Scan Updates

• Outcome: Review
• Latest audit: Jun 24, 2026 · 2:32 PM UTC
• Version: 1.1.1

Overview

The skill mostly matches its stated scan-and-update purpose, but it requires broad Gitea admin credentials and performs persistent remote writes that are not tightly scoped.

Install only in a dedicated PaperKB/Gitea environment where you are comfortable giving the skill a narrowly controlled service account. Avoid a site-wide admin token if possible, replace the sample HTTP Gitea URL with your own trusted HTTPS endpoint, pin dependencies, and restrict where scan output and repository writes are allowed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill instructs the agent to run local Python scripts, read and write files under /tmp, and interact with external Git-based sources, but the frontmatter does not declare any permissions or capability boundaries. This creates a mismatch between documented behavior and runtime power, which can lead to over-privileged execution, weak reviewability, and accidental abuse of file, environment, or network access paths.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: This helper includes repository creation and collaborator-management functions that exceed the stated purpose of scanning and updating source state. In a skill expected to inspect repositories, bundled administrative write capabilities create unnecessary privilege and expand the blast radius if the skill is misused, compromised, or invoked unexpectedly.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The code reads a site-wide admin token and includes a check for site ადმინისტратор capabilities even though the described skill only needs to scan registered sources. Using broad administrative credentials for a low-privilege workflow violates least privilege and makes any bug or abuse path much more dangerous, potentially exposing or modifying data across the entire Gitea instance.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The manifest describes a skill focused on scanning registered Gitea or Obsidian sources for file changes, creating incremental compilation jobs, and updating source fingerprints. This module instead creates and manages a separate "system-config" repository containing users, teams, chat bindings, permissions, active tasks, and job state, which is substantially broader administrative functionality than source-update scanning.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: Repository creation and collaborator changes are remote state-changing actions with security consequences, and this helper exposes them without any built-in approval, policy check, or safety gate. In the context of a scanning skill, these functions are especially risky because they enable unexpected privilege propagation or unauthorized repository provisioning if invoked by mistake or through abuse.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The helper can create or overwrite remote repository files directly, and those write operations are exposed as generic utility functions with no guardrails. In a skill whose purpose is source scanning, unrestricted remote writes increase the chance of accidental tampering, malicious modification, or persistence of harmful content in repositories.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script accepts a user-controlled --save_to path and writes the full scan result there without validating that the destination stays within an approved directory. Because the result includes repository metadata, file fingerprints, commit information, and chat/binding context, an attacker or low-privilege caller could overwrite arbitrary writable files or exfiltrate sensitive data to unexpected locations.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

_load_env()

GITEA_URL = os.environ.get("GITEA_URL", "").rstrip("/")
ADMIN_TOKEN = os.environ.get("GITEA_ADMIN_TOKEN", "")
BOT_USERNAME = os.environ.get("GITEA_BOT_USERNAME", "AIFusionBot")

• Confidence: 70% confidence
• Finding: Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.

Credential Access

High

• Category: Privilege Escalation

Content

except ImportError:
        return
    here = Path(__file__).resolve().parent
    for candidate in (here / ".env", here.parent / ".env"):
        if candidate.exists():
            load_dotenv(candidate)
            return

• Confidence: 90% confidence
• Finding: Automatically loading credentials from local .env files broadens the chance that powerful tokens are picked up from a developer or deployment environment without strong controls. In this codebase, that risk is amplified because the loaded secret is a Gitea admin token used for administrative API actions, so accidental exposure or misuse can affect the whole server.

Credential Access

High

• Category: Privilege Escalation

Content

except ImportError:
        return
    here = Path(__file__).resolve().parent
    for candidate in (here / ".env", here.parent / ".env"):
        if candidate.exists():
            load_dotenv(candidate)
            return

• Confidence: 90% confidence
• Finding: Automatically loading credentials from local .env files broadens the chance that powerful tokens are picked up from a developer or deployment environment without strong controls. In this codebase, that risk is amplified because the loaded secret is a Gitea admin token used for administrative API actions, so accidental exposure or misuse can affect the whole server.

Credential Access

High

• Category: Privilege Escalation

Content

#!/usr/bin/env bash
set -e
python3 -m pip install -r requirements.txt
if [ ! -f .env ]; then cp env-example.txt .env; fi
echo "setup complete"

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests
python-dotenv

• Confidence: 97% confidence
• Finding: The dependency 'requests' is unpinned, so installs may resolve to different versions over time, including versions with breaking changes or newly disclosed security issues. In a skill that scans remote Git-based sources, dependency drift increases supply-chain risk and can silently introduce exploitable behavior into network-facing code.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests
python-dotenv

• Confidence: 95% confidence
• Finding: The dependency 'python-dotenv' is unpinned, which allows uncontrolled version changes during installation and weakens build reproducibility. While often lower risk than core networking libraries, unpinned utility packages can still introduce vulnerable or malicious releases through supply-chain compromise.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

• Category: Supply Chain
• Confidence: 89% confidence
• Finding: The file includes 'requests' without a version constraint, and the analyzer reports multiple known advisories affecting some requests releases. Because this skill scans remote Gitea/Obsidian Git material sources and is likely to make outbound HTTP(S) requests, using an affected requests version could expose credentials, weaken TLS/request validation, or leak sensitive data depending on runtime resolution.

Known Vulnerable Dependency: python-dotenv — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

• Category: Supply Chain
• Confidence: 68% confidence
• Finding: The file includes 'python-dotenv' without a version constraint, and the analyzer associates at least one advisory with some versions of that package. The reported issue appears lower severity and may only matter if the skill uses dotenv file-writing helpers such as set_key on attacker-influenced paths, but the unbounded dependency still creates avoidable exposure.

Static analysis

No suspicious patterns detected.