Security audit

知识捕获工具（免费版）

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a document and knowledge-capture helper, but it asks for shell execution and describes broad API, file-writing, and delete-style operations without clear limits.

Install only if you are comfortable with a Markdown skill that may use shell commands and broad file/API operations. Keep it constrained to explicit knowledge-capture tasks, review any command before it runs, and avoid using it on sensitive documents unless you control where outputs are saved and whether external services are contacted.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The skill is presented as a knowledge-capture/document-processing tool, but later claims broad API integration and system command execution features. This scope expansion weakens least-privilege expectations and can cause an agent or user to authorize behavior far beyond the declared purpose, increasing the chance of unsafe command or network use.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The documentation broadens the skill into generic create/query/export/modify/delete operations that exceed a focused knowledge-capture role. Overbroad operational claims create ambiguity about what the agent is allowed to do and may enable unintended data manipulation if the skill is invoked under normal document-processing expectations.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: Advertising command execution in a skill whose stated purpose is knowledge capture materially increases risk because it normalizes shell access without a clear need. If users or agents trust the skill as a simple document tool, this mismatch can lead to execution of local commands in contexts where only parsing or summarization was expected.

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: The documentation introduces external API/service integration despite a primarily local knowledge-capture scope. This can expand data exposure by encouraging transmission of user content to third-party services without clear necessity, consent boundaries, or data-handling guarantees.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The example trigger phrases are very broad and overlap with ordinary conversational requests such as extracting knowledge or generating meeting notes. In an agent ecosystem, vague triggers increase the likelihood of unintended activation, which is more dangerous here because the skill also advertises exec and API-related behavior.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The top-level description says to use the skill for a wide range of file handling, format conversion, and content extraction tasks without clear boundaries. Such an expansive trigger surface makes accidental or inappropriate invocation more likely, especially given the declared access to read and exec tools.

Static analysis

No suspicious patterns detected.