Agent Context KB

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:53 AM UTC
• Version: 0.1.0

Overview

The skill is a coherent project knowledge-base tool, but it reads local Claude/Codex transcript histories by default for stats and keeps derived activity records locally.

Install only if you are comfortable with a KB tool that can modify AGENTS.md/CLAUDE.md and create persistent .agent-kb state. Avoid running stats unless you intend to scan local Claude/Codex transcript histories; use --no-backfill or the per-provider skip flags when you want transcript-free statistics. Review and periodically delete .agent-kb/.log/ if local activity metadata should not persist.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/agent_kb.py:481

Finding

Default Statistics Collection Scans Sensitive Local Agent Transcripts Without Explicit Opt-In

Content

View full analysis

Vulnerability Details

File Location: scripts/agent_kb.py:481-486, 1922-1967, 2102-2108; scripts/transcript_reads.py:411-474
Vulnerability Type: Privacy-invasive local transcript access
Risk Level: Medium

Vulnerable Code

python

# Scans transcripts for this repo and backfills KB read events into the local event log.
def backfill_kb_reads(root: Path, args: argparse.Namespace) -> tuple[TranscriptScan, int]:
    kb = kb_dir(root)
    claude_dir = None if args.no_backfill_claude else resolve_transcript_path(args.claude_dir)
    codex_dir = None if args.no_backfill_codex else resolve_transcript_path(args.codex_dir)
    scan = scan_transcripts_incremental(root, kb, claude_dir, codex_dir)
    added = append_kb_read_events(kb, scan.reads)
    return scan, added

python

def command_stats(args: argparse.Namespace) -> int:
    root = repo_root(args)
    kb = kb_dir(root)
    if not kb.exists():
        print("ERROR: missing .agent-kb/")
        return 1

    scan: TranscriptScan | None = None
    added = 0
    backfill_error = None
    if not args.no_backfill:
        try:
            scan, added = backfill_kb_reads(root, args)
        except Exception as err:
            backfill_error = str(err)
            scan, added = None, 0

python

stats_parser = subparsers.add_parser(
    "stats",
    help="Summarize CLI usage, KB reads, and KB file churn."
)
stats_parser.add_argument("--root", default=".", help="Repository root to manage.")
stats_parser.add_argument("--top", type=int, default=5, help="Show at most this many rows per section (default 5).")
stats_parser.add_argument("--no-backfill", action="store_true", help="Do not scan local transcripts before rendering stats.")
stats_parser.add_argument("--claude-dir", default="~/.claude/projects", help="Claude Code projects transcript directory.")
stats_parser.add_argument("--codex-dir", default="~/.codex/sessions", help="Codex sessions transcript directory.")
stats_parser.add_argument("-
...[truncated 3872 chars]

Remediation

View remediation

Remediation Suggestions

1. Disable transcript scanning by default. Replace --no-backfill with an explicit --backfill or --scan-transcripts opt-in option.
2. Before the first scan, clearly disclose which directories will be traversed, which fields will be extracted, and where derived records will be retained.
3. Require explicit confirmation before scanning default home-directory locations, especially when running through an AI agent.
4. Constrain scans to transcript directories and sessions demonstrably associated with the selected repository. Avoid using the generic .agent-kb substring alone as a repository ownership signal.
5. Validate custom transcript directories and reject unexpectedly broad locations such as the user's home directory or filesystem root unless an additional override is supplied.
6. Minimize retained data. Prefer aggregate counters over persistent session identifiers, timestamps, command details, or absolute paths.
7. Add a retention policy and a command that deletes transcript-derived events and the backfill cache.
8. Apply restrictive permissions to .agent-kb/.log/, such as owner-only access where supported.
9. Preserve --no-backfill-claude and --no-backfill-codex controls, but make both sources disabled until explicitly selected.
10. Update SKILL.md to explain the privacy implications and provide a transcript-free statistics example.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (30)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared purpose is KB management, but the observed behavior includes parsing local Claude/Codex transcripts, tracking tool-usage/compliance events, inspecting AGENTS.md and non-KB source paths, and performing audit-style analysis. In context, this makes the skill more dangerous because it broadens both data collection and behavioral monitoring beyond what a user would reasonably expect from a maintenance utility, creating risk of privacy invasion and overbroad repository inspection.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared purpose is KB management, but the observed behavior includes parsing local Claude/Codex transcripts, tracking tool-usage/compliance events, inspecting AGENTS.md and non-KB source paths, and performing audit-style analysis. In context, this makes the skill more dangerous because it broadens both data collection and behavioral monitoring beyond what a user would reasonably expect from a maintenance utility, creating risk of privacy invasion and overbroad repository inspection.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md

