Security audit

Knowledge Base Manager

Security checks for vulnerabilities and agentic risk

Overview

This skill organizes a local Markdown knowledge base and does not show hidden network, credential, or system-persistence behavior.

Use this in a dedicated or clearly chosen workspace and expect it to create and update files under knowledge/. Review bulk inbox-organization reports before moving many files, and require explicit confirmation before any deletion; archiving is the safer default for low-value material.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.
md
- guarantee semantic search or retrieval quality - fetch web content by itself unless other tools are available - replace a full document management system - overwrite existing files aggressively without a clear reason This is a workflow and organization skill for local knowledge management.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The instruction "Please save this article to the knowledge base" describes a broad action without defining when this skill should be invoked, what counts as an eligible article, or any exclusion conditions. Because this is a plain-text skill file, the lack of explicit trigger boundaries could cause unintended activation from common content-management requests.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The instruction 'Please turn this PDF into a knowledge entry' is generic enough to trigger on arbitrary PDF-processing requests, which can cause the skill to activate outside its intended scope. In a knowledge-base manager, that broad matching increases the chance of processing untrusted or irrelevant documents, potentially leading to unsafe ingestion, misclassification, or unintended handling of sensitive content.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The instruction to 'organize knowledge/00_inbox/' is broad and underspecified, which can authorize sweeping actions over an entire directory without clear scope limits, approval checkpoints, or file-selection criteria. In a knowledge-base management skill, this ambiguity is risky because the agent may reinterpret, move, or otherwise alter many items based on its own confidence rather than explicit user intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The instruction to 'suggest archive or deletion for low-value items' introduces destructive decision-making without any explicit user warning, confirmation requirement, or safety guard around deletion. Even if framed as a suggestion, in this skill context it normalizes deletion behavior during routine inbox maintenance and could lead to accidental loss of useful knowledge artifacts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This README instructs the skill to create a knowledge/ directory, create multiple subdirectories, and copy or create several files in the current workspace. The section does not include any warning that these actions will modify local files or recommend confirming the target workspace before initialization.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The README instructs the agent to create directories and copy files within the workspace, but it does not explicitly warn that these actions modify local data. In a skill that is expected to manage a local knowledge base this behavior is aligned with the stated purpose, so the issue is not overtly malicious, but it still creates a risk of unintended filesystem changes if a user invokes it without understanding the write operations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This markdown skill description states that it will initialize a local knowledge base, save Markdown files, organize items, and maintain metadata, which can modify the user's local filesystem. While the behavior is central to the skill's purpose, the document does not include a clear upfront warning or confirmation-oriented note that these actions will create and update files on disk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The instruction to 'prefer short English names where practical' imposes a language preference in natural-language guidance. The file does not provide user opt-in, locale choice, or a documented regional justification for enforcing English naming conventions.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.