Security audit

Knowledge Graph Skill Free

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward local knowledge-graph helper, with ordinary data-writing risks that users should manage.

Install only if you are comfortable with a skill that can create, modify, delete, import, and export local knowledge-graph data. Use a dedicated folder, keep backups of important graph files, review import/export paths before running actions, and avoid storing secrets or regulated data unless your environment provides appropriate protections.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill advertises create/update/delete operations plus local persistence and includes the exec tool, but it does not clearly warn users that actions may modify or delete stored data or write to the local filesystem. In an agent context, this increases the chance of unintended destructive actions or silent file changes when the skill is invoked from natural-language instructions.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The import/export and local persistence features are documented without any privacy, data handling, or system-impact warning. Because the skill can save and load graph data from local files, users may unknowingly expose sensitive structured data, overwrite existing files, or import unsafe/untrusted data into downstream workflows.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.