Ontology Knowledge Graph Mgmt

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:56 AM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent, but its core workflow asks users to run missing external Python scripts without a trusted source or integrity checks.

Install only if you already trust the separate graph scripts and can verify their source. Do not run the documented Python or cron commands until the scripts come from an authoritative repository or pinned release with checksums, and prefer testing them in an isolated project account before using real graph data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16

Finding

Execution of Unpinned and Unaudited External Python Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 16–17 and 83–100
Vulnerability Type: Supply-chain risk from unspecified external executable dependencies
Risk Level: Medium

Complete Code Snippet

markdown

> ⚠️ **外部依赖声明**：本 Skill 引用的 `scripts/graph_sync.py`、`scripts/graph_vectorize.py`、`scripts/graph_search.py` 不包含在本目录中。
> 它们是与知识图谱绑定的独立 Python 工具集，需从项目仓库单独获取，或根据本 Skill 描述的接口自行实现。

bash

# 同步图谱数据到 SQLite
python3 scripts/graph_sync.py --sync

bash

# 为图谱内容生成向量索引
python3 scripts/graph_vectorize.py --index

bash

python3 scripts/graph_search.py "查询内容" --top 5

Technical Analysis

The Skill instructs users to execute three Python programs that are not included in the audited package. It states that these tools must be obtained separately from a project repository, but it does not identify an authoritative repository URL, trusted publisher, immutable version or commit, cryptographic checksum, or signature.

As a result, the effective executable behavior cannot be reviewed from this project and may vary according to where and when the scripts are obtained. An attacker could distribute malicious files under the expected names or compromise a mutable upstream source. Because Python executes module-level code immediately, merely invoking any substituted script is sufficient to run attacker-controlled code.

Attack Path

1. A user follows the Skill and searches for or otherwise obtains the missing graph scripts.
2. The user retrieves them from a malicious, compromised, or incorrect source because no authoritative source or integrity value is specified.
3. The malicious files use the expected names, such as graph_sync.py or graph_vectorize.py.
4. The user places the files under the local scripts/ directory.
5. The user runs one of the documented python3 scripts/... commands.
6. Python executes the substituted program with the user's privileges, allowin ...[truncated 693 chars]

Remediation

View remediation

Remediation Suggestions

1. Include the required scripts in the Skill package so their complete source can be audited together with the instructions.
2. If external distribution is necessary, specify one authoritative HTTPS repository controlled by the publisher.
3. Pin each dependency to an immutable release or commit rather than a branch or mutable download URL.
4. Publish and verify SHA-256 hashes or cryptographic signatures before execution.
5. Document a verification workflow that fails closed when a signature or checksum does not match.
6. Review the scripts for network access, subprocess execution, unsafe deserialization, secret handling, and filesystem write scope.
7. Run the tools with a dedicated least-privilege account and restrict access to unrelated credentials and files.
8. Test newly obtained scripts in an isolated environment before granting access to production graph data.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The display name and description are entirely in Chinese, and the rest of the skill instructions continue in Chinese without any indication that the skill is region-specific or that users may opt into another language. This creates a natural-language locale constraint that can violate organizational language-choice policy for general-purpose skills.

Content

No source excerpt is available for this finding.