Query Kb

• Outcome: Review
• Latest audit: Jun 24, 2026 · 2:34 PM UTC
• Version: 1.1.1

Overview

The skill does answer knowledge-base questions, but it also uses an admin Gitea token and creates or mutates persistent repository-backed control and log data beyond a clearly scoped read-only query role.

Install only if you are comfortable giving this skill an admin-capable Gitea token and allowing it to write query logs and system configuration data into repositories. Prefer a read-only, repo-limited token, pin dependencies, and review who can access log.md and the system-config repository before use.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (22)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 81% confidence
• Finding: The skill invokes local scripts and passes user-derived inputs into them, which implies file, environment, and likely network access, yet no permissions are declared. This creates an authorization transparency gap: operators and reviewers cannot accurately assess what the skill can access, and the surrounding scripts may reach sensitive repos, local files, or tokens without explicit approval boundaries.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence
• Finding: The documented behavior says this skill answers grounded KB questions, but the detected behavior extends into repository administration, access-control resolution, indexing, and control-plane maintenance. That mismatch is dangerous because users and auditors may invoke or trust the skill under a narrow read-only mental model while it actually has broader state-changing and potentially privilege-affecting capabilities.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The skill is ներկայացված as a strict knowledge-base question-answering capability, but this module performs repository mutations by writing catalog.json. That creates a scope mismatch: a seemingly read-only skill can alter persistent repository state, which is dangerous because callers, reviewers, or policy gates may not expect side effects from a query-oriented skill.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: regen_index rewrites index.md based on repository catalog data, which exceeds the stated query-only purpose of the skill and introduces persistent side effects. In the context of a personal/team knowledge-base answering skill, hidden content regeneration is especially risky because it can silently modify shared documentation and mislead users into trusting a non-mutating tool.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This helper includes privileged state-changing operations such as repository creation, collaborator management, and file writes, which are inconsistent with a skill described as read-only knowledge-base querying. In this context, those capabilities expand the blast radius from answering questions to modifying repositories and permissions, creating a strong risk of unauthorized changes or abuse if the skill is invoked unexpectedly or compromised.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code is wired to use a Gitea administrative token and even probes admin-only endpoints, despite the skill's stated purpose being knowledge-base question answering. Using an admin token for a read-oriented feature violates least privilege and means any misuse of this module could affect all users or repositories accessible to the administrator account.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This module creates and mutates a dedicated control-plane repository and persists operational state there, which is materially broader than the declared purpose of a grounded KB query skill. In an agent environment, hidden state-management and repo-writing capabilities increase the attack surface for unauthorized configuration changes, persistence, and misuse of bot credentials, especially when those capabilities are unrelated to answering queries.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code initializes and manages users, teams, chat bindings, pending bindings, events, jobs, active tasks, and permissions, which are administrative identity/authorization functions not justified by the stated KB-query purpose. Embedding these capabilities in a query skill creates unnecessary privilege concentration and could enable unauthorized account mapping, permission tampering, or covert coordination state if the skill is invoked or modified maliciously.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly logs the user's question, open_id, scope, and hit pages, but the user-facing description does not provide notice, consent, retention limits, or access controls for that telemetry. Query logs can contain sensitive personal or team information, so silent collection increases privacy, compliance, and insider-misuse risk.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The code writes repository content without any visible user-facing warning or disclosure at the call site. While not a memory-safety issue, this is a real security and trust problem because users of a purported QA skill may unknowingly trigger persistent modifications to shared knowledge-base data.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: This write to index.md occurs silently within index regeneration, with no indication in this module that users are informed or must consent. In a shared team repository, undisclosed updates can cause integrity, auditability, and trust issues even if the generated content is not directly attacker-controlled.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This code performs repository file creation and updates without any visible confirmation, policy gate, or indication that the skill is allowed to modify content. In a read-only Q&A skill, silent write capability is especially dangerous because it enables tampering with knowledge-base contents, persistence, or hidden data manipulation under the guise of retrieval.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: Changing collaborator permissions is a highly sensitive administrative action, and exposing it in a knowledge-base query skill without clear gating or user awareness creates a direct privilege-management risk. If misused, this function can grant repository access to unauthorized users or escalate permissions, leading to data exposure and supply-chain compromise.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script persists raw user questions, user identifiers, scope, and hit metadata directly into a repository-backed log without any evidence of notice, minimization, or sanitization. In a personal/team knowledge-base skill, queries can easily contain sensitive business data, credentials, customer information, or private intent, so committing them to a shared repo creates a durable disclosure and privacy risk.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

_load_env()

GITEA_URL = os.environ.get("GITEA_URL", "").rstrip("/")
ADMIN_TOKEN = os.environ.get("GITEA_ADMIN_TOKEN", "")
BOT_USERNAME = os.environ.get("GITEA_BOT_USERNAME", "AIFusionBot")

• Confidence: 70% confidence
• Finding: Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.

Credential Access

High

• Category: Privilege Escalation

Content

except ImportError:
        return
    here = Path(__file__).resolve().parent
    for candidate in (here / ".env", here.parent / ".env"):
        if candidate.exists():
            load_dotenv(candidate)
            return

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

except ImportError:
        return
    here = Path(__file__).resolve().parent
    for candidate in (here / ".env", here.parent / ".env"):
        if candidate.exists():
            load_dotenv(candidate)
            return

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#!/usr/bin/env bash
set -e
python3 -m pip install -r requirements.txt
if [ ! -f .env ]; then cp env-example.txt .env; fi
echo "setup complete"

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests
python-dotenv

• Confidence: 95% confidence
• Finding: The dependency 'requests' is unpinned, so installs may resolve to different versions over time, including versions with known security flaws or breaking behavior. In a security-sensitive skill that queries knowledge bases and may handle credentials or internal data, this weakens supply-chain integrity and makes builds non-reproducible.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests
python-dotenv

• Confidence: 90% confidence
• Finding: The dependency 'python-dotenv' is also unpinned, which allows uncontrolled version drift and can introduce newly vulnerable or incompatible releases into deployments. While typically lower risk than network-facing libraries, it still affects supply-chain reproducibility and can expose the project to avoidable dependency risk.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: The file allows installation of 'requests' without a safe fixed version, and the package has multiple known advisories including credential leakage and TLS/session verification issues. Given this skill likely performs network access to answer knowledge-base queries and may use tokens, URLs, or internal endpoints, exploitation could expose secrets, enable man-in-the-middle conditions, or leak sensitive internal data.

Known Vulnerable Dependency: python-dotenv — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

• Category: Supply Chain
• Confidence: 74% confidence
• Finding: The referenced advisory for 'python-dotenv' indicates possible arbitrary file overwrite through symlink following in set_key. If this skill or its tooling ever writes .env files in a workspace influenced by another user or process, that behavior could be abused to overwrite unintended files; otherwise the exploitability is more limited.

Static analysis

No suspicious patterns detected.