knowledge is what brings us together

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:32 AM UTC
• Version: 1.0.0

Overview

This personal knowledge-base skill is purpose-aligned overall, but it needs review because it persistently indexes private knowledge, searches it proactively across broad conversations, and gives unsafe shell-command templates for user-supplied URLs and paths.

Install only if you are comfortable with the agent maintaining a persistent local knowledge index and searching saved material proactively. Prefer explicit recall commands, review what is stored in memory, avoid importing untrusted directory names or filenames, and harden the shell-command steps before using URLs, paths, or category names from untrusted sources.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:197
• Finding: Shell Command Injection Through Untrusted URL and File-Path Interpolation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:197-199`; related unsafe filesystem commands appear at `SKILL.md:252-253`, `SKILL.md:270-271`, and `SKILL.md:287` **Vulnerability Type**: Command injection and unsafe filesystem command construction **Risk Level**: High ### Vulnerable Code ```markdown | YouTube | Bash: `yt-dlp --write-auto-sub --sub-lang "en" --skip-download --print title --print description -o "/tmp/yt-%(id)s" "{url}"` then Read the `.vtt` file and clean it (see transcript cleaning below) | | Local file | `Read(filepath)` | | Audio | Bash: `whisper "{path}" --output_format txt` if available; otherwise note as placeholder | ``` Related command templates: ```markdown c. Move raw file: Bash `mv unsorted/raw/{filename} {category}/raw/{filename}`. d. Move summary file: Bash `mv unsorted/summary/{filename} {category}/summary/{filename}`. ``` ```markdown 4. Move raw and summary files via Bash `mv`. 5. Delete the old empty category directory via Bash `rm -r` after confirming it is empty. ``` ```markdown 1. Rename directory via Bash `mv`. ``` ### Technical Analysis The Skill instructs the agent to construct shell commands by inserting URLs, local paths, filenames, and category names directly into Bash command text. These values can originate from user input or attacker-controlled imported directory structures. The `mv` examples do not quote their operands. Consequently, whitespace, wildcard characters, shell metacharacters, redirection operators, or option-like filenames can change the meaning of the command. Even the quoted URL and audio-path placeholders are unsafe if the agent performs literal textual substitution without robust shell escaping. Embedded quotes or shell substitutions may terminate or alter the intended argument. The templates also fail to: - Insert `--` before file operands to stop option parsing. - Canonicalize and constrain paths to the configured knowledge-base directory. - Reject control characters or she ...[truncated 1904 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not construct shell command strings containing user-controlled values. 2. Invoke `yt-dlp` and `whisper` through a process API that accepts an executable and a separate argument array. 3. Replace shell-based `mv`, directory creation, and deletion with native filesystem APIs. 4. If a shell is unavoidable: - Apply context-appropriate escaping to every dynamic operand. - Place `--` before path operands. - Reject null bytes, control characters, newlines, and shell metacharacters. - Never concatenate multiple operations into one command. 5. Resolve every source and destination to a canonical absolute path and verify that applicable write, move, and deletion targets remain beneath the configured knowledge-base root. 6. Restrict category slugs to a conservative allowlist such as `^[a-z0-9]+(?:-[a-z0-9]+)*$`. 7. Treat imported filenames as opaque data; generate safe internal filenames rather than reusing untrusted names in shell commands. 8. Before deletion, verify through a filesystem API that the directory is empty, is not a symbolic link, and remains inside the expected root. 9. Use securely created per-operation temporary directories instead of predictable `/tmp/yt-*` paths, and remove them through native APIs. ]]>

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:24
• Finding: Persistent Agent Context Can Be Poisoned by Knowledge-Base Metadata<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:24-43`; proactive consumption also appears at `SKILL.md:311` **Vulnerability Type**: Persistent memory poisoning through insufficiently constrained metadata **Risk Level**: Medium ### Vulnerable Code ```markdown 3. **Save the chosen path** to the agent's persistent memory so it persists across sessions. 4. **On subsequent invocations**, read the stored path. Do not ask again unless the path no longer exists. ### Knowledge Index in Agent Memory The agent's persistent memory should contain a lightweight index of the knowledge base so that category awareness is always in context — even before this skill is activated. This is what makes proactive recall possible. After any operation that changes the knowledge base structure (adding entries, sorting, creating/splitting/merging/renaming categories), update the index in agent memory. The index should look approximately like this: ## Knowledge Base Path: ~/Documents/knowledge/ Categories: - fitness: exercise routines, nutrition, recovery - parenting: child development, sleep training, education approaches - software-design: architecture patterns, API design, system modeling - industrial-design: product design, materials, manufacturing Unsorted: 3 entries ``` The index is subsequently consumed proactively: ```markdown 6. **Proactive recall.** When the knowledge index shows a relevant category exists, load and reference it without being asked. The knowledge base is an extension of memory — if relevant knowledge is there, use it. ``` ### Technical Analysis The Skill requires knowledge-base paths and a generated category index to be written into persistent agent memory. It further requires this index to remain in context before explicit Skill activation and to influence responses to later, potentially unrelated questions. Category names and descriptions can be derived from user-controlled artifacts, imported directories, and inferred source content ...[truncated 2319 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Store the knowledge index as typed, structured data rather than free-form natural-language instructions. 2. Restrict persistent fields to: - A canonical knowledge-base path. - Validated category slugs. - Numeric entry counts. - Short declarative descriptions generated under a strict schema. 3. Reject or neutralize imperative language, role instructions, tool directives, XML-like control blocks, and prompt-injection phrases before persistence. 4. Never copy source text, filenames, headings, or imported instructions directly into agent memory. 5. Validate category slugs with a strict allowlist and impose conservative length limits on all fields. 6. Keep untrusted descriptions in the knowledge-base files rather than the agent’s instruction context. 7. Require explicit user confirmation before creating or materially changing persistent-memory entries. 8. Record provenance and timestamps for every persistent field so poisoned entries can be identified and rolled back. 9. Treat all recalled knowledge as untrusted reference content, not as instructions. Explicitly require the agent to ignore commands contained in stored artifacts or metadata. 10. Limit proactive recall to explicit knowledge-related requests, or ask for permission before searching local files in unrelated conversations. 11. Provide a command to display, edit, reset, and disable the persistent knowledge index. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The skill instructs the agent to check and use the knowledge base whenever a user asks about almost any topic, framing it as an extension of memory and saying "when in doubt, check the knowledge base." That creates overbroad activation and retrieval behavior, which can cause unintended access to prior stored content, privacy leakage, and context contamination even when the user did not ask for knowledge-base recall.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The example triggers include generic phrases such as "save this" and broad everyday requests that may appear in many unrelated conversations. This increases the chance of accidental skill activation, causing unintended file operations, memory updates, or background knowledge capture/search behavior without sufficiently clear user intent.

Static analysis

No suspicious patterns detected.