Knowfun

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:12 AM UTC
• Version: 1.0.15

Overview

The skill appears to be a real Knowfun.io API integration, but it asks for broader local and network authority than its purpose requires and has some under-disclosed security weaknesses.

Install only if you trust Knowfun.io and are comfortable sending prompts, URLs, and task metadata to its API under your API key. Prefer a version-pinned install, avoid sudo/manual global symlinks, store the API key in a safer secret mechanism when possible, and review commands before allowing an assistant or remote chat interface to create tasks that may consume credits.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/knowfun-cli.sh:55

Finding

Unescaped User Input Allows JSON Request Injection

Content

View full analysis

" exit 1 fi # Generate unique request ID local request_id="req_$(date +%s)_$(uuidgen | head -c 8)" # Determine if material is URL or text local material_type="text" local material_field="text" if [[ "$material" =~ ^https?:// ]]; then material_type="url" material_field="url" fi print_info "Creating $task_type task..." print_info "Request ID: $request_id" local response=$(curl -s -w "\n%{http_code}" -X POST "$BASE_URL/api/openapi/v1/tasks" \ -H "Authorization: Bearer $API_KEY" \ -H "Content-Type: application/json" \ -d "{ \"requestId\": \"$request_id\", \"taskType\": \"$task_type\", \"material\": { \"$material_field\": \"$material\", \"type\": \"$material_type\" } }") ``` ### Technical Analysis The `task_type` and `material` values originate from command-line arguments and are inserted directly into a JSON document. They are not encoded with a JSON serializer or escaped for use inside JSON strings. Shell quoting prevents these values from becoming separate shell commands, so this is not direct shell-command injection. However, shell quoting does not make the expanded values safe JSON. An input containing double quotes, backslashes, control characters, or JSON delimiters can terminate the intended string and alter the structure of the request body. For example, a crafted material value could close the `text` property and attempt to introduc ...[truncated 1906 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: SKILL.md:7

Finding

Skill Declares Unnecessary Read and Write Permissions

Content

View full analysis

[args]" disable-model-invocation: false user-invocable: true allowed-tools: "Bash(curl *), Read, Write" ``` ### Technical Analysis The Skill declares access to generic `Read` and `Write` tools in addition to `Bash(curl *)`. The documented and implemented functionality consists of creating API requests, checking tasks, and retrieving account information. The reviewed implementation does not require arbitrary workspace file reads or writes for those operations. Granting capabilities that are not necessary for the declared workflow violates the principle of least privilege. Although no malicious instructions directing the Agent to misuse these tools were found, excessive permissions increase the consequences of future prompt injection, compromised documentation, unsafe model behavior, or later changes to the Skill instructions. The `Bash(curl *)` permission is also broader than the implementation's intended network scope if the host interprets it as permission to invoke curl against arbitrary destinations. The executable script currently hardcodes `https://api.knowfun.io`, but the declarative permission itself is not restricted to that host. ### Attack Path A potential exploitation path requires an additional prompt-injection or instruction-confusion condition: 1. The Skill is loaded with `Read`, `Write`, and broad curl execution available. 2. Attacker-controlled task text, URL-derived content, or another untrusted instruction attempts to influence the Agent. 3. The Agent follows the malicious instruction while operating under ...[truncated 1183 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (164)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · CONTRIBUTING.md (reported line 62)May include surrounding context.

md

git checkout -b feature/your-feature-name

# 4. Set up environment
cp .env.example .env
# Add your API key to .env

# 5. Test your changes

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · CONTRIBUTING.md (reported line 242)May include surrounding context.

md

git checkout -b feature/your-feature-name

# 4. Set up environment
cp .env.example .env
# Add your API key to .env

# 5. Test your changes

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · CONTRIBUTING.md (reported line 63)May include surrounding context.

md

# 4. Set up environment
cp .env.example .env
# Add your API key to .env

# 5. Test your changes
./scripts/test-api.sh

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · CONTRIBUTING.md (reported line 243)May include surrounding context.

md

# 4. Set up environment
cp .env.example .env
# Add your API key to .env

# 5. Test your changes
./scripts/test-api.sh

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · INSTALLATION.md (reported line 239)May include surrounding context.

y

1. 访问 https://www.knowfun.io/api-platform
2. 点击"创建 API Key"
3. 命名（例如："开发密钥"）
4. 复制密钥（以 kf_ 开头）

