Security audit

KnowMine

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent remote memory/search skill, but users should treat it as a cloud personal-knowledge service and be careful about what they save.

Install only if you are comfortable sending selected notes, memories, and profile-like summaries to KnowMine for remote storage and semantic search. Avoid saving secrets, credentials, regulated data, or highly sensitive personal information, and prefer a pinned installer version instead of `@latest` when available.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:46
Finding: Unpinned Third-Party Package Execution via npx
Content: View full analysis
Remediation: View remediation
install knowmine ``` 2. Do not use version ranges or distribution tags for security-sensitive installation instructions. 3. Where supported, verify the downloaded package using a published integrity hash, signature, provenance attestation, or trusted release checksum. 4. Document the expected package publisher, registry, exact version, and verification procedure so users can detect dependency confusion or registry substitution. 5. Review the selected package version, including lifecycle scripts and transitive dependencies, before recommending it. 6. Update the pinned version only through a controlled dependency-review process. 7. Advise users not to run the installer with administrative privileges and to use an isolated environment where practical. 8. In CI environments, use a lockfile or equivalent immutable dependency resolution and restrict installation-time network access to approved registries. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The description uses broad activation cues such as remembering things across conversations, saving notes, and carrying context between AI platforms, which could trigger the skill during ordinary user discussion rather than an explicit request to use a remote memory service. Because this skill has network access and persists user data, overbroad invocation increases the chance of unintentional transmission of sensitive information.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill encourages saving memories, notes, reflections, and generating profile summaries on a remote MCP server, but it does not prominently warn that conversation-derived content may be transmitted to and stored by an external service. In this context, the omission is especially risky because the skill is designed to accumulate personal knowledge over time, which can include sensitive personal, professional, or credential-adjacent information.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 84% confidence
Finding: The installation instruction uses npx clawhub@latest install knowmine, which pulls and executes the latest published package at runtime without pinning to a reviewed version. If the upstream package is compromised or a malicious release is published, users could execute attacker-controlled code during installation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.