Knowledge Base Manager

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:37 PM UTC
• Version:
  1.0.0

Overview

This is a coherent Obsidian knowledge-base management skill; the only issue found is a stray shell-style footer that should be cleaned up but is not executable by itself.

Install only if you are comfortable letting the agent manage files in the intended Obsidian vault. Keep backups and require confirmation for deletion or large reorganizations. The publisher should remove the stray footer lines to avoid confusion in downstream tooling.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The file is presented as a Markdown skill document but contains shell-style trailer content (`_SKILLEOF` and `echo "SKILL.md created"`), which can indicate content-boundary confusion or prompt/script injection into tooling that concatenates docs into shell commands. In systems that automatically parse, template, or execute generated setup snippets, this kind of mixed-format content can cause unintended command execution or corrupt downstream processing.

VirusTotal

65/65 vendors flagged this skill as clean.