Kb Ingest

• Outcome: Review
• Latest audit: Jun 25, 2026 · 9:07 PM UTC
• Version: 1.0.1

Overview

This skill does what it says, but it has broad authority to read uploaded local files and persist source/config contents into Gitea using an admin token.

Install only in a controlled Research KB environment with a least-privilege Gitea token limited to intended repositories. Do not feed arbitrary task JSON or untrusted uploadedPath values to this skill, and avoid ingesting repositories or files that may contain secrets unless archival is disabled or secret scanning/redaction is added first.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (20)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill clearly describes access to environment variables, local file reads/writes, and networked writes to Gitea, but it does not declare permissions or surface those capabilities explicitly. Hidden capability scope increases the chance that an agent or operator will invoke the skill without understanding that it can read secrets and persistently modify remote content.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill is designed to write Markdown, update catalog/index files, and push changes to a Gitea repository, yet it does not prominently warn that it will modify remote repository contents. This can lead to unintended persistent changes, especially if the task input or target repository is wrong or attacker-influenced.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill requires archiving uploaded source files into the repository without warning that raw source contents may be persistently copied and retained. If uploaded files contain proprietary code, credentials, secrets, or regulated data, the skill can unintentionally replicate sensitive material into a broader, longer-lived storage location.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The module uses a global administrative token for all outbound Gitea API calls, including read and write operations. In the context of a skill that ingests backend-uploaded files and writes wiki content, compromise or misuse of this code path could enable broad repository modification with elevated privileges far beyond the minimum needed.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The code automatically archives each uploaded source file to a remote Gitea repository via g.put_file, including files classified as code/config such as .env and .npmrc, without any filtering for secrets or explicit user confirmation in this module. This can exfiltrate sensitive source code, credentials, or internal data into a broader-access repository and make later exposure persistent.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script extracts text from many uploaded files, aggregates their contents in collect_codebase_text, and commits derived markdown containing excerpts and structure summaries to the remote repository. Because the extraction is broad and content-based, confidential code, embedded secrets, proprietary notes, or sensitive documentation can be copied into searchable markdown pages and persisted remotely.

Credential Access

High

• Category: Privilege Escalation

Content

"pom.xml", "build.gradle", "settings.gradle", "gradle.properties",
    "cargo.toml", "go.mod", "go.work", "composer.json", "gemfile",
    "makefile", "cmakelists.txt", "dockerfile", "docker-compose.yml", "docker-compose.yaml",
    ".env", ".env.example", ".gitignore", ".dockerignore", ".npmrc", ".yarnrc",
    ".prettierrc", ".eslintrc", ".babelrc",
}

• Confidence: 97% confidence
• Finding: Including .env in CODE_CONFIG_NAMES means environment files, which frequently contain API keys, database passwords, and service credentials, are eligible for archival and further processing. Given this skill's behavior of uploading archived sources to a remote repository, the risk is immediate credential leakage and downstream compromise of connected systems.

Credential Access

High

• Category: Privilege Escalation

Content

"pom.xml", "build.gradle", "settings.gradle", "gradle.properties",
    "cargo.toml", "go.mod", "go.work", "composer.json", "gemfile",
    "makefile", "cmakelists.txt", "dockerfile", "docker-compose.yml", "docker-compose.yaml",
    ".env", ".env.example", ".gitignore", ".dockerignore", ".npmrc", ".yarnrc",
    ".prettierrc", ".eslintrc", ".babelrc",
}

• Confidence: 97% confidence
• Finding: Including .env in CODE_CONFIG_NAMES means environment files, which frequently contain API keys, database passwords, and service credentials, are eligible for archival and further processing. Given this skill's behavior of uploading archived sources to a remote repository, the risk is immediate credential leakage and downstream compromise of connected systems.

Credential Access

High

• Category: Privilege Escalation

Content

matches = matching_lines(text, ["route", "api", "controller", "service", "store", "database", "model", "ipc", "接口", "服务", "数据库", "模型"], 8)
        return markdown_bullets(matches)
    if section == "配置":
        config_files = [file.get("relativePath", "") for file in files if file_name(file) in CODE_CONFIG_NAMES or file_suffix(file) in {".env", ".yaml", ".yml", ".toml", ".json"}]
        return markdown_bullets([f"`{item}`" for item in config_files[:24]])
    if section == "运行与测试":
        matches = matching_lines(text, ["scripts", "npm run", "pnpm", "yarn", "pytest", "uvicorn", "mvn", "gradle", "cargo run", "cargo test", "go test", "docker", "测试", "运行"], 10)

