知识本体

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:29 AM UTC
• Version: 1.0.1

Overview

This skill is a local knowledge-graph helper whose file writes and command use are aligned with its stated purpose, though users should run it only in a scoped project directory.

Install only if you want a project-local ontology memory helper. Keep its `memory/ontology` files inside a workspace you control, review any write operation before running it, and install PyYAML in a virtual environment with a pinned version if possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:164

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 164
Vulnerability Type: Unpinned dependency installation
Risk Level: Medium

Complete Code Snippet:

markdown

| PyYAML | Python package | Required | Run `pip install pyyaml` to parse schema definition files |

Technical Analysis

The Skill directs users or agents to install pyyaml without specifying an audited version or verifying package integrity. Consequently, pip resolves whichever release is current from the configured package index at installation time.

This makes the resulting environment non-reproducible and exposes installation to supply-chain threats involving a compromised package release, package-index account, repository mirror, or local package-index configuration. No evidence establishes that the legitimate PyYAML package is malicious; the issue is the absence of version and integrity controls.

Attack Path

1. An attacker compromises a dependency release, package publisher account, configured Python package index, or mirror.
2. A user or agent follows the documented pip install pyyaml instruction.
3. pip resolves and downloads the attacker-controlled artifact because no version or hash is enforced.
4. Malicious installation logic may run during package installation, or malicious runtime code may execute when the dependency is imported.
5. The payload operates with the permissions of the account or agent environment performing the installation or import.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the installing or importing process's privileges. Potential scope includes data and credentials accessible to that account, modification of writable project or user files, and abuse of network access available to the environment.

The impact is constrained by the process's operating-system permissions and sandboxing. The audited file does not request elevated privileges, and no privilege-escalation mechanism wa ...[truncated 13 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin PyYAML to a specifically reviewed version rather than resolving the latest release dynamically.

2. Place dependencies in a lock or requirements file containing cryptographic hashes, and install with hash verification, for example:

   text

   PyYAML==<reviewed-version> --hash=sha256:<verified-artifact-hash>
   

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

3. Generate and review lock-file updates through a controlled dependency-update process.

4. Explicitly configure an approved HTTPS package index rather than relying on an unknown environment-level index or mirror.

5. Install dependencies inside an isolated virtual environment or sandbox using a non-privileged account.

6. Scan pinned artifacts for known vulnerabilities and verify package provenance before approving upgrades.

7. Avoid executing installation commands automatically from untrusted input or with administrator/root privileges.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description is framed so broadly ('knowledge ontology related' and generic development scenarios) that an agent could invoke it in contexts far beyond the author's intended scope. Over-broad activation increases the chance of unintended execution of its file-writing and exec-backed workflows in unrelated tasks, which can cause unsafe side effects or misuse of local resources.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs the agent to create directories, touch persistent files, and append schema/entity data using shell commands, but it does not warn that these actions modify local state. In an agent environment with exec/write tools, this can lead to silent persistence, accidental overwrites, or unauthorized changes to local memory files when the user did not explicitly consent to storage modification.

Content

No source excerpt is available for this finding.