cause the skill to trigger unexpectedly. In context, this is risky because activation leads to file creation and persistence behavior, so vague heuristics can turn normal conversation into unanticipated data collection and writes.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The auto-detection flow states that the skill may automatically create a knowledge base and requirement record, but it does not provide a clear, immediate warning about the write side effects at the moment of triggering. This is dangerous because users may disclose information in a conversation without realizing it will be persisted to disk automatically.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The skill enables automatic activation based on broad heuristic keywords and task characteristics, which can cause the agent to create or update a knowledge base during ordinary conversations without sufficiently explicit user consent. Because this skill persists information to files, overbroad triggering increases the chance of unintended data capture, unexpected filesystem writes, and privacy violations.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This section describes automatic creation of a knowledge base and ongoing task recording, but does not clearly warn that user content will be written to persistent local storage. Users may disclose sensitive project, business, or personal information in normal conversation without realizing it will be stored in files, creating privacy, retention, and accidental exposure risks.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The guide states that the AI automatically records each step of later conversation progress to the knowledge base, but it does not present an explicit privacy, persistence, or consent warning. In the context of a documentation and project-memory skill, this is especially risky because users may reveal credentials, internal plans, customer data, or other sensitive content during follow-up discussion that then becomes stored and discoverable.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The skill description is very broad ('general knowledge base management', requirements, project docs, automatic recording of complex tasks) and does not clearly define invocation boundaries. In agent ecosystems, overly broad descriptions can cause the skill to be selected for unrelated or sensitive tasks, increasing the chance of unnecessary access to user data and unintended side effects such as recording or organizing information the user did not intend to store.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: INSTALL.md:88