Personalised Local Wiki

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:42 AM UTC
• Version: 1.0.1

Overview

This local personal-wiki skill is mostly coherent, but it asks the agent to proactively read and persist broad conversation and research context with weak user control.

Install only if you want the agent to maintain a persistent local wiki. Before use, set a dedicated PERSONAL_WIKI_ROOT, keep secrets and private files out of that tree, prefer pipx or a pinned Wikmd version, require confirmation before writes or commits, and inspect staged Git files before committing.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:49
• Finding: Unpinned Third-Party Package Installation Creates a Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md`, lines 49-58 **Vulnerability Type**: Unpinned and unverifiable third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash ### Install Wikmd ```bash pip install wikmd ``` Or via pipx (recommended): ```bash pipx install wikmd ``` ``` ### Technical Analysis The installation instructions retrieve and install the latest available version of `wikmd` and its transitive dependencies. No exact version, package hash, lock file, or other integrity control is specified. Python package installation can execute package build and installation logic with the privileges of the user running `pip` or `pipx`. Consequently, an upstream compromise, malicious replacement, dependency confusion event, or unexpectedly unsafe future release could introduce code that was not present when this skill was audited. The audit found no evidence that `wikmd` itself is malicious. The vulnerability is the absence of controls that make the installed dependency reproducible and verifiable. ### Attack Path 1. An attacker compromises the package, one of its transitive dependencies, or the relevant package-distribution account. 2. The attacker publishes a malicious release that satisfies the unconstrained installation command. 3. A user follows the skill instructions and runs `pip install wikmd` or `pipx install wikmd`. 4. The package manager downloads the attacker-controlled release. 5. Malicious build, installation, or runtime code executes in the user's environment. ### Impact Assessment Successful exploitation could execute arbitrary code with the privileges of the user performing the installation. This may permit access to that user's files, environment variables, wiki content, Git configuration, and credentials available to the process. It could also modify files or install additional user-level components. System-wide impact would depend on whether ins ...[truncated 109 chars]
• Remediation: ## Remediation Suggestions - Pin `wikmd` to a specifically reviewed version, such as `wikmd==X.Y.Z`. - Publish a lock file containing exact transitive dependency versions. - Require package hashes using a hash-locked requirements file and `pip install --require-hashes`. - Verify the package's canonical name, publisher, source repository, and release artifacts. - Install the dependency in a dedicated virtual environment or through `pipx`, without administrative privileges. - Establish a controlled dependency-update process that reviews code and release notes before changing the pinned version.

