Security audit

知识图谱技能

Security checks for vulnerabilities and agentic risk

Overview

This skill appears aimed at a local knowledge graph, but it asks for persistent agent-instruction changes and credential handling without enough clear scoping or safeguards.

Review carefully before installing. Only use it if you are comfortable with a skill that may modify assistant instruction files, persist local knowledge/configuration, and manage credentials. Ask for exact file paths, a dry run, backups, rollback steps, and replacement of the secret examples before trusting it with real data or API keys.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The skill claims cross-assistant access is read-only, yet elsewhere instructs running an installer that modifies assistant instruction files and injects graph content. This mismatch can mislead users and downstream agents about the actual write capabilities and trust boundary, increasing the risk of unauthorized prompt/context modification.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The file labels itself as a pure Markdown, natural-language-driven skill while also declaring exec tooling and extensive CLI command usage. This inconsistency can cause agents or users to apply a lower-risk handling model than warranted, potentially permitting command execution under false assumptions about the skill's behavior.

Vague Triggers

High

Confidence: 87% confidence
Finding: The activation guidance is extremely broad, recommending use for generic efficiency, automation, batch processing, and workflow optimization scenarios. Over-broad triggering increases the chance the skill is invoked in unrelated contexts where it can read, execute, persist data, or alter configuration without a narrowly scoped user expectation.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documentation says the installation step patches assistant instruction files and injects graph directives, but does not prominently warn that this is a write operation affecting agent behavior. Silent or under-disclosed modification of instruction files can change future assistant behavior and create persistence beyond the user’s immediate request.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The secret-handling example includes a raw-looking API key value in plaintext, normalizing unsafe handling of credentials in documentation and increasing the risk that users paste real secrets into chats, terminals, logs, or version control. Even example secrets can be harvested or copied into unsafe workflows.

Static analysis

No suspicious patterns detected.