Knowledge Graph Extractor

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:57 AM UTC
• Version: 0.1.0

Overview

The skill has a clear document-to-knowledge-graph purpose, but it asks the agent to run an unshipped local script and install unpinned packages.

Review before installing. Use it only in an isolated workspace, provide only documents intended for extraction, and do not run the referenced script unless you have verified where it comes from. Prefer pinned dependencies or a locked environment for openpyxl, python-docx, and pdfplumber.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:419

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 419
Vulnerability Type: Unpinned third-party dependencies and insufficient supply-chain controls
Risk Level: Medium

Vulnerable Code

bash

pip install openpyxl python-docx pdfplumber

Technical Analysis

The troubleshooting guidance instructs the agent or user to install three third-party Python packages without version constraints, cryptographic hashes, a lockfile, or an explicitly trusted package index.

Because dependency resolution is unconstrained, the packages and their transitive dependencies may change between installations. If a future release or dependency is compromised, the installation can introduce attacker-controlled code even though the Skill itself contains no malicious script. Package installation and subsequent imports execute with the privileges of the user or agent environment.

The audit found no evidence that these package names are currently malicious. The vulnerability is the absence of reproducible, integrity-verified dependency controls.

Attack Path

1. A required Python library is unavailable in the execution environment.
2. The agent or user follows the troubleshooting instruction in SKILL.md.
3. pip resolves the latest compatible versions and transitive dependencies from its configured indexes.
4. An attacker has compromised a package release, one of its dependencies, or the configured package source.
5. The compromised component executes code during installation or when imported by the document-processing workflow.
6. The payload operates with the permissions and network access of the invoking process.

This path requires compromise or manipulation of the dependency supply chain; no direct remote-payload mechanism is embedded in the reviewed project.

Impact Assessment

Successful exploitation could allow arbitrary code execution under the account running pip or the document-processing workflow. Depending on that account's permission ...[truncated 347 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the ad hoc installation command with a reviewed dependency manifest containing exact versions.
2. Generate and verify cryptographic hashes for every direct and transitive dependency, then install with pip --require-hashes.
3. Use a lock-generation process such as pip-tools and commit both the source requirements and generated lockfile.
4. Install dependencies in an isolated virtual environment or container under a non-privileged account.
5. Restrict resolution to an approved package index and prevent unintended fallback to untrusted indexes.
6. Add automated dependency vulnerability, provenance, and license scanning.
7. Review and deliberately update locked versions rather than resolving mutable releases at runtime.

A hardened installation pattern is:

bash

python -m pip install \
  --require-hashes \
  --only-binary=:all: \
  --index-url https://pypi.org/simple \
  -r requirements.lock

The referenced requirements.lock should pin all direct and transitive packages and include verified hashes.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill's trigger scope is broad enough to overlap with common document-processing and educational requests, which increases the chance of unintended invocation on user documents outside a clearly consented workflow. In this skill, that matters because it directs parsing of uploaded files and generation of transformed outputs, so accidental activation could cause unexpected local processing or disclosure of document-derived content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The description mandates Chinese schema labels and throughout the file the required node types, column names, and validation values are fixed in Chinese such as '分类' and '知识点'. The file does not offer any user opt-in or language choice, so it imposes a specific language/locale by default.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The entire skill prompt is written as mandatory Chinese-language instructions, including the core extraction directive and output requirements, with no indication that users may choose another language or locale. This can violate language/locale policy where skills must not force a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The title and all instructions in the file are written exclusively in Chinese, presenting the format requirements as mandatory output rules. There is no indication that users may choose another language or that the Chinese-only constraint is justified as a region-specific requirement, which can violate language/locale choice policy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file is entirely written as a mandatory Chinese prompt template and instructs the agent to produce its validation workflow and report in Chinese, but it does not mention any user opt-in or language selection. This can violate language/locale policy when users or environments expect a different language by default.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill instructs the agent to parse uploaded documents, read templates, and generate CSV/Excel outputs, but it does not prominently warn users that their files will be locally transformed into derivative artifacts. This can undermine informed consent and create privacy surprises, especially when source documents contain sensitive educational or proprietary material.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The entire prompt template is written as mandatory Chinese-language instructions and output labels, with no indication that users may choose another language or locale. Under the policy rule for natural-language constraints, this is a locale/language restriction that is not presented as optional or justified as region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.