Kb Literature Review

• Outcome: Review
• Latest audit: Jun 25, 2026 · 7:46 PM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent, but it writes generated review pages into a repository by default using an admin Gitea token, so it needs human review before installation.

Install only if you are comfortable giving this skill Gitea repository write access. Prefer changing it to use a narrowly scoped bot token, make writeReview default to false, require explicit user confirmation before writing, and pin dependencies before production use.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 80% confidence
• Finding: The skill advertises a constrained literature-review function, but the content indicates capabilities beyond a purely declarative prompt, including environment, file-read, and network access. In a repository-oriented skill, undeclared capability scope reduces auditability and can enable unexpected data access or exfiltration if the implementation or helper scripts are compromised or extended.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill description frames the tool as a read/summarize capability, but the workflow includes writing generated content back into the repository and apparently using elevated repository APIs/tokens. That mismatch is dangerous because operators or upstream agents may invoke it under a read-only trust assumption, leading to unauthorized content modification, persistence of incorrect data, or abuse of privileged credentials.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: This skill is framed as a literature-review/query tool, but it can persist a newly generated markdown page back into the repository by default. That creates an unexpected state-changing side effect from a read-oriented workflow, which is dangerous because user-controlled input can cause repository modifications and content pollution without explicit approval.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code uses a GITEA_ADMIN_TOKEN for a skill whose primary purpose is searching and synthesizing knowledge-base content. Combining broad administrative credentials with repository content write APIs greatly increases blast radius: compromise, prompt abuse, or logic misuse could alter repositories beyond the minimum scope needed for the task.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill states that it will write a review file into the target repository by default unless an option is set to false, but it does not prominently warn that it modifies user data. Default-on mutation in a summarization skill creates integrity risk, accidental repository pollution, and a path for prompt-driven unwanted writes into trusted knowledge bases.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The repository write happens implicitly when options.writeReview is unset, because it defaults to True, and there is no user-facing warning before the side effect occurs. In this skill context, that makes the behavior more dangerous because a user asking for a review may not realize they are causing a persistent modification to the KB.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests
python-dotenv

• Confidence: 93% confidence
• Finding: The dependency `requests` is unpinned, so installs may resolve to different versions over time, including versions with known security defects or breaking changes. In an agent skill environment, this weakens supply-chain integrity and makes builds non-reproducible, increasing the chance of silently pulling a vulnerable release.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests
python-dotenv

• Confidence: 91% confidence
• Finding: The dependency `python-dotenv` is also unpinned, which allows uncontrolled version drift and potential installation of a newly introduced vulnerable or incompatible version. While this package is typically lower risk than network-facing libraries, leaving it unpinned still creates avoidable supply-chain exposure.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: `requests` is flagged with multiple known advisories, and because the requirement is unpinned, the environment may install an affected version. This is especially relevant for an agent skill that may fetch or process remote content, where HTTP client flaws can lead to credential leakage, TLS verification issues, request manipulation, or other network-originated compromise paths.

Known Vulnerable Dependency: python-dotenv — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

• Category: Supply Chain
• Confidence: 72% confidence
• Finding: `python-dotenv` is associated with a symlink-following arbitrary file overwrite advisory, which can be dangerous if the skill or its supporting code uses `set_key` on attacker-influenced paths. The skill description does not clearly indicate such behavior, so the practical exploitability here is less certain, but the dependency risk is still real if that API is present and reachable.

Static analysis

No suspicious patterns detected.