知识管理工具（免费版）

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:34 AM UTC
• Version: 1.0.3

Overview

This skill is mostly documentation, but it asks for command execution and describes broad file, API, and install behavior without tight scope or clear user control.

Install only if you are comfortable with a knowledge-management skill that may be invoked broadly and that advertises command execution, file writing, and API integration. Prefer using it with exec disabled or requiring confirmation before any package install, command, file write, or external API call.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:124

Finding

Unpinned and Unnecessary Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 124
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code Snippet:

bash

pip install requests

Technical Analysis

The environment setup instructions install requests without pinning an audited version, constraining transitive dependencies, verifying package hashes, or explicitly selecting a trusted package index. Consequently, installation results may change over time and depend on the user's pip configuration.

The supplied Python example does not import or use requests, while the dependency table identifies only the Agent-provided LLM API as required. The installation therefore introduces an avoidable supply-chain attack surface.

An attacker who compromises a future package release, a transitive dependency, or a package index configured in the target environment could cause attacker-controlled package code to run during installation or subsequent import. This finding does not establish that the legitimate requests package is malicious; the risk arises from mutable, unverified dependency resolution.

Attack Path

1. A user follows the documented environment preparation instructions.
2. The user runs pip install requests.
3. Pip resolves an unspecified version and its transitive dependencies using the environment's configured package indexes.
4. A compromised release, dependency, or configured index supplies attacker-controlled package content.
5. The malicious component executes during installation or when imported by a subsequent workflow, under the privileges of the user or Agent process.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the process running pip. Depending on those privileges and the environment, this may permit access to project files, user-readable credentials, environment variables, and network resources. It could also modify files or installed Pyt ...[truncated 317 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the installation instruction if requests is not required by an implemented workflow.
2. If it is required, pin an audited version rather than resolving the latest available release.
3. Lock all transitive dependencies in a reviewed requirements file.
4. Record and enforce cryptographic hashes with pip's --require-hashes option.
5. Use an explicitly configured, trusted package index or an internally controlled package mirror.
6. Install dependencies in an isolated virtual environment with minimal operating-system privileges.
7. Add automated dependency vulnerability and integrity scanning to the release process.
8. Document why the dependency is required and where it is used so unused dependencies can be removed promptly.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest description mixes a knowledge-management skill with unrelated design, UI, poster, and brand-visual use cases. This scope confusion can cause an agent or user to invoke the skill in contexts it was not designed for, increasing the chance of inappropriate tool use, privilege overreach, or unsafe handling of unrelated tasks.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The example trigger is broad enough to overlap with ordinary user requests, which increases the chance of accidental activation in contexts where the user did not intend to invoke this skill. Because the skill also advertises read/exec-adjacent behavior elsewhere, overbroad triggering makes unintended tool use more dangerous than a normal prompt-quality issue.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Documenting exec capability for a knowledge-management skill without a clear necessity invites arbitrary shell execution under a benign-looking skill label. In agent environments, this can be abused to run local commands, access files, or chain into broader compromise if the host permits tool execution.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The documentation introduces external API and network capabilities even though the skill's stated role is local knowledge-management assistance. Unnecessary network scope creates a data-exfiltration path and can mislead users into exposing internal knowledge artifacts to remote services without clear justification or consent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill presents itself as a knowledge-management assistant, but later advertises broad file handling, API integration, information retrieval, and system command execution. This mismatch expands the effective attack surface and may lead an agent to grant or use capabilities far beyond what a user would reasonably expect from the stated purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill advertises file processing, API integration, and command execution, but does not provide prominent user-facing warnings about system impact, data modification, or outbound data flow. Users may reasonably treat this as a harmless documentation helper and unknowingly authorize operations that affect local files or transmit sensitive information.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The file says no extra API key is needed, but later security guidance discusses API keys and external services. This inconsistency can confuse operators about whether remote services are involved, causing misconfiguration, misplaced trust, or accidental exposure of credentials when users try to enable undocumented integrations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.