Security audit

Super Agent Knowledge

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a knowledge-base maintenance helper with disclosed file-cleanup behavior, but users should avoid unattended auto-fix runs unless they have backups or version control.

Install only if you want an agent to help maintain a knowledge base. Run cleanup in report-only mode first where possible, keep the knowledge base in version control or backed up, and do not schedule `--fix` unattended until you are comfortable with the exact files it can change.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The documentation explicitly recommends running `know tidy --fix` automatically in heartbeats or nightly cron, while describing that the command can move misplaced files and remove empty content. Encouraging unattended use of a destructive auto-fix operation without safeguards, dry-run guidance, backup advice, or clear warnings increases the chance of unintended data loss or silent modification of a knowledge base.

Static analysis

No suspicious patterns detected.