2. 设置环境变量

bash

# 临时（当前会话）
export KNOWFUN_API_KEY="kf_your_api_key_here"

# 永久 — zsh（macOS 默认）
echo 'export KNOWFUN_API_KEY="kf_your_api_key_here"' >> ~/.zshrc && source ~/.zshrc

# 永久 — bash
echo 'export KNOWFUN_API_KEY="kf_your_api_key_here"' >> ~/.bashrc && source ~/.bashrc

3. 测试安装

bash

knowfun credits

---

📊 功能对比

功能	Claude Code	Cursor	Cline	OpenClaw
斜杠命令（/knowfun）	✅	❌	❌	❌
自动技能调用	✅	❌	❌	✅
CLI 工具（knowfun）	✅	✅	✅	✅
自然语言请求	✅	✅	✅	✅
远程访问（Telegram 等）	❌	❌	❌	✅
npm 安装	✅	✅	✅	✅

---

🆘 故障排�

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · INSTALLATION_CN.md (reported line 239)May include surrounding context.

y

1. 访问 https://www.knowfun.io/api-platform
2. 点击"创建 API Key"
3. 命名（例如："开发密钥"）
4. 复制密钥（以 kf_ 开头）

2. 设置环境变量

bash

# 临时（当前会话）
export KNOWFUN_API_KEY="kf_your_api_key_here"

# 永久 — zsh（macOS 默认）
echo 'export KNOWFUN_API_KEY="kf_your_api_key_here"' >> ~/.zshrc && source ~/.zshrc

# 永久 — bash
echo 'export KNOWFUN_API_KEY="kf_your_api_key_here"' >> ~/.bashrc && source ~/.bashrc

3. 测试安装

bash

knowfun credits

---

📊 功能对比

功能	Claude Code	Cursor	Cline	OpenClaw
斜杠命令（/knowfun）	✅	❌	❌	❌
自动技能调用	✅	❌	❌	✅
CLI 工具（knowfun）	✅	✅	✅	✅
自然语言请求	✅	✅	✅	✅
远程访问（Telegram 等）	❌	❌	❌	✅
npm 安装	✅	✅	✅	✅

---

🆘 故障排�

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This section promotes remote chat control, browser automation, persistent memory, full file access, shell control, and self-installing extensions as benefits, but gives no security boundaries, authentication guidance, or privacy warnings. In a tool-integrated skill, these capabilities materially increase the attack surface and could enable unauthorized command execution, data exposure, or persistence if the surrounding platform is misconfigured or socially engineered.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code does support the declared core capability of generating educational content through Knowfun.io by creating tasks for course, poster, game, and film. However, its behavior is broader than the description states. In addition to content generation, it acts as a general-purpose API/account management CLI, exposing operational and account-level capabilities: listing tasks, fetching task details/status, viewing credits, pricing, usage statistics, and schema. These are materially undeclared capabilities and go beyond a description focused only on content generation. No harmful exfiltration is evident, but the description does not accurately represent the full behavior of the code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The description presents the skill as an end-user content generation tool for educational materials. The actual code shown is not implementing a general content-generation workflow; it is an administrative/test script for validating the Knowfun.io API and inspecting account/service state. Although it optionally creates a poster task, that action is framed as a diagnostic test consuming credits, not as fulfilling a user request to generate educational content. This is a materially different primary purpose from the declared description.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

Writing an API key into a .env file is common, but presented without safeguards it can normalize unsafe secret handling and lead to accidental commits, backups, workspace sharing, or local disclosure. Because this credential authorizes paid API operations and access to account resources, compromise can directly enable unauthorized usage and billing abuse.

Content

Scanner excerpt · examples.md (reported line 16)May include surrounding context.

Or create a .env file:

bash

echo 'KNOWFUN_API_KEY="kf_your_api_key_here"' >> .env

---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

Instructing users to append an API key to .env without companion secret-handling guidance creates a concrete credential exposure risk. .env files are commonly committed accidentally, copied into support bundles, or read by other local tooling, making this more severe than a generic documentation nit.

Content

Scanner excerpt · examples_CN.md (reported line 16)May include surrounding context.

或创建 .env 文件：

bash

echo 'KNOWFUN_API_KEY="kf_your_api_key_here"' >> .env

---

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · examples_CN.md (reported line 93)May include surrounding context.

直接使用 curl（Claude 可以帮助构建这个）：

bash

curl -X POST https://api.knowfun.io/api/openapi/v1/tasks \
  -H "Authorization: Bearer $KNOWFUN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · examples_CN.md (reported line 483)May include surrounding context.

