Security audit
Security checks for vulnerabilities and agentic risk
This local knowledge-base skill is not malicious, but it needs review because it requests write and exec capability while its scope and supported operations are inconsistent.
Review the skill before installing. It appears intended for local note and knowledge-base management, not remote access or exfiltration, but you should only use it for explicit fact-management tasks, verify what script will actually run, keep it inside a chosen knowledge-base folder, and back up files before running summarize or any operation that may modify, reset, import, export, or delete data.
The skill asserts that facts are never deleted and that replacement should be used instead of deletion, yet the technical section also states it supports delete operations. This semantic conflict is dangerous because an agent may legitimately choose deletion, causing irreversible loss of supposedly append-only historical knowledge and violating the user’s trust in the retention model.
The skill documentation contradicts itself by claiming the free edition does not support export/backup, while later describing output handling that includes export/save/convert operations. This can mislead an agent into invoking file-writing or data-export behaviors the user did not expect, increasing the risk of unintended data disclosure or destructive local writes.
An overly broad trigger condition increases the chance the agent selects this skill outside its intended domain. Because the skill advertises read/write/exec capabilities, accidental invocation in unrelated tasks expands the attack surface and can lead to unnecessary local command execution or file changes.
The trigger condition is far broader than the stated purpose of a local knowledge-graph note tool, claiming applicability to data analysis, reporting, statistics, and visualization. This can cause the agent to invoke the skill in unrelated contexts where its write/exec capabilities are unnecessary, raising the chance of unintended file modification or misuse.
The skill states that data is stored locally and summaries overwrite prior files, but it does not prominently warn users that operations perform persistent local writes and can replace existing content such as summary.md. Insufficient disclosure is risky in an exec-enabled skill because users or agents may treat it as read-only knowledge assistance rather than a state-changing filesystem tool.
The visible display name, summary, and the entire operational documentation are presented only in Chinese, with no indication that users may choose another language. This creates a locale-specific experience without explicit opt-in or justification that the skill is intended only for a Chinese-speaking region or audience.
