se-semantic-graph

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:32 AM UTC
• Version: 0.1.0

Overview

The skill has a coherent local project-knowledge purpose, but its install and dependency-loading path give mutable third-party code broad local execution without enough provenance controls.

Review this before installing. Use it only in a project-scoped directory, avoid recording secrets or full source text in graph summaries, and do not run the documented third-party installer unless you have independently reviewed and pinned the dependency revision. Treat SE_SEMANTIC_ENGINE as a trusted-code path, not a casual configuration value.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: README.md:51

Finding

Unpinned Third-Party Installation Script Execution

Content

View full analysis

Vulnerability Details

File Location: README.md:51-52
Vulnerability Type: Supply-chain risk through an unpinned external dependency
Risk Level: High

Complete Code Snippet:

bash

git clone https://github.com/LittleLollipop/lobster-memory.git
cd lobster-memory && bash install.sh

Technical Analysis

The documented installation procedure clones the current default branch of a third-party repository and immediately executes its install.sh script. It does not pin a reviewed commit or signed release, verify a checksum or signature, or require inspection of the downloaded script.

Consequently, the code executed during installation can change after this Skill has been reviewed. The broad lobster-memory >=0.2.0 dependency declaration in _skillhub_meta.json also does not constrain installations to a specific audited version. After installation, graph_api.py imports and executes modules from the external engine path.

This creates a supply-chain trust boundary in which control of the dependency repository, its default branch, or its maintainer account can translate into arbitrary local code execution.

Attack Path

1. An attacker compromises the dependency repository, a maintainer account, or the repository's default branch.
2. The attacker modifies install.sh or another component invoked by that script.
3. A user follows the installation instructions in README.md.
4. git clone retrieves the attacker-controlled revision without integrity verification.
5. bash install.sh executes the modified payload with the installing user's privileges.
6. The installed engine can also be loaded later when graph_api.py imports engine.memory_graph and engine.schema.

Impact Assessment

Successful exploitation permits arbitrary code execution with the privileges of the user performing the installation. Within those privileges, a malicious dependency could read or modify access ...[truncated 249 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a specific reviewed commit hash or signed release instead of cloning the mutable default branch.
2. Publish and verify a cryptographic checksum or trusted signature for the expected installation artifact.
3. Avoid immediately executing scripts from a cloned repository. Prefer a locked package artifact or document explicit, reviewable installation steps.
4. Pin an exact compatible dependency version in _skillhub_meta.json rather than allowing every version at or above 0.2.0.
5. Record the expected repository, revision, and integrity value consistently in both README.md and SKILL.md.
6. Run dependency installation with the minimum required privileges and in an isolated environment.
7. Add automated dependency provenance and integrity checks to the release process.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The entire skill description and operational guidance are written in Chinese, with no indication that other languages are supported or that the locale restriction is optional. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill documents use of environment variables and local execution (PY, RUN, SE_SEMANTIC_DIR, SE_SEMANTIC_ENGINE) but does not declare an explicit tool scope such as allowed tools or permissions. That creates ambiguity about what runtime capabilities the skill expects, which can lead an agent platform to over-grant access or invoke the skill without appropriate sandboxing and user awareness.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger phrases include broad natural-language prompts such as '修 bug 前查上下文', '这段代码为什么存在', '功能来源', and '为何这么设计', which are common during ordinary development conversations. This can cause unintended invocation, pulling the skill into contexts where the user did not explicitly request it and potentially causing unnecessary access to project metadata or execution guidance.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The module prepends an environment-controlled path (SE_SEMANTIC_ENGINE) to sys.path and then imports executable Python modules from that location. This creates a code execution primitive: any attacker who can influence the environment variable or place files at the default external path can cause arbitrary code to run at import time, which is especially risky because the imported engine is trusted and accessed through private internals (_g).

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This Python file contains user-facing natural-language documentation and CLI help text exclusively in Chinese. That imposes a specific language choice on users without offering an alternative or opt-in, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file's docstring, inline comments, and field descriptions are entirely in Chinese, including prescriptive schema text such as summaries and labels. This imposes a specific language/locale on users and maintainers without any visible opt-in, alternative locale, or documented region-specific justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The entire template and usage guidance are written in Chinese, with no indication that users may choose another language or that the skill is intended only for a Chinese-language environment. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file’s natural-language instructions, prompts, and labels are all presented in Chinese, which effectively forces a specific language for users and operators. Under the policy, language constraints should either be optional for the user or clearly justified as region-specific; neither is stated here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The natural-language instructions and metadata are entirely in Chinese, and the file does not state that the skill supports other languages or that Chinese is an intentional user-selected locale. This can violate language-choice policy when users are not given an explicit option to interact in their preferred language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The manifest presents the primary display name and default description in Chinese, while English appears only in alternate fields. This can amount to a language/locale policy issue if the skill is shown to users without allowing them to choose their preferred language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file's natural-language interface is written in Chinese, including the top-level module description and the stderr message shown on import failure. Under the policy, forcing a specific language is a locale choice that should be optional or explicitly justified; this file does not offer any language selection or note that it is intentionally region-specific.

Content

No source excerpt is available for this finding.