Knowledge Curator

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:31 AM UTC
• Version: 1.0.0

Overview

This appears to be a real knowledge-base skill, but it needs review because it fetches arbitrary URLs and writes/deletes persisted files with weak validation.

Review before installing, especially in cloud, enterprise, or shared-agent environments. The skill should add URL destination validation, block private/internal addresses, cap response sizes, allowlist or contain category paths, redact sensitive URL parameters, and require clear confirmation for saving sensitive links and deleting entries. If used before fixes, run it in an isolated environment with no access to internal networks or sensitive local files.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/fetch.js:45
• Finding: Unrestricted URL Fetching Enables Server-Side Request Forgery<![CDATA[ ## Vulnerability Details **File Location**: `scripts/fetch.js:45-72`, with user-controlled input entering the vulnerable function through `scripts/main.js:27-35` **Vulnerability Type**: Server-Side Request Forgery (SSRF) **Risk Level**: High ### Vulnerable Code ```javascript function fetchHtml(url) { return new Promise((resolve, reject) => { const protocol = url.startsWith('https') ? https : http; const options = { headers: { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36', 'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8', 'Accept-Language': 'zh-CN,zh;q=0.9,en;q=0.8' } }; const req = protocol.get(url, options, (res) => { let data = ''; res.on('data', (chunk) => { data += chunk; }); res.on('end', () => { resolve(data); }); }); ``` The input reaches this code without security validation: ```javascript async function processLink(url, options = {}) { console.log(`Processing link: ${url}`); try { const content = await fetch.fetchContent(url); ``` ### Technical Analysis The application performs an HTTP request to a caller-supplied URL without validating the destination. It does not enforce a strict scheme allowlist through structured URL parsing, resolve and inspect the destination IP address, or reject loopback, private, link-local, multicast, and reserved address ranges. The platform-recognition logic does not provide a security boundary. Unknown destinations are handled by the generic fetching strategy and therefore remain reachable. An attacker can consequently direct the process to HTTP services that are inaccessible from the attacker's own network but accessible from the environment running the Skill. The implementation also lacks controls against DNS rebinding. If redirect support is added ...[truncated 1378 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Parse all input using `new URL(url)` and reject malformed URLs. 2. Allow only the exact `http:` and `https:` schemes. 3. Resolve the hostname before connecting and reject every resolved address in loopback, private, link-local, multicast, unspecified, and reserved IPv4 and IPv6 ranges. 4. Prevent DNS rebinding by connecting only to a validated resolved address while preserving the intended host name for TLS and HTTP. 5. Revalidate the destination after every redirect and impose a low redirect limit. 6. Consider an allowlist of supported public platforms instead of allowing arbitrary generic websites. 7. Block cloud metadata destinations explicitly, including link-local metadata ranges. 8. Apply outbound firewall or sandbox rules so the Skill cannot reach internal networks even if application validation fails. 9. Add automated tests for loopback, private IPv4, IPv4-mapped IPv6, link-local IPv6, encoded IP addresses, alternate numeric IP forms, and DNS rebinding cases. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/store.js:176
• Finding: Unvalidated Category Allows Path Traversal and Filesystem Writes Outside the Knowledge Base<![CDATA[ ## Vulnerability Details **File Location**: `scripts/store.js:176-189`, with attacker-controlled category input propagated through `scripts/main.js:43-58` **Vulnerability Type**: Path Traversal / Arbitrary File Creation **Risk Level**: High ### Vulnerable Code The supplied category is accepted without checking it against the configured category list: ```javascript let category = options.category; if (!category) { console.log('Automatically categorizing content...'); const classification = categorize.categorize(processed); category = classification.category; if (classification.uncertain) { console.log('Classification confidence is low'); } } const entry = { ...processed, category, notes: options.notes || '', platform: content.platform?.name || 'Web page' }; ``` It is then used directly as a path component: ```javascript const safeTitle = entry.title.replace(/[<>:"/\\|?*]/g, '_').substring(0, 50); const fileName = `${entryId}-${safeTitle}.md`; const filePath = path.join(knowledgeBasePath, entry.category, fileName); // Generate Markdown content const markdownContent = generateMarkdown(entry); // Write file fs.writeFileSync(filePath, markdownContent, 'utf-8'); ``` ### Technical Analysis Although the title is partially sanitized, `entry.category` is not validated or normalized as an allowed category. A caller can supply traversal components such as `../` in `options.category`. `path.join()` normalizes traversal segments but does not enforce containment within `knowledgeBasePath`. As a result, a category such as `../../target-directory` can resolve to a location outside the intended knowledge-base root. The generated filename is not fully attacker-selected, which limits direct replacement of a specific filename, but it does not prevent creation of an attacker-influenced Markdown file in an unauthorized directory. The supported categories are already present in `CONFIG.categories`, so accepting arbitrary path values is un ...[truncated 1417 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require the category to exactly match an entry in the configured category allowlist. 2. Reject absolute paths, path separators, null bytes, `.` components, and `..` components. 3. Resolve the final path before writing and enforce containment: ```javascript const root = path.resolve(config.knowledgeBasePath); const allowedCategories = new Set(config.categories); if (!allowedCategories.has(entry.category)) { throw new Error('Invalid category'); } const destination = path.resolve(root, entry.category, fileName); if (!destination.startsWith(root + path.sep)) { throw new Error('Destination escapes knowledge-base root'); } ``` 4. Create and write files using the verified resolved path only. 5. Run the Skill under an operating-system account that has write access only to the knowledge-base directory. 6. Apply the same containment validation to every read, delete, export, and index-derived filesystem operation. 7. Add tests using traversal sequences, absolute paths, mixed separators, Unicode separator variants, and symlinked category directories. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: knowledge-base/чФЯц┤╗/kb-20260316-001.md:3
