Causal Graph Builder

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 2:16 AM UTC
• Version: 1.0.0

Overview

This skill locally builds a causal knowledge graph from scoped memory/log files and does not show hidden execution, exfiltration, or persistence beyond writing its graph output.

Install only if you want a local graph derived from your workspace memory files. Review or redact MEMORY.md and memory logs first, and do not enable the documented LLM extraction idea unless you are comfortable sending that text to the chosen model provider.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The file presents the skill instructions and description primarily in Chinese, which can effectively force a specific language on users. There is no indication that users may opt into another language or that the Chinese-only presentation is required for a region-specific or compliance-related reason.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly ingests logs, memory files, and task files, which commonly contain sensitive operational data, personal information, credentials, or internal project context. Because the description provides no warning, scoping, redaction guidance, or data-handling limits, users may unknowingly expose sensitive content during graph construction.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The LLM-based extraction flow sends raw text into a prompt without warning that the content may be transmitted to an external model provider. If logs or memory files contain secrets, personal data, or confidential business information, this can cause unintended third-party disclosure and retention outside the user's trust boundary.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The package description is written entirely in Chinese and does not indicate that users can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. This can violate language/locale policy when a skill implicitly enforces a language without opt-in or documented justification.

Static analysis

No suspicious patterns detected.