ClawHub
Back to skill

Security audit

llm-wiki-knowledge-Karpathy

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Obsidian wiki manager that reads and writes project knowledge-base files, with no evidence of hidden execution, exfiltration, or destructive behavior.

Install this only if you want the agent to manage persistent files in an Obsidian wiki. Use a dedicated project folder, review planned ingest changes before they are written, and avoid pointing it at vault areas containing sensitive material you do not want summarized or logged.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (19)

Vague Triggers

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger conditions are extremely broad and include common phrases like adding an article to a wiki or asking whether the wiki contains something, plus keyword-based activation on generic terms. This can cause unintended skill invocation, redirecting unrelated user requests into file-reading/writing workflows and increasing the chance of unwanted access to the user's vault or persistent state changes.

Content

No source excerpt is available for this finding.

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/templates.md (reported line 3)May include surrounding context.

md
# LLM-Wiki 场景模板参考

> 生成文件时，将 `<!-- ... -->` 注释中的占位符替换为用户填写的实际内容。

---

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/templates.md (reported line 3)May include surrounding context.

md
# LLM-Wiki 场景模板参考

> 生成文件时,将 `<!-- ... -->` 注释中的占位符替换为用户填写的实际内容。

---

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/templates.md (reported line 215)May include surrounding context.

md
## Hypothesis / Working Thesis

<!-- Your current best guess. This will evolve — update it as evidence accumulates. -->

>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/templates.md (reported line 384)May include surrounding context.

md
## Key Themes to Track

<!-- What thematic threads do you expect or want to follow? -->

1.
2.

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/templates.md (reported line 411)May include surrounding context.

Final Takeaways

text

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/templates.md (reported line 411)May include surrounding context.

Final Takeaways

text

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/templates.md (reported line 540)May include surrounding context.

md
## Motivation

<!-- Why now? What prompted you to start this wiki? -->

## Current Goals (Summary)

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/templates.md (reported line 717)May include surrounding context.

md
## Key Projects

<!-- High-level list — create detailed pages in wiki/projects/ -->

-
-

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Line L145 states that Chinese materials generate Chinese pages and English materials generate English pages. This imposes a language-selection rule automatically, rather than offering the user a language preference or opt-in, which matches the policy-violation criterion for forced language or locale behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The skill description and required prompts are written to default interaction into Chinese, including prescribed Chinese clarification text and questionnaires, without clearly deferring to the user's language. While not directly leading to code execution or data exfiltration, it can override user expectations and cause unsafe misunderstanding in operational workflows such as initialization or ingest decisions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The mode-selection table maps vague phrases like '查一下' and '问题' directly to QUERY mode without sufficient scope checks. In context, this increases the chance that ordinary conversational queries are treated as wiki operations, potentially causing unintended reads from the wiki and writes to the operation log.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The embedded instruction says to 'ALWAYS match the language of the source document,' which imposes a language choice automatically rather than offering the user a choice. This is a natural-language policy issue because it hard-codes locale behavior across the skill workflow without opt-in or a documented exception.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The constant explicitly requires that page titles, content, and descriptions 'all be in the same language as the source material' and says this rule is '强制执行' in both analysis and generation. That is a broad language/locale restriction applied to the entire skill without presenting an opt-in or user override.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The instruction says to ALWAYS match the language of the source document, which imposes a mandatory language policy rather than offering a user choice. This can violate organizational language/locale requirements because the user is not given an opt-in or override mechanism.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This section requires output to ALWAYS match the language of the source document, forcing a locale decision without user consent. The policy does not provide an explicit option for the user to request a different language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The template mandates that content ALWAYS match the source document language, which is a natural-language policy constraint applied without user choice. This is a locale/language policy violation under the audit criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The language rule is mandatory and tied to the source document language, with no user opt-in or override. That creates a policy issue because it forces a specific language behavior across generated content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This instruction requires the generated wiki to ALWAYS use the source document language, which is a forced locale choice. Because no user choice or justified regional constraint is provided, it matches the policy-violation criteria.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.