Knowledge Retrieval Publish

• Outcome: Pass
• Latest audit: Sep 17, 2026 · 5:45 PM UTC
• Version: 3.3.0

Overview

This is a disclosed local document search skill that indexes user-approved folders and stores local caches, with sensitive behavior called out for the user.

Install this only for folders you are authorized to process. Expect it to read approved local files, create local indexes and extracted-text caches under knowledge-base, store source paths, create shortcut links, and potentially send selected file contents to the model provider you choose. Review or clear the cache if the documents are sensitive, and approve dependency installation only if you are comfortable with the listed pinned packages.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (23)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents a broader document search skill with dual-channel retrieval (keyword + AI semantic) and adaptive evolution. The supplied code only performs Phase A BM25 indexing for local knowledge-base projects. It scans authorized local directories, extracts text from supported file types, caches extracted content, and writes BM25 index artifacts and metadata. There is no evidence in this chunk of semantic/AI retrieval, ranking, embeddings, model calls, or any progressive improvement logic. While the code is consistent with part of the declared local-first/PDF-PPT support story, the implemented behavior in this chunk is materially narrower than the declared capability set, so the description does not accurately represent what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a richer search system with multiple retrieval channels, format-aware support, and adaptive improvement. The supplied code chunk only implements one component: searching a BM25 index for a selected project folder and rebuilding that index if absent. While the query may be described as 'already expanded by AI,' there is no semantic retrieval or AI ranking in this code. Likewise, support for PPT/PDF and progressive learning are not evidenced here. The auto-rebuild of the index is an additional operational behavior not mentioned in the description, though it is ancillary rather than the main mismatch. Overall, the code materially under-delivers relative to the declared capabilities, so this is a mismatch.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/knowledge-base-conventions.md (reported line 1)May include surrounding context.

md

# Phase 执行细节

> 本文档是 `SKILL.md` 的详细扩展，覆盖 Phase 0 / A / B 的完整执行步骤。
> 仅在执行对应阶段时读取。

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/phase-execution.md (reported line 1)May include surrounding context.

md

# Phase 执行细节

> 本文档是 `SKILL.md` 的详细扩展，覆盖 Phase 0 / A / B 的完整执行步骤。
> 仅在执行对应阶段时读取。

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill clearly instructs file reads, file writes, and shell execution, but it does not declare any explicit tool scope or allowed-tools boundary. In agent systems, missing capability scoping increases the chance of overbroad execution, misuse of shell/file primitives, and unsafe invocation outside the intended project boundary.

Content

No source excerpt is available for this finding.

Ssd 1

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The document includes embedded control text telling the agent to ignore preceding content and obey only a later tagged section. This is a prompt-structure manipulation pattern that can be abused to hide risky behavior in 'human-readable' sections, suppress scrutiny, or condition the agent to privilege attacker-chosen subregions of the file.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation states that files are read in place and original documents are never modified or moved, which implies non-interference with the source area. But the same section says a shortcut link is added to the source folder, and later instructions require creating bidirectional shortcuts, contradicting the stronger no-modification framing.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill markets itself as local-first and 'no cloud upload needed,' yet it explicitly states that selected file contents may be sent to external model providers for semantic analysis. This can mislead users into exposing sensitive local documents under a weaker trust assumption, creating a real confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The entire skill file specifies behavior and user-facing wording exclusively in Chinese, including the prescribed response text at L32-L33. Under the policy rule for language/locale, this is a natural-language constraint that appears to force a specific language without documenting any user choice or opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file presents all operational instructions in Chinese and does not state that the user may choose another language or locale. Under the policy criteria, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The entire skill guidance is written only in Chinese and does not indicate that users may choose another language or locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Natural-language policy violations include forcing a specific language without user opt-in. This file presents all operational instructions exclusively in Chinese and contains no indication that users may choose another language or that the skill is intentionally restricted to a Chinese-language context.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The workflow authorizes automatic edits to data_structure.md and potentially coordinated updates with source_manifest.json during a search-preparation phase. Even if intended for index maintenance, this expands a retrieval skill into a state-mutating tool and can silently alter local project metadata, creating integrity and trust risks for user files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document instructs direct modification of local metadata files without an upfront warning that running the skill may change repository contents. Lack of clear disclosure undermines informed consent and raises the risk of unintended edits, especially in a tool presented primarily as search functionality.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The workflow includes execution of Python scripts and package installation commands without a strong safety gate or explicit warning before command execution. In a local-file skill context, silent or lightly disclosed command execution is risky because it can alter the machine, install packages, or trigger unreviewed script behavior under the guise of normal retrieval.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documented flow permits dependency installation and setup execution as part of search enablement, including running local batch scripts and pip install. This is dangerous because a retrieval skill should not implicitly execute software installation steps; doing so increases attack surface, may run unreviewed code, and can change the host environment in ways the user did not clearly authorize.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The 'description evolution' section directs the agent to rewrite data_structure.md after reading files, which is persistent content mutation beyond retrieval. This can silently modify knowledge-base metadata, introduce hallucinated summaries, and create a feedback loop where future searches rely on AI-authored descriptions rather than original user-curated data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file presents all user-facing guidance in Chinese, and it does not indicate that the language is optional, user-selectable, or required for a region-specific purpose. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

This code creates .bm25_index, writes extracted document content into a cache directory, and saves file_mapping.json containing resolved source paths. Although the module docstring describes outputs generally, there is no explicit user-facing warning at the point of execution that local files and metadata from the authorized source directory will be persisted on disk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file-level documentation states that an error message is produced if the index is not found. In practice, the implementation first tries to auto-rebuild the index and only errors if rebuild fails or the index is still absent, which contradicts the stated behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The module docstring and function documentation describe this file as a BM25 search utility that returns ranked results, with an error if the index is not found. Instead, when the index directory is absent, the code performs a state-changing auto-rebuild by launching build_kb_index.py, which goes beyond the declared read/search behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

For a skill described as local-first document retrieval, searching local indexes is expected, but process execution is a broader capability than necessary for the search operation itself. The code invokes a separate Python script via subprocess.run, introducing execution behavior not inherent to basic retrieval.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The manifest emphasizes a local-first document search capability for local files, which suggests primarily local processing behavior. This setup script performs a network-backed package installation via pip, which introduces external network activity not reflected in the description, even though it is only for installation rather than runtime retrieval.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.