T03 · Remote Payload Retrieval and Execution
Warning
- Location
scripts/es_search.py:104- Finding
Unverified Remote Executable Download and Execution
- Content
View full analysis
- Remediation
View remediation
Security audit
everything-search-breadmemory
Security checks for vulnerabilities and agentic risk
Overview
The skill has a coherent local search and note-taking purpose, but it under-discloses file-content reading, persistent storage, scheduler setup, and an unverified executable download.
Install only if you are comfortable with a local agent searching files, potentially reading matched file contents when workflows are used, and storing summaries plus source paths persistently. Require confirmation before any file-content ingestion, scheduled task setup, or Everything CLI download, and prefer a manually installed, verified es.exe. Review and restrict the data directory and recovery backups if stored knowledge may be sensitive.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (4)
T06 · System Persistence
Note
- Location
references/workflow.md:58- Finding
Recurring Automation Guidance Can Establish Cross-Session Persistence
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
references/workflow.md:5- Finding
Workflow Directs File-Content Access Beyond the Declared Metadata-Only Scope
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/breadcrumb.py:78- Finding
Private Knowledge Data Is Duplicated into Reversibly Encoded Executable Backups
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (39)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill claims to implement Everything search, breadcrumb management, and Ebbinghaus scheduling, but the analyzed behavior suggests only partial consumption of existing data and missing core features. This mismatch undermines trust boundaries and can conceal the real operational surface, making it harder to review whether the skill's actual actions are safe.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill claims to implement Everything search, breadcrumb management, and Ebbinghaus scheduling, but the analyzed behavior suggests only partial consumption of existing data and missing core features. This mismatch undermines trust boundaries and can conceal the real operational surface, making it harder to review whether the skill's actual actions are safe.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill claims to implement Everything search, breadcrumb management, and Ebbinghaus scheduling, but the analyzed behavior suggests only partial consumption of existing data and missing core features. This mismatch undermines trust boundaries and can conceal the real operational surface, making it harder to review whether the skill's actual actions are safe.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md > 📚 **渐进式加载**：本技能采用渐进式 MD 体系，`SKILL.md` 为入口（≤230行），详细内容拆分到 `references/*.md` 按需加载。
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The code supports an '-exit' capability that locates the Everything process, sends WM_CLOSE, and waits for the process to terminate. In an agent skill marketed for search, process-termination functionality is unnecessary and dangerous because it can be abused to disrupt indexing/search availability or terminate a user service without clear consent.
- Content
YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]
High
- Category
- YARA Match
- Confidence
- 75% confidence
- Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
- Content
md ��用 `topology_donut.py generate` 重新分析面包屑关联 2. 新关联发现时向用户报告更新摘要 3. 配合 `daily-review-expand` 在复习时自动利用拓扑扩展 --- ## 跨平台调度指南 脚本本身是平台无关的纯 Python CLI，可由任意调度器触发： | 平台 | 实现方式 | 命令示例 | |------|---------|---------| | **Linux/macOS cron** | `crontab -e` 添加定时任务 | `0 2 * * * python3 ~/.workbuddy/skills/everything-search-breadmemory/scripts/topology_donut.py generate` | | **Windows 任务计划** | `schtasks` 命令行或 GUI | `schtasks /create /tn "拓扑甜甜圈更新" /tr "python topology_donut.py generate" /sc daily /st 02:00` | | **macOS Launchd** | 创建 `.plist` 到 `~/Library/LaunchAgents/` | 配置 StartCalendarInterval 和 ProgramArguments | | **WorkBuddy** | `automation_update` 工具 | prompt: "调用 topology_donut.py generate" | | **Claude Code** | `.claude/settings.json` hooks | 同 cron 语法 | |
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 85% confidence
- Finding
The skill metadata does not declare tool scope or allowed tools, yet the described behavior and static analysis indicate capabilities for shell execution, file read/write, and network access. This creates a permission-transparency gap: an agent or user cannot accurately assess what the skill may do, increasing the risk of unintended execution, file changes, or downloads.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation reportedly contradicts itself about whether the skill reads file contents. Ambiguity around data access is security-relevant because users may believe only filenames/paths are processed, while the implementation might parse or ingest file content, exposing sensitive local information.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill states that on first use it may automatically download and place es.exe into the skill directory, but the warning is not sufficiently clear in the description. Automatically retrieving and installing an executable is risky because it changes the environment and introduces supply-chain exposure, particularly if users did not knowingly approve network and file-write actions.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest description is entirely in Chinese and presents the skill as generally applicable ("Agent通用") without indicating that use of Chinese is optional or region-specific. This creates a natural-language locale constraint that may violate organizational language-choice policy because no user opt-in or justification is provided.
- Content
Unbounded Resource Access
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
- Content
text int es_hide_empty_search_results = 0; int es_save = 0; HWND es_everything_hwnd = 0; DWORD es_timeout = 0; int es_get_result_count = 0; // 1 = show result count only int es_get_total_size = 0; // 1 = calculate total result size, only display this total size and exit. int es_no_result_error = 0; // 1 = set errorlevel if no results found.
