Knowledge Base Pro

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:56 AM UTC
• Version: 3.5.3

Overview

This skill is a legitimate corporate knowledge-base assistant, but it under-discloses networked document processing and keeps sensitive search analytics in ways users should review before installing.

Review this before installing in a real company environment. Treat it as requiring network access if you enable indexing from Notion, Google Docs, Confluence, YouTube, embeddings, vector databases, or Telegram reports. Do not use it with confidential HR, salary, contract, finance, or NDA material until access control, query-log retention, redaction, export approval, and external-provider destinations are explicitly configured. Prefer explicit commands and confirmations for archive, delete, export, and indexing workflows.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:7
• Finding: Undeclared External Processing of Corporate Documents<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:7, 298-308` **Vulnerability Type**: Security metadata inconsistency and uncontrolled external data transfer **Risk Level**: High ### Vulnerable Code Snippet ```yaml metadata: openclaw: emoji: "📚" security_level: L1 always: false optional: env: - ANTHROPIC_API_KEY - OPENAI_API_KEY - NOTION_API_KEY - CONFLUENCE_API_TOKEN - GOOGLE_SERVICE_ACCOUNT_JSON - TELEGRAM_BOT_TOKEN network_behavior: makes_requests: false uses_agent_telegram: false ``` The document-indexing workflow later states: ```text STEP 1 — UPLOAD Accept: [file path / URL / text] Formats: PDF, DOCX, MD, TXT, HTML, Google Docs, Notion STEP 4 — EMBEDDING Create an embedding vector for every chunk Model: text-embedding-3-large (OpenAI) or equivalent Store in: vector database (Pinecone / Supabase pgvector / Weaviate) ``` Supported external sources include: ```text Google Docs | URL | Requires read permission Notion | URL | Through the Notion API Confluence | URL | Through the Confluence API YouTube | URL | Subtitle transcription ``` ### Technical Analysis The manifest declares `network_behavior: makes_requests: false`, but the documented operational workflow requires network access to: - Retrieve documents from URLs and third-party platforms. - Send document chunks to an external embedding provider. - Store vectors and associated metadata in external vector databases. - Use optional Notion, Confluence, Google, OpenAI, and Telegram credentials. This discrepancy prevents users and automated security controls from accurately evaluating the Skill's data-flow behavior. Corporate documents may contain personal information, trade secrets, contracts, credentials, financial records, or Level 3/4 restricted knowledge. The workflow does not define: - A destination allowlist. - Explicit user approval before external transmission. - Secret or personal-data redaction. - Data residency requirements. - Provider retention and deletion ...[truncated 1729 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Change the manifest to accurately declare network behavior: ```yaml network_behavior: makes_requests: true ``` 2. Document every permitted external destination and the categories of data sent to each destination. 3. Require explicit user confirmation before transmitting a document or document-derived content externally. 4. Default to local parsing, local embeddings, and local vector storage. 5. Prohibit external processing of Level 3 and Level 4 records unless a trusted administrator explicitly authorizes it. 6. Detect and redact API keys, passwords, tokens, personal data, and other secrets before embedding or storage. 7. Validate URL schemes and destinations. Block loopback, private, link-local, multicast, and cloud metadata addresses. 8. Disable redirects to prohibited address ranges and revalidate DNS results after resolution. 9. Define retention, deletion, encryption, and data-residency requirements for each provider. 10. Add tests that verify the declared network behavior matches actual agent workflows. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: config.yaml:18
• Finding: Declarative Access Levels Are Not Bound to Authenticated Identities<![CDATA[ ## Vulnerability Details **File Location**: `config.yaml:18-20`; `SKILL.md:74-81, 104-112` **Vulnerability Type**: Missing enforceable authorization boundary **Risk Level**: High ### Vulnerable Code Snippet ```yaml knowledge_structure: access_levels: - level: 0 name: "Public" description: "Available to everyone, including customers" - level: 1 name: "Employees" description: "All company employees" - level: 2 name: "Department" description: "Only a specific department" - level: 3 name: "Management" description: "Managers and directors" - level: 4 name: "Confidential" description: "Restricted set of people" ``` The only configured search control is: ```yaml search: mode: "semantic + keyword + filters" max_results: 5 relevance_threshold: 0.65 semantic_weight: 0.7 keyword_weight: 0.3 show_related: true freshness_boost: 0.1 popularity_boost: 0.1 filter_by_access_level: true show_source: true ``` The Skill instructions describe filtering as: ```text Access level: according to the requester's role ``` ### Technical Analysis `filter_by_access_level: