Security audit

agent-knowledge

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a generic knowledge capture helper, but it asks for broad write and command-execution authority without enough concrete limits.

Review this skill before installing. It is not clearly malicious, but it grants command execution and file-writing capabilities for a broadly described knowledge workflow. Use it only if you are comfortable supervising any file writes, API calls, or commands it may ask the agent to run, and avoid giving it sensitive local data unless the storage and handling path is clear.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The skill is presented as a focused knowledge capture/retrieval tool, but the manifest also requests broad capabilities including write and exec. That mismatch can mislead users and host agents into granting more authority than is necessary, increasing the risk of unintended file modification or command execution during normal use.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: Granting command execution to a knowledge-retrieval skill is a clear least-privilege violation unless narrowly justified and constrained. In an agent environment, this can turn ordinary user content or remote content into an execution path, enabling local system actions beyond the stated function.

Intent-Code Divergence

Low

Confidence: 80% confidence
Finding: The documentation promises structured processing output while separately advertising generic file handling and command execution as core features. This inconsistency hides the real operational risk of the skill and can cause reviewers or users to underestimate its ability to affect the local environment.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The activation guidance is broad enough to trigger the skill whenever a user needs anything vaguely related to agent knowledge, without clear limits or disallowed cases. Overbroad routing increases the chance the skill is invoked in contexts where its powerful tools, including exec and write, are unnecessary or unsafe.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill requests read, write, exec, glob, and grep capabilities but does not clearly warn users that it may modify files, run commands, or access external services. In the context of an agent skill, missing disclosure materially increases risk because users may authorize or invoke it under the false assumption that it only performs passive knowledge retrieval.

Static analysis

No suspicious patterns detected.