• Finding: Plaintext Platform Security Token Is Bundled and Persisted in Stored URLs<\n`; ``` ### Technical Analysis A Xiaohongshu security/share token is included in plaintext in the distributed knowledge-base content. The application stores complete submitted URLs without identifying or removing security-sensitive query parameters. Signed and token-bearing URLs are commonly treated as bearer capabilities: possession of the complete URL may grant access to content, preserve tracking context, or bypass restrictions for the token's validity period. Even where the token does not grant account-level access, publishing it unnecessarily discloses a security-sensitive value. The same storage behavior can affect future URLs containing parameters such as `token`, `access_token`, `signature`, `auth`, session identifiers, or temporary download credentials. URLs also appear in index data, logs, exports, and generated Markdown, increasing the number of disclosure channels. ### Attack Path 1. A user submits a signed or token-bearing URL for storage. 2. The fetch and processing pipeline retains the original URL unchanged. 3. `generateMarkdown()` writes the full URL into a plaintext knowledge-base file. 4. The index and export features may further distribute the URL. 5. Anyone with access to the package, repository, backup, logs, or exports can obtain and attempt to reuse the token. ### Impact Assessment The confirmed exposure affects the bundled Xiaohongshu token and any access or trac ...[truncated 434 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the exposed token from the current package and repository history. 2. Revoke or rotate the token if the platform supports revocation and it remains valid. 3. Parse URLs before storage and redact sensitive query parameters using a case-insensitive denylist. 4. Include at least `token`, `access_token`, `xsec_token`, `auth`, `authorization`, `signature`, `sig`, `key`, `session`, and platform-specific credential parameters. 5. Prefer storing a canonical URL containing only parameters required to identify the content. 6. Avoid printing full signed URLs in console logs and error messages. 7. Warn the user and require confirmation when a URL appears to contain credentials or a temporary signature. 8. Add secret scanning to source-control and packaging workflows. 9. Review existing knowledge-base files, indexes, exports, and backups for additional token-bearing URLs. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/fetch.js:66
• Finding: Unbounded HTTP Response Buffering Permits Memory Exhaustion<![CDATA[ ## Vulnerability Details **File Location**: `scripts/fetch.js:66-72` **Vulnerability Type**: Resource Exhaustion / Denial of Service **Risk Level**: Medium ### Vulnerable Code ```javascript let data = ''; res.on('data', (chunk) => { data += chunk; }); res.on('end', () => { resolve(data); }); ``` ### Technical Analysis The HTTP response is accumulated into a JavaScript string without a byte limit. Although extracted page text is later truncated, that truncation happens only after the complete HTTP response has been downloaded and buffered. The ten-second request timeout does not provide an adequate size limit. A server can transmit a very large amount of data within that interval, and request timeouts may not stop a continuously active response in the same way as a strict overall deadline. The code also does not inspect `Content-Length`, constrain accepted response media types, or limit decompressed response size. Repeated large responses can increase garbage-collection pressure and exhaust the Node.js heap, terminating or substantially degrading the Agent process. ### Attack Path 1. An attacker hosts an endpoint that returns a very large response body or continuously streams data. 2. The attacker asks the Skill to save that URL. 3. `fetchHtml()` appends every received chunk to `data`. 4. Memory consumption grows until the response ends, the process becomes unstable, or the Node.js heap is exhausted. 5. Repeating the request increases the likelihood of service interruption. ### Impact Assessment Exploitation can cause elevated memory use, severe latency, process termination, and loss of availability for all users sharing the Agent process. The issue does not directly grant additional privileges, but it can disrupt knowledge-base operations and other co-located Agent functions. The impact depends on the Node.js heap limit, concurrency, response transfer speed, and whether a supervisor automatically restarts the process. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Maintain a byte counter while streaming and destroy the request immediately when the maximum is exceeded. 2. Set a conservative response limit appropriate for text extraction, such as one to five megabytes. 3. Reject responses whose declared `Content-Length` exceeds the limit. 4. Restrict accepted content types to expected textual formats. 5. Enforce both an inactivity timeout and an absolute request deadline. 6. Limit decompressed size if compressed responses are supported. 7. Cap concurrent fetch operations and total memory allocated to active downloads. 8. Return a controlled error without storing partial content when any limit is exceeded. 9. Add tests for oversized fixed-length responses, chunked responses, endless streams, compressed expansion, and multiple concurrent large downloads. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (28)

