Security audit

腾讯乐享知识库 Lexiang Knowledge Base

Security checks across malware telemetry and agentic risk

Overview

This is a coherent Lexiang knowledge-base integration with powerful but disclosed read, write, upload, and sync workflows that should be used carefully.

Install this only if you want an agent to access and modify your Lexiang tenant. Protect mcp.json like a secret, use the built-in OAuth connector where available, confirm exact target pages/spaces before writes or deletes, and run folder sync in dry-run mode before uploading local files.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (17)

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The code explicitly notes that remote children should be listed first, but then computes sync actions against an empty remoteEntries map. In a sync tool, this can cause incorrect create/update decisions, duplicate remote objects, and synchronization drift because the local state is compared against incomplete remote reality.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The trigger phrases include very broad, everyday language such as generic search/read actions, which can cause the skill to activate in situations not clearly scoped to Lexiang operations. Because this skill supports powerful read/write/import/upload actions against a knowledge base, accidental invocation could expose internal content or initiate unintended data-changing workflows in the wrong context.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README prominently advertises write, edit, upload, download, and import capabilities but does not place user-facing warnings or guardrails near those capabilities. In an agent setting, this can normalize high-risk data-changing operations without making consent, scope, and target-validation requirements explicit, increasing the chance of unintended modification or exfiltration of knowledge-base content.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The skill description triggers on broad terms such as '知识库' and related content-management phrases, which can cause the agent to invoke this skill for generic knowledge-base or writing tasks unrelated to 乐享. Over-broad activation expands the chance of misrouting user requests into a tool-enabled skill, increasing the risk of unintended data access or writes in the wrong system.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The invocation rule says to read this skill whenever the user mentions broad keywords or supplies common-looking identifiers, but it does not define strong disambiguation checks. In a tool-using environment, ambiguous activation can wrongly pull in instructions that authorize searches, reads, or write workflows against a sensitive external knowledge base.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill instructs the agent to upload local file contents via a direct curl PUT to a remote pre-signed URL, but it does not require an explicit user-facing confirmation that local data will be transmitted off-host. In an agent setting, this can normalize exfiltration of arbitrary local files if the path or file selection is ambiguous or attacker-influenced, making the workflow risky even if the backend upload URL is legitimate.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The documented restore operation changes persistent file state and can overwrite the current version, but the procedure lacks a warning or confirmation step before performing the rollback. In collaborative knowledge-base environments, an agent could unintentionally destroy newer content or revert important updates without the user understanding the consequence.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The document instructs users to sync a local folder to a remote knowledge base, including recursive scanning and file upload, but does not warn that local files and metadata will be transmitted off-device. In a skill that may be invoked for project docs or personal knowledge bases, this omission can lead to accidental exposure of sensitive documents, secrets, or internal structure when users run the workflow without understanding the privacy implications.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: This document explicitly describes converting Markdown into block structures and writing them into a target document, but it does not warn that the operation is state-changing or require user confirmation before modifying content. In an agent skill context, omission of mutation warnings can lead to unintended document edits, especially if the skill is auto-invoked from broad knowledge-base related prompts.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The file provides multiple copy-pastable MCP examples that create or modify document content, but it does not warn users that these operations are state-changing or advise confirmation before use. In an agent skill context, examples like these can normalize unsafe write behavior and increase the chance that an agent or operator performs unintended edits against a real entry_id.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs the agent to place a long-lived bearer token directly into mcp.json on disk, but does not warn about the sensitivity of that secret, storage risks, or file-permission requirements. If the config file is exposed through backups, local compromise, logs, screenshots, or other tools that read config files, the token can be reused to access the user's knowledge-base tenant.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger guidance is intentionally broad and includes common conversational phrases like '为什么不能...', '太麻烦了...', and '能不能支持...'. In an agent skill, overly broad intent matching can cause the skill to activate outside its intended scope, leading to unnecessary access to knowledge-base-related tools or generation of unsolicited issue-drafting behavior. The maintenance context makes this somewhat more dangerous because it explicitly encourages proactive behavior based on inferred intent, increasing the chance of overreach.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger conditions are broad and loosely bounded, covering generic terms like knowledge base and table-related tasks. In an agent setting, this can cause the skill to activate on ambiguous requests and expose powerful read/write capabilities, increasing the chance of unintended data access or modification.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The document advertises deletion and schema-alteration operations without prominent warnings that these actions may be irreversible or disruptive. In a skill that can modify structured data, this increases the risk of accidental destructive changes such as record loss, broken automations, or schema incompatibilities.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The README describes sync and upload workflows that can write to and modify remote knowledge-base content, but it does not prominently warn users about the destructive or persistent effects of those operations. In a skill specifically designed for knowledge-base search, write, edit, file, comment, and draft actions, unclear safety messaging increases the chance of unintended remote changes, accidental overwrites, or bulk content publication.

MCP Config Access

High

Category: Agent Snooping
Content: | 顶级域名（如 `lexiangla.com`） | `{domain}/pages/{entry_id}?company_from={company_from}` | `https://lexiangla.com/pages/abc?company_from=csig` | **`{company_from}` 获取优先级：** 1. mcp.json `url` 字段中的 `company_from` 参数 2. 若无，使用 `whoami().company.code` ---
Confidence: 85% confidence
Finding: The skill instructs the agent to derive `company_from` from the `mcp.json` `url`, which exposes configuration-derived values to runtime logic and potentially to user-visible links. Accessing connector configuration in this way can leak internal tenancy metadata or normalize a pattern where sensitive config fields are consulted directly by the skill, which is risky if configuration contains secrets or environment-specific routing details.

MCP Config Access

High

Category: Agent Snooping
Content: **返回值**：包含新文件的 `entry_id`，上传完成。按 `references/base.md` 中的**链接生成规则**拼接访问链接返回给用户。 > `{company_from}` 优先从 mcp.json `url` 提取，其次取 `whoami().company.code`。 ---
Confidence: 84% confidence
Finding: The skill explicitly directs access to mcp.json configuration data to extract a URL-derived company identifier. Accessing local MCP configuration expands the skill's reach into potentially sensitive environment/config secrets and creates a pathway for unintended disclosure or misuse of connection metadata beyond what is needed for normal file operations.

VirusTotal

59/59 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/test_upload_files.py:28