Sdw Kb

• Outcome: Review
• Latest audit: Jun 11, 2026 at 9:23 AM UTC
• Version:
  1.0.0

Overview

This skill has a coherent knowledge-graph purpose, but it can persistently index local content and offers network, server, watch, and remote database modes with broad activation and limited guardrails.

Install only if you are comfortable with a skill that can index local folders into a persistent knowledge base. Use explicit /sdw-kb commands, review the target path before running, avoid sensitive repositories unless needed, and be cautious with add <url>, --neo4j-push, --mcp, --watch, and hook install because those modes can fetch remote content, transmit graph data, expose a graph to agents, or keep processing files over time.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill supports fetching arbitrary URLs and saving them into the knowledge-base workflow, which expands it from local graph generation into unrestricted network retrieval. That creates SSRF/privacy risks, can ingest attacker-controlled content, and may exfiltrate browsing intent or pull in sensitive internal resources if URL handling is not constrained.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: Direct Neo4j push introduces remote write capability beyond simple file-based graph generation. If invoked with attacker-influenced parameters or on sensitive corpora, it can transmit extracted data to an external database, creating confidentiality and integrity risks.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: Starting an MCP stdio server exposes the generated graph through a long-lived runtime/service interface not reflected in the core skill description. This increases attack surface and can enable unintended access patterns or data exposure from a persistent knowledge base.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: Watch mode and hook/integration features create ongoing automation that can repeatedly process files or modify developer workflow beyond a one-shot graph build. That persistence can surprise users, repeatedly ingest new data, and widen the blast radius if the skill is triggered in a sensitive repository.

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The trigger condition is overly broad and can activate on common user requests about knowledge graphs even without explicit invocation. For a skill that creates persistent storage, performs optional network actions, and can start services/hooks, accidental triggering materially increases the risk of unintended side effects.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill persistently writes knowledge bases and outputs under `~/.sdw/knowledge_bases/` and auto-creates directories, but this is not clearly disclosed up front in the description. Hidden persistence is risky because users may not realize local copies, reports, and derived graphs are being retained across sessions.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill includes network-dependent and service-like features such as URL fetch, Neo4j push, and MCP/watch functionality without a consolidated warning about transmission, exposure, or persistence. Users may assume a local-only graphing tool and inadvertently authorize external communication or broader data handling than expected.

VirusTotal

64/64 vendors flagged this skill as clean.