Cheat Code Paid

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:20 AM UTC
• Version: 1.0.2

Overview

This skill fits an enterprise knowledge-retrieval use case, but it grants broad command/file/API authority and can persist or share internal results with weak scoping.

Review this skill before installing. Use it only in environments where the agent may access internal documentation, source repositories, and API-backed knowledge sources. Keep cache and shared directories private, do not sync them to public or broadly shared repositories, restrict API tokens, and require explicit approval for command execution or administrator-level troubleshooting.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:63

Finding

Unprotected Shared Knowledge Storage May Disclose Sensitive Information

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 63–67 and 282–289
Vulnerability Type: Insecure storage and sharing of potentially sensitive query results
Risk Level: Medium

Vulnerable Code

text

### Q3: 缓存数据存储在哪里?
默认存储在项目根目录的 `.knowledge-toolkit/cache/` 下,可配置为其他路径。缓存数据不出本机.
### Q4: 团队共享知识如何同步?
将 `.knowledge-toolkit/shared/` 目录纳入版本控制或同步盘,团队成员拉取后即可共享知识.

The relevant configuration also enables shared storage:

json

"team": {
  "shared_enabled": true,
  "storage": ".knowledge-toolkit/shared/"
}

Technical Analysis

The Skill recommends placing .knowledge-toolkit/shared/ under version control or a synchronized drive. It also enables shared storage in the example configuration. The documented workflow supports querying authenticated internal Wikis, source repositories, API specifications, and other enterprise data sources.

Consequently, stored query results may contain proprietary documentation, internal architecture details, source-derived information, personal information, or sensitive query history. The instructions do not require data classification, content redaction, encryption, destination validation, restrictive filesystem permissions, retention limits, or repository access verification before synchronization.

Environment variables are appropriately recommended for API tokens, and no hardcoded production credentials were found. However, protecting credentials does not protect sensitive content returned through those credentials.

Attack Path

1. An authorized user configures an authenticated internal data source.
2. The Agent queries sensitive internal documentation or repository content.
3. The result is written to .knowledge-toolkit/shared/.
4. Following the documented recommendation, the directory is added to version control or a synchronization service.
5. The selected repository, branch, synchronization group, or inherited sharing configuration gr ...[truncated 699 chars]

Remediation

View remediation

Remediation Suggestions

• Disable shared storage by default and require explicit user authorization for each sharing destination.
• Require users to classify content before saving or synchronizing it.
• Apply secret detection and sensitive-data redaction before writing query results.
• Encrypt shared data at rest and in transit.
• Create shared directories with restrictive filesystem permissions.
• Validate repository visibility, branch protections, synchronization membership, and access-control lists before sharing.
• Define retention periods and provide secure deletion functionality.
• Add cache and shared directories to .gitignore by default.
• Permit version control only when the user explicitly selects an approved private repository.
• Maintain an audit log identifying the source, destination, initiator, and classification of every shared item.

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: SKILL.md:440

Finding

Blanket Administrator Execution Guidance Violates Least Privilege

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 440 and 474
Vulnerability Type: Unnecessary privilege elevation
Risk Level: Low

Vulnerable Code

The following troubleshooting instruction appears twice:

text

| 权限不足 | 当前用户无读写权限 | 检查文件权限,以管理员身份运行 |

Its meaning is: when permissions are insufficient, inspect the file permissions and run as an administrator.

Technical Analysis

The troubleshooting guidance recommends administrator execution as a generic response to insufficient read or write permissions. It does not identify which command needs elevation, restrict the elevated operation, require verification of the target path, or recommend correcting narrowly scoped ownership and permission problems first.

This conflicts with the principle of least privilege. It is particularly risky because the Skill declares command-execution capability and describes file processing and external-data workflows. If an Agent applies this advice to a command containing unsafe paths, untrusted arguments, or attacker-influenced content, the same operation may run with administrator privileges.

The reviewed file does not contain a concrete command that automatically elevates privileges. Therefore, exploitation depends on a user or Agent following the troubleshooting recommendation in a context involving an unsafe command.

Attack Path

1. A file-processing or command-execution operation fails because the current user lacks permission.
2. The user or Agent follows the documented advice and reruns the operation with administrator privileges.
3. The operation includes an unsafe target path, untrusted argument, or attacker-controlled input.
4. The command modifies, creates, or reads resources that were inaccessible to the original account.
5. The resulting effect occurs with administrator privileges rather than the minimum permissions required for the task.

Impact Assessment

If applied to an unsafe ...[truncated 520 chars]

Remediation

View remediation

Remediation Suggestions

• Remove generic instructions to run commands as an administrator.
• Diagnose the exact denied resource and required permission before recommending any change.
• Prefer narrowly scoped ownership, access-control, or directory-permission corrections.
• If elevation is unavoidable, document the exact command and expected effect.
• Validate all paths and arguments before elevated execution.
• Prohibit attacker-controlled input, shell interpolation, and unrestricted wildcards in elevated commands.
• Require explicit user confirmation immediately before elevation.
• Run elevated operations in a constrained environment and retain an audit log.
• Restore temporary permission changes after the operation completes.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill claims to be for knowledge retrieval but also enables exec-backed command execution without a tight, purpose-based limitation. An agent following this skill could be induced to run shell commands unrelated to retrieval, creating risk of arbitrary local actions, data exposure, or environmental modification.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill’s stated purpose shifts between enterprise knowledge retrieval and code generation/review, creating ambiguity about what actions it may legitimately take. In agent systems, this kind of scope confusion can enable unexpected tool use or broaden invocation beyond what users intended, increasing the chance of unsafe file, code, or network operations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation wording is broad enough to match common development requests such as coding, debugging, and deployment help, not just the claimed premium retrieval function. Overbroad triggers can cause the skill to activate in many unrelated contexts and apply powerful tools or hidden behaviors where users did not expect them.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The description explicitly states '支持中文交互' while the surrounding guidance is otherwise general-purpose and not limited to a China-specific or Chinese-only compliance context. There is no indication that users can choose another language, so this creates a locale/language policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The description includes file writing, team sharing, command execution, and external data access but does not clearly warn about side effects, persistence, or data disclosure. That omission is risky because users may invoke the skill expecting passive analysis while it can modify files, transmit data externally, or propagate content into shared storage.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The file describes a narrow 'core function' but later advertises command execution, file handling, and code review features, which materially expand the skill’s effective behavior. This inconsistency is dangerous because operators and downstream agents may trust the safer summary while the full document authorizes more powerful actions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill’s role expands from knowledge retrieval into static analysis, vulnerability detection, and batch code review without clear justification or separation of duties. This broadening increases the chance of over-triggering the skill on unrelated development tasks and grants it undue authority over sensitive code and review workflows.

Content

No source excerpt is available for this finding.