Security audit

safety-kb-import

Security checks for vulnerabilities and agentic risk

Overview

This skill appears intended for legitimate safety knowledge-base imports, but its update workflow can overwrite and delete existing regulatory records too easily.

Install only if you are comfortable with a tool that can permanently modify the safety-review SQLite database. Before using it, back up knowledge.db, inspect the manifest carefully, avoid broad document numbers such as common GB/AQ prefixes, and prefer adding dry-run, exact matching, confirmation, and transaction rollback before production imports.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:45
Finding: Unpinned Third-Party Dependencies Create Supply-Chain Risk
Content: View full analysis
Remediation: View remediation
pdf2image== pytesseract== ``` 2. Generate and distribute a locked requirements file containing reviewed transitive dependencies. 3. Require cryptographic hashes by installing with `pip install --require-hashes -r requirements.txt`. 4. Document and enforce a trusted package index rather than relying on ambient pip configuration. 5. Periodically scan dependencies for known vulnerabilities and review updates before changing pinned versions. 6. Prefer installation inside a dedicated virtual environment with only the permissions required by the Skill. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: scripts/kb_import.py:332
Finding: Ambiguous Document-Number Matching Can Overwrite Unrelated Regulations
Content: View full analysis
Remediation: View remediation
` before overwriting a mismatched record. 6. Return a distinct conflict status and preserve the existing record and clauses when a conflict occurs. 7. Record an audit trail containing the previous values, new values, source manifest, timestamp, and initiating user. 8. Add tests involving multiple `GB`, `AQ`, and versioned document numbers to confirm that only the exact intended record is updated. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: scripts/kb_import.py:300
Finding: Database Errors Are Suppressed and Partial Destructive Imports Are Committed
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill describes filesystem and environment-dependent operations, including a fixed database path under the user's home directory and commands that read local files, but it does not declare any explicit tool scope or permissions boundaries. This makes the skill harder to sandbox and review, increasing the chance that an agent may grant broader file/env access than intended when executing import workflows.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger list contains broad phrases like '入库', '添加标准', and '导入知识库' that can match routine user requests outside this exact database-import context. Overbroad activation can cause the wrong skill to run, leading to unintended write-oriented guidance or modification of the knowledge base when the user only meant to discuss, summarize, or inspect content.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The statement that the skill should be used for 'Any write operation on the safety-review database' is an overly broad activation condition with no approval, identity, or task-boundary checks. In context, this is more dangerous because the skill performs overwrite-style imports and explicitly notes no rollback, so accidental invocation can directly change or replace existing regulatory records.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The import path performs real database writes and, when a matching regulation is found, deletes all existing clauses and replaces the record without any confirmation, dry-run mode, backup, or transaction-scoped safety prompt. Because matching is fuzzy (LIKE on document number fragments), a malformed or unintended manifest can overwrite the wrong regulation and irreversibly destroy associated clause data in this knowledge base.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.