Ontology Engineer

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:19 AM UTC
• Version: 1.1.1

Overview

This skill is not plainly malicious, but it needs review because it can broadly index personal or client files and passively store conversation facts in a persistent local graph without a clear opt-in or deletion model.

Install only if you are comfortable letting the skill scan the specific directories you choose, write local graph files containing file paths and extracted metadata, and potentially persist conversation facts. Use dry-run and custom output paths first, avoid client or partner data unless you have authorization, review graph.jsonl before syncing or committing it, and prefer a sandboxed environment with pinned dependencies.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:172

Finding

Unconfirmed Persistence of Conversation-Derived Personal Data

Content

View full analysis

> graph.jsonl ``` **Rules**: - Only append entities with concrete evidence from the conversation - Never overwrite existing entities — only add new ones or note conflicts - Use `source.type = "runtime"` to distinguish from scan-derived entities - Keep it lightweight: 1-3 entities per conversation, not a full re-scan ``` The related workflow reiterates the behavior: ```markdown ## Step 3 — Runtime Evolution Agent enriches the knowledge graph during daily conversations. `source.type = "runtime"`. ### Procedure 1. **Check**: Query graph for existing entity (`python query_graph.py search "name"`) 2. **Compare**: If found, verify info is consistent. If new info, note but don't overwrite. 3. **Append**: If not found, create new entity with `source.type = "runtime"` and conversation context. ### Rules - **Lightweight**: 1-3 entities per conversation max. This is passive enrichment, not a re-scan. - **Evidence-based**: Only append what the user explic ...[truncated 3041 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:22

Finding

Unpinned Third-Party Dependencies Create Supply-Chain Exposure

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (36)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill’s declared multi-mode enterprise and external-data analysis posture suggests a mature scoped workflow, but the detected behavior indicates immediate scanning/indexing without the promised Step 1.5 control. In contexts involving client or partner data, this mismatch raises the risk of collecting metadata or content from unauthorized locations before meaningful user review.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill’s declared multi-mode enterprise and external-data analysis posture suggests a mature scoped workflow, but the detected behavior indicates immediate scanning/indexing without the promised Step 1.5 control. In contexts involving client or partner data, this mismatch raises the risk of collecting metadata or content from unauthorized locations before meaningful user review.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The skill’s declared multi-mode enterprise and external-data analysis posture suggests a mature scoped workflow, but the detected behavior indicates immediate scanning/indexing without the promised Step 1.5 control. In contexts involving client or partner data, this mismatch raises the risk of collecting metadata or content from unauthorized locations before meaningful user review.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The skill’s declared multi-mode enterprise and external-data analysis posture suggests a mature scoped workflow, but the detected behavior indicates immediate scanning/indexing without the promised Step 1.5 control. In contexts involving client or partner data, this mismatch raises the risk of collecting metadata or content from unauthorized locations before meaningful user review.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/scan_directory.py (reported line 99)May include surrounding context.

python

for rule in PRIORITY_RULES:
        for pattern in rule["patterns"]:
            if re.search(pattern, search_text, re.IGNORECASE):
                return rule["priority"]

    return "P7"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/scan_filesystem.py (reported line 67)May include surrounding context.

python

SKIP_DIR_NAMES = {
    # 包管理器依赖
    'node_modules', '__pycache__', 'site-packages',
    '.venv', 'venv', 'env', '.env',
    '.tox', '.nox', 'vendor', '.bundle',
    # 构建产物
    'dist', 'build', 'out', 'output', '_build',

