knowledge-graph-builder

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:40 AM UTC
• Version: 1.2.0

Overview

The skill appears to do what it says, but its generated HTML and optional deployment instructions can expose private vault contents or run injected browser code if used with untrusted notes.

Install only if you understand that the skill reads your selected knowledge vault and writes an HTML file from that content. Do not follow the 0.0.0.0 server example for private vaults; serve only a dedicated publish directory, preferably on localhost, and avoid using untrusted Markdown/config/title content unless the HTML generation is fixed to escape values safely.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/build_graph.py:379

Finding

Stored Cross-Site Scripting in Generated Graph HTML

Content

View full analysis

{name}' for name, c in cats_seen[:12] ) ``` The generated values are inserted directly into HTML and an executable script block: ```html __TITLE__ ``` ```html

🌐 __TITLE__

Loading...

``` ```javascript const GRAPH=__GRAPH_JSON__; ``` Graph-controlled values are subsequently concatenated into an `innerHTML` assignment: ```javascript document.getElementById('sidebar-content').innerHTML='

'+(n.layer||'?')+' · '+(n.isFramework?'🔑 Framework':'📄 Entry')+'

Category: '+(n.category||'—')+'

'+(n.date?'

Date: '+n.date+'

':'')+'

'+n.label+'

'+(n.insight?'

'+n.insight+'

':'')+(n.summary&&n.summary!==n.label?'

'+n.summary+'

':'')+'

Connections ('+conns.length+')

'+(connHtml||'

No connections

')+'

'; ``` The final substitutions do not apply context-aware encoding: ```python html = (html_template .replace("__TITLE__", title) .replace("__LEGEND__", legend_items) ...[truncated 2735 chars]

Remediation

View remediation

`, `&`, U+2028, and U+2029 in serialized JSON before placing it in a script element; or - Store JSON in a non-executable element and parse its `textContent`; or - Load the graph from a separate JSON resource served with the correct content type. 4. Apply `html.escape(value, quote=True)` to title and legend text before inserting them into HTML. 5. Validate color values against a strict allowlist, such as hexadecimal RGB/RGBA values, rather than inserting arbitrary configuration strings into style attributes. 6. Consider adding a restrictive Content Security Policy that disallows inline scripts. This should be defense in depth and not a replacement for output encoding. 7. Add regression tests with payloads in every source field, including: - `` - `` - Attribute-breaking strings - Malicious category colors and manual-link labels 8. Regenerate any previously published graph after removing malicious or untrusted content. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:156

Finding

Documented Deployment Command Exposes the Entire Knowledge Vault

Content

View full analysis

&& python3 -m http.server 8848 --bind 0.0.0.0 ``` Use `background=true` in Hermes terminal for long-running server. Ensure firewall allows the port. ``` ### Technical Analysis The documented command changes into the knowledge vault root and launches Python's basic HTTP server from that directory. The server therefore exposes the entire vault directory as its document root, rather than exposing only `knowledge-graph-full.html`. Binding to `0.0.0.0` makes the server listen on all available network interfaces. The additional recommendation to allow the port through the firewall can make the complete vault reachable from untrusted networks. Python's basic HTTP server does not provide authentication, access control, or TLS. Any readable files underneath the selected document root may be requested directly if their names or paths are known or discoverable. ### Attack Path 1. A user follows the documented deployment procedure from the vault root. 2. The HTTP server binds to every network interface on port 8848. 3. The user permits inbound access through the host or cloud firewall as recommended. 4. A remote client connects to the server. 5. The client requests vault resources directly, including predictable locations such as: - `/references/INDEX.md` - `/03-sources/article-cards/.md` - Other files located beneath the vault root 6. The server returns any requested file that is readable and located within the served directory tree. No browser exploit is required; ordinary HTTP requests are sufficient. ### Impact Assessment The exposure can disclose the complete contents of the knowledge vault, including: - Article cards ...[truncated 584 chars]

Remediation

View remediation

/knowledge-graph-full.html /path/to/graph-public/ cd /path/to/graph-public python3 -m http.server 8848 --bind 127.0.0.1 ``` 2. Bind to `127.0.0.1` by default so the graph is available only to local clients. 3. If remote access is required, place the publishing directory behind a production web server or reverse proxy with: - Authentication and authorization. - TLS. - Explicit file allowlisting. - Appropriate access logging. - Network restrictions where possible. 4. Do not recommend opening the development server directly to the public Internet. 5. Warn users that `python3 -m http.server` serves every file below its document root. 6. Document a verification step that confirms only the intended graph artifact is accessible. 7. Keep private vault contents outside the web server's document root. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md

python3 scripts/build_graph.py

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md

python3 scripts/build_graph.py

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

md

python3 scripts/build_graph.py

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

md

python3 scripts/build_graph.py

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

md

python3 scripts/build_graph.py

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill describes reading from a vault, writing an HTML output file, and optionally serving content, but it does not declare any explicit tool scope or permissions boundaries. In an agent environment, missing scope declarations can allow broader-than-expected file and environment access, increasing the chance of unintended data exposure or modification if the skill is invoked in the wrong directory or against sensitive content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The deployment step instructs users to run python3 -m http.server 8848 --bind 0.0.0.0, which exposes the generated graph on all network interfaces. Because the graph is built from a knowledge vault and may contain sensitive internal notes, this can unintentionally publish private content to other hosts if the port is reachable.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The generated document sets <html lang="zh-CN">, which forces a specific language/locale in the skill output. The file does not offer a user opt-in or configuration for locale, and no region-specific justification is documented in the script.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This JSON example contains a natural-language value 核心框架 while surrounding user-facing labels are in English, which suggests an implicit locale choice in a generally English template. Because no opt-in, locale selection mechanism, or justification is documented in the file, this can conflict with language/locale policy expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.