Knowledge Graph Hardened

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:41 PM UTC
• Version:
  1.0.0

Overview

The skill appears to be a local knowledge-base helper that may edit personal note files, with no evidence of hidden network transfer or destructive behavior.

Install only if you are comfortable with the agent reading and editing the intended personal knowledge-base files. Keep backups or version control for those notes, and review any proposed edits before applying them.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill instructs the agent to read and modify files under `life/areas/**` via a bundled Python script, but it declares no explicit permissions. This creates a permission-model mismatch: an orchestrator or reviewer may treat the skill as lower risk than it really is, while the skill can still drive persistent file reads/writes to a sensitive knowledge base containing personal data.

VirusTotal

65/65 vendors flagged this skill as clean.