Security audit

Knowledge Base Skill

Security checks across malware telemetry and agentic risk

Overview

This knowledge-base skill is mostly coherent, but its scripts can write or delete files outside the intended knowledge-base area if given crafted paths.

Review before installing. Use only simple business and image names with no slashes, absolute paths, or '..' segments; avoid delete commands until path containment and confirmation are added; and do not store screenshots containing passwords, tokens, customer data, or other sensitive information unless you are comfortable keeping it searchable locally.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The script stores the user-supplied original image path directly in the attachment metadata. This can expose sensitive filesystem locations such as home directories, temporary folders, network mounts, or internal application paths to downstream consumers of the knowledge base, and it is unnecessary for core image/OCR functionality once the file has been imported.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The delete_business function recursively removes a business directory with shutil.rmtree based on a user-controlled business_name joined directly under KB_ROOT, and there is no path normalization or containment check. An attacker who can supply a crafted business name such as path traversal segments could cause deletion outside the intended knowledge-base area, and even without traversal this exposes destructive capability beyond the stated search/management scope.

Description-Behavior Mismatch

Medium

Confidence: 98% confidence
Finding: The export_markdown function accepts an arbitrary output_path and writes knowledge-base contents there without constraining the destination. If an attacker controls that argument, they can overwrite or create files anywhere the process has access, which can lead to data loss, tampering, or writing sensitive exported data into unintended locations.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The CLI export path is taken directly from user input and passed to export_markdown, enabling arbitrary path-based file writes. In the context of a knowledge-base skill, this capability is more dangerous because the exported content may include sensitive business Q&A and attachments-derived text, so misuse can both overwrite files and exfiltrate data to attacker-chosen locations.

Vague Triggers

Medium

Confidence: 85% confidence
Finding: The trigger phrases include very broad terms such as '知识库', 'knowledge base', and 'KB', which can easily appear in normal conversation and unintentionally activate the skill. Accidental activation is security-relevant here because the skill supports persistent storage, file attachment handling, OCR extraction, and command-like operations that may act on sensitive content.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill emphasizes image attachments and OCR text extraction but does not clearly warn users that uploaded screenshots and extracted text may contain passwords, tokens, personal data, or other sensitive information that will be stored and made searchable. Because the system persists both the image and OCR output, inadvertent disclosure risk is materially increased.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The documented command set includes business deletion as a normal operation without stating any confirmation, safeguard, or recovery requirement. In a skill that manages persistent knowledge bases, accidental or prompt-induced deletion could cause irreversible data loss across entire business datasets.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: `delete_image` constructs a filesystem path directly from untrusted `business_name` and `filename` and deletes it without validating that the resolved path stays under the attachments root. An attacker can supply path traversal sequences such as `../` to delete arbitrary files accessible to the process, making this more serious than a mere lack of confirmation prompt.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: Destructive deletion occurs immediately with no confirmation, preview, or safety interlock. In an agent or CLI setting, this increases the chance of accidental or socially engineered data destruction, especially because the operation removes entire directories recursively.

Missing User Warnings

Low

Confidence: 83% confidence
Finding: Markdown export writes directly to the specified path and silently overwrites existing files, with no warning to the user. While less severe than arbitrary path traversal itself, this still creates a realistic file-clobbering risk and can destroy unrelated files if the destination is mistaken or attacker-influenced.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.