Security audit

KWDB Build

Security checks across malware telemetry and agentic risk

Overview

The skill is a coherent KaiwuDB build and test helper, but its mandatory cleanup steps can delete broad workspace and GOPATH content without enough safeguards.

Install only if you are comfortable letting the agent run KaiwuDB build and test commands. Before use, require it to show the exact cleanup paths, confirm they are inside the intended source checkout, and avoid or manually approve any deletion under GOPATH or wildcard rm -rf target.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (28)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill clearly orchestrates build and test flows and references shell scripts, but it does not declare the shell capability/permission. That creates a transparency and policy-enforcement gap: an agent may invoke command execution for compiling, testing, or cleaning without an explicit permission boundary, increasing the risk of unintended command execution in a source tree.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The file is presented as a configuration-confirmation document, but it embeds mandatory destructive cleanup commands including broad recursive deletions. This is dangerous because an agent following the skill could perform irreversible deletions in the workspace or GOPATH before the user understands the scope, especially since some paths depend on environment variables and globbing.

Intent-Code Divergence

Medium

Confidence: 79% confidence
Finding: The document states that all configuration options must be confirmed with the user before any action, yet it also specifies unconditional automatic edition selection based on filesystem inspection. That inconsistency can cause the agent to make material build decisions without explicit user approval, undermining the stated safety gate and potentially changing what code or targets are built.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The document claims to cover Go unit testing, but its prescribed workflow includes broad cleanup, CMake configuration, native library compilation, and execution of a repository script. This expands the operational scope beyond a narrow test action and increases the chance that a user authorizes actions they did not reasonably expect from a 'Go unit test' skill.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The documentation automatically selects enterprise build mode whenever `kwbase/Makefile_ent` exists, without making that behavior explicit in the manifest scope or requiring a separate user choice. This can cause the skill to perform materially different build actions than the user requested and may involve code paths, artifacts, or licensing-sensitive components the user did not intend to use.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The script immediately changes into the provided source tree and executes all discovered unit test artifacts without any confirmation step, despite the skill metadata explicitly requiring user confirmation of configuration options before taking action. In an agent setting, this can cause unintended execution of repository-provided code, which is risky because test binaries/scripts are executable content and may perform arbitrary local actions.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The trigger terms are broad build-related words such as '编译', '构建', 'cmake', and '清理', which can appear in general discussion and may cause the skill to activate when the user did not intend to execute a build workflow. In a shell-capable skill, over-triggering is dangerous because it can lead to unnecessary repository operations, test execution, or cleanup actions with side effects.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The documented cleanup sequence includes multiple `rm -rf` operations and build-clean targets, but there is no explicit warning that these steps may delete existing build artifacts, logs, install outputs, generated files, or GOPATH-local content. In an agent context, omission of a clear data-loss warning materially increases the chance that users authorize actions without understanding the irreversible consequences.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill documents a mandatory clean step containing multiple destructive deletions but does not provide any explicit warning about data loss, scope, or the need to verify the working directory and environment variables first. In an agent skill context, this is dangerous because the instructions may be executed on a real user system, and commands like `rm -rf build*` and `rm -rf ${GOPATH}/native` can remove unintended data if paths or variables are mis-set.

Missing User Warnings

Low

Confidence: 87% confidence
Finding: The skill instructs execution of `bash scripts/run_unittest.sh {源码目录}` without warning that this will run repository code on the user's machine. In a security-sensitive agent workflow, silently invoking a script from the repo is risky because the script contents may change, may perform additional side effects, or may execute attacker-controlled code if the repository is untrusted or compromised.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The cleanup section contains multiple destructive `rm -rf` operations, including wildcard deletion and removal under `${GOPATH}`, but provides no explicit warning about deletion risk or the directories that will be affected. In a skill context, this is dangerous because users may consent to 'running tests' without understanding that repository and environment state will be recursively deleted first.

Missing User Warnings

Low

Confidence: 83% confidence
Finding: The documentation instructs the agent to run a repository shell script using a user-supplied source directory, but does not warn the user that arbitrary script logic from that source tree will execute. This is risky because repository scripts can perform unexpected filesystem, network, or environment-modifying actions beyond merely running tests.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script enumerates directories matching '*.dir', derives a name, marks a same-named file executable, and runs it with no validation, warning, or confirmation. Because the executed artifact comes from the source tree under test, a malicious or trojaned repository could place arbitrary executables there and achieve code execution in the agent's environment.

