Kb Review

• Outcome: Review
• Latest audit: Jun 24, 2026 · 2:34 PM UTC
• Version: 3.1.1

Overview

This skill does the advertised KB-review work, but it asks for and contains helpers for broad Gitea admin-level access and persistent system-state changes that are not narrowly disclosed.

Install only in a controlled Paper-KB/Gitea environment. Do not provide a site-admin token unless you intend this skill to have broad repository and system-config mutation power; prefer a least-privilege token limited to the specific KB repositories and paths. Review the hardcoded Gitea URL, require user confirmation before saving to shared KBs, and pin dependencies before production use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill invokes local scripts, reads files such as chat_bindings.json/catalog content, and appears to rely on network-backed systems like OpenClaw, yet it declares no permissions. This creates a transparency and enforcement gap: operators and users cannot accurately assess what the skill can access, increasing the risk of overbroad data access or unintended execution in sensitive contexts.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This helper exposes broad remote administrative and repository-modification capabilities including repository creation, collaborator management, and arbitrary file writes. For a skill whose stated purpose is generating KB reviews, this is over-privileged functionality that could be abused to alter repositories or provision access well beyond the expected scope.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code reads a site-admin-capable token from environment and includes a function that probes admin endpoints, indicating the token may have instance-wide administrative power. In the context of a KB review skill, such privilege is unjustified and dramatically increases blast radius if the skill, host, or token is compromised.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: This module implements a global control-plane for users, teams, chat bindings, permissions, jobs, and task state, which is materially broader than the declared knowledge-base review function. In an agent skill context, hidden state-management capabilities increase the blast radius of compromise or misuse because the skill can alter cross-user configuration and operational metadata unrelated to review generation.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The code creates and maintains a dedicated private repository used as a persistent system-state backend, including mutable JSON files for operational records. This creates covert persistence and a centralized state store that can be modified by the skill, which is risky because it exceeds the advertised scope and could be abused to store or tamper with sensitive agent state.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill states that generated reviews are saved back to the knowledge base by default, but it does not require an explicit user confirmation or even a warning before performing a write. In a KB environment, silent default writes can leak sensitive summaries, create unauthorized records in shared/team repositories, or persist incorrect/generated content that others may trust.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: These functions create repositories and add collaborators through remote API calls, causing persistent changes in a source-control system. In a KB review skill, undisclosed write/admin behavior is more dangerous because users would reasonably expect content generation, not provisioning repositories or changing access controls.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The code can create or overwrite remote repository files, which is a persistent write action with supply-chain implications if misdirected. Even if intended for saving generated reviews, unrestricted path/repo writes without clear scope enforcement can be abused to modify unintended content.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The module writes JSON data into a repository-backed system store without any visible user-facing notice, consent flow, or disclosure in this file. In an agent ecosystem, undisclosed persistence is dangerous because users may believe the skill only generates reviews while it actually records and mutates broader system state.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The read-modify-write helper performs persistent updates with retry logic, enabling durable mutation of shared system configuration without visible disclosure here. This is risky because it supports silent state changes to global control-plane data, making unauthorized or unexpected modifications harder for users to detect.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

_load_env()

GITEA_URL = os.environ.get("GITEA_URL", "").rstrip("/")
ADMIN_TOKEN = os.environ.get("GITEA_ADMIN_TOKEN", "")
BOT_USERNAME = os.environ.get("GITEA_BOT_USERNAME", "AIFusionBot")

• Confidence: 70% confidence
• Finding: os.environ.get("GITEA_ADMIN_TOKEN

Credential Access

High

• Category: Privilege Escalation

Content

except ImportError:
        return
    here = Path(__file__).resolve().parent
    for candidate in (here / ".env", here.parent / ".env"):
        if candidate.exists():
            load_dotenv(candidate)
            return

• Confidence: 60% confidence
• Finding: .env"

Credential Access

High

• Category: Privilege Escalation

Content

except ImportError:
        return
    here = Path(__file__).resolve().parent
    for candidate in (here / ".env", here.parent / ".env"):
        if candidate.exists():
            load_dotenv(candidate)
            return

• Confidence: 60% confidence
• Finding: .env"

Credential Access

High

• Category: Privilege Escalation

Content

#!/usr/bin/env bash
set -e
python3 -m pip install -r requirements.txt
if [ ! -f .env ]; then cp env-example.txt .env; fi
echo "setup complete"

• Confidence: 60% confidence
• Finding: .env

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests
python-dotenv

• Confidence: 94% confidence
• Finding: requests

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests
python-dotenv

• Confidence: 93% confidence
• Finding: python-dotenv

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: requests

Known Vulnerable Dependency: python-dotenv — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

• Category: Supply Chain
• Confidence: 78% confidence
• Finding: python-dotenv

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.