true` is a configuration flag, not an authorization mechanism. The project does not define how the requester's identity is: - Authenticated. - Bound to a trusted employee record. - Assigned to a department. - Mapped to access levels. - Revoked after role changes or termination. - Prevented from self-asserting a privileged role. If the agent infers authorization from conversation text, an attacker can claim to be a manager, administrator, or member of another department. More importantly, filtering after retrieval is insufficient: unauthorized records may already be present in the language model's context and can be disclosed through direct responses, summaries, related-result generation, exports, or prompt manipulation. Authorization must occur in the retrieval and storage layer before restricted conte ...[truncated 1482 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Integrate the Skill with a trusted identity provider or authenticated platform identity. 2. Map identities to roles, departments, and access levels in a server-controlled authorization store. 3. Enforce authorization in the database or retrieval layer before semantic search results are supplied to the model. 4. Apply deny-by-default behavior when identity, role, or department cannot be verified. 5. Never rely on role claims made in user-controlled conversation text. 6. Ensure unauthorized records are excluded from prompts, embeddings returned to the model, related results, analytics, and exports. 7. Use separate indexes or mandatory metadata filters for different access tiers where practical. 8. Revalidate authorization for every search, export, update, and deletion operation. 9. Add audit records for successful and denied access attempts without recording sensitive content unnecessarily. 10. Add tests for cross-department access, ordinary-employee-to-management access, unauthenticated access, terminated users, and prompt-based role impersonation. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: config.yaml:26
• Finding: Search Query Logging and Telegram Reporting Lack Privacy Safeguards<![CDATA[ ## Vulnerability Details **File Location**: `config.yaml:26`; `SKILL.md:117, 431-433` **Vulnerability Type**: Sensitive telemetry collection and external reporting without minimization controls **Risk Level**: Medium ### Vulnerable Code Snippet ```yaml analytics: log_searches: true gap_threshold: 3 weekly_report: true report_channel: "telegram" main_metrics: - "top searched topics" - "no-answer queries" - "stale entries" - "popular records" - "onboarding gaps" - "access violations" ``` The Skill additionally instructs the agent to: ```text Record every search query for analytics, including what users search for and what they cannot find. ``` The integration section states: ```text The audit starts automatically every Monday. FAQ export to the bot occurs on schedule or when records are updated. The usage report is sent weekly to the management channel. ``` ### Technical Analysis Knowledge-base search queries can contain sensitive information even when the underlying record is access-controlled. Examples include employee names, customer account details, contract terms, incident descriptions, passwords accidentally pasted into search, medical or HR questions, and confidential project names. Logging is enabled by default, and the project does not define: - Query redaction or token detection. - Personal-data minimization. - Retention periods. - User consent or notice. - Role-based access to analytics. - Encryption requirements. - Deletion procedures. - Aggregation thresholds for reports. - Protection against including raw queries in Telegram messages. The `no-answer queries` metric is particularly sensitive because unanswered searches may contain raw user-entered text. Sending query-derived reports to Telegram expands the number of recipients and introduces another external processor. The reviewed scripts do not implement the scheduler or Telegram transmission, so no persistence mechanism was found. The risk a ...[truncated 1422 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Set `log_searches: false` by default and require explicit administrative opt-in. 2. Display a clear notice describing what is logged, why it is logged, where it is sent, and how long it is retained. 3. Redact passwords, API keys, tokens, email addresses, phone numbers, identifiers, and personal data before storage. 4. Store normalized topics or one-way query fingerprints instead of complete raw queries where possible. 5. Define and automatically enforce a short retention period. 6. Restrict analytics access using the same authenticated authorization system as the knowledge base. 7. Aggregate reports and suppress low-frequency items to reduce re-identification risk. 8. Do not include raw no-answer queries in Telegram reports. 9. Require explicit approval and a verified destination before enabling Telegram reporting. 10. Encrypt telemetry at rest and in transit, rotate bot tokens, and support deletion requests. 11. Add abuse controls so repeated attacker-generated queries cannot force sensitive text into management reports. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (92)