Unbounded Resource Access
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
- Content
text int es_hide_empty_search_results = 0; int es_save = 0; HWND es_everything_hwnd = 0; DWORD es_timeout = 0; int es_get_result_count = 0; // 1 = show result count only int es_get_total_size = 0; // 1 = calculate total result size, only display this total size and exit. int es_no_result_error = 0; // 1 = set errorlevel if no results found.
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This CLI is described as a local file-search interface, but it also exposes state-changing administrative controls over the Everything service, such as reindexing and saving the database. That expands the effective privilege and behavior surface beyond user expectations, enabling misuse or unintended operational changes if this binary is invoked by a higher-level agent or automation without strict command restrictions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The '-clear-settings' path directly deletes the es.ini file with DeleteFileA and immediately exits, without confirmation, backup, or clear warning at execution time. In an agent or scripted context, this can silently wipe user configuration and produce destructive side effects disproportionate to a search task.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The document presents the skill behavior rules entirely in Chinese and frames them as mandatory instructions for agent use, without offering any language choice or stating that Chinese is required for a region-specific reason. This can violate language/locale policy when users have not opted into that language.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The workflow explicitly instructs the agent to read local files, extract content, and persist derived knowledge into a breadcrumb store, but it does not require any explicit user warning or confirmation before modifying persistent storage. In an agent context, this creates a real transparency and consent problem because users may trigger a search task without realizing it will also perform ingestion and long-term retention of file-derived data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The scheduled task documentation describes recurring automated searches, file reads, knowledge extraction, and database updates without disclosing that this will continuously process local files and write derived content to persistent storage. In a long-running agent deployment, that lack of disclosure can lead to unexpected collection and retention of sensitive local information over time.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md | 平台 | 实现方式 | 命令示例 | |------|---------|---------| | **Linux/macOS cron** | `crontab -e` 添加定时任务 | `0 2 * * * python3 ~/.workbuddy/skills/everything-search-breadmemory/scripts/topology_donut.py generate` | | **Windows 任务计划** | `schtasks` 命令行或 GUI | `schtasks /create /tn "拓扑甜甜圈更新" /tr "python topology_donut.py generate" /sc daily /st 02:00` | | **macOS Launchd** | 创建 `.plist` 到 `~/Library/LaunchAgents/` | 配置 StartCalendarInterval 和 ProgramArguments | | **WorkBuddy** | `automation_update` 工具 | prompt: "调用 topology_donut.py generate" |
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md |------|---------|---------| | **Linux/macOS cron** | `crontab -e` 添加定时任务 | `0 2 * * * python3 ~/.workbuddy/skills/everything-search-breadmemory/scripts/topology_donut.py generate` | | **Windows 任务计划** | `schtasks` 命令行或 GUI | `schtasks /create /tn "拓扑甜甜圈更新" /tr "python topology_donut.py generate" /sc daily /st 02:00` | | **macOS Launchd** | 创建 `.plist` 到 `~/Library/LaunchAgents/` | 配置 StartCalendarInterval 和 ProgramArguments | | **WorkBuddy** | `automation_update` 工具 | prompt: "调用 topology_donut.py generate" | | **Claude Code** | `.claude/settings.json` hooks | 同 cron 语法 | | **GitHub Actions** | `.github/workflows/` YAML | `on: schedule: - cron: '0 2 * * *'` |
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This code file contains user-facing natural-language descriptions entirely in Chinese, including the module docstring and later CLI help text, which establishes a fixed language experience. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The top-level documentation states that breadcrumb data is stored at ~/.everything_search/breadcrumb.json. However, the implementation sets DATA_DIR to a skill-specific .standardization directory and BREADCRUMB_FILE under that path, so the documented storage location contradicts actual behavior.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script generates executable .py and .bat recovery files during normal data writes, which expands the skill from passive knowledge storage into code generation and execution enablement. Because backup contents include user-controlled entry data serialized into restorable scripts, this increases the attack surface and may cause users to execute locally generated code they did not expect from a note-taking feature.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Writing Windows .bat launchers as part of routine updates creates executable artifacts in the data directory, which is unnecessary for core breadcrumb storage and encourages click-to-run restoration. In a skill whose stated purpose is local search and knowledge management, automatic creation of runnable shell files is contextually suspicious because it conditions users to trust and execute generated files.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The argparse descriptions, subcommand help, and argument help strings are all user-facing text and are written only in Chinese. Because the skill does not offer a language selection or state a justified region-specific constraint, this creates a language-policy issue.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def get_review_records(): """从 breadcrumb.py 获取复习记录""" result = subprocess.run( [sys.executable, BREADCRUMB_PY, "review-records"], capture_output=True, text=True, encoding="utf-8", errors="replace" )