Ai Intelligent Knowledge Base

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:54 AM UTC
• Version: 1.0.0

Overview

This appears to be a knowledge-base app, but it asks users to download and run unpinned external code and gives little guidance for sensitive enterprise documents.

Review this skill before installing. Only run it from a trusted, pinned commit after reviewing the remote repository and its dependencies, preferably in an isolated environment with least-privilege credentials. Do not upload confidential, regulated, or broadly internal documents until storage, embedding retention, access controls, logging, and deletion behavior are clear.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:41

Finding

Mutable Remote Repository and Unpinned Dependencies Are Installed and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 41-44
Vulnerability Type: Remote payload retrieval and insecure software supply chain
Risk Level: High

Vulnerable Code

bash

git clone https://github.com/openclaw-skills/ai-intelligent-knowledge-base
cd ai-intelligent-knowledge-base
pip install -r requirements.txt
python app.py

Technical Analysis

The packaged skill does not contain the advertised application implementation. Instead, its installation instructions retrieve the application from an external Git repository and execute it without pinning the repository to a reviewed commit or verifying its integrity.

The subsequent pip install -r requirements.txt command also installs dependencies defined by the remotely retrieved repository. No dependency lock file, package hashes, signatures, or version constraints are available in the audited artifact. Consequently, neither the application code nor its transitive dependencies can be verified from this package.

Because the repository's default branch and dependency sources are mutable, the effective payload can change after this skill has been reviewed. A repository compromise, maintainer account compromise, malicious update, dependency confusion attack, or compromised upstream package could introduce attacker-controlled code.

Attack Path

1. An attacker compromises the referenced repository, a maintainer account, or one of the packages named in its remotely supplied requirements.txt.
2. The attacker adds malicious installation behavior, a malicious Python dependency, or malicious code to app.py.
3. A user follows the documented installation procedure and clones the current default branch without selecting a trusted commit.
4. pip install -r requirements.txt may execute attacker-controlled package build or installation logic.
5. The user runs python app.py, directly executing the remotely supplied payload.
6. The payload ...[truncated 712 chars]

Remediation

View remediation

Remediation Suggestions

1. Include the complete, reviewable application source code in the skill package rather than retrieving executable code at installation time.
2. If external retrieval is unavoidable, pin the Git checkout to a specific reviewed commit hash rather than relying on a mutable default branch.
3. Verify the downloaded source using a trusted cryptographic signature or an independently distributed checksum before installation or execution.
4. Commit a dependency lock file containing exact versions and cryptographic hashes. Install dependencies using hash verification, such as pip install --require-hashes.
5. Review and constrain transitive dependencies, and obtain packages only from explicitly configured trusted indexes.
6. Run installation and application processes under a dedicated, least-privileged account in an isolated environment or container without unnecessary secrets, host mounts, or network access.
7. Perform security review and malware scanning on the pinned application source and every dependency before publishing the skill.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill advertises enterprise knowledge management, semantic search, embeddings, and document storage, but it provides no warning about handling sensitive corporate documents, access control, data retention, or the privacy implications of vectorized content. In this context, users may upload confidential internal materials without understanding that semantic indexing and retrieval can broaden exposure or create secondary data stores containing sensitive information.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description is extremely generic and does not define clear boundaries for when the skill should activate or what tasks it is permitted to perform. In agent ecosystems, vague scope increases the risk of over-broad invocation, unintended handling of sensitive enterprise knowledge, and misuse in contexts the author did not explicitly constrain.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The natural-language content of the skill is presented exclusively in Chinese, including the description and usage sections. This may impose a language requirement on users without explicit opt-in or explanation of a region-specific scope.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.