Security audit
Ai Intelligent Knowledge Qa
Security checks for vulnerabilities and agentic risk
Overview
The submitted skill is a simple knowledge-QA description with no executable code in the package, though users should inspect the external GitHub app before running it.
This package itself looks benign. Before installing, inspect the referenced GitHub repository and Python dependencies because the actual application code is outside the scanned package. Be careful before connecting GPT, WeChat, Web, or API channels that may process private knowledge-base content or require credentials.
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Static analysis
No suspicious patterns detected.