LLM Wiki - Personal Knowledge Base

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:27 AM UTC
• Version: 1.0.0

Overview

This looks like a real personal wiki skill, but it needs review because installation and URL ingestion use broad, mutable, and partly under-disclosed network behavior.

Review this before installing. Use it only for sources you are comfortable storing as local Markdown, avoid private or token-bearing URLs, do not enable always-download media for untrusted pages, and prefer local-only URL extraction. Do not follow curl-to-shell installer suggestions unless you independently trust and verify them. The package also appears incomplete because required source-registry TSV files are missing, so installation may fail or routing may not work as documented.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: install.sh:216

Finding

Remote installation instructions execute mutable network content directly in a shell

Content

View full analysis

/dev/null 2>&1; then warn "未找到 uv，跳过 wechat-article-to-markdown 安装" echo " 安装 uv：curl -LsSf https://astral.sh/uv/install.sh | sh" return 0 fi ``` ### Technical Analysis The installer does not execute these commands automatically; it prints them as recommended installation instructions. Nevertheless, the instructions pipe a mutable HTTPS response directly into `bash` or `sh`, without first saving, reviewing, or verifying the downloaded content. The referenced domains are recognizable official project domains, which reduces the likelihood of typo-squatting. However, HTTPS alone does not provide artifact integrity or protect against compromise of the upstream project, hosting account, DNS infrastructure, or content delivery system. The executed payload may also change after this Skill has been reviewed. This behavior is not required for the core wiki functionality. The Skill can continue with reduced adapter support when Bun or uv is unavailable, so direct remote shell execution exceeds the minimum installation mechanism necessary. ### Attack Path 1. Bun or uv is absent from the user's environment. 2. The installer prints a `curl | bash` or `curl | sh` command. 3. The user follows the installation recommendation. 4. An attacker who has compromised the referenced hosting infrastructure supplies a modified installer response. 5. The response is executed immediately by the user's shell. 6. The attacker obtains arbitrary code execution with all permissions available to the invoking user. ### Impact Assessment Successful exploitation permits arbitrary command execution under the user's account. This can ...[truncated 307 chars]

Remediation

View remediation

' bun-install.sh | shasum -a 256 -c - less bun-install.sh bash bun-install.sh ``` The checksum must come from an independently authenticated, version-specific release channel rather than from the same mutable response. ]]>

T08 · Insecure Dependencies

Error

• Location: install.sh:211

Finding

Unpinned dependencies and mutable Git sources are installed and executed

Content

View full analysis

/dev/null 2>&1; then (cd "$baoyu_dir" && bun install) || warn "bun install 失败，跳过（可手动粘贴文本作为替代）" elif command -v npm >/dev/null 2>&1; then (cd "$baoyu_dir" && npm install) || warn "npm install 失败，跳过（可手动粘贴文本作为替代）" ``` ```bash uv tool install "${WECHAT_TOOL_URL}" \ || warn "wechat-article-to-markdown 安装失败（可手动安装：uv tool install ${WECHAT_TOOL_URL}）" ``` ```bash WECHAT_TOOL_URL="git+https://github.com/jackwener/wechat-article-to-markdown.git" ``` ```markdown 3. Resolve `${BUN_X}` runtime: if `bun` installed → `bun`; if `npx` available → `npx -y bun`; else suggest installing bun ``` ```json "dependencies": { "@mozilla/readability": "^0.6.0", "baoyu-chrome-cdp": "file:./vendor/baoyu-chrome-cdp", "defuddle": "^0.12.0", "jsdom": "^24.1.3", "linkedom": "^0.18.12", "turndown": "^7.2.2", "turndown-plugin-gfm": "^1.0.2" } ``` ```python #!/usr/bin/env -S uv run --script # /// script # requires-python = ">=3.10" # dependencies = ["youtube-transcript-api>=1.0.0"] # /// ``` ### Technical Analysis The project contains no reviewed lockfile in the supplied directory structure. Installation therefore resolves JavaScript dependencies from mutable semantic-version ranges. The YouTube adapter accepts any `youtube-transcript-api` version at or above 1.0.0, including future major releases. The WeChat adapter is installed directly from an unpinned Git repository rather than a reviewed commit. The Skill instructions also permit `npx -y bun`, which downloads and executes a package without interactive approval. Package installation can execute lifecycle scripts or install ...[truncated 1669 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: deps/baoyu-url-to-markdown/scripts/main.ts:100

