Knowledge Router

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 4:32 PM UTC
• Version: 1.0.0

Overview

The skill is a local knowledge-routing helper whose sensitive local reads are disclosed and purpose-aligned, with no evidence of exfiltration or hidden execution.

Install only if you are comfortable with the skill reading previews from local memory, skills, audit logs, and ~/self-improving notes when used with the default scope. Prefer narrower --scope values for sensitive work, and avoid --output paths that could overwrite important files.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

other

Warning

• Location: scripts/knowledge_router.py:9

Finding

Broad Collection of Sensitive Local Knowledge and Audit Data

Content

View full analysis

Vulnerability Details

File Location: scripts/knowledge_router.py, lines 9-60
Vulnerability Type: Sensitive Local Information Access
Risk Level: Medium

python

WORKSPACE = Path.cwd()
SELF_IMPROVING = Path.home() / 'self-improving'

@dataclass
class Source:
    path: str
    source_type: str
    summary: str
    preview: str = ''


def preview_text(path: Path, max_lines: int = 12) -> str:
    try:
        lines = path.read_text(errors='ignore').splitlines()
        return '\n'.join(lines[:max_lines])
    except Exception:
        return ''


def collect_sources(scope: str) -> List[Source]:
    sources: List[Source] = []
    p = WORKSPACE / 'MEMORY.md'
    if p.exists():
        sources.append(Source('MEMORY.md', 'stable-rule', 'Long-term defaults and durable operating rules.', preview_text(p)))

    mem_dir = WORKSPACE / 'memory'
    if mem_dir.exists() and scope in {'default', 'memory-only'}:
        for fp in sorted(mem_dir.glob('*.md'))[-8:]:
            sources.append(Source(str(fp.relative_to(WORKSPACE)), 'daily-fact', 'Dated event log, project progress, and recent factual history.', preview_text(fp)))

    if SELF_IMPROVING.exists() and scope in {'default', 'improvement-only'}:
        for fp in sorted(SELF_IMPROVING.glob('*.md'))[:10]:
            sources.append(Source(str(fp), 'improvement', 'Workflow improvement notes, corrections, and reusable lessons.', preview_text(fp)))

    if scope in {'default', 'skills-only'}:
        for fp in sorted((WORKSPACE / 'skills').glob('*/references/*.md'))[:80]:
            sources.append(Source(str(fp.relative_to(WORKSPACE)), 'method', 'Reusable method/reference knowledge from a skill.', preview_text(fp)))
        for fp in sorted((WORKSPACE / 'skills').glob('*/SKILL.md'))[:80]:
            sources.append(Source(str(fp.relative_to(WORKSPACE)), 'method', 'Skill-level guidance and workflow entry point.', preview_text(fp)))

    if
...[truncated 3327 chars]

Remediation

View remediation

Remediation Suggestions

1. Default to metadata-only routing and avoid reading file contents unless content inspection is explicitly requested.
2. Require explicit opt-in for sensitive source groups, particularly audit records, memory files, and directories outside the workspace.
3. Resolve each candidate with Path.resolve() and verify that it remains under an approved root before reading it.
4. Reject symbolic links or any path that resolves outside the authorized workspace or explicitly approved home-directory location.
5. Apply secret redaction before storing previews, including filtering for access tokens, private keys, passwords, connection strings, and authentication headers.
6. Minimize preview size and retain previews only for the shortest period necessary to calculate ranking scores.
7. Clearly document the exact directories, file patterns, and content ranges read by every scope.
8. Separate the home-directory source from the default scope so users must deliberately select improvement-only or another explicit option before it is accessed.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill instructs the agent to read multiple local references and optionally run a Python script that can also write an output report, but it does not declare any explicit tool scope such as allowed-tools or permissions. That mismatch increases the risk of overbroad file access or unintended file writes because the runtime has no clear least-privilege boundary for what the skill is permitted to access.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file says to emit a promotion hint when conditions 'seem true' and then lists subjective patterns like 'appears repeatedly' or 'would be more reusable' without defining thresholds or exclusions. This can cause inconsistent or unintended activation because the trigger scope is not specific and lacks negative examples or concrete constraints.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The code reads from Path.home() / 'self-improving', which is outside the workspace boundary described by the skill context. That creates an unexpected cross-boundary data access path and may expose unrelated personal or system-resident notes to routing output, especially because file previews are included in memory for scoring.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script accepts an arbitrary --output path and writes a report there, while the skill description presents the tool as a lightweight router over existing knowledge sources rather than a file-writing utility. In an agent setting, this expands side effects beyond expected read-only behavior and can overwrite files within the agent's accessible filesystem if a caller supplies a sensitive path.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The natural-language routing logic recognizes only predefined Chinese and English phrases, effectively privileging those languages in skill behavior. Because the file does not document this as a justified locale constraint or offer language choice, it risks violating language/locale neutrality expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Writing the generated report to any caller-supplied path without warning is a real security-relevant behavior because it enables silent filesystem modification. Although the content is only the generated report, the lack of disclosure and path constraints can still lead to accidental overwrites or misuse in automated workflows.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.