Deep Learning (Zettelkasten)

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:10 PM UTC
• Version: 1.0.0

Overview

This is a coherent deep-reading note workflow, but it needs review because it can modify a note vault and mandates unverified companion skills despite documentation calling them optional.

Install only from a source you trust, prefer pinned or verified installer and repository versions, and review any companion skills before allowing this workflow to call them. Run it with filesystem access limited to the intended note vault and ask for a preview before it creates folders, appends to existing indexes, or moves notes.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:46

Finding

Unpinned Third-Party Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Locations:

• README.md:46-56
• PUBLISH.md:33-40

Vulnerability Type: Supply-chain exposure caused by executing an unpinned third-party package
Risk Level: Medium

Vulnerable Code Snippet — README.md:46-56:

bash

npx skills add <owner/repo>

bash

npx skills add your-username/deep-learning

Vulnerable Code Snippet — PUBLISH.md:33-40:

bash

npx skills add <your-username>/deep-learning

bash

npx skills add mikonos/deep-learning

Technical Analysis

The documented installation process uses npx without pinning the skills package to a specific version or verifying its integrity. Depending on local npm and npx behavior, the command may download and execute the version currently resolved from the configured npm registry.

The Skill source is also identified using a mutable GitHub owner/repository reference rather than an immutable commit hash or a cryptographically verified release artifact. Consequently, the effective installation components can change after this project has been reviewed.

This creates a supply-chain trust gap. Compromise of the npm publisher, npm package, registry configuration, GitHub account, or referenced repository could cause users to retrieve content different from the audited content.

Attack Path

1. An attacker compromises the npm package or publisher account associated with the skills command, poisons a registry used by the victim, or compromises the referenced GitHub repository.
2. The attacker publishes or introduces a modified installer, dependency, or Skill version.
3. A user follows the project documentation and runs the unpinned npx skills add ... command.
4. npx resolves and executes the mutable package version, which then retrieves the mutable repository content.
5. The compromised component performs actions using the permissions available to the user's shell or inst ...[truncated 870 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the npm command-line package to a reviewed version, for example by using an explicit package version rather than allowing npx to resolve the latest release.
2. Pin the installed Skill to an immutable Git commit hash or signed release tag instead of relying exclusively on a mutable owner/repository name.
3. Publish expected checksums for release artifacts and verify them before installation.
4. Document the expected npm publisher, repository owner, package name, and release provenance so users can detect typosquatting or ownership changes.
5. Use npm lockfiles and integrity metadata wherever installation is performed through a maintained local project.
6. Prefer an installation process that downloads the Skill for review before activation, rather than immediately executing a remotely resolved installer.
7. Advise users to run installation with least privilege and never through an administrator or root shell.
8. Add release signing or provenance attestations and document how users can verify them.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:62

Finding

Mandatory Invocation of Unbundled and Unverified Companion Skills

Content

View full analysis

Vulnerability Details

File Locations:

• SKILL.md:62
• SKILL.md:69
• SKILL.md:78
• SKILL.md:128-132
• SKILL.md:163
• SKILL.md:176
• Conflicting documentation: README.md:25, README.md:37, and README.md:42

Vulnerability Type: Unverified external Skill dependencies and inconsistent dependency policy
Risk Level: Medium

Relevant Source Excerpts — faithful English rendering of SKILL.md:

markdown

2. Instruction: Invocation of the `structure-note` skill is mandatory.

markdown

2. Instruction: Invocation of the `index-note` skill is mandatory.

markdown

* Use the `file-organize` skill to determine whether the file belongs in
  the root directory or a subject-specific subdirectory.

markdown

Phase 6.5: Workflow execution audit (mandatory)

This must be executed after Phase 6. Invoke the `workflow-audit` skill
to review workflow completion and system closure.

3. Main workflow-audit file:
   `.cursor/skills/workflow-audit/SKILL.md`;
   report template:
   `workflow-audit/references/audit_report_template.md`.

markdown

- [ ] Invoke `workflow-audit` to conduct the workflow execution audit,
      produce the audit report, and remediate every failed item until
      the definition of done is fully satisfied.