python3 scripts/agent_kb.py init --root /path/to/repo

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md

python3 scripts/agent_kb.py init --root /path/to/repo

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

md

python3 scripts/agent_kb.py init --root /path/to/repo

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md

python3 scripts/agent_kb.py init --root /path/to/repo

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

md

python3 scripts/agent_kb.py init --root /path/to/repo

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

md

python3 scripts/agent_kb.py init --root /path/to/repo

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md

python3 scripts/agent_kb.py init --root /path/to/repo

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md

python3 scripts/agent_kb.py init --root /path/to/repo

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md

python3 scripts/agent_kb.py init --root /path/to/repo

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill advertises operational commands that imply shell execution and repository file reads/writes, but it does not declare any explicit tool scope such as allowed tools or permissions. That creates an authorization ambiguity where an agent may invoke broader capabilities than a reviewer expects, increasing the chance of unintended file modification or command execution in the target repository.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The code implements surveillance-like analytics over local session histories by scanning transcript directories, attributing sessions to the repo, and persisting KB-read events. In the context of a KB management skill, this is overbroad collection behavior that could reveal usage patterns, filenames, timestamps, and indirectly sensitive workflow data from unrelated local agent activity.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/agent_kb.py (reported line 527)May include surrounding context.

python

else:
        cmd = ["git", "-C", str(root), "log", "--format=", "--name-only", "--", ".agent-kb"]
    try:
        result = subprocess.run(
            cmd,
            check=True,
            encoding="utf-8",

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/agent_kb.py (reported line 909)May include surrounding context.

python

# Reports whether the project root sits inside a git work tree, so init can word the .gitignore note honestly instead of asserting a parent repo that may not exist.
def parent_is_git_repo(root: Path) -> bool:
    try:
        result = subprocess.run(
            ["git", "-C", str(root), "rev-parse", "--is-inside-work-tree"],
            check=False,
            stdout=subprocess.PIPE,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/agent_kb.py (reported line 931)May include surrounding context.

python

["git", "add", "-A"],
            ["git", "commit", "-q", "-m", "initial KB snapshot"],
        ):
            subprocess.run(command, cwd=kb, check=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
    except (subprocess.CalledProcessError, FileNotFoundError):
        return "failed"
    return "created"

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The stats/backfill feature reads local Claude/Codex transcript stores outside .agent-kb/ and derives KB usage analytics from prior agent sessions. That expands the skill's data access well beyond repository KB management and can expose sensitive local conversation content or metadata without a strong, task-local need.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Transcript backfill is privacy-sensitive because it reads from local session stores by default, yet the code lacks an execution-time warning or consent prompt before doing so. Users invoking stats for KB maintenance may not realize the tool will inspect external transcript histories, creating a confidentiality and expectation mismatch.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/dev/compliance_analyzer.py (reported line 63)May include surrounding context.

python

parsed = parse_timestamp(value)
    if parsed is not None:
        return parsed
    result = subprocess.run(
        ["git", "show", "-s", "--format=%cI", value],
        cwd=root,
        check=False,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/smoke_test.py (reported line 24)May include surrounding context.

python

# Runs the KB CLI against a temporary repository and captures output for assertions.
def run_cli(root: Path, *args: str) -> subprocess.CompletedProcess[str]:
    return subprocess.run(
        [sys.executable, str(SCRIPT), *args, "--root", str(root)],
        check=False,
        encoding="utf-8",

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/smoke_test.py (reported line 35)May include surrounding context.

python

# Runs the private compliance analyzer against temporary transcript directories.
def run_compliance(root: Path, claude_dir: Path, codex_dir: Path, *args: str) -> subprocess.CompletedProcess[str]:
    return subprocess.run(
        [
            sys.executable,
            str(DEV_COMPLIANCE_SCRIPT),

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script sets up and drives external git workflows and later test coverage includes evaluation-runner subprocess behavior, which broadens the operational footprint beyond simple KB file management. In the context of an agent skill, this can be dangerous because invoking VCS and evaluation tooling may touch repository state, mine history, or normalize broader command execution patterns that are not necessary for the core feature set.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/smoke_test.py (reported line 77)May include surrounding context.

python

# Runs git in a fixture repository and returns stripped stdout.
def run_fixture_git(repo: Path, *args: str) -> str:
    result = subprocess.run(
        ["git", *args],
        cwd=repo,
        check=False,

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The smoke test script exercises transcript-analysis and eval-runner functionality that goes beyond the stated skill purpose of managing a repository-local .agent-kb/. Expanding a skill's test surface into transcript ingestion, compliance analysis, and evaluation workflows increases the chance that the packaged skill is used to process sensitive local history or run broader capabilities than users expect.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/smoke_test.py (reported line 1585)May include surrounding context.

python

]
            },
        )
        result = subprocess.run(
            [
                sys.executable,
                str(EVAL_RUNNER),