Wiki Creator

• Outcome: Review
• Latest audit: Jul 13, 2026 · 12:34 PM UTC
• Version: 1.0.3

Overview

This skill appears to be a local wiki builder, but it persistently stores uploaded documents and may later read them for broad knowledge questions with storage behavior that is not fully consistent in the description.

Install only if you are comfortable with uploaded documents being copied into a persistent .wiki-creator directory, either in the current project or in your home directory. Before using it with private or regulated material, choose the storage location explicitly, add project-local .wiki-creator/ to .gitignore when appropriate, and manually delete stored raw files or generated wiki data when no longer needed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill describes persistent file read/write behavior but does not declare permissions or present clear consent boundaries. This is dangerous because users and hosting systems may not realize the skill can copy uploaded documents into local or global storage and later read them again, increasing the risk of unintended data retention and access.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 83% confidence
• Finding: The manifest frames the skill as a global, project-independent wiki creator, but the body adds materially different behaviors: project-scoped storage, broad document parsing, metadata graph generation, change tracking, and linting. This mismatch is risky because users may authorize the skill based on an incomplete description and not expect additional persistence, file processing, or artifact generation.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The manifest claims a global, project-independent wiki, while the documented behavior stores data under the current project when project markers are detected. This inconsistency can cause documents to be written into repositories or workspaces unexpectedly, creating confidentiality and accidental-commit risks.

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: The top-level description promises global/project-independent behavior, but the detailed instructions repeatedly direct project-bound storage in common coding environments. That makes the skill more dangerous in development contexts because sensitive uploaded materials may be co-located with source repositories and potentially exposed through backups, sync tools, or version control mistakes.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The trigger rules include broad, everyday phrases and even require checking the wiki first for any knowledge question once a wiki exists. Overbroad activation can cause the skill to read from or act on persistent local knowledge stores in situations where the user did not clearly request it, increasing surprise access and privacy risk.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The workflow says uploaded documents are copied into raw/ persistent storage, but the skill description does not clearly warn users about this retention behavior. This is a significant privacy and data-governance issue because users may believe they are providing files for one-time processing, not durable local or global storage.

Session Persistence

Medium

• Category: Rogue Agent

Content

---
name: "wiki-creator"
description: "Builds and maintains a global, project-independent knowledge wiki from user-uploaded documents using Karpathy's native LLM Wiki paradigm (zero vectors, zero chunks, single-page units, two-level topic/page index). Invoke when user uploads documents and asks to 'create wiki / build wiki / compile knowledge base', says 'update wiki / add new materials', asks 'search wiki / look up X / use wiki / 用wiki查', or asks for 'wiki health check / lint'. When a knowledge question is asked and a wiki exists, ALWAYS check the wiki FIRST before web search. Does NOT use vector retrieval."
---

# Wiki Creator

• Confidence: 86% confidence
• Finding: The skill is explicitly designed to persist uploaded content and reuse it across future interactions, which creates session-to-session retention of potentially sensitive material. In this context, persistence is core functionality, but it becomes dangerous without strong consent, visibility, and deletion controls because later prompts may surface prior documents unexpectedly.

Static analysis

No suspicious patterns detected.