知识本体

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:18 AM UTC
• Version: 1.0.4

Overview

This looks like a local knowledge-graph helper, but its docs mix local-only behavior with API key/network instructions and broad command/file authority, so it needs review before installation.

Install only if you are comfortable granting local file and command execution access for a persistent knowledge graph. Treat the API key and network sections as unresolved documentation conflict unless the publisher clarifies them, use a user-owned data directory, avoid administrator/root execution, and pin dependencies in an isolated environment.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:236

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:236
Vulnerability Type: Uncontrolled third-party dependency version
Risk Level: Medium

Complete Code Snippet:

markdown

| PyYAML | Python package | Required | `pip install pyyaml` (used to parse schema.yaml) |

Technical Analysis

The setup instructions install PyYAML without specifying a reviewed version, lock file, or integrity hash. Consequently, the package content installed by users can change after the Skill has been audited.

Although pyyaml is the expected official package name and no malicious dependency is currently demonstrated, unconstrained dependency resolution creates a supply-chain exposure. A compromised upstream release, package-index account, index configuration, or unexpectedly incompatible future version could introduce unwanted behavior during installation or subsequent import.

Attack Path

1. A user follows the dependency installation instructions.
2. pip resolves pyyaml using the environment's currently configured package index.
3. The latest matching release is selected because no version constraint is present.
4. If that release or package source has been compromised, attacker-controlled package content is installed.
5. Malicious behavior could run during installation or when the package is imported by a future implementation.

This attack path is conditional on compromise or manipulation of the dependency supply chain; the audited project does not itself contain evidence that PyYAML is malicious.

Impact Assessment

Dependency code normally executes with the privileges of the user performing installation or running the Skill. Potential access therefore includes files, environment variables, credentials, and network resources available to that account. If installation is combined with the separate recommendation to run operations as an administrator, the potential scope could become system-wide.

Remediation

View remediation

Remediation Suggestions

• Pin PyYAML to a reviewed, compatible version or narrowly constrained version range.
• Maintain dependencies in a lock file rather than relying on an unconstrained inline installation command.
• Use hashes, such as pip's --require-hashes mode, to verify downloaded artifacts.
• Document the trusted package index and reject unexpected additional indexes.
• Regularly scan and update the pinned dependency after security review.
• Prefer installation in an isolated virtual environment under an unprivileged user account.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:346

Finding

Blanket Recommendation to Run with Administrator Privileges

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:346
Vulnerability Type: Unnecessary privilege escalation guidance
Risk Level: Medium

Complete Code Snippet:

markdown

| Insufficient permissions | The current user lacks read/write permissions | Check file permissions and run as administrator |

Technical Analysis

The troubleshooting guidance recommends running as an administrator whenever a read/write permission problem occurs. The documented ontology workflow uses local files and does not establish a legitimate requirement for system-wide privileges.

This advice violates least-privilege principles. A permission failure should be resolved by selecting a user-owned storage location or granting narrowly scoped access to the necessary file. Elevating the entire workflow also elevates Python migration scripts, package installation operations, and any future implementation invoked through the Skill.

The documentation does not itself perform elevation or provide an exploit. The risk arises when a user follows the instruction and then executes untrusted, compromised, or defective code with administrative authority.

Attack Path

1. The workflow encounters a file permission error.
2. The user follows the troubleshooting recommendation and starts the agent, shell, or command as an administrator.
3. The workflow invokes Python scripts, migration files, or installed dependencies in that elevated context.
4. If any invoked component is malicious or compromised, it inherits administrator privileges.
5. The component may then modify protected files, access other users' data, alter system configuration, or install persistent system components.

Impact Assessment

Successful abuse could expand access from the invoking user's normal permissions to administrator-level control. Depending on the operating system and execution context, this may expose protected application data, system configuration, creden ...[truncated 227 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the blanket instruction to run as an administrator.
• Store ontology data in a directory owned by the current user.
• Diagnose the specific denied path before changing permissions.
• Grant only the minimum read or write permission required for that path.
• Run package installation, migration scripts, and Skill operations from an unprivileged account.
• If an operation genuinely requires elevation, document the exact command, affected resource, reason, and minimum required duration.
• Add an explicit warning that migration scripts and dependencies must never be executed with elevated privileges unless independently reviewed.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest advertises applicability to broad developer and automation scenarios without clear boundaries, which can mislead agent planners into over-selecting this skill. In combination with exec and filesystem tools, unnecessary invocation can expose local files, permit unintended command execution paths, or create confusing overlaps with safer, narrower skills.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.

md

---

slug: knowledge-ontology
name: knowledge-ontology
version: 2.0.2
displayName: 知识本体
summary: 类型化知识图谱：约束校验+模式演进+图遍历规划，让Agent记忆结构化可验证。。面向AI Agent的类型化知识图谱系统，提供实体关系建模、约束校验、模式演进、图遍历规划能力。在需要结构
license: MIT
description: |-. 适用于需要knowledge ontology相关能力的开发场景,提供结构化工作流程和配置说明. 该工具经过深度优化,基于用户反馈改进了实用性和可操作性。Use。Use when 需要AI模型调用、智能对话、Agent编排、LLM应用时使用。不适用于需要100%确定性的关键决策。适用于独立开发者、企业团队和自动化工作流场景。
  when 需要AI模型调用、智能对话、Agent编排、LLM应用时使用。不适用于需要100%确定性的关键决策。。类型化知识图谱：约束校验+模式演进+图遍

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The document makes mutually inconsistent trust and data-flow claims: one section says the skill is purely local and requires no API keys or network access, while other sections instruct users to configure API keys and establish API connections. This can cause operators or agents to grant unnecessary secrets or network permissions under false assumptions, weakening least-privilege controls and increasing the chance of credential exposure or unintended external communication.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file presents the skill name and most instructions in Chinese while also embedding English terms like 'Use' and 'Knowledge Ontology', but it never states a language-selection policy or asks the user which language they prefer. This can effectively impose a locale/language experience without user opt-in.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest advertises applicability to broad developer and automation scenarios without clear boundaries, which can mislead agent planners into over-selecting this skill. In combination with exec and filesystem tools, unnecessary invocation can expose local files, permit unintended command execution paths, or create confusing overlaps with safer, narrower skills.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Referencing HTTPS communication and certificate validation in a skill that elsewhere claims to be local-only indicates undocumented network behavior or copied boilerplate security guidance. Even if unintentional, this ambiguity can lead reviewers to miss network requirements or approve the skill with an incorrect risk classification.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The FAQ contradicts earlier safety claims by stating that some features require API keys. Contradictory security documentation is dangerous because users and orchestrators may trust the lower-risk description while the skill later solicits secrets, enabling over-collection of credentials or use outside approved trust boundaries.

Content

No source excerpt is available for this finding.