T08 · Insecure Dependencies
Warning
- Location
SKILL.md:494- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Security audit
Knowledge Graph Builder Free
Security checks for vulnerabilities and agentic risk
Overview
This skill is mostly a local knowledge-graph helper, but it needs review because it stores potentially sensitive personal and business data in plaintext and suggests Git tracking without adequate privacy warnings.
Review before installing. Use it only for non-sensitive graph data unless you add your own protections. Do not commit memory/knowledge-graph/graph.jsonl to Git if it contains real people, messages, accounts, devices, notes, or business information. Install dependencies in an isolated environment, and confirm any create/update/delete operation before letting an agent modify the graph.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:75- Finding
Plaintext Sensitive Data Storage Combined with Git Tracking Guidance
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill documents create, update, relate, and delete operations against local JSONL storage but does not prominently warn users that these actions modify persistent local data. In contexts where the agent has exec and read tools, a user may trigger destructive or irreversible graph changes without realizing the operation writes to disk and preserves/deletes state.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill declares an overly broad set of trigger keywords, including generic terms and fragmented phrases, which can cause the agent to invoke this skill for unrelated user requests. In a skill with read and exec permissions plus file-modifying workflows, over-triggering increases the chance of unintended local file access or modification under mistaken routing.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The statement '完全中文化表达，适配中文用户工作流' indicates a language-specific constraint, but the document does not offer an opt-in language choice or clearly justify that the skill is intended only for a Chinese-language region or compliance context. This can violate a language/locale policy when users are not given a choice.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
L538把“版本追踪与差异对比”列为免费版限制项，但文档前文已明确宣称JSONL追加式存储会“保留完整历史，可追溯任意时间点的图谱状态”（L213-L216），FAQ中也再次宣称JSONL可追溯且可纳入版本控制（L442-L449）。这不是单纯信息遗漏，而是对免费版是否具备历史追溯/版本能力的直接矛盾陈述。
- Content