Conflicting README.md excerpts:

markdown

| 6.5 | Workflow audit (optional) | If `workflow-audit` skill is present |

markdown

9. Phase 6.5: Optional workflow-audit pass if that skill is installed.

markdown

Optional companion skills: For full automation, `structure-note`,
`index-note`, `file-organize`, and `workflow-audit` can be used when
available; the skill still works with manual steps if they are missing.

Technical Analysis

The primary Skill instructions require invocation of several companion Skills that are not included in the audited project. Their source, version, ...[truncated 2579 chars]

Remediation

View remediation

Remediation Suggestions

1. Bundle reviewed companion functionality with the project, or declare each companion Skill through a versioned dependency manifest.
2. Pin every companion Skill to an immutable release or commit and verify its checksum or signature before invocation.
3. Validate the resolved Skill's canonical source, publisher, version, and expected content rather than trusting only its local name.
4. Require explicit user approval before invoking any Skill that is outside the currently audited package.
5. Provide an internal manual fallback for every companion operation so missing or unverified dependencies do not block the workflow.
6. Change mandatory dependency language to conditional execution unless the dependency has passed provenance and integrity checks.
7. Reconcile README.md and SKILL.md so both documents accurately state whether each dependency is required or optional.
8. Apply least-privilege controls to companion Skills, restricting them to the current vault and only the file operations required for the phase.
9. Reject ambiguous, duplicate, writable, or user-controlled Skill resolution paths. Resolve dependencies from a trusted registry or verified installation directory.
10. Record the resolved dependency versions and integrity identifiers in the generated audit report for traceability.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (13)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

The README instructs users to run npx skills add <owner/repo> without pinning a specific package version. Because npx resolves and executes the latest available package by default, a compromised upstream package, malicious update, or typo/confusion around the package source could cause unreviewed code execution on the user's machine.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The example command npx skills add your-username/deep-learning still relies on an unpinned npx package invocation, which can execute whatever version is current at install time. That creates a supply-chain risk where users may run attacker-controlled or unexpectedly changed code simply by following the documentation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

The publishing section repeats the unpinned npx skills add <owner>/deep-learning pattern, reinforcing insecure installation guidance. Repetition increases the chance that users will execute a mutable remote package without review, expanding exposure to package hijacking or malicious updates.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The skill description and operational conventions are written as Chinese-first instructions and prescribe Chinese naming/output patterns such as folder and file names throughout the workflow. There is no indication that the user may choose another language or that the locale restriction is required for a region-specific purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill directs the agent to create, append, and move files inside the user's knowledge base, including modifying existing index notes and relocating newly created notes, without requiring explicit user confirmation or presenting a dry-run first. This is dangerous because it can cause unintended filesystem changes, overwrite organizational structure, or silently alter a user's notes in ways that are hard to audit or reverse.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

md

1. **审查对象**：本 skill（deep-learning）；**产出**：本次任务目录（执行计划、结构笔记、索引、原子笔记、task.md 等）。
2. **产出**：落盘审查报告（`YYYYMMDD_[任务名]_流程审查报告_德明与葛文德视角.md`），含逐项清单、系统闭环、DoD 勾选、多索引挂载清单；对审查中标为 ❌ 的项**必须补执行**，直至 DoD 全部通过。
3. **workflow-audit 主文件**：`.cursor/skills/workflow-audit/SKILL.md`；报告模板：`workflow-audit/references/audit_report_template.md`。

> 不可跳过。未通过流程执行审查并补全漏项，则本流程视为未完成。

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file’s natural-language instructions are fully presented in Chinese, and there is no indication that users may opt into another language or that the skill is intentionally limited to a Chinese-speaking audience. This can violate a language/locale policy when skills are expected to avoid forcing a specific language without user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This markdown template presents all user-facing headings and instructional text in Chinese, which imposes a specific language on users. The file does not indicate that Chinese is optional, configurable, or justified as a region-specific template, so it conflicts with the language/locale policy criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The entire skill-related publishing guidance is written in Chinese, and the file does not indicate that language selection is optional or that the skill is intended only for a Chinese-speaking audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown template consistently instructs users in Chinese, with only partial English glosses, and does not indicate that the language requirement is optional or tied to a specific regional use case. That can violate the language/locale policy when users are not given a choice of language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The template is predominantly written in Chinese and includes role/instruction text in that language, which effectively imposes a specific language for use of the skill content. The file does not offer any language choice or indicate that Chinese is optional, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.