Security audit

Knowledge Base Ingestion

Security checks for vulnerabilities and agentic risk

Overview

The skill’s knowledge-base ingestion purpose is clear, but it asks users to run missing external Python scripts that are not pinned or verifiable while handling potentially sensitive document and vector-database data.

Review this skill carefully before installing. Only use it with scripts you obtained from a trusted, pinned source, verify their contents or checksum, restrict KB_DIR to the exact documents you intend to index, and use least-privileged vector-database credentials. Avoid running it on broad home, project, or shared directories until the path validation and dependency provenance are tightened.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:16
Finding: Execution of Unverifiable External Scripts
Content: View full analysis
⚠️ **外部依赖声明**：本 Skill 的核心脚本 `scripts/knowledge-ingest.py` 不包含在本目录中。 > 它是一个独立的 Python 工具，需从项目仓库单独获取或根据本 Skill 描述的接口自行实现。 ``` ```bash # 方式 A：自动下一批（推荐，从断点续跑） python3 scripts/knowledge-ingest.py # 方式 B：指定单个客户（调试或重跑） python3 scripts/knowledge-ingest.py --client <客户名> # 方式 C：查看当前状态 python3 scripts/knowledge-ingest.py --status # 方式 D：重置进度（从头重跑，慎用！） python3 scripts/knowledge-ingest.py --reset ``` ```bash # 使用搜索脚本做语义检索测试（选取 3 条典型查询） python3 scripts/kg_search.py "你的测试查询1" --top 5 python3 scripts/kg_search.py "你的测试查询2" --top 5 python3 scripts/kg_search.py "你的测试查询3" --top 5 ``` ### Technical Analysis The project contains only `SKILL.md`; neither `scripts/knowledge-ingest.py` nor `scripts/kg_search.py` is available for review. Nevertheless, the Skill instructs the Agent to execute both scripts directly with Python. The documentation does not provide an authoritative source URL, immutable revision, cryptographic checksum, signature, trusted publisher identity, or other integrity-verification procedure. It also permits the primary script to be obtained separately or independently implemented. Consequently, the actual code executed under the documented filenames can differ from the behavior reviewed in this audit. The ingestion script is expected to receive access to the knowledge-base directory, vector-database configuration, connection credentials, and ingestion state. A malicious or compromised replacement would execute with all filesystem, environment, network, and database privileges granted to the invoking Agent. The separate `kg_search.py` dependency is not even identified in the external-dependency warning. ### Attack Path 1. An attacker supplies, replaces, or compromises `scripts/knowledge-ingest.py` or `scripts/kg_search.py`. 2. The repla ...[truncated 1254 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: SKILL.md:84
Finding: Unsafe Shell Expansion of the Knowledge-Base Directory
Content: View full analysis
1MB，可能灌入失败） find $KB_DIR -type f -size +1M -name "*.md" # 3. 查看目录结构 ls -la $KB_DIR ``` ### Technical Analysis `$KB_DIR` is expanded without quotation marks or prior validation. In POSIX-style shells, an unquoted variable is subject to field splitting and pathname expansion. A directory containing spaces can therefore become multiple arguments, while wildcard characters can expand to unrelated paths. The documentation also does not require `KB_DIR` to be non-empty, canonicalized, readable, or constrained to an approved root before these commands run. This can cause the pre-scan to enumerate a broader or different set of files than the user intended. The resulting file counts may then be presented at the confirmation checkpoint as if they represented the intended ingestion scope. This issue does not itself establish direct data exfiltration or command execution through shell metacharacters; ordinary metacharacters produced by variable expansion are not reparsed as shell syntax. The confirmed risks are argument splitting, glob expansion, unintended option/path interpretation, and inaccurate scope validation. ### Attack Path 1. `KB_DIR` is configured with whitespace, wildcard characters, or an otherwise malformed path. 2. The shell expands the unquoted value into multiple path arguments or matching filesystem entries. 3. `find` and `ls` enumerate directories outside the intended knowledge-base scope or fail in a misleading manner. 4. The Agent reports incorrect pre-scan totals at the user confirmation checkpoint. 5. If the external ingestion script interprets the same configuration without stronger validation, the user may approve process ...[truncated 584 chars]
Remediation: View remediation
&2 exit 1 fi find "$KB_DIR" -type f | wc -l find "$KB_DIR" -type f | sed 's/.*\.//' | sort | uniq -c | sort -rn find "$KB_DIR" -type f -size +1M -name '*.md' ls -la -- "$KB_DIR" ``` Additionally: 1. Resolve `KB_DIR` to a canonical absolute path before scanning. 2. Verify that the canonical path is beneath an administrator-approved knowledge-base root. 3. Reject unexpected roots such as `/`, the Agent's home directory, or the project root unless explicitly approved. 4. Display the canonical path and representative included/excluded paths at Checkpoint #1. 5. Require downstream ingestion code to repeat the same validation rather than trusting the pre-scan. 6. Use a fixed allowlist of accepted document extensions and prevent symbolic-link traversal where it is not required. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill name and description are presented only in Chinese (displayName and description), with no indication that the user can choose another language or that the skill is intended exclusively for a Chinese-speaking environment. This is a natural-language locale policy concern because it imposes a language preference without explicit opt-in or justification.
Content: No source excerpt is available for this finding.