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill declares broad file scanning, shell execution, and file write behavior but does not define an explicit tool scope such as permissions or allowed-tools. That creates a least-privilege failure: an agent may invoke file read/write and shell capabilities more broadly than users expect, especially given the skill’s emphasis on scanning large local or external data spaces.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest states that Step 1.5 confirmation is mandatory before any analysis, yet later instructions allow passive graph updates during ordinary conversations. This inconsistency undermines the stated consent model and can lead to persistence of user-derived data without the same approval gate that file-scanning workflows claim to require.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The security model says nothing is analyzed without explicit confirmation, but the runtime evolution section says conversation-derived graph enrichment occurs passively with no user action needed. That contradiction can cause silent collection and retention of sensitive personal or business information, especially because users are told the opposite in the security section.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The mandatory scope-confirmation prompt is written entirely in Chinese and presented as the required interaction flow, but the document does not offer the user an option to choose another language. This creates a language/locale policy issue because the skill effectively forces a specific language without user opt-in or documented justification.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Automatic runtime logging of entities from normal conversation into a persistent knowledge graph can capture names, roles, organizations, events, and strategic decisions without a per-item consent step. In this skill’s context—personal and external knowledge graphs spanning user, client, and partner data—that creates a meaningful privacy and retention risk even without network exfiltration.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Line L023 instructs users to use business language with a Chinese example and wording that effectively prescribes Chinese naming conventions. This is a natural-language locale policy constraint without any opt-in, alternative locale, or justification that the skill is region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file content is written entirely in Chinese and does not offer any language or locale choice. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest emphasizes that the LLM and local parsers are the semantic analysis engine with no external services, but these instructions require automating a full Word desktop instance via COM. Controlling installed applications is a materially different capability from straightforward document parsing and is not clearly declared in the skill's stated purpose.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The manifest describes local file reading and semantic analysis with specific Python libraries, but this document adds a separate capability: invoking LibreOffice to convert arbitrary office files before analysis. Spawning external desktop conversion tooling is not an obvious requirement of an ontology/knowledge-graph extraction skill as described, and expands the operational capability into host-level program execution.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/formats-and-deps.md (reported line 100)May include surrounding context.

pip install pywin32

Linux/macOS .doc/.wps conversion

sudo apt install libreoffice # or: brew install libreoffice

text

### Optional

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instructions require users to interact with priority categories labeled only as 重点, 普通, 忽略, and 全部, and surrounding examples are also Chinese-specific. This imposes a specific language/locale in the workflow without any stated opt-in or alternative, which matches the language-policy violation criteria.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The workflow instructs the agent to persist conversationally supplied personal and business-sensitive details into a local knowledge graph, including people, roles, organizations, events, and strategic decisions. Even without network access, this creates a durable store of sensitive data that may exceed user expectations, broaden retention of incidental disclosures, and expose confidential information to later sessions, other tools, backups, or filesystem access.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The manifest frames the skill as a local semantic analysis engine using file readers such as python-docx, PyMuPDF, openpyxl, and python-pptx for ontology extraction and knowledge-graph building. This file additionally documents active .doc-to-.docx conversion through Windows COM automation and Linux LibreOffice headless conversion, introducing application automation/subprocess-style capabilities not justified in the stated purpose or declared tooling.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This file's core behavior is batch conversion of legacy .doc files into .docx using Microsoft Word COM automation or LibreOffice. The manifest describes local semantic analysis and file scanning/extraction, but does not declare format-conversion tooling or dependence on spawning external office applications as part of the skill's purpose.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest emphasizes that the LLM is the semantic analysis engine and lists local parsers/libraries for document reading, but this code invokes a separate executable through subprocess for conversion. Process execution is a materially different capability from parsing/analyzing files and is not explicitly justified in the stated skill scope.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/convert_doc.py (reported line 70)May include surrounding context.

python

"""Convert .doc to .docx using LibreOffice headless (Linux/macOS)."""
    lo_cmd = shutil.which("libreoffice") or shutil.which("soffice")
    if not lo_cmd:
        print("ERROR: LibreOffice not found. Install with: sudo apt install libreoffice", file=sys.stderr)
        return False

    try:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/convert_doc.py (reported line 74)May include surrounding context.

python

return False

    try:
        result = subprocess.run(
            [lo_cmd, "--headless", "--convert-to", "docx", "--outdir", str(output_dir), str(doc_path)],
            capture_output=True,
            text=True,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script serializes extracted table contents, including raw cell values from Word and Excel files, directly to a JSON file on disk without any explicit warning, consent checkpoint, masking, or sensitivity filtering. In this skill's context, the tool is designed to scan broad enterprise or personal data stores, so persisted output can easily contain confidential schema details, business metadata, or personal information and create a secondary data exposure surface.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file's natural-language documentation and user-facing messages are written in Chinese, including usage descriptions, warnings, and printed output, with no indication that users can select another language. This creates a locale policy concern because the skill effectively imposes a specific language without user opt-in or justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.