Finding

Automatic hosted fallback discloses complete target URLs to a third party

Content

View full analysis

{ const apiUrl = buildDefuddleApiUrl(targetUrl); const response = await fetch(apiUrl, { headers: { accept: "text/markdown,text/plain;q=0.9,*/*;q=0.1", }, }); ``` ```ts } catch (error) { const primaryError = error instanceof Error ? error.message : String(error); console.warn(`Primary capture failed: ${primaryError}`); console.warn("Trying defuddle.md API fallback..."); try { const remoteResult = await fetchDefuddleApiMarkdown(args.url); outputPath = args.output || await generateOutputPath(args.url, remoteResult.title, args.outputDir); await mkdir(path.dirname(outputPath), { recursive: true }); document = remoteResult.markdown; conversionMethod = "defuddle-api"; fallbackReason = `Local browser capture failed: ${primaryError}`; ``` ### Technical Analysis When local Chrome capture fails, the code automatically sends the complete target URL to `defuddle.md`. There is no separate consent check, no sensitivity classification, and no removal of query strings or fragments before transmission. URLs may contain signed download parameters, password-reset tokens, invitation tokens, document identifiers, internal hostnames, search terms, or other confidential information. Encoding the URL only changes its representation; it does not redact it from the hosted service or intermediary logs. A hosted extraction fallback is useful but is not necessary for the Skill's core functionality because local capture and ...[truncated 1187 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: deps/baoyu-url-to-markdown/scripts/media-localizer.ts:247

Finding

Untrusted Markdown media URLs can trigger internal-network requests and unbounded downloads

Content

View full analysis

(); const fmMatch = markdown.match(/^---\n([\s\S]*?)\n---/); if (fmMatch) { const coverMatch = fmMatch[1]?.match(FRONTMATTER_COVER_RE); if (coverMatch?.[2] && !seen.has(coverMatch[2])) { seen.add(coverMatch[2]); candidates.push({ url: coverMatch[2], hint: "image" }); } } MARKDOWN_LINK_RE.lastIndex = 0; let match: RegExpExecArray | null; while ((match = MARKDOWN_LINK_RE.exec(markdown))) { const label = match[1] ?? ""; const rawUrl = match[3] ?? ""; if (!rawUrl || seen.has(rawUrl)) continue; seen.add(rawUrl); candidates.push({ url: rawUrl, hint: label.startsWith("![") ? "image" : "unknown", }); } return candidates; } ``` ```ts for (const candidate of candidates) { try { const response = await fetch(candidate.url, { method: "GET", redirect: "follow", headers: { "user-agent": DOWNLOAD_USER_AGENT, }, }); if (!response.ok) { log(`[url-to-markdown] Skip media (${response.status}): ${candidate.url}`); continue; } const sourceUrl = response.url || candidate.url; const contentType = normalizeContentType(response.headers.get("content-type")); const extension = resolveExtensionFromUrl(sourceUrl) ?? resolveExtensionFromUrl(candidate.url); const kind = resolveMediaKind(sourceUrl, contentType, extension, candidate.hint); if (!kind) { continue; } const outputExtension = resolveOutputExtension(contentType, extension, kind); const n ...[truncated 3351 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (51)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

Even if part of the finding is exaggerated, the skill clearly instructs filesystem mutation such as initializing directories and writing wiki files while presenting itself primarily as a content-organization assistant. Silent or under-disclosed local state creation is a real risk because it can alter user environments and persist sensitive processed content.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Even if part of the finding is exaggerated, the skill clearly instructs filesystem mutation such as initializing directories and writing wiki files while presenting itself primarily as a content-organization assistant. Silent or under-disclosed local state creation is a real risk because it can alter user environments and persist sensitive processed content.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

Even if part of the finding is exaggerated, the skill clearly instructs filesystem mutation such as initializing directories and writing wiki files while presenting itself primarily as a content-organization assistant. Silent or under-disclosed local state creation is a real risk because it can alter user environments and persist sensitive processed content.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Even if part of the finding is exaggerated, the skill clearly instructs filesystem mutation such as initializing directories and writing wiki files while presenting itself primarily as a content-organization assistant. Silent or under-disclosed local state creation is a real risk because it can alter user environments and persist sensitive processed content.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Even if part of the finding is exaggerated, the skill clearly instructs filesystem mutation such as initializing directories and writing wiki files while presenting itself primarily as a content-organization assistant. Silent or under-disclosed local state creation is a real risk because it can alter user environments and persist sensitive processed content.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Even if part of the finding is exaggerated, the skill clearly instructs filesystem mutation such as initializing directories and writing wiki files while presenting itself primarily as a content-organization assistant. Silent or under-disclosed local state creation is a real risk because it can alter user environments and persist sensitive processed content.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Even if part of the finding is exaggerated, the skill clearly instructs filesystem mutation such as initializing directories and writing wiki files while presenting itself primarily as a content-organization assistant. Silent or under-disclosed local state creation is a real risk because it can alter user environments and persist sensitive processed content.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Even if part of the finding is exaggerated, the skill clearly instructs filesystem mutation such as initializing directories and writing wiki files while presenting itself primarily as a content-organization assistant. Silent or under-disclosed local state creation is a real risk because it can alter user environments and persist sensitive processed content.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Even if part of the finding is exaggerated, the skill clearly instructs filesystem mutation such as initializing directories and writing wiki files while presenting itself primarily as a content-organization assistant. Silent or under-disclosed local state creation is a real risk because it can alter user environments and persist sensitive processed content.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Even if part of the finding is exaggerated, the skill clearly instructs filesystem mutation such as initializing directories and writing wiki files while presenting itself primarily as a content-organization assistant. Silent or under-disclosed local state creation is a real risk because it can alter user environments and persist sensitive processed content.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Even if part of the finding is exaggerated, the skill clearly instructs filesystem mutation such as initializing directories and writing wiki files while presenting itself primarily as a content-organization assistant. Silent or under-disclosed local state creation is a real risk because it can alter user environments and persist sensitive processed content.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Even if part of the finding is exaggerated, the skill clearly instructs filesystem mutation such as initializing directories and writing wiki files while presenting itself primarily as a content-organization assistant. Silent or under-disclosed local state creation is a real risk because it can alter user environments and persist sensitive processed content.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · install.sh (reported line 216)May include surrounding context.