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The manifest declares `makes_requests: false`, but the body describes Notion, Confluence, Google Docs, YouTube, Whisper, embedding APIs, and vector database integrations that inherently require network access. This misrepresentation can bypass operator trust decisions, sandbox policy, or approval workflows, causing unintended external data transfer from internal knowledge sources.

Credential Access

High

• Category: Privilege Escalation

Content

done chmod +x "$TARGET/install.sh" 2>/dev/null || true
if [[ -f "$TARGET/test/smoke-test.sh" ]]; then chmod +x "$TARGET/test/smoke-test.sh" 2>/dev/null || true
fi
echo "[✓] Файлы скопированы в $TARGET" # 3. Создать .env из шаблона если нет
if [[ ! -f "$TARGET/.env" ]]; then cp "$SRC_DIR/.env.example" "$TARGET/.env" echo "[✓] Создан $TARGET/.env (заполнять только если нужны интеграции)"
else echo "[i] $TARGET/.env уже существует — не перезаписываю"
fi # 4. Напомнить про OBLIGATORY-поля

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

done chmod +x "$TARGET/install.sh" 2>/dev/null || true
if [[ -f "$TARGET/test/smoke-test.sh" ]]; then chmod +x "$TARGET/test/smoke-test.sh" 2>/dev/null || true
fi
echo "[✓] Файлы скопированы в $TARGET" # 3. Создать .env из шаблона если нет
if [[ ! -f "$TARGET/.env" ]]; then cp "$SRC_DIR/.env.example" "$TARGET/.env" echo "[✓] Создан $TARGET/.env (заполнять только если нужны интеграции)"
else echo "[i] $TARGET/.env уже существует — не перезаписываю"
fi # 4. Напомнить про OBLIGATORY-поля

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

done chmod +x "$TARGET/install.sh" 2>/dev/null || true
if [[ -f "$TARGET/test/smoke-test.sh" ]]; then chmod +x "$TARGET/test/smoke-test.sh" 2>/dev/null || true
fi
echo "[✓] Файлы скопированы в $TARGET" # 3. Создать .env из шаблона если нет
if [[ ! -f "$TARGET/.env" ]]; then cp "$SRC_DIR/.env.example" "$TARGET/.env" echo "[✓] Создан $TARGET/.env (заполнять только если нужны интеграции)"
else echo "[i] $TARGET/.env уже существует — не перезаписываю"
fi # 4. Напомнить про OBLIGATORY-поля

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

if [[ -f "$TARGET/test/smoke-test.sh" ]]; then chmod +x "$TARGET/test/smoke-test.sh" 2>/dev/null || true
fi
echo "[✓] Файлы скопированы в $TARGET" # 3. Создать .env из шаблона если нет
if [[ ! -f "$TARGET/.env" ]]; then cp "$SRC_DIR/.env.example" "$TARGET/.env" echo "[✓] Создан $TARGET/.env (заполнять только если нужны интеграции)"
else echo "[i] $TARGET/.env уже существует — не перезаписываю"
fi # 4. Напомнить про OBLIGATORY-поля
echo ""

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence
• Finding: Suspicious Unicode normalization or mixed-script content

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The changelog content is written in Russian and does not offer any language choice or indicate that the file is intentionally region-specific. This creates a natural-language policy concern because it imposes a specific locale on readers without documented opt-in or justification.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence
• Finding: Suspicious Unicode normalization or mixed-script content

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The trigger phrases listed near quick start include very broad natural-language activators such as 'база знаний', 'FAQ', and onboarding-related phrases that are likely to occur in ordinary workplace conversation. This can cause unintended skill invocation, leading to accidental processing of internal prompts, documents, or employee queries in contexts where the user did not intend to activate the skill.