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The README claims 'only explicit user instructions' should trigger saving, but immediately contradicts that with '直接发送链接即可', meaning a bare link may cause collection and persistence. This ambiguity can lead to unintended data capture, remote fetching of user-supplied URLs, and permanent storage of content without clear affirmative consent.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The file says the skill supports fetching content from multiple platforms, and later mentions integrating external AI APIs and cloud sync. In a markdown skill description, these behaviors should include a user-facing warning that links, content, or knowledge-base data may be transmitted to third-party services or remote systems.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This is a markdown file, so SQP-2 applies to user-facing descriptions of risky behavior. The document shows `/kb delete` and `/kb export` as available management commands, but it does not warn that deletion may be irreversible or that export may expose stored knowledge contents to other locations.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The quickstart tells users that content will be automatically fetched, summarized, classified, and saved, but gives no notice about data collection, retention, or possible transmission of linked content to external services. In a knowledge-curation skill, this omission can cause users to submit links or notes containing sensitive, copyrighted, or private material without understanding the storage and processing implications.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This markdown file documents a destructive operation that affects user data, but it provides no caution, confirmation note, or recovery guidance near the delete command. Under the markdown criteria for missing user warnings, users should be warned when a skill can remove stored content.

Natural-Language Policy Violations

Medium

• Confidence: 71% confidence
• Finding: The entire user-facing documentation, commands, category names, and examples are presented in Chinese, with no indication that other languages are supported or that the user can choose their locale. This can constitute a language/locale policy issue when a skill implicitly enforces one language without opt-in or documented regional justification.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill is described as automatically fetching external links, generating AI summaries, and writing structured entries to a local knowledge base, but the README does not prominently warn users that submitted URLs may trigger outbound requests and persistent local storage. Users may unknowingly disclose sensitive links or cause the system to retain private content longer than intended.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill explicitly stores structured knowledge-base entries that may include full or abridged original content, extracted page text, transcripts, and user-added notes, but it does not clearly warn users about the privacy and data-handling implications of persisting that material. This can lead to unintended retention or export of sensitive personal data, copyrighted content, or confidential notes, especially because the skill supports export and broad multi-platform ingestion.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The documented `/kb delete <id>` command exposes destructive behavior without any stated confirmation, undo, or warning about permanent data loss. In a knowledge-management skill that stores curated content over time, accidental or ambiguous deletions could remove valuable or sensitive records irreversibly.

