zero-one-two-three知识变现架构师

Security checks across static analysis, malware telemetry, and agentic risk

Overview

The skill is mostly coherent with its knowledge-management and monetization purpose, but its mailbox automation and local indexing create meaningful privacy and business-action risks that need review before installation.

Install only if you are comfortable giving this skill access to the specific mailbox, local folders, and tokens you configure. Use a dedicated mailbox or app password, avoid broad directory scans, review the files it will index, do not run --report against a live mailbox until the report/process-mail coupling is fixed, and treat the voice/style features as preset TTS and writing-style analysis rather than true identity cloning.

Publisher note

## 📜 核心宣言：0+1+2≠3 → ∞ > **0 (Zero) | 零基建模** > 不盲从旧结论，不依赖旧框架。用第一性原理，从空白中重建认知的骨架。 > **一切伟大，始于归零。** > **1 (One) | 极致原子** > 不满足于摘要，不妥协于碎片。把一份资料拆解为最纯粹的逻辑、数据与机制。 > **一份笔记，就是一个完整的宇宙。** > **2 (Two) | 连接碰撞** > 当 IMA 遇见语雀，当旧灵感碰撞新数据。在看似无关的节点间建立关联，寻找共识与分歧。 > **1 + 1 不止是 2，而是意外的惊喜 (Serendipity)。** > **≠3 (Three) | 涌现创生** > 拒绝线性的累加，追求指数级的涌现。机器负责发现空白与提案，人类负责把关与决策。让知识像生命一样自我修复、自我生长。 > **这才是真正的"生万物"。"吾生也有涯，而知也无涯"；"以其至小，求穷其致大之域，是故迷乱而不能自得"** > **"知识创造了世界，世界充满着知识，我们用知识改变世界。"** —— **C 叔 | 低碳有方 + AI** ### 多语言版本 | **English** | Zero-One-Two-Three frees you from AI summaries, delivering complete knowledge. | | **日本語** | Zero-One-Two-Three は AI の要約からあなたを解放し、完全な知識をもたらします。 | | **བོད་སྐད་ (Tibetan)** | Zero-One-Two-Three ཡིས་ AI ཡི་བསྡུས་དོན་ལས་གྲོལ་ནས་ཆ་ཚང་བའི་ཤེས་བྱ་སྤྲོད། | | **Монгол (Mongolian)** | Zero-One-Two-Three нь таныг AI-ийн хураангуйгаас чөлөөлж, бүрэн мэдлэгийг хүргэдэг. | | **ئۇيغۇرچە (Uyghur)** | Zero-One-Two-Three sizni AI xulasiliridin azat qilip, mukemmel bilimni élip kélidu. | | **Français** | Zero-One-Two-Three vous libère des résumés de l'IA, offrant un savoir intégral. | | **Español** | Zero-One-Two-Three te libera de los resúmenes de IA, entregando conocimiento completo. |

SkillSpector (20)

