Security audit

Knowledge Toolkit Free

Security checks across malware telemetry and agentic risk

Overview

The skill is a knowledge-management assistant, but it asks for broad write and command execution authority without clear limits or user confirmations.

Install only if you are comfortable giving this skill local file-write and command-execution capability. Use it in a dedicated notes directory, review any file changes before accepting them, avoid callback URLs unless you fully trust the destination, and require explicit confirmation before deletes, command execution, package installation, or network checks.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill is presented as a personal knowledge-management tool, but its manifest grants broad exec capability without constraining execution to narrowly scoped note-management tasks. In an agent environment, this unnecessarily expands the attack surface and could enable arbitrary command execution if a prompt, note content, or workflow triggers shell use.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The documented callback_url parameter introduces outbound network interaction that is not needed for basic personal knowledge capture and retrieval. In an agent context, this can be abused to exfiltrate note contents, metadata, or execution results to attacker-controlled endpoints.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The trigger phrases are extremely broad and overlap with ordinary conversation, making accidental activation more likely. Because the skill also advertises write and exec capabilities, ambiguous invocation increases the risk that benign user text could trigger file modification or other side effects unexpectedly.

Vague Triggers

Medium

Confidence: 78% confidence
Finding: The skill's activation conditions remain underspecified near the capability classification section, leaving unclear when the agent should interpret natural language as actionable commands. In a mixed-chat agent, that ambiguity can cause overbroad routing into a skill that may write files or invoke execution features.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The document declares write/exec capability and support for create/modify/delete operations without prominent risk disclosure. In practice, users may not realize the skill can alter local files or run commands, which weakens informed consent and makes harmful side effects more likely.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The example code writes Markdown files directly to the local filesystem using a filename derived from user-controlled title input, yet the documentation provides no warning or sanitization guidance. This normalizes direct local writes and could lead to unintended file creation, overwrites, or path-manipulation issues in copied implementations.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.