LLM Wiki - Personal Knowledge Base

• Outcome: Review
• Latest audit: May 29, 2026 · 9:32 PM UTC
• Version: 1.0.0

Overview

This is a coherent local knowledge-base skill, but it needs review because URL ingestion can use browser-debugging capture, automatically fall back to an external service, and the installer can overwrite local skill directories.

Install only if you are comfortable with an agent writing and updating a local wiki and installing dependencies. Do not use it on private, authenticated, internal, or secret-bearing URLs unless you have reviewed or disabled the hosted defuddle.md fallback and understand that captured HTML/raw material may be stored locally. Use a dedicated browser profile for web capture and avoid custom --target-dir values unless you have verified the destination.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The fallback sends the user-supplied target URL to the undeclared third-party service defuddle.md, which can leak sensitive URLs, query parameters, internal endpoints, or browsing targets outside the local environment. Because this network exfiltration path is not disclosed in the skill description, users and operators may unknowingly expose private resources or data to an external service.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The script searches for an existing Chrome remote-debugging instance, attaches to it, creates a new target, and issues browser-control commands. Reusing an already-running debug-enabled browser is dangerous because it may share authenticated session state, cookies, and local access with other tabs, enabling unintended access to private resources or interaction with a highly privileged browser context.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README explicitly encourages users to hand the repository to an agent and let it install itself, including running shell commands. In an agent-skill context, this increases the chance of unreviewed code execution and persistent filesystem changes in user environments without clearly warning about trust boundaries, permissions, or the need to inspect installation scripts first.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The README describes Chrome debug-mode usage and automated extraction of web, WeChat, and YouTube content, but does not clearly warn that browser debugging can expose active session data and that extracted content may include private or account-bound information. In a knowledge-base ingestion tool, this creates a realistic privacy and credential-adjacent risk if users enable debugging on a logged-in browser without understanding the consequences.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The query trigger examples include generic phrases such as asking what something is or requesting a summary, which can overlap with ordinary conversation. That makes unintended activation more likely, causing the skill to read or operate on a local knowledge base when the user did not actually request wiki actions.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The digest workflow trigger phrases are broad enough to match normal requests like 'tell me about X' or 'analyze X deeply,' even outside a knowledge-base context. In this skill, unintended digest activation is more dangerous because it can create or modify persistent wiki content and perform broader searches across local files.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The skill is described in very broad terms ('Fetch any URL' and 'save a webpage as markdown') without strong invocation constraints or guardrails. In an agent setting, this increases the chance of the tool being triggered on untrusted, internal, or user-authenticated URLs, which can lead to unintended browsing, data capture, or processing of sensitive content.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill documents a hosted fallback to defuddle.md and general remote URL fetching, but does not clearly warn that page contents may be transmitted to an external service or that authenticated content could be exposed. Because the skill also supports login/wait-mode capture and saves rendered HTML, the absence of explicit disclosure materially raises the risk of leaking sensitive data off-host.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The function automatically downloads remote URLs found in Markdown and writes them to local disk with no consent gate, allowlist, or safety checks on source, size, or destination policy. In a knowledge-base ingestion workflow, this can cause unreviewed network access and persistence of attacker-controlled content, creating privacy, supply-chain, and storage-abuse risk even if the files are only media.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The installer unconditionally deletes the destination path with `rm -rf` before copying files, which can destroy an existing skill installation or any directory passed via `--target-dir`. Because `TARGET_DIR` is user-controlled and there is no overwrite confirmation, backup, or path safety check, a mistaken or maliciously influenced invocation can cause irreversible local data loss.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script automatically runs `bun install`, `npm install`, and `uv tool install`, which execute network-dependent package resolution and may trigger package lifecycle scripts or install unreviewed code. In a security-sensitive installer, doing this without explicit opt-in or a clear warning expands the trust boundary from the local bundle to remote registries and package maintainers.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: deps/baoyu-url-to-markdown/scripts/vendor/baoyu-chrome-cdp/src/index.test.ts:89

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: deps/baoyu-url-to-markdown/scripts/vendor/baoyu-chrome-cdp/src/index.ts:220

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: deps/baoyu-url-to-markdown/scripts/vendor/baoyu-chrome-cdp/src/index.ts:97