获取详细的使用统计：

bash

curl -s "https://api.knowfun.io/api/openapi/usage?page=1&pageSize=20" \
  -H "Authorization: Bearer $KNOWFUN_API_KEY" | python3 -m json.tool

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · examples_CN.md (reported line 524)May include surrounding context.

5. 保存任务 ID

跟踪你的任务 ID 以供将来参考：

bash

TASK_ID=$(curl ... | python3 -m json.tool | grep taskId | cut -d'"' -f4)
echo "$TASK_ID" >> task_history.txt

Lp1

High

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The CLI forwards the entire parent environment into a spawned Bash process via env: process.env. In an agent setting, environment variables commonly contain secrets such as API keys, tokens, proxy settings, or execution controls; passing them wholesale to a shell wrapper increases the blast radius if the wrapper script, its children, or downstream commands leak, misuse, or are influenced by those values.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The file is an executable shell script that performs network operations and handles API credentials, which is a powerful capability. If the enclosing skill does not explicitly declare shell execution permissions, the mismatch undermines least-privilege expectations and can let an agent execute commands and transmit data in ways users or the platform did not authorize.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · CLAWHUB_VERIFICATION.md (reported line 37)May include surrounding context.

Lines 46, 74, 110, 141, 163, 179, 206 - all hardcoded paths

text

### 2. curl Commands in Shell Script

**What Scanner Sees:**
```bash

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · CONTRIBUTING.md (reported line 104)May include surrounding context.

md

1. **Update Documentation**: If you changed functionality, update docs
2. **Test Thoroughly**: Test on all supported platforms if possible
3. **Update Changelog**: Add entry to CHANGELOG.md
4. **Create PR**: Use a clear title and description
5. **Address Feedback**: Respond to review comments

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

The installation guide instructs users to run npx clawhub install knowfun-skills without pinning a specific version. This allows execution of whatever package version is current at install time, increasing supply-chain risk if the upstream package is compromised or a breaking/malicious release is published.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 79% confidence

Finding

Installing SKILL.md into ~/.claude/skills/knowfun creates persistent agent behavior across future Claude Code sessions. Persistence is expected for a skill install, but from a security perspective it means remote-fetched instructions continue to influence later sessions until manually removed.

Content

Scanner excerpt · INSTALLATION.md (reported line 27)May include surrounding context.

Method 1: curl (Recommended — no cloning needed)

bash

mkdir -p ~/.claude/skills/knowfun
curl -fsSL https://raw.githubusercontent.com/MindStarAI/KnowFun-Skills/master/SKILL.md \
  -o ~/.claude/skills/knowfun/SKILL.md

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The alternative install path instructs users to use sudo ln -s ... /usr/local/bin/knowfun, which elevates privileges to modify a system-wide executable path. In a setup flow involving a locally cloned repository, encouraging privileged file placement increases the impact of any compromised or substituted script.

Content

Scanner excerpt · INSTALLATION.md (reported line 86)May include surrounding context.

bash

git clone https://github.com/MindStarAI/KnowFun-Skills.git
sudo ln -s $(pwd)/KnowFun-Skills/scripts/knowfun-cli.sh /usr/local/bin/knowfun
chmod +x KnowFun-Skills/scripts/knowfun-cli.sh

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guide tells users to export an API key directly in the shell and append it to ~/.zshrc without warning about shell history, local file exposure, or safer secret-handling mechanisms. This can leak credentials through command history, shared dotfiles, backups, screenshots, or multi-user systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The Cursor section says natural-language requests will cause the agent to run CLI commands automatically, but does not warn users that this can trigger local command execution. In agent-integrated environments, normalizing automatic execution without confirmation increases the risk of unintended or prompt-influenced system actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The Cline section similarly states that a plain-language request will execute CLI commands automatically, with no safety notice about command execution or external API use. This can mislead users into treating natural-language interaction as harmless text rather than an action that affects their system and account.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

The OpenClaw installation section again relies on unpinned npx clawhub, which fetches and executes the latest available package version. In installation docs, this creates a repeatable remote-code-execution supply-chain exposure for users following the instructions.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.generated_source_template_injection

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: knowfun.js:30

User-controlled placeholder is embedded directly into generated source code.

Critical

• Code: suspicious.generated_source_template_injection
• Location: CLAWHUB_VERIFICATION.md:80