Vague Triggers

Medium

• Confidence: 98% confidence
• Finding: The documented modes rely on ambiguous one-word commands like 'найди', 'FAQ', 'онбординг', 'обнови', 'архив', 'удали', 'экспорт', and 'индексируй' without scope restrictions or confirmation requirements. In a chat-based environment these terms can appear in normal discussion, increasing the risk of accidental execution of sensitive operations such as deletion, archival, export, or indexing of internal knowledge.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence
• Finding: Suspicious Unicode normalization or mixed-script content

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The description emphasizes "Russian language native" and presents the skill as the only KB skill with full RU localization, but it does not state that users can choose another language or that operation is region-restricted for a justified compliance reason. This creates a natural-language locale policy concern because the skill appears to force a specific language context without user opt-in.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: Several triggers are common workplace phrases such as 'FAQ', 'новый сотрудник', 'как сделать', and 'wiki', which can cause the skill to activate during unrelated conversations. In a skill that can add, update, export, archive, and index documents, accidental invocation can lead to unauthorized content operations or unintentional disclosure of internal knowledge.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The manifest text explicitly claims 'Работает без внешнего SaaS' and says tools like Guru and Botpress are not needed. However, later documentation describes indexing from Google Docs, Notion, Confluence, YouTube, Whisper transcription, and vector databases such as Pinecone/Weaviate, which are external services and APIs. This is a direct contradiction in the skill's stated intent versus its described behavior.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The smart-search trigger includes broad natural-language phrases like 'как сделать', which are likely to appear in ordinary requests not intended for this skill. Because search results may surface internal documents, accidental activation increases the chance of over-broad retrieval or exposing sensitive internal content to the wrong user context.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs logging every search and every unanswered query for analytics without a clear user-facing notice, consent model, or data handling limits. Search terms in a corporate knowledge base often contain employee names, customer issues, credentials-adjacent details, or confidential project references, so indiscriminate logging creates privacy and compliance risk.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: Logging all user searches and unanswered queries creates a durable natural-language record of potentially sensitive requests without any minimization rules. In a corporate knowledge system, those queries can contain internal incidents, HR matters, customer names, or confidential terms, turning analytics storage into a secondary sensitive data repository.

Ssd 3

Medium

• Confidence: 91% confidence
• Finding: The FAQ/export templates include raw queries and usage analytics in plain language outputs, which can leak sensitive user inputs when exported to bots, documents, or other systems. Once exported, this data may spread beyond the original access boundary and be harder to audit or delete.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The SOP trigger includes a very broad phrase equivalent to 'how to correctly [action]', which can match many ordinary requests. Since the SOP mode can produce authoritative procedural content, accidental matches may leak internal process instructions or steer users into unintended workflow execution.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The reporting section describes collection of user activity metrics and query-level analytics without stating retention, audience, minimization, or user notice. In an internal enterprise setting, this can become covert monitoring of employee behavior and can expose sensitive operational searches through routine reports.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: Publishing exact top searches and failed searches in usage reports creates a clear data-leak channel because users often search with sensitive business context, personnel issues, or incident details. The skill further states that reports may be sent to leadership channels, increasing the blast radius of any leaked query content.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: A persistent `search-log.csv` in the knowledge storage structure indicates retained raw queries as a first-class artifact. This expands the attack surface because anyone with filesystem or repository access may obtain historical searches containing confidential information unrelated to the knowledge base documents themselves.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence
• Finding: Suspicious Unicode normalization or mixed-script content

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This code invokes external archiving tools and PowerShell, then performs a recursive delete with rm -rf on the temporary build directory. Although the script has comments about build behavior, it does not visibly warn the user at the point of execution that shell commands and filesystem deletion will occur, nor does it request confirmation.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence
• Finding: Suspicious Unicode normalization or mixed-script content

Static analysis

No suspicious patterns detected.