《毛选》1-7卷文本查询

• Outcome: Review
• Latest audit: May 28, 2026 · 1:23 PM UTC
• Version: 1.0.2

Overview

This is a coherent Mao Selected Works search skill with optional remote embedding/rerank features that need privacy-aware configuration.

Install only if you want a local searchable Mao Selected Works corpus. Keep the default keyword mode for local-only use; enable RAG only after reviewing the external provider, API key handling, and whether sending queries or document chunks is acceptable. Avoid running utility scripts on unrelated paths or databases.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill documentation describes executable workflows that read environment variables, read and write local files, invoke shell commands, and optionally contact external APIs, yet it declares no permissions. This creates a trust and review gap: users or orchestrators may grant or assume fewer capabilities than the skill actually needs, increasing the chance of unintended file modification, secret exposure, or network egress when the skill is run.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The declared purpose frames the skill as a retrieval tool, but the documented behavior includes broader operational capabilities: modifying config files, testing outbound model connectivity, unpacking EPUBs, and batch-editing Markdown content. This mismatch is dangerous because operators may invoke or approve the skill under a narrower mental model, while it can alter local data and send requests to external services outside the expected retrieval-only scope.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The file includes a model-connectivity test command that reads API-key environment variables and performs outbound HTTP requests to configured embedding/rerank services, which is unrelated to the core local search function. In an agent skill context, this expands the attack surface by enabling network egress and use of sensitive credentials from the runtime environment, especially if the skill can be invoked in broader workflows than intended.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README instructs users to enable remote RAG by configuring an API key and external endpoint, but it does not clearly warn that user queries and possibly indexed text may be transmitted to a third-party service. In a local knowledge-base skill, that omission can mislead operators into believing retrieval remains entirely local, creating privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The deployment section tells users to export API credentials and configure a remote base URL without any accompanying privacy, retention, or external-transmission warning. This increases the chance that administrators will deploy the skill in environments handling sensitive prompts or corpus content without understanding that data may leave the local system.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The manifest enables implicit invocation without any trigger constraints, so the platform may auto-select this skill in contexts where the user did not clearly request Mao Selected Works retrieval. That can cause unintended data import, indexing, or retrieval behavior, and increases the attack surface for prompt-routing mistakes or tool misuse.

Natural-Language Policy Violations

High

• Confidence: 96% confidence
• Finding: The text explicitly endorses killing people labeled as 'counterrevolutionaries' and justifies detention and coercive punishment. Even though this appears in a historical/political text rather than as an instruction to the agent, it is still harmful extremist/violent advocacy content that a retrieval skill could surface to users without safeguards. In a quote-retrieval skill, preserving source fidelity does not remove the risk of distributing or normalizing advocacy of lethal political violence.

Natural-Language Policy Violations

High

• Confidence: 94% confidence
• Finding: This passage endorses revolution, violent struggle, and armed force as acceptable means of resolving political and social conflict. In a retrieval skill, making such text easily discoverable by keyword/title can facilitate propaganda-style consumption or reuse outside historical context. The skill's purpose is to retrieve full original text, which increases exposure risk because it may return the passage verbatim and decontextualized.

Natural-Language Policy Violations

High

• Confidence: 97% confidence
• Finding: The passage approves attacking officials, endorses retaliatory violence, and frames physical force against perceived bureaucratic enemies as justified. Although this is archival source material, the skill is specifically designed to locate and reproduce such passages, so without moderation it can act as a distribution channel for content legitimizing political violence. The historical-literary context makes the author's intent non-malicious in the skill itself, but the operational effect remains risky.

Natural-Language Policy Violations

High

• Confidence: 94% confidence
• Finding: The text explicitly calls for people to '行动起来' and to launch a '持久的猛烈的进攻' against identified enemies, without any safety framing, historical disclaimer, or contextual guardrails in the skill content itself. Although this is a historical political document rather than operational attack guidance, exposing or retrieving such advocacy verbatim can still normalize or amplify extremist/violent rhetoric in downstream agent use.

Natural-Language Policy Violations

High

• Confidence: 98% confidence
• Finding: The flagged passage explicitly advocates coercive repression, including language about arresting, encircling, and annihilating those who persist. Even though this appears in a historical source text rather than as live instructions from the skill author, surfacing such content to users without guardrails can distribute or normalize violent extremist rhetoric and may be repurposed as justification for harm.

Natural-Language Policy Violations

High

• Confidence: 97% confidence
• Finding: This section frames escalation to wider armed conflict as an acceptable or even desirable option, which can normalize mass violence. In a retrieval skill, returning such passages without contextualization is risky because users may receive direct violent rhetoric detached from historical critique or safety framing.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The schema creation routine unconditionally drops all existing tables before recreating them, which will erase any prior indexed data every time the script runs against the target database. Because the database path can be supplied by config or CLI and there is no warning, backup, or confirmation, an operator can accidentally destroy data or point the script at the wrong SQLite file.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: When embed_texts and rerank_documents are used, they send user queries and document text to external services via HTTP APIs without any in-code consent, warning, or minimization controls. In a text-retrieval skill, this can leak sensitive prompts or corpus contents to third-party providers whenever hybrid retrieval is enabled.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
python scripts/config.py show
python scripts/config.py set rag.api.base_url "https://api.siliconflow.cn/v1"
python scripts/config.py set rag.enabled true
```

• Confidence: 87% confidence
• Finding: The documented configuration points users to a third-party API endpoint, which is a concrete indicator of external network transmission when RAG is enabled. In this skill's context, the risk is not the URL itself but that retrieval behavior may cease to be local and send user inputs or indexed content to an outside provider without prominent disclosure.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
export MAO_SKILL_API_KEY="sk-xxxxxx"
export MAO_SKILL_API_BASE_URL="https://api.siliconflow.cn/v1"
```

3. **建立索引**

• Confidence: 90% confidence
• Finding: The deployment example combines an API key and remote base URL, operationalizing outbound data transfer to an external service. Without a warning about privacy and data handling, users may unknowingly expose search terms, prompts, or document-derived embeddings/content to a third party.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:361

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/search.py:334