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:175
• Finding: Persistent Capture of Conversation and Research Content Can Poison Future Agent Context## Vulnerability Details **File Location**: `SKILL.md`, lines 175-180 **Vulnerability Type**: Insufficiently controlled writes to persistent agent memory **Risk Level**: Medium ### Vulnerable Code ```markdown The wiki is an extension of your memory system: - **After conversations**: Review if anything discussed should be captured - **After research**: Document key findings and sources - **When patterns emerge**: Create or update pages that connect related information - **During heartbeats**: Check for pages needing updates or maintenance ``` The persisted content is subsequently consulted under the following instructions at `SKILL.md`, lines 131-135: ```markdown **Always check the wiki before:** 1. Making recommendations — the wiki may have preferences or constraints documented 2. Answering questions — the user may have already researched this 3. Planning — there may be existing projects or goals to align with 4. Researching — avoid duplicating effort by checking what's already known ``` ### Technical Analysis The skill treats wiki pages as an extension of agent memory and encourages information from conversations and research to be persisted, including during autonomous heartbeat activity. It does not require explicit approval before each write, define which information is safe to retain, label the trust or provenance of stored information, or instruct the agent to treat directives found in wiki content as untrusted data. Because the same skill requires future sessions to consult the wiki before answering, planning, researching, or recommending, attacker-controlled text captured from a conversation or external research source could become persistent context. If such text contains misleading assertions or instruction-like content, it could continue to influence later sessions. ### Attack Path 1. An attacker or untrusted source supplies misleading or instruction-like content during a conversation or resear ...[truncated 1013 chars]
• Remediation: ## Remediation Suggestions - Require explicit user confirmation before creating or updating persistent wiki content. - Save only user-selected facts rather than automatically capturing broad conversation or research content. - Redact credentials, tokens, personal data, and other secrets before writing. - Record provenance, author, creation date, and trust status for retained information. - Clearly instruct the agent that wiki text is untrusted data and that instructions embedded in pages must never override system or user instructions. - Separate trusted user-authored memory from imported research and other externally sourced material. - Disable autonomous heartbeat writes unless the user expressly enables them. - Provide review, correction, expiration, and deletion mechanisms for retained information.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:157
• Finding: Overbroad Git Staging Can Commit Unrelated Files and Sensitive Data## Vulnerability Details **File Location**: `SKILL.md`, lines 157-163; related scope statement at lines 195-199 **Vulnerability Type**: Overbroad file staging and inaccurate filesystem-scope documentation **Risk Level**: Medium ### Vulnerable Code ```markdown 3. **Commit the changes** — the wiki uses git for version control: ```bash cd $PERSONAL_WIKI_ROOT git add . git commit -m "Add page about X" ``` ``` The documented scope claim is: ```markdown ## Privacy & Security - **Scope**: This skill only creates/modifies Markdown files in `PERSONAL_WIKI_ROOT/wiki`, reads documentation from https://linbreux.github.io/wikmd/ and hosts the Wiki on a local http server - **Data Handling**: All content is stored locally; no data is sent to external services - **Version Control**: Use git to track changes and maintain history ``` ### Technical Analysis After changing to `PERSONAL_WIKI_ROOT`, the command `git add .` stages every unignored changed or untracked file beneath that directory. It does not limit staging to the Markdown page created or updated by the skill. If configuration files, backups, credentials, private notes, generated files, or unrelated content are present under the wiki root, they can be included in the next commit. Once committed, sensitive data remains recoverable from Git history even if it is removed in a later commit. This behavior also conflicts with the statement that the skill only creates or modifies Markdown files in `PERSONAL_WIKI_ROOT/wiki`. The documented setup itself creates `wiki_config.yaml` and Git metadata outside that subdirectory, while the staging command acts on the entire repository. ### Attack Path 1. A sensitive or unrelated file is created or copied beneath `PERSONAL_WIKI_ROOT`. 2. The file is not excluded by `.gitignore`. 3. The agent creates or updates a wiki page. 4. Following the documented workflow, it runs `git add .` from `PERSONAL_WIKI_ROO ...[truncated 705 chars]
• Remediation: ## Remediation Suggestions - Stage only the exact file modified by the operation, for example: ```bash git add -- "$PERSONAL_WIKI_ROOT/wiki/projects/my-project.md" ``` - Resolve and validate the target path before writing or staging it, ensuring it remains inside `PERSONAL_WIKI_ROOT/wiki`. - Reject absolute paths, `..` traversal, and symbolic-link escapes. - Add a restrictive `.gitignore` covering environment files, credentials, keys, backups, editor artifacts, databases, and generated content. - Run `git diff --cached --name-only` and inspect the staged paths before committing. - Require user confirmation when a commit contains any file other than the intended Markdown page. - Use `git add --intent-to-add` or explicit pathspecs rather than repository-wide staging. - Correct the privacy and scope documentation so it accurately describes configuration, Git metadata, and all files the workflow may modify.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The top-level description instructs the agent to proactively consult and regularly update the wiki whenever topics might be documented, which is ambiguous and overbroad. In practice, this encourages autonomous handling of user data and state changes without a clear, specific user request.

Ssd 3

Medium

• Confidence: 90% confidence
• Finding: The description encourages ongoing documentation of projects, research, decisions, and contextual information in a persistent local wiki. Even without external exfiltration, this creates a data retention risk because sensitive personal or organizational details may be stored in plain-language notes without minimization or consent checkpoints.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger conditions are broad and subjective, causing the skill to activate on many ordinary conversations about projects, research, plans, or recurring topics. This can lead to unintended reads and writes to the wiki, expanding data collection and retention beyond what the user explicitly requested.

Ssd 3

Medium

• Confidence: 91% confidence
• Finding: The maintenance guidance tells the agent to capture anything 'worth remembering' after conversations or research, which is highly subjective and likely to preserve sensitive user information unnecessarily. Because entries are stored locally in markdown and versioned with git, retained information may persist indefinitely and be harder to remove completely.

Static analysis

No suspicious patterns detected.