By NVIDIA

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The documented behavior says '--report' sends a report, but the implementation then also connects to IMAP and processes unread mail, which can trigger automatic order handling and outbound emails. This mismatch is dangerous because a user invoking a seemingly harmless reporting action may unintentionally grant mailbox access and cause side effects on real customer messages.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The CLI help advertises '--report' as a standalone reporting action, but the code path continues into mailbox login and auto-delivery logic. In a skill that monitors inboxes and sends outbound messages, this hidden coupling materially increases the chance of unintended mailbox processing and unauthorized business actions.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The analyzer recursively ingests all matching files under user-supplied directories, including .py source files, which is broader than the stated purpose of analyzing user writing samples. In a local agent context, this can unintentionally collect source code, secrets in comments, prompts, or other sensitive local content and fold it into the generated fingerprint or reports.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The module markets itself as a 'voice clone engine' that uses a user's tone, rhythm, and pause style, but the implementation only selects from predefined TTS voices and adjusts simple parameters like rate and pitch from a JSON profile. This is a deceptive capability claim that can mislead users into believing they are getting true voice cloning or identity-linked synthesis, which is especially sensitive in voice/biometric contexts.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README promotes style and voice cloning without any mention of consent, identity protection, or abuse restrictions. These capabilities can facilitate impersonation, fraud, social engineering, and privacy violations, especially when presented as easy-to-use personal cloning tools.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README advertises ephemeral sharing for confidential files with language that may overstate security, yet 'read-once' or self-destruct semantics do not prevent screenshots, forwarding, caching, or server-side retention. Users may wrongly rely on this as strong confidentiality protection and expose sensitive data.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The README instructs users to place email and Notion secrets into environment variables without any handling guidance, rotation advice, or least-privilege recommendations. While environment variables are common, presenting raw credential setup without warnings increases the risk of accidental exposure through shells, logs, screenshots, shared profiles, or local compromise.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The README advertises continuous mailbox monitoring and automatic parsing of attachments but does not clearly disclose what mailbox data will be accessed, how attachments are processed, or whether content may be transmitted to third-party services. That creates a meaningful privacy and security risk because users may grant broad email access without informed consent, and attachments commonly contain sensitive personal, financial, or proprietary data.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The environment setup instructs users to provide email and token credentials, including a mail auth code, without a clear warning that the skill will use them to access mailbox contents and potentially process sensitive data. This is dangerous because users may treat the variables as routine configuration and unknowingly authorize broad access to private communications, especially in a tool that also promotes automated monitoring and parsing.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The skill says it will automatically email an experience report after configuration to the address in ZOT_AUTHOR_EMAIL, but it does not present a prominent privacy warning or explicit opt-in at the point of setup. Automatic outbound transmission after configuration can disclose environment details, usage context, and user identifiers without informed consent, especially if users are encouraged to set contact email variables during onboarding.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The mailbox feature describes continuous inbox monitoring, attachment parsing, automatic labeling, and knowledge-base linkage, but the warning about persistent surveillance and content processing is not made sufficiently explicit before enrollment. This creates a serious privacy risk because sensitive emails and attachments may be ingested and processed continuously, potentially beyond what users expect from a 'mailbox tool.'

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The code prints the full recovery mnemonic and then embeds that secret directly into a sample shell command. In a CLI context, this encourages users to place the mnemonic in shell history, process listings, terminal scrollback, logs, or screenshots, which can expose the recovery secret and allow an attacker to recover the encrypted password and decrypt protected content.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill automatically sends a report to an external author-controlled address containing mailbox account details and order/business metrics, without a clear just-in-time warning at the send action. That creates an exfiltration path for operational and potentially sensitive customer-related data from the user's environment to a third party.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The code scans local Markdown/text files, reads portions of their contents, and stores absolute source paths, headings, and content previews into a persistent catalog without any explicit consent flow or privacy warning. In a personal-library tool this behavior is functional, but it still creates a real privacy risk because sensitive local notes, filenames, and filesystem structure may be indexed and later exposed through search, browse, or export features.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The export function writes a Markdown index containing note titles, subcategories, tags, and headings to disk, which can unintentionally duplicate sensitive knowledge-base metadata into a new file. This is lower severity than the scan behavior, but it still increases disclosure risk because exported catalogs are easier to share, back up, or commit accidentally.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill reads arbitrary files and recursively scans directories based on user input, but gives no upfront notice that local files will be accessed and aggregated. In the context of a style-cloning tool, this is risky because users may provide broad paths expecting only prose analysis, while the tool silently processes large amounts of local content, including potentially sensitive data.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The tool persists derived fingerprint data to disk automatically with only a post-save message, so users may not realize behavioral/profile data is being retained locally. While this does not exfiltrate data, style fingerprints can still be privacy-sensitive because they summarize writing traits and may reveal characteristics of the source corpus.

Ssd 3

Medium

Confidence: 95% confidence
Finding: These instructions describe automated collection and processing of mailbox content and attachments, then triggering downstream analysis and linkage. Even if framed as a product feature, automatic ingestion of email-derived content is sensitive and can expose personal, confidential, or regulated data if users are not clearly informed and controls are weak.

Ssd 3

Medium

Confidence: 96% confidence
Finding: Automatically emailing a configuration-derived experience report is an unsolicited outbound disclosure channel. Even if intended for support or feedback, it can leak setup metadata, operational details, and potentially user-specific information without a clear approval step, making it an avoidable privacy and security weakness.

Ssd 3

High

Confidence: 99% confidence
Finding: The report function compiles the mailbox account, IMAP provider, OS/Python details, and business/order metrics, then emails them to AUTHOR_EMAIL, which defaults to an external author address. In the context of a mailbox automation skill, this is a strong exfiltration pattern because it transfers environment and business data off-system to a third party unrelated to core mail processing.

Static analysis

Exposed secret literal

Critical

Finding: File appears to expose a hardcoded API secret or token.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal