LLM Wiki 健康评分

• Outcome: Pass
• Latest audit: Aug 11, 2026 · 6:35 AM UTC
• Version: 1.0.0

Overview

This skill locally audits an Obsidian-style knowledge base and writes disclosed report files, with no evidence of hidden exfiltration or destructive behavior.

Install only if you are comfortable letting the agent read the selected vault and create local audit artifacts. Point it at the smallest intended vault root, use --no-artifacts for a read-only run, or set --artifact-dir/--out to a safe location if you do not want files written inside the vault.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill instructs the agent to invoke a local Python script, read from the target vault, and write artifacts back into the vault, which implies shell, file read, and file write capabilities. Because these capabilities are not explicitly declared or gated, users and policy systems may underestimate the skill's ability to modify local data and execute commands.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill is framed as an audit/scoring tool, but the CLI writes report and semantic template artifacts to disk by default, modifying the user's vault during what appears to be a read-only assessment. In a security-sensitive agent context, unexpected writes can violate least surprise, alter evidence, and create persistence inside the vault without explicit opt-in.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The script accepts --out, --artifact-dir, and --semantic-template-out as arbitrary filesystem paths and then writes files there without constraining them to the vault root or a safe allowlisted directory. If invoked by an agent with broader filesystem access, this enables writes outside the intended local-vault scoring scope and can overwrite or create files in unintended locations.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill directs outputs to be written under the evaluated knowledge-base root by default, which modifies user files during an audit/scoring workflow. Without a prominent warning and opt-in, this can cause unintended local changes, pollute repositories, or trigger downstream automation on newly created files.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The default prompt automatically invokes auditing of a local Obsidian Vault using a broad activation phrase, without clear boundaries on when the skill should trigger or what scope of files should be analyzed. In a local-knowledge-base context, this can cause unintended access or over-collection of sensitive notes if the skill is invoked loosely or by ambiguous user phrasing.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly advertises auditing a local Obsidian vault but does not warn users that local files and potentially sensitive personal knowledge-base content may be accessed. Because personal vaults commonly contain private notes, credentials, health data, or work material, missing disclosure materially increases the risk of uninformed consent and unintended data exposure.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The code writes report and template artifacts to disk automatically, yet the script description and flow do not prominently warn that execution is state-changing. In agent-driven environments, undisclosed side effects are dangerous because users may authorize a scoring action expecting passive inspection while the tool persists files into the vault or elsewhere.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.