Security audit

知识管理工具-免费版

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly a local knowledge-management helper, but it asks for command execution while leaving external API behavior and automatic mutating maintenance under-scoped.

Install only if you are comfortable with an agent running a separate `know` CLI against a persistent local knowledge directory. Before using scheduled tidy/reindex operations, keep backups or version control, and avoid granting this skill broad SEO/API tasks unless the publisher documents exactly what commands and external services are used.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Description-Behavior Mismatch

Medium

Confidence: 84% confidence
Finding: The manifest and description present the skill as a file-based knowledge capture tool, but they also advertise SEO optimization, ranking improvement, and traffic workflows that materially expand the operational scope. This mismatch can cause the agent to invoke the skill in broader contexts than intended, increasing the chance of unnecessary command execution or data handling under a misleading trust boundary.

Description-Behavior Mismatch

Medium

Confidence: 80% confidence
Finding: The documentation says no extra API key is needed, yet elsewhere claims external API integration and network-dependent behavior. This inconsistency can mislead users and calling agents about whether data may leave the local environment, weakening informed consent and safe tool-selection decisions.

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: Advertising generic API integration and external service calls goes beyond the stated purpose of a local knowledge management tool and broadens the attack surface. In an agent setting, such broad capability claims can justify exfiltration-prone behaviors or trigger higher-trust execution paths without a clear need.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: Positioning command execution as a core capability is overly broad for a knowledge management skill and normalizes use of the exec tool beyond minimal necessity. In the context of agent skills, that can encourage unsafe shell operations on user-controlled inputs or overprivileged execution for routine tasks.

Intent-Code Divergence

Medium

Confidence: 83% confidence
Finding: The skill describes itself as a file-based local tool needing no extra API key, yet later references API integration and an LLM API dependency. These contradictory trust signals make it difficult for users and agents to evaluate whether operations are local, networked, authenticated, or privacy-sensitive.

Vague Triggers

Medium

Confidence: 79% confidence
Finding: The skill uses an expansive list of activation keywords and scenarios, including broad SEO-related terms, which can cause accidental invocation for unrelated user requests. Overbroad routing is dangerous in an exec-enabled skill because it increases the chance that an agent selects a tool with file and command side effects when a safer, narrower tool would suffice.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The documentation recommends running `know tidy --fix`, a mutating maintenance command, without clearly warning that it may rewrite tags, move files, or otherwise modify stored knowledge entries. In a file-management skill, undocumented mutation increases the risk of unintended data loss, corruption, or trust erosion during normal use.

Missing User Warnings

Low

Confidence: 72% confidence
Finding: The index rebuild operation is presented without warning that derived files like `INDEX.md` may be regenerated or overwritten. While lower severity than direct content mutation, this can still surprise users, break manual edits, and obscure the boundary between source content and generated artifacts.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.