Security audit
Security checks for vulnerabilities and agentic risk
This knowledge-graph skill is mostly coherent, but it needs Review because it handles secrets and patches assistant instruction files without enough guardrails.
Review before installing. Use this only if you are comfortable with a local CLI skill that can modify assistant instruction files and store encrypted secrets. Avoid putting real credentials into the vault until the plaintext example and secret-display behavior are clarified, and look for install documentation that shows exactly what files are changed and how to undo those changes.
The document explicitly claims vault secrets are never printed, yet nearby examples and instructions show get <key> returning the raw secret value. This contradiction normalizes plaintext secret exposure and can lead users or downstream agents to display credentials in terminal output, logs, transcripts, or shared chats.
The skill presents itself as offering read-only cross-assistant access, but the installer is documented to patch assistant instruction files automatically. That creates a hidden write side effect affecting other assistants' behavior and trust boundaries, which is especially risky in an agent environment where instruction files define model behavior.
A general-purpose secret vault is materially broader than the stated embedded knowledge-graph functionality and introduces sensitive credential handling into a skill that already has exec capability. This expands the attack surface: misuse of the vault or confusion about its guarantees could expose secrets or encourage storing unrelated credentials in the skill context.
The invocation guidance says to use the skill whenever efficiency, automation, batch processing, or workflow optimization are needed, which is so broad that it can cause the skill to activate for many unrelated tasks. In an agent with exec, broad routing increases the chance that users are pushed into file-modifying or command-running behavior they did not specifically request.
The documentation states that installation will automatically detect the platform and patch assistant instruction files, but it does not prominently warn users that local files will be modified. Silent or under-disclosed modification of instruction files can alter future agent behavior and persistence in ways users may not expect or notice.
The merge operation documentation states that in absorb mode the source entity is deleted, but this destructive behavior is not highlighted with a clear warning or recovery guidance at the point of use. Users may unintentionally destroy data or graph structure, especially when using assistant-generated entity IDs or automated workflows.
The vault usage example includes plaintext output of a secret (sk-abc123) immediately after claiming such values are only for pipeline use and should not appear in dialogue. Even if illustrative, showing plaintext secret output teaches unsafe handling and can result in credential leakage via logs, screenshots, shell history, or model context.
No suspicious patterns detected.