Natural-Language Policy Violations

Medium

• Confidence: 82% confidence
• Finding: The titles, platform labels, categories, and tags are all specified in Chinese, which indicates the skill content is constrained to a specific language/locale. The file does not document that this knowledge base is China-specific or that users can opt into Chinese-language content, which can violate the language/locale policy for natural-language behavior.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The examples explicitly show automatic extraction of video subtitles and summarization, but provide no consent, privacy, retention, or copyright-handling notice. In a knowledge-curation skill that ingests third-party content, this can cause users to process personal, copyrighted, or sensitive content without understanding what is stored or transformed.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The file’s natural-language interface and taxonomy are entirely hard-coded in Chinese, including category names, comments, and CLI output. There is no indication that this skill is region-specific or that users can opt into another language, which can violate a language/locale policy requiring user choice or justification.

External Transmission

Medium

• Category: Data Exfiltration

Content

aiService: {
    provider: 'openai',  // 或 'anthropic', 'bailian', etc.
    apiKey: process.env.AI_API_KEY,
    endpoint: 'https://api.openai.com/v1/chat/completions',
    model: 'gpt-3.5-turbo',
    maxTokens: 500
  },

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Intent-Code Divergence

Medium

• Confidence: 99% confidence
• Finding: The searchKnowledge function shadows the imported query module with a string parameter named query, then attempts to call methods on that string. This causes runtime failures or denial of service for search operations, and in some JS environments could trigger unexpected method resolution behavior if the value is attacker-controlled and not a plain string.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The deleteEntry path performs deletion immediately with no confirmation, preview, or safety guard. In an agent or CLI context, this increases the risk of accidental or socially engineered destructive actions that can permanently remove knowledge-base data.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The help text and command examples are presented only in Chinese for core user workflows such as saving content and querying the knowledge base. This creates a language/locale constraint without any opt-in or alternative language support, which matches the policy's language-choice concern.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The code forces date formatting to the zh-CN locale, which imposes a specific language/locale behavior regardless of user preference. This is a natural-language policy concern because the skill does not offer opt-in, fallback, or configuration for other locales.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The deleteEntry function deletes a stored file with fs.unlinkSync and updates the index, but there is no confirmation prompt or explicit user-facing disclosure that this operation irreversibly removes data. Although errors are logged, the code does not warn the user before performing the destructive action.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: This JavaScript file documents its behavior and presents CLI output entirely in Chinese, which imposes a specific language on users without any opt-in or alternative locale. The policy for natural-language violations applies to all file types, including code comments and string literals.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The file’s natural-language strings, comments, labels, and category values are consistently Chinese-only, indicating a fixed language/locale choice. Under the policy, forcing a specific language without offering user choice or documenting a justified locale constraint is a natural-language policy violation.

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: SQP-3 applies to all file types and includes language or locale policy violations. This file presents the skill report and usage instructions entirely in Chinese, while not stating that the skill is region-specific or that users can select another language.

Natural-Language Policy Violations

Low

• Confidence: 79% confidence
• Finding: A language-only presentation can violate locale-choice policy when it forces a specific language without user opt-in. This file provides no indication that the skill is China-region-specific or that alternative language documentation is available.

Natural-Language Policy Violations

Low

• Confidence: 92% confidence
• Finding: This markdown file presents all user-facing content in a single language and does not indicate that the user can choose another language or that the restriction is required for a region-specific purpose. Under the policy rule for natural-language violations, forcing a specific language without opt-in is a reportable issue.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: The package description is written entirely in Chinese and does not indicate that users can choose another language or that the skill is intentionally region-specific. This can be a natural-language locale policy issue because it implicitly fixes the skill's user-facing description to one language without opt-in.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: The examples, commands, and interaction text are all written in Chinese, which can amount to a language-policy issue if the skill implicitly forces a specific language for use or documentation. There is no visible indication that users may choose another language or locale.

Static analysis

No suspicious patterns detected.