Security audit

The Librarian

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent local document-search tool, but it needs review because it can load a pickle file from an index directory, which can execute code if that index is untrusted.

Install only in an isolated environment, use a trusted local Ollama endpoint for sensitive documents, and protect or delete generated index folders because they contain document text. Do not search downloaded, shared, or otherwise untrusted index directories unless you accept the risk that bm25_index.pkl could execute code when loaded.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The script is presented as a lightweight/local indexing tool, but it generates embeddings by POSTing document chunks to an Ollama HTTP API. Even if Ollama is often hosted locally, the configurable API URL can point to a remote service, so document contents may leave the local trust boundary without an explicit privacy warning.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The search path sends the user’s query text to an HTTP embedding API, which creates a real data-disclosure boundary outside the local process. In a document-search skill marketed as lightweight/local, this is security-relevant because sensitive search terms may be exposed to another service without clear consent or strong transport guarantees.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: Loading bm25_index.pkl with pickle.load allows arbitrary code execution if an attacker can replace or supply the index file. Because index contents are data, not trusted code, using pickle here turns opening an untrusted search index into code execution in the user’s environment.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The code sends raw chunk text in the 'prompt' field to the embedding API without any explicit user-facing notice that document contents are transmitted over HTTP. Users may reasonably expect local-only processing from the skill description, creating a confidentiality risk for sensitive documents.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: Queries are transmitted to the Ollama API with no explicit warning to the user that their search terms leave the process and may traverse the network. Search queries often contain sensitive document topics, names, or secrets, so silent transmission meaningfully increases privacy and compliance risk.

Static analysis

No suspicious patterns detected.