Knowledge Base Manager

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:45 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent Obsidian knowledge-base manager, but it grants broad automatic retention and cleanup authority, including private MEMORY.md storage and deletion without clear user confirmation or recovery.

Review this skill before installing. Use it only with an explicitly configured knowledge-base folder, require approval before writes, moves, or deletions, avoid storing secrets or sensitive private data in MEMORY.md, and remove the trailing shell-like residue from SKILL.md.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:65

Finding

Overbroad Persistent Collection of Sensitive Information

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 65-69 and 187
Vulnerability Type: Excessive data retention and insecure storage of private information
Risk Level: Medium

Relevant Source Snippet

The following is an English translation of the relevant source instructions:

markdown

| **Complete any task** | Immediately conduct a retrospective and write it to "Practice Retrospectives" |
| **Learn a new skill** | Write it to "Skill Overview" |
| **Obtain new information** | If classified, archive it directly; if unclear, place it in the inbox |
| **Every Friday** | Organize, archive, and clean the inbox |
| **At the end of every month** | Create a monthly summary and update the cumulative journal |

4. **Private content** — Content visible only to the agent should be placed in MEMORY.md

Technical Analysis

The skill instructs the agent to persist information after every task and to archive newly obtained information. It does not limit collection to knowledge-base management tasks, distinguish operational data from credentials or other secrets, require user consent, or establish data minimization and retention rules.

The instruction at line 187 explicitly directs private content into MEMORY.md. Persistent agent memory may influence or be retrieved during future sessions. Merely describing the content as visible only to the agent does not establish an access-control boundary, encryption, isolation, or protection against later disclosure.

This is not confirmed attacker-controlled memory poisoning because the reviewed file does not direct the agent to store malicious behavioral rules. It is nevertheless an insecure skill configuration involving indiscriminate storage of potentially sensitive data.

Attack Path

1. A user performs a task containing private information, internal project details, credentials, personal data, or confidential output.
2. The skill's mandatory retrospective ...[truncated 887 chars]

Remediation

View remediation

Remediation Suggestions

1. Restrict automatic archival to explicit knowledge-base management requests rather than every completed task.
2. Require informed user confirmation before writing private or sensitive information to persistent storage.
3. Add sensitivity filtering that excludes credentials, authentication tokens, cryptographic keys, personal data, private communications, and regulated information.
4. Store only the minimum information necessary for the declared purpose and prefer summaries that omit sensitive details.
5. Do not use MEMORY.md as a generic location for private information. Use an access-controlled, encrypted storage mechanism where persistent retention is genuinely required.
6. Define retention periods, deletion procedures, and a user-accessible mechanism to inspect and remove stored information.
7. Ensure future retrieval is scoped to the relevant user, project, and task context.
8. Document the actual access controls and threat model instead of assuming that an agent-only file is private.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:68

Finding

Destructive Cleanup Instructions Lack Confirmation and Recovery Controls

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 68, 75, and 161
Vulnerability Type: Unsafe autonomous deletion and insufficient file-operation safeguards
Risk Level: Medium

Relevant Source Snippet

The following is an English translation of the relevant source instructions:

markdown

| **Every Friday** | Organize, archive, and clean the inbox |

3. **Delete** — Do not retain information confirmed to be useless.

2. Identify redundant or outdated content and archive or delete it promptly.

Technical Analysis

The skill authorizes periodic cleanup and deletion based on subjective classifications such as "useless," "redundant," or "outdated." It does not require user confirmation, specify an allowed root directory, mandate backups, use a recoverable trash mechanism, or define objective deletion criteria.

Because knowledge classification can be incorrect or influenced by misleading document content, an agent following these instructions may remove valid information. The risk is amplified by the recurring weekly cleanup instruction and the direction to delete content promptly.

No executable deletion implementation is present in the reviewed project, so actual deletion capability depends on the tools and filesystem permissions granted to the agent at runtime. The weakness is therefore an unsafe skill instruction rather than confirmed arbitrary file deletion code.

Attack Path

1. A legitimate file is old, duplicated, ambiguously named, or contains text causing it to appear obsolete.
2. During scheduled or user-triggered maintenance, the agent classifies the file as useless, redundant, or outdated.
3. The agent invokes an available filesystem tool to delete the file without presenting a review plan or obtaining confirmation.
4. Because no trash, versioning, or backup requirement is specified, recovery may be difficult or impossible.
5. If path boundaries are not independently enforced b ...[truncated 637 chars]

Remediation

View remediation

Remediation Suggestions

1. Restrict all maintenance operations to a canonical, explicitly configured knowledge-base root directory.
2. Resolve and validate paths before every write, move, or deletion operation, rejecting path traversal and symbolic-link escapes.
3. Replace permanent deletion with movement to a recoverable quarantine or trash directory.
4. Require explicit user confirmation before permanent deletion or bulk cleanup.
5. Present the proposed file list, reasons for classification, and expected changes before applying them.
6. Define objective retention criteria and minimum age thresholds instead of relying only on subjective judgments.
7. Create versioned backups or verify repository history before destructive operations.
8. Record an audit log containing affected paths, timestamps, operation types, and recovery locations.
9. Apply operation-count and scope limits so a single maintenance run cannot delete or move an excessive number of files.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger conditions are very broad, such as acting after any completed task, any new skill, or any new information. In an agent environment this can cause the skill to activate during routine interactions, leading to unnecessary file operations, excessive retention, or actions the user did not explicitly request.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The archive priority explicitly includes deleting information deemed useless, but it does not require user approval, soft-delete, or warning about irreversible loss. In a knowledge-base management context, that creates a real risk of destructive actions based on the agent's subjective classification.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The instruction to place private content into MEMORY.md encourages centralized retention of sensitive data in a natural-language store without access-control, minimization, or lifecycle rules. This increases the chance that future prompts, indexing, backups, or other skills will expose private information beyond its intended scope.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The document is presented as a knowledge-base management skill, but the trailing shell-like content (_SKILLEOF and echo "SKILL.md created") introduces executable-seeming instructions unrelated to the declared purpose. In an agent skill context, hidden or appended command fragments can cause unintended file creation or execution if a loader or wrapper interprets them, making this a strong command-injection / packaging-integrity concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 71% confidence

Finding

The entire skill is written to operate in Chinese and presents its role and procedures only in that language, without indicating that users may choose another language. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.