Mult Call

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:31 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its data-retrieval purpose, but it reads local environment files and passes the full environment into a Python subprocess more broadly than needed.

Review this before installing if your skills directory or parent directories contain broad .env files. Use a dedicated, minimal .env with only the required Neo4j, Milvus, and embedding variables, and be aware that the standalone mode can contact those services, send the query to the configured embedding endpoint, and write or clean specific workflow JSON files.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Credential Access

High

• Category: Privilege Escalation

Content

## 注入服务（通过 `.env` 配置）

| 服务类 | 作用 | .env 关键配置 |
|--------|------|---------------|
| `_RealNeo4jService` | 查询表结构 DDL | `NEO4J_URI` / `NEO4J_USER` / `NEO4J_PASSWORD` |
| `_RealMilvusQAService` | 召回相似 QA 对 | `MILVUS_*`, `EMBEDDING_*`, `MILVUS_QA_COLLECTION`（默认 `dev_vanna_sql`） |

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

## 注入服务（通过 `.env` 配置）

| 服务类 | 作用 | .env 关键配置 |
|--------|------|---------------|
| `_RealNeo4jService` | 查询表结构 DDL | `NEO4J_URI` / `NEO4J_USER` / `NEO4J_PASSWORD` |
| `_RealMilvusQAService` | 召回相似 QA 对 | `MILVUS_*`, `EMBEDDING_*`, `MILVUS_QA_COLLECTION`（默认 `dev_vanna_sql`） |

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

## 注入服务（通过 `.env` 配置）

| 服务类 | 作用 | .env 关键配置 |
|--------|------|---------------|
| `_RealNeo4jService` | 查询表结构 DDL | `NEO4J_URI` / `NEO4J_USER` / `NEO4J_PASSWORD` |
| `_RealMilvusQAService` | 召回相似 QA 对 | `MILVUS_*`, `EMBEDDING_*`, `MILVUS_QA_COLLECTION`（默认 `dev_vanna_sql`） |

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

const path = require('path');
const fs = require('fs');

// 加载 skills/.env
(function loadDotEnv() {
  const envFile = path.join(__dirname, '..', '.env');
  if (!fs.existsSync(envFile)) return;

• Confidence: 91% confidence
• Finding: The explicit loading of a nearby .env file is a credential-access enabler because it pulls local secrets into process memory for use by the skill and its child process. In a retrieval-focused skill, this is more dangerous because the code also bridges into Python, creating another trust boundary that now receives potentially sensitive credentials.

Credential Access

High

• Category: Privilege Escalation

Content

// 加载 skills/.env
(function loadDotEnv() {
  const envFile = path.join(__dirname, '..', '.env');
  if (!fs.existsSync(envFile)) return;
  for (const line of fs.readFileSync(envFile, 'utf8').split('\n')) {
    const m = line.match(/^\s*([A-Z_][A-Z0-9_]*)\s*=\s*(.+?)\s*$/);

• Confidence: 90% confidence
• Finding: The .env parsing logic programmatically imports secret values and makes them available to subsequent execution paths. Combined with env inheritance in spawn(), this can unintentionally disclose credentials to imported Python modules, dependencies, logs, or any compromise in the Python execution chain.

Credential Access

High

• Category: Privilege Escalation

Content

from dotenv import load_dotenv
        search_path = Path(__file__).resolve().parent
        for _ in range(8):
            for name in (".env", ".env.dev", ".env.local"):
                env_file = search_path / name
                if env_file.exists():
                    load_dotenv(env_file, override=False)

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

from dotenv import load_dotenv
        search_path = Path(__file__).resolve().parent
        for _ in range(8):
            for name in (".env", ".env.dev", ".env.local"):
                env_file = search_path / name
                if env_file.exists():
                    load_dotenv(env_file, override=False)

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill documents capabilities to read environment-backed configuration and write workflow output files, but it does not declare any explicit tool scope such as permissions or allowed-tools. This weakens governance and reviewability because the runtime may grant broader file or environment access than users expect, increasing the chance of unintended data access or file modification.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The natural-language policy requires flagging language or locale constraints when a skill forces a specific language without user opt-in. This file presents the description, role, and functional documentation only in Chinese, with no indication that users may choose another language or that the skill is intentionally region-specific.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill reads a parent .env file and then forwards the full process environment into the spawned Python subprocess. That gives the child access to secrets unrelated to this retrieval skill, violating least privilege and increasing the blast radius if the Python code, its imports, or downstream libraries are compromised.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This code reads a sibling .env file and injects its contents into process.env, which is access to potentially sensitive credentials or configuration. There is no confirmation prompt, user-facing log, or warning comment indicating that secret-bearing environment data will be consumed.

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: The stated purpose is multi-source recall over vector and graph databases, but this JavaScript entrypoint achieves it by launching an external interpreter with a large inline script. Subprocess execution is a materially broader capability than simple retrieval orchestration and is not disclosed in the manifest description.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The skill spawns a Python interpreter to execute embedded code, which is a subprocess operation covered by the warning requirement for code files. Although this may be part of implementation, the file lacks any explicit user-facing warning, confirmation, or comment explaining that a subprocess will be launched.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: This file’s natural-language instructions, comments, and user-facing descriptions are presented only in Chinese, which effectively forces a specific language for operators or maintainers. The policy requires flagging language or locale constraints unless the skill offers user opt-in or clearly documents a justified regional limitation.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: For markdown files, missing-warning findings apply when the description omits warnings about behaviors that could affect user data or system integrity. Here the skill explicitly reads and writes workflow artifacts, but the documentation presents this as routine I/O without any caution that running the skill will overwrite `multicall_output.json` or interact with prior step outputs.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: index.js:109