Security audit

知识本体

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a local knowledge-graph helper, but it requests broad file and command access while giving inconsistent instructions about API keys and network use.

Review this skill before installing. Use it only in a workspace where broad read/write/exec access is acceptable, avoid giving it real API keys unless the publisher clarifies the network features, and do not store raw secrets in the ontology graph.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The skill claims it is purely local and makes no network requests, yet other sections instruct users to configure API keys, establish API connections, use HTTPS, and handle network/API failures. This inconsistency can mislead operators and automated policy engines into granting trust or permissions under false assumptions, increasing the chance of unintended secret exposure or network-enabled execution.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The FAQ directly contradicts the earlier statement that no API key is required by saying some functions do need API keys. Contradictory security guidance can cause users or agents to provide credentials unnecessarily, or to invoke the skill in environments where secret handling rules would otherwise block it.

Description-Behavior Mismatch

Low

Confidence: 83% confidence
Finding: The skill is framed as a local knowledge-ontology tool, but later advertises generic API calling, multi-interface aggregation, and broad command-execution automation. This scope inflation makes the skill harder to reason about and may cause it to be invoked with broader trust, tools, or data access than its stated purpose justifies.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The activation guidance is overly broad, describing use in general AI model calling, smart dialogue, agent orchestration, and LLM application scenarios. Overbroad invocation criteria increase the chance that an agent will select this skill in unrelated contexts, unnecessarily exposing read/write/exec capabilities.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The capability coverage section relies on broad keywords and vague scenario matching rather than precise invocation constraints. Keyword-triggered scope can cause accidental tool activation and privilege use in contexts only loosely related to the intended function.

Static analysis

No suspicious patterns detected.