Security audit

个人文献知识库，自带全球文献检索（支持向量搜索+传统分词搜索）

Security checks across malware telemetry and agentic risk

Overview

The skill fits its research-library purpose, but it needs Review because it under-discloses remote data sharing and cross-skill credential/config use.

Review before installing. Use it only if you are comfortable with research queries, document metadata or extracted text, an email address, and optional vectorization inputs being sent to SmartLib or a selected embedding provider. Avoid unpublished, proprietary, or sensitive documents unless remote matching and vectorization are disabled or explicitly controlled, and inspect local config files and permissions before storing API keys.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The README states that all data stays local and is not uploaded to any server, but elsewhere it describes SmartLib-backed external search/matching and optional remote vectorization. This creates a materially misleading privacy claim that could cause users to submit sensitive research documents or notes under false assumptions about data handling.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The skill's credential flow is internally inconsistent: it first says the agent must always ask the user for an email before any SmartLib API use, then later says it may reuse a preconfigured email from another skill's config. This ambiguity can lead an implementation to use stored third-party credentials or personal data without fresh user consent, causing privacy violations and accidental cross-account actions.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The document claims all operations are confined to ~/.workbuddy/academic-kb/, but it explicitly instructs reading ~/.workbuddy/skills/global-biblio-base/config.json. That mismatch weakens trust boundaries and can normalize cross-skill file access, which may expose credentials or unrelated user data stored in adjacent skill directories.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger examples are broad and conversational, making it unclear when the skill should activate versus when the user is speaking generally about research. In an agent environment, ambiguous activation boundaries can cause unintended searches, writes, imports, or other side effects without clear user intent.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: Generic save/archive phrases like saving to the knowledge base are too vague for a markdown-described activation interface and can be matched during ordinary discussion. This increases the risk of accidental persistence of sensitive documents, notes, or search results into local storage or downstream processing flows.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The README describes user-uploaded literature being parsed and matched via SmartLib, but does not clearly warn that uploaded files or extracted content may be transmitted to external services. Users handling unpublished manuscripts, proprietary data, or sensitive research could unknowingly expose information to third parties.

Missing User Warnings

Low

Confidence: 78% confidence
Finding: The README says the skill will automatically create directories and update the local knowledge base during first use, but does not clearly warn users about filesystem changes. While lower severity than remote data transfer issues, silent local writes can still surprise users and lead to unintended storage of sensitive material.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger list includes broad phrases like knowledge base, literature management, and research notes that can easily appear in ordinary conversation. Ambiguous activation increases the chance the agent performs file writes, ingestion, or external lookups when the user only intended discussion, leading to unintended data persistence or quota consumption.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The quick-trigger examples are presented as natural language shortcuts without strong boundaries, so routine phrases may activate topic creation, export, or configuration behavior. In a skill with write access, network access, and quota-bearing APIs, accidental invocation can have real privacy, integrity, and billing consequences.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill authorizes silent creation and repair of directories, JSON files, schema files, and vector configuration under the user's home area without a user-facing warning. Silent state changes reduce user awareness, make forensic review harder, and can be abused by accidental or malicious trigger paths to establish persistent local state unexpectedly.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill instructs storing user API keys directly in a local JSON configuration file but does not prominently warn about plaintext secret storage, local exposure, backup leakage, or permission requirements. If the workstation, backups, or adjacent tools can read that file, attackers may recover the key and abuse the external vectorization account.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.