sh

(cd "$baoyu_dir" && npm install) || warn "npm install 失败，跳过（可手动粘贴文本作为替代）"
  else
    warn "未找到 bun 或 npm，无法安装 Node 依赖"
    echo "  推荐安装 bun：curl -fsSL https://bun.sh/install | bash"
    return 0
  fi

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file content is entirely in Chinese and gives operational instructions in that language, but it does not offer the user an alternative language or indicate that the skill is intentionally limited to a Chinese-speaking context. Under the stated policy, imposing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The operational instructions in this entry file are written entirely in Chinese, which imposes a language choice on users without opt-in. Under the stated policy, language constraints should either offer user choice or be clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README explicitly tells users to hand the repository to an agent and let it perform installation by executing shell commands. In an agent-skill context, this is risky because it encourages autonomous code execution and filesystem modification before the user has reviewed what the installer does, increasing the chance of unintended changes or supply-chain abuse if the repo or dependencies are compromised.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill instructs the agent to invoke shell commands, read environment-dependent paths, and access network-capable helper tools, but it does not declare any explicit tool scope or permission boundary. This creates hidden capability expansion: a reviewer or runtime may treat the skill as low-risk text guidance while it actually performs filesystem mutation, process execution, and remote content retrieval.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The routing guidance says bare URLs or files should default to ingest, which conflicts with the earlier requirement that the skill only trigger for explicit knowledge-base intent. This broadens activation to ambiguous inputs and can cause unintended network retrieval, local file reads, or wiki writes when a user merely shares a link or document for another purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs writing to ~/.llm-wiki-path and other persistent wiki files under user-controlled or default home-directory paths without a strong upfront warning about those side effects. Persistent writes to the home directory can surprise users, leak sensitive path information, and leave durable state that influences future executions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest description is written entirely in Chinese, which indicates a language-specific skill presentation without any indication that users can choose another language or that the skill is intended only for a Chinese-speaking region. Under the policy rule, forcing a specific language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The skill instructs the agent to resolve the runtime as npx -y bun when bun is not installed, but does not pin a specific version. That means execution depends on whatever package/version is current at invocation time, creating a supply-chain risk where a compromised, replaced, or breaking upstream package could execute arbitrary code in the agent environment.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · deps/baoyu-url-to-markdown/SKILL.md (reported line 76)May include surrounding context.

md

### First-Time Setup (BLOCKING)

**CRITICAL**: When EXTEND.md is not found, you **MUST use `AskUserQuestion`** to ask the user for their preferences before creating EXTEND.md. **NEVER** create EXTEND.md with defaults without asking. This is a **BLOCKING** operation — do NOT proceed with any conversion until setup is complete.

Use `AskUserQuestion` with ALL questions in ONE call:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 72% confidence

Finding

The skill instructs the agent to create and persist EXTEND.md preferences in either the project directory or the user's home directory. Persisting settings across sessions can be risky because later runs may silently inherit prior choices—such as media downloading or output locations—causing unexpected behavior, privacy issues, or writes to sensitive locations if the stored configuration is modified or planted by another party.

Content

Scanner excerpt · deps/baoyu-url-to-markdown/SKILL.md (reported line 76)May include surrounding context.

md

### First-Time Setup (BLOCKING)

**CRITICAL**: When EXTEND.md is not found, you **MUST use `AskUserQuestion`** to ask the user for their preferences before creating EXTEND.md. **NEVER** create EXTEND.md with defaults without asking. This is a **BLOCKING** operation — do NOT proceed with any conversion until setup is complete.

Use `AskUserQuestion` with ALL questions in ONE call:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill includes a hosted fallback to https://defuddle.md/<url> but does not require an explicit user warning or consent before using it. This can leak the target URL—and potentially sensitive browsing targets or authenticated-resource identifiers—to a third-party service, which is especially risky in a personal knowledge-base workflow that may process private or internal links.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

When local capture fails, the code sends the user-supplied target URL to defuddle.md and retrieves processed markdown from that third-party service. In a knowledge-base ingestion context, this can disclose browsing targets and potentially private or internal resources to an undeclared external processor, which is especially risky if users ingest sensitive, authenticated, or non-public content.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: deps/baoyu-url-to-markdown/scripts/vendor/baoyu-chrome-cdp/src/index.test.ts:89

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: deps/baoyu-url-to-markdown/scripts/vendor/baoyu-chrome-cdp/src/index.ts:220

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: deps/baoyu-url-to-markdown/scripts/vendor/baoyu-chrome-cdp/src/index.ts:97