• Confidence: 89% confidence
• Finding: The configuration-summary logic explicitly enumerates config files including .env-like files and publishes their paths into generated markdown. Even if it does not print values directly here, surfacing the presence and locations of secret-bearing files in remotely committed docs increases discoverability and pairs dangerously with the broader archival behavior elsewhere in the script.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests
python-dotenv
pymupdf
python-docx

• Confidence: 97% confidence
• Finding: The dependency list is completely unpinned, so installs may resolve to different versions over time, including versions with newly introduced vulnerabilities or breaking behavior. In a skill that ingests untrusted uploaded documents and processes them with network- and parser-heavy libraries, lack of version pinning materially increases supply-chain and reproducibility risk.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests
python-dotenv
pymupdf
python-docx
openpyxl

• Confidence: 97% confidence
• Finding: Unpinned python-dotenv means deployments may pull different releases over time, which can introduce unexpected behavior or vulnerable versions without code changes. While this package is less exposed than file parsers, it still contributes to avoidable supply-chain risk.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests
python-dotenv
pymupdf
python-docx
openpyxl
xlrd

• Confidence: 98% confidence
• Finding: Unpinned PyMuPDF is risky because this skill processes uploaded source files and document parsing libraries frequently receive security fixes for malformed-file handling and file path issues. Allowing arbitrary version resolution increases the chance of silently installing an unsafe or incompatible parser release.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests
python-dotenv
pymupdf
python-docx
openpyxl
xlrd
python-pptx

• Confidence: 98% confidence
• Finding: python-docx is a parser for potentially attacker-controlled Office documents, making version control especially important. Unpinned installation can expose the skill to older vulnerable releases or unexpected parser behavior that affects security boundaries.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

python-dotenv
pymupdf
python-docx
openpyxl
xlrd
python-pptx

• Confidence: 98% confidence
• Finding: openpyxl parses spreadsheet content, which may come from untrusted backend-uploaded files in this skill's workflow. Unpinned parser dependencies amplify risk because vulnerable versions can be installed implicitly and remain unnoticed until exploited.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pymupdf
python-docx
openpyxl
xlrd
python-pptx

• Confidence: 96% confidence
• Finding: Unpinned xlrd creates avoidable supply-chain and reproducibility risk even if it is not the highest-risk library listed. Future installs may resolve to a version with changed behavior, compatibility problems, or disclosed flaws.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

python-docx
openpyxl
xlrd
python-pptx

• Confidence: 97% confidence
• Finding: python-pptx handles presentation files, which are attacker-influenced inputs in this ingestion skill. Leaving it unpinned weakens supply-chain control and can expose the system to parser vulnerabilities or unexpected functionality changes.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

• Category: Supply Chain
• Confidence: 89% confidence
• Finding: The requirements file includes requests without a version constraint, and static analysis indicates multiple advisories affect some requests versions. Because this skill writes to Gitea and likely performs authenticated HTTP operations, a vulnerable requests release could expose credentials, weaken TLS/request verification, or mishandle malicious URLs, making the context more dangerous than a generic utility script.

Known Vulnerable Dependency: python-dotenv — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

• Category: Supply Chain
• Confidence: 62% confidence
• Finding: A known advisory is reported for python-dotenv involving symlink following in set_key, which can allow arbitrary file overwrite in affected versions. This is only exploitable if the skill actually calls the vulnerable write path on attacker-influenced .env locations, so the package presence alone is lower confidence, but the unpinned dependency still leaves room for exposure.

Known Vulnerable Dependency: python-docx — 2 advisory(ies): CVE-2016-5851 (Improper Restriction of XML External Entity Reference in python-docx); CVE-2016-5851 (python-docx before 0.8.6 allows context-dependent attackers to conduct XML Exter)

High

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: python-docx has known XXE-related vulnerabilities in older versions, which are especially relevant here because the skill ingests uploaded Office documents that may be attacker-controlled. XXE can enable file disclosure, server-side network access, or denial of service during document parsing, so the skill context makes this notably dangerous.

Known Vulnerable Dependency: openpyxl — 2 advisory(ies): CVE-2017-5992 (Improper Restriction of XML External Entity Reference in Openpyxl); CVE-2017-5992 (Openpyxl 2.4.1 resolves external entities by default, which allows remote attack)

High

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: openpyxl has known XXE issues in affected versions, and this skill explicitly processes spreadsheet uploads, making the vulnerable code path plausibly reachable. An attacker could craft a workbook that triggers external entity resolution to read local files, initiate internal network requests, or cause parser abuse during ingestion.

Static analysis

No suspicious patterns detected.