V1.4.1

• Outcome: Review
• Latest audit: Aug 12, 2026 · 3:31 PM UTC
• Version: 1.4.1

Overview

The skill appears to perform its stated knowledge-base setup work, but it also enables broad command execution, scheduled background processing, and Feishu delivery of document-derived content with limited scoping and cleanup controls.

Review this skill before installing if your knowledge directory may contain confidential documents. Prefer running setup without a Feishu user ID until you have checked the scripts, enable exec/process only if you accept host command execution, and add your own exclusions, backups, and cron removal steps before turning on unattended daily processing.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (8)

os.system() or os exec-family call

High

• Category: Dangerous Code Execution

Content

def _kill_proc_tree(pid):
    try:
        os.system(f"pkill -P {pid} 2>/dev/null")
    except:
        pass
    try:

• Confidence: 96% confidence
• Finding: os.system(f"pkill -P {pid} 2>/dev/null")

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill clearly instructs file reads/writes and shell execution, yet no permissions are declared. That creates a transparency and consent gap: a user or platform may treat the skill as lower-risk than it really is, while it can copy scripts, modify configuration, register cron jobs, and process local files.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 82% confidence
• Finding: The description frames the skill as setup/configuration for a local knowledge base, but the documented behavior goes further into bulk document scanning, content extraction, OCR/conversion, summary generation, archive overwrites, and outbound messaging. That mismatch can mislead operators about the amount of data access and processing involved, increasing the risk of unintended exposure of sensitive documents.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill instructs users to enable exec/process tools, which materially increases command-execution capability, but it does not warn about the resulting security boundary change. In this context, those tools are then used for shell commands, script deployment, package installation, config changes, and cron registration, so compromise or misuse would have broad local-system impact.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill advertises automatic Feishu summary delivery without warning that document-derived content will leave the local machine. Even if only summaries are sent, they may still contain sensitive or regulated information extracted from private files, especially because the skill processes broad document types and performs OCR.

Missing User Warnings

Low

• Confidence: 74% confidence
• Finding: The documented batch repair flow says it will overwrite prior corrupted archive summaries, but does not caution users that existing files may be replaced. While this is not arbitrary destructive behavior, it can still cause loss of prior outputs, forensic history, or manual edits if operators do not realize replacement is automatic.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The script registers a persistent scheduled task that will execute local Python scripts automatically every day and send results to Feishu when a user ID is supplied. Persistent unattended execution increases risk because any later modification of the deployed scripts, analyzed documents, or environment can trigger unexpected code paths or data exfiltration without fresh user review.

Session Persistence

Medium

• Category: Rogue Agent

Content

echo "  知识库 + RAG 搜索系统 安装脚本 v2.0"
echo "=========================================="

# 1. Create directories
echo "[1/8] 创建目录结构..."
mkdir -p ~/.openclaw/workspace/knowledge/.analysis/summaries/archives
mkdir -p ~/.openclaw/workspace/knowledge/temp_docs

• Confidence: 88% confidence
• Finding: Create directories echo "[1/8] 创建目录结构..." mkdir -p ~/.openclaw/workspace/knowledge/.analysis/summaries/archives mkdir -p ~/.openclaw/workspace/knowledge/temp_docs mkdir -p ~/.openclaw/workspace/knowle

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.