Security audit

Llmwiki

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate personal knowledge-base tool, but it deserves review because its optional server can allow unauthenticated persistent writes and its install command pulls unpinned external code.

Install only in an isolated environment, pin the package version yourself, and treat the web/API server as unsafe for shared networks unless you bind it to localhost or put it behind authentication and rate limits. Assume documents sent for compilation or asking may be transmitted to the configured LLM API.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:22
Finding: Unpinned Third-Party Package Installation
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:205
Finding: Unauthenticated Persistent Write Operation on a Network-Exposed Service
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.
md
mkdir my-kb && cd my-kb cat > .env << 'EOF' LLMBASE_API_KEY=sk-your-key LLMBASE_BASE_URL=https://your-endpoint/v1 LLMBASE_MODEL=your-model

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The description states that the LLM writes trilingual articles in EN / 中文 / 日本語 by default. This is a language/locale constraint presented as a default behavior rather than an explicit user-selected option, which can violate organizational policies requiring user choice for language preferences.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The security section makes an overbroad assurance that 'nothing is sent anywhere except the configured LLM API,' but the same skill explicitly supports fetching arbitrary URLs and corpus sources over the network. This is a security/privacy documentation flaw: users may underestimate outbound connections and data exposure paths, which can lead to unsafe deployment decisions or privacy misunderstandings.
Content: No source excerpt is available for this finding.