腾讯乐享知识库-私有化版本

• Outcome: Review
• Latest audit: Jul 9, 2026 · 6:45 AM UTC
• Version: 1.0.0

Overview

This appears to be a legitimate private Lexiang knowledge-base connector, with expected but sensitive token, file upload, and write capabilities.

Install only if you trust the publisher and intend to connect a private Lexiang instance. Keep the LEXIANG_TOKEN private, redact mcp.json in screenshots or logs, use dry-run/plan review before folder uploads, avoid pointing uploads at broad project or home directories, and confirm every write, delete, or bulk upload target.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill appears to rely on powerful capabilities such as MCP access, network interaction, possible file writes, and shell-like operational reach, but the manifest shown in this file does not declare permissions or constrain those capabilities. That creates a trust and review gap: operators cannot easily assess what the skill may do, and downstream systems may grant broader access than users expect.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The activation criteria are very broad, including generic terms like '知识库', '我的知识库', and 'lexiang', plus links and several identifier patterns. This can cause unintended invocation in unrelated conversations, increasing the chance that the skill gains access to sensitive knowledge-base operations or influences the assistant when the user did not clearly intend to use this integration.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The document instructs users to recursively scan a local directory and sync its contents to a remote knowledge base, but it does not warn about uploading sensitive files, hidden files, secrets, or proprietary documents. In a skill that facilitates bulk folder synchronization, omission of privacy and scope safeguards can lead to unintentional data exfiltration, especially if users point it at broad project directories.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The guide instructs storing a bearer token in a local config file but does not explicitly warn the user that the file now contains reusable credentials that must be protected. This increases the risk of credential leakage through backups, file sharing, screenshots, overly broad permissions, or accidental disclosure during troubleshooting.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger guidance uses broad, implicit phrases such as common complaints or feature requests to initiate feedback-related behavior. In a skill context, this can cause the agent to infer intent too aggressively and steer conversations toward drafting or initiating external feedback workflows the user did not clearly request, increasing the risk of unintended actions or data disclosure in prepared issue content.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README instructs users to sync a local folder to a remote knowledge base but does not clearly warn that local content will be transmitted externally. In a private knowledge-base skill, users may reasonably include internal documents, credentials, or proprietary files, so missing disclosure increases the risk of accidental sensitive-data exfiltration.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The bulk upload workflow tells users to upload an entire folder and generate execution plans without clearly warning that all matched files may be sent to an external system. Because this skill is specifically for knowledge-base ingestion and private deployment, users may over-trust it and inadvertently expose confidential documents if folder contents are not carefully reviewed.

MCP Config Access

High

• Category: Agent Snooping

Content

> 例如：用户的乐享地址是 `https://lexiang.mycompany.com`，则配置页为 `https://lexiang.mycompany.com/ai/claw`

登录后，用户可在页面上看到：
- **MCP Endpoint**：MCP 服务地址（用于 mcp.json 的 `url` 字段）
- **LEXIANG_TOKEN**：访问令牌（格式 `lxmcp_xxx`）

### Step 2: 确定 mcp.json 路径

• Confidence: 95% confidence
• Finding: mcp.json 的 `url

MCP Config Access

High

• Category: Agent Snooping

Content

1. **先自动重连一次**：使用 mcp.json 中已有的配置静默重连
2. **重连成功**：继续执行未完成的任务
3. **重连失败**：引导用户确认 mcp.json 配置是否正确，或重新访问 `/ai/claw` 页面检查 token 状态

---

• Confidence: 88% confidence
• Finding: mcp.json 配置是否正确，或重新访问 `/ai/claw` 页面检查 token

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/test_upload_files.py:28