知识捕获工具（免费版）

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:28 AM UTC
• Version: 1.0.3

Overview

The skill is a knowledge-capture helper, but it asks for broad command execution and describes saving, API, file write, and delete behavior without clear user control.

Review before installing. Only use this skill in a sandboxed workspace, avoid giving it shell access unless you explicitly need it, and require confirmation before it saves conversation content, modifies files, deletes anything, or sends data to an external API.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:125

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:125
Vulnerability Type: Unpinned and unverified package installation
Risk Level: Medium

Vulnerable Code Snippet:

bash

pip install requests

Technical Analysis

The setup instructions install requests without a fixed version, cryptographic hashes, a lockfile, or an explicitly trusted package index. Consequently, the dependency resolved during installation can change after the skill has been reviewed.

The supplied knowledge-extraction example does not import or use requests, so this installation also introduces an unnecessary supply-chain component. Although no malicious package or package source was identified in the audited project, an upstream package compromise, registry compromise, or unexpected future release could affect users who follow this instruction.

Attack Path

1. A user or automation system follows the environment-preparation instructions.
2. pip resolves the current version of requests and its transitive dependencies from the configured package index.
3. If a resolved release or package index is compromised, attacker-controlled installation or runtime code is placed in the Python environment.
4. That code executes with the permissions of the user or service performing installation or subsequently importing the affected package.

Impact Assessment

Exploitation could provide code execution within the Python installation context and access to files, credentials, network resources, and environment variables available to the installing or executing account. The project itself contains no evidence of registry manipulation or a malicious dependency, so the risk is conditional on an external supply-chain compromise.

Remediation

View remediation

Remediation Suggestions

• Remove requests because the supplied implementation does not use it.
• If it becomes necessary, pin an audited version and all transitive dependencies in a lockfile.
• Require cryptographic hashes, for example through pip install --require-hashes.
• Configure an explicitly trusted package index rather than relying on uncontrolled environment configuration.
• Run dependency installation in an isolated virtual environment or container with minimal filesystem and network privileges.
• Add automated dependency vulnerability and integrity scanning to the release process.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:5

Finding

Unnecessary Arbitrary Command-Execution Permission

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:5
Vulnerability Type: Excessive tool permission violating least privilege
Risk Level: Medium

Vulnerable Code Snippet:

yaml

allowed-tools: read exec

Technical Analysis

The skill grants the Agent access to the general-purpose exec tool even though its demonstrated knowledge-extraction logic only processes text locally and does not require system-command execution. The document recommends executing only allowlisted commands, but it does not define or technically enforce such an allowlist.

Prompt-level safety guidance is not an access-control boundary. If untrusted conversation or document content influences tool selection, the unnecessary exec capability increases the potential consequences of generated or manipulated instructions. The audit did not identify an embedded command-injection payload or an explicit instruction requiring execution of attacker-controlled input.

Attack Path

1. The skill is loaded with both read and exec permissions.
2. The Agent processes an attacker-controlled conversation, meeting record, or document.
3. Malicious content attempts to influence the Agent into treating embedded text as operational instructions.
4. Because the skill has general command-execution access, the Agent may issue a command that is unrelated to legitimate knowledge extraction.
5. If the host does not independently enforce sandboxing and command restrictions, the command executes with the Agent process's operating-system permissions.

Impact Assessment

Successful misuse could affect files and processes accessible to the Agent account and could expose environment variables or permit network activity where the runtime allows it. The precise scope is bounded by the external host sandbox and operating-system account; the audited file does not establish root access, sandbox escape, persistence, or credential theft.

Remediation

View remediation

Remediation Suggestions

• Remove exec from allowed-tools and retain only the minimum file or text-processing permissions required.
• If command execution is essential, replace general-purpose execution with a narrowly scoped tool exposing only specific operations.
• Enforce an allowlist outside the skill prompt, including exact executable paths, permitted arguments, working directories, and resource limits.
• Never interpolate conversation text, filenames, or other untrusted input into shell command strings.
• Execute permitted commands without a shell, using structured argument arrays.
• Run the Agent in an isolated container or sandbox with restricted filesystem access, no unnecessary credentials, and denied network access by default.
• Require explicit user confirmation before any command that changes system state.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill promises to automatically save extracted knowledge to a knowledge base or document system but does not clearly warn users about write operations. This can cause silent persistence of sensitive conversation data, unexpected modification of user resources, or disclosure into external/document systems without informed consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

SQP-3 适用于所有文件类型。文件中明确写有“支持中文交互”且功能说明强调“本技能涵盖 中文交互”，但未说明这是可选项，也未给出其他语言支持或用户选择机制，构成未获用户选择的语言/区域策略限制。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The example trigger phrases are very broad and overlap with normal conversation, making accidental invocation more likely. In a skill that may read files, save content, or potentially use exec/network-adjacent capabilities, mis-triggering can lead to unintended processing, data writes, or other side effects without clear user intent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Declaring command execution for a knowledge-capture skill is unjustified by the described workflow and creates unnecessary privilege. Even without explicit exploit code, giving a loosely specified skill shell access can allow harmful local actions if triggered by ambiguous instructions or future prompt extensions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The documentation introduces external API and network behavior even though the stated purpose—extracting and structuring knowledge from conversations—can be performed locally. Unnecessary network access increases risk of data exfiltration, leakage of sensitive conversation content, and expansion of trust boundaries beyond what users expect.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill is presented as a knowledge-capture/document-processing tool, but later expands its scope to generic API integration and command execution. This broadening increases the attack surface and can mislead users or invoking agents into granting capabilities unrelated to the stated purpose, enabling unintended file, network, or shell actions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The FAQ states the skill requires no additional API key, yet the security section later includes precautions for configuring API keys through environment variables. This is an active documentation inconsistency about whether secret-backed external services are part of the skill's intended operation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.