Security audit

图谱

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a generic, inconsistent knowledge-graph note tool that asks for write and command-execution authority without clear boundaries.

Review before installing. This skill may be useful for maintaining local knowledge-graph notes, but only use it if you are comfortable granting it write access and potential command execution. Keep it limited to the intended life/areas/** notes, back up important files first, and avoid providing API keys unless the publisher clarifies what service uses them and why.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The skill declares a narrow purpose of maintaining notes under life/areas/**, but the surrounding description expands its use to broad AI/agent orchestration scenarios and references automation, API use, and flexible execution. This mismatch weakens user understanding of what the skill may actually do and can enable overbroad operation beyond the advertised scope, increasing the risk of unintended file or system actions.

Intent-Code Divergence

Medium

Confidence: 85% confidence
Finding: The paid-features section advertises image-generation-related capabilities that are unrelated to knowledge-graph maintenance. This kind of contradictory documentation is dangerous because it signals template contamination or copy-pasted content, reducing trust in the stated behavior and making it harder for users or reviewers to determine what the skill is really permitted to do.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The skill requests exec capability even though the stated purpose is maintaining a knowledge graph and atomic notes, which can typically be handled with scoped read/write operations. Unnecessary command execution materially expands the attack surface because an agent could run local shell commands, touch unrelated files, or invoke external tools in ways users would not expect from the declared function.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The invocation guidance is broad and ambiguous, stating the skill should be used for AI model calls, intelligent dialogue, agent orchestration, and LLM applications generally. Overly broad invocation criteria can cause the skill to be selected in contexts far beyond its narrow stated purpose, increasing the chance that write/exec-capable behavior is applied to inappropriate tasks.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill exposes read, write, and exec capabilities but does not provide a clear warning that local files may be modified or that commands may run on the host. In this context, the missing disclosure is dangerous because users may invoke what appears to be a document-maintenance skill without realizing it can perform impactful system actions.

Static analysis

No suspicious patterns detected.