Security audit

知识图谱技能

Security checks across malware telemetry and agentic risk

Overview

This knowledge-graph skill is mostly coherent, but it needs Review because it handles secrets and patches assistant instruction files without enough guardrails.

Review before installing. Use this only if you are comfortable with a local CLI skill that can modify assistant instruction files and store encrypted secrets. Avoid putting real credentials into the vault until the plaintext example and secret-display behavior are clarified, and look for install documentation that shows exactly what files are changed and how to undo those changes.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The document explicitly claims vault secrets are never printed, yet nearby examples and instructions show `get <key>` returning the raw secret value. This contradiction normalizes plaintext secret exposure and can lead users or downstream agents to display credentials in terminal output, logs, transcripts, or shared chats.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The skill presents itself as offering read-only cross-assistant access, but the installer is documented to patch assistant instruction files automatically. That creates a hidden write side effect affecting other assistants' behavior and trust boundaries, which is especially risky in an agent environment where instruction files define model behavior.

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: A general-purpose secret vault is materially broader than the stated embedded knowledge-graph functionality and introduces sensitive credential handling into a skill that already has `exec` capability. This expands the attack surface: misuse of the vault or confusion about its guarantees could expose secrets or encourage storing unrelated credentials in the skill context.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The invocation guidance says to use the skill whenever efficiency, automation, batch processing, or workflow optimization are needed, which is so broad that it can cause the skill to activate for many unrelated tasks. In an agent with `exec`, broad routing increases the chance that users are pushed into file-modifying or command-running behavior they did not specifically request.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documentation states that installation will automatically detect the platform and patch assistant instruction files, but it does not prominently warn users that local files will be modified. Silent or under-disclosed modification of instruction files can alter future agent behavior and persistence in ways users may not expect or notice.

Missing User Warnings

Low

Confidence: 74% confidence
Finding: The merge operation documentation states that in `absorb` mode the source entity is deleted, but this destructive behavior is not highlighted with a clear warning or recovery guidance at the point of use. Users may unintentionally destroy data or graph structure, especially when using assistant-generated entity IDs or automated workflows.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The vault usage example includes plaintext output of a secret (`sk-abc123`) immediately after claiming such values are only for pipeline use and should not appear in dialogue. Even if illustrative, showing plaintext secret output teaches unsafe handling and can result in credential leakage via logs, screenshots, shell history, or model context.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.