llm-wiki SKILL inspired by Karpathy

• Outcome: Pass
• Latest audit: Jul 26, 2026 · 4:16 PM UTC
• Version: 1.5.1

Overview

This skill is a disclosed Markdown knowledge-base tool with expected file, optional network, optional Zotero, and optional embedding behavior, but users should be careful before enabling remote embedding or MCP integrations.

Install only in a wiki/repository where the agent is allowed to read sources and write wiki/log/cache files. Keep embeddings disabled for sensitive content unless you intentionally accept sending page text and queries to the configured provider. Treat MCP stdio/SSE and Zotero write-back as trusted, opt-in integrations, and review dry-runs before applying merges or sync actions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (21)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill instructs the agent to perform sensitive actions including shell execution, reading and writing repository files, using network-backed source fetches, and accessing external MCP/Zotero tooling, yet it declares no explicit permissions or capability boundaries. This mismatch can cause the runtime or reviewer to underestimate the skill’s effective power, increasing the risk of unintended file modification, data exposure, or unsafe tool use when the skill is invoked.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The protocol states agents must never use system Python, but later fallback logic explicitly permits it when project-local dependencies are unavailable. In an agentic workflow, this can bypass the intended isolation boundary, causing commands to run with unexpected globally installed packages, different interpreter behavior, or attacker-influenced PATH/module resolution.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The document requires post-fetch verification before writing to `sources/`, but the examples download directly into `sources/` first and only verify afterward. That inconsistency can normalize storing unverified remote content in the trusted raw-materials area, increasing the chance of poisoned sources, mislabeled files, or error pages being treated as legitimate inputs by later automation.

Intent-Code Divergence

Low

• Confidence: 89% confidence
• Finding: The document establishes a strict rule to never use system Python, but the embedded dependency-check logic explicitly falls back to system Python if the project environment is unavailable. In an agent-executed workflow, that contradiction can cause tools to run under an unpinned interpreter with different packages or unsafe globals, weakening reproducibility and potentially bypassing the project's dependency and isolation assumptions.

Intent-Code Divergence

Low

• Confidence: 92% confidence
• Finding: The protocol says fetched files must be verified before being written to `sources/`, but the examples instruct downloading directly into `sources/` first. That inconsistency can lead agents to persist unverified, malicious, or incorrect files into the trusted source corpus, undermining provenance and potentially poisoning later ingest and synthesis steps.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The MCP stdio transport constructs StdioServerParameters from configuration and will spawn whatever local command and arguments are supplied. In a skill context where configuration may be influenced by users, repositories, or untrusted automation, this creates an execution boundary crossing that can launch arbitrary local programs with supplied environment variables.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The README encourages free-form natural-language requests that can cause the agent to perform ingest and wiki operations based on broad, non-specific prompts. In a skill that reads local files and writes structured content, ambiguous invocation boundaries increase the chance of unintended actions, prompt-trigger collisions, or misuse when untrusted content contains similar instructions.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The protocol-mode examples use everyday phrasing like 'Please ingest...' and 'Check wiki health', which are easy to reproduce accidentally in surrounding context or adversarial content. Because this skill is designed for agent operation and file manipulation, ambiguous trigger phrases make instruction-source confusion more likely and can lead to unauthorized reads, writes, or tool execution.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The OpenAI embedding provider sends input texts to a remote API, which can expose sensitive document contents, prompts, or proprietary data to an external service. The danger is amplified because this file provides no consent, classification, redaction, or policy gate before transmitting content off-host.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The MCP SSE transport connects to a remote URL and can send all embedding input texts to that server, creating the same confidentiality risk as other remote embedding backends. Because the URL is configuration-driven, users may unknowingly route sensitive corpus contents to an untrusted or misconfigured external endpoint.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The build path sends full page content to provider.embed(texts), and the provider may be backed by a remote service. In a knowledge-base skill, wiki pages can contain proprietary notes, credentials, personal data, or internal documents, so transmitting them externally without explicit consent, policy checks, or provider restrictions can cause serious data exfiltration.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: Search queries are sent to embed_query(query), which may forward user input to an external embedding service. Queries against a wiki often contain confidential project names, incident details, or investigative questions, so this can leak sensitive intent and data even when page contents are not transmitted at search time.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger pattern "查询.*wiki.*" is broad enough to activate on ordinary user messages that merely mention querying or a wiki, which can cause unintended invocation of the skill. Because this skill has high-priority context and can operate on knowledge-base files, accidental activation increases the chance of unintended data access, modification workflows, or misleading routing of user intent.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

click>=8.0.0
pyyaml>=6.0
pymupdf>=1.25.0
numpy>=1.24.0

• Confidence: 94% confidence
• Finding: click>=8.0.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

click>=8.0.0
pyyaml>=6.0
pymupdf>=1.25.0
numpy>=1.24.0
httpx>=0.27.0

• Confidence: 94% confidence
• Finding: pyyaml>=6.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

click>=8.0.0
pyyaml>=6.0
pymupdf>=1.25.0
numpy>=1.24.0
httpx>=0.27.0
mcp>=1.0.0

• Confidence: 95% confidence
• Finding: pymupdf>=1.25.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

click>=8.0.0
pyyaml>=6.0
pymupdf>=1.25.0
numpy>=1.24.0
httpx>=0.27.0
mcp>=1.0.0
openai>=1.0.0

• Confidence: 90% confidence
• Finding: numpy>=1.24.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pyyaml>=6.0
pymupdf>=1.25.0
numpy>=1.24.0
httpx>=0.27.0
mcp>=1.0.0
openai>=1.0.0
pytest>=7.0.0

• Confidence: 94% confidence
• Finding: httpx>=0.27.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pymupdf>=1.25.0
numpy>=1.24.0
httpx>=0.27.0
mcp>=1.0.0
openai>=1.0.0
pytest>=7.0.0

• Confidence: 96% confidence
• Finding: mcp>=1.0.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy>=1.24.0
httpx>=0.27.0
mcp>=1.0.0
openai>=1.0.0
pytest>=7.0.0

• Confidence: 91% confidence
• Finding: openai>=1.0.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.27.0
mcp>=1.0.0
openai>=1.0.0
pytest>=7.0.0

• Confidence: 88% confidence
• Finding: pytest>=7.0.0

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.