Tool Parameter Abuse

High

Category: Tool Misuse
Content: rm -rf build* rm -rf log/ rm -rf install/ rm -rf kwbase/.buildinfo rm -rf kwbase/bin rm -rf kwbase/build/defs.mk kwbase/build/defs.mk.sig rm -rf qa/TEST_integration
Confidence: 96% confidence
Finding: rm -rf kwbase/

Tool Parameter Abuse

High

Category: Tool Misuse
Content: rm -rf log/ rm -rf install/ rm -rf kwbase/.buildinfo rm -rf kwbase/bin rm -rf kwbase/build/defs.mk kwbase/build/defs.mk.sig rm -rf qa/TEST_integration rm -rf kwbase/ui/yarn.installed
Confidence: 96% confidence
Finding: rm -rf kwbase/

Tool Parameter Abuse

High

Category: Tool Misuse
Content: rm -rf install/ rm -rf kwbase/.buildinfo rm -rf kwbase/bin rm -rf kwbase/build/defs.mk kwbase/build/defs.mk.sig rm -rf qa/TEST_integration rm -rf kwbase/ui/yarn.installed rm -rf ${GOPATH}/native
Confidence: 97% confidence
Finding: rm -rf kwbase/build/defs.mk kwbase/build/

Tool Parameter Abuse

High

Category: Tool Misuse
Content: rm -rf kwbase/.buildinfo rm -rf kwbase/bin rm -rf kwbase/build/defs.mk kwbase/build/defs.mk.sig rm -rf qa/TEST_integration rm -rf kwbase/ui/yarn.installed rm -rf ${GOPATH}/native rm -rf kwdbts2/roachpb/*.cc kwdbts2/roachpb/*.h
Confidence: 95% confidence
Finding: rm -rf qa/

Tool Parameter Abuse

High

Category: Tool Misuse
Content: rm -rf kwbase/bin rm -rf kwbase/build/defs.mk kwbase/build/defs.mk.sig rm -rf qa/TEST_integration rm -rf kwbase/ui/yarn.installed rm -rf ${GOPATH}/native rm -rf kwdbts2/roachpb/*.cc kwdbts2/roachpb/*.h cd kwbase && GOPATH=${GOPATH} make clean -f Makefile_ent
Confidence: 95% confidence
Finding: rm -rf kwbase/ui/

Tool Parameter Abuse

High

Category: Tool Misuse
Content: rm -rf build* rm -rf log/ rm -rf install/ rm -rf kwbase/.buildinfo rm -rf kwbase/bin rm -rf kwbase/build/defs.mk kwbase/build/defs.mk.sig rm -rf qa/TEST_integration
Confidence: 97% confidence
Finding: rm -rf kwbase/

Tool Parameter Abuse

High

Category: Tool Misuse
Content: rm -rf log/ rm -rf install/ rm -rf kwbase/.buildinfo rm -rf kwbase/bin rm -rf kwbase/build/defs.mk kwbase/build/defs.mk.sig rm -rf qa/TEST_integration rm -rf kwbase/ui/yarn.installed
Confidence: 95% confidence
Finding: rm -rf kwbase/

Tool Parameter Abuse

High

Category: Tool Misuse
Content: rm -rf install/ rm -rf kwbase/.buildinfo rm -rf kwbase/bin rm -rf kwbase/build/defs.mk kwbase/build/defs.mk.sig rm -rf qa/TEST_integration rm -rf kwbase/ui/yarn.installed rm -rf ${GOPATH}/native
Confidence: 98% confidence
Finding: rm -rf kwbase/build/defs.mk kwbase/build/

Tool Parameter Abuse

High

Category: Tool Misuse
Content: rm -rf kwbase/.buildinfo rm -rf kwbase/bin rm -rf kwbase/build/defs.mk kwbase/build/defs.mk.sig rm -rf qa/TEST_integration rm -rf kwbase/ui/yarn.installed rm -rf ${GOPATH}/native rm -rf kwdbts2/roachpb/*.cc kwdbts2/roachpb/*.h
Confidence: 96% confidence
Finding: rm -rf qa/

Tool Parameter Abuse

High

Category: Tool Misuse
Content: rm -rf kwbase/bin rm -rf kwbase/build/defs.mk kwbase/build/defs.mk.sig rm -rf qa/TEST_integration rm -rf kwbase/ui/yarn.installed rm -rf ${GOPATH}/native rm -rf kwdbts2/roachpb/*.cc kwdbts2/roachpb/*.h cd kwbase && GOPATH=${GOPATH} make clean -f Makefile_ent
Confidence: 99% confidence
Finding: rm -rf kwbase/ui/

Tool Parameter Abuse

High

Category: Tool Misuse
Content: rm -rf build* rm -rf log/ rm -rf install/ rm -rf kwbase/.buildinfo rm -rf kwbase/bin rm -rf kwbase/build/defs.mk kwbase/build/defs.mk.sig rm -rf qa/TEST_integration
Confidence: 96% confidence
Finding: rm -rf kwbase/

Tool Parameter Abuse

High

Category: Tool Misuse
Content: rm -rf log/ rm -rf install/ rm -rf kwbase/.buildinfo rm -rf kwbase/bin rm -rf kwbase/build/defs.mk kwbase/build/defs.mk.sig rm -rf qa/TEST_integration rm -rf kwbase/ui/yarn.installed
Confidence: 96% confidence
Finding: rm -rf kwbase/

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.