Security audit

火一五知识库技能(Karpathy)

Security checks for vulnerabilities and agentic risk

Overview

This skill is not malicious, but it needs review because it can persist and sync business knowledge to Odoo using broad triggers without clear confirmation or sanitization controls.

Install only if users understand that captured conversation, document, email, business, product, and customer-feedback content may be saved under memory/ and sent to the company Odoo knowledge base. Before use, add an explicit confirmation step for every write or sync, clarify trigger phrases, sanitize or escape HTML content, and limit any maintenance deletion to user-approved changes.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:81
Finding: Unescaped Knowledge Content Interpolated into Odoo HTML
Content: View full analysis

摘要

{摘要}

详细说明

{详细说明}

关键要点

{要点1}

{要点2}

""" category = "技术" # 或 "业务" / "产品" / "客户反馈" ``` ### Technical Analysis The Skill instructs the agent to extract knowledge from conversations and documents and interpolate that content directly into an HTML document. The placeholders for the title, summary, detailed description, and key points are not HTML-escaped or passed through an allowlist sanitizer before being submitted through `odoo_knowledge_create`. An attacker who controls or influences source material could include HTML elements, event-handler attributes, dangerous links, or other active markup. If this markup is preserved during extraction and Odoo does not reliably sanitize the submitted content, it may be stored as part of a knowledge article and rendered to subsequent viewers. The repository does not include the implementation of `odoo_knowledge_create` or Odoo's rendering configuration. Therefore, successful script execution depends on whether downstream sanitization is absent or insufficient. Nevertheless, the Skill itself establishes an unsafe untrusted-content-to-HTML flow and does not require any defensive validation. ### Attack Path 1. An attacker supplies a conversation message or document containing crafted HTML or active markup. 2. The Skill processes that source through its documented data-ingestion workflow. 3. The malicious value is retained in a field such as `{摘要}`, `{详细说明}`, `{要点1}`, or `{要点2}`. 4. The value is interpolated directly into the HTML assigned to `content`. 5. The resulting document is submitted to the company knowledge base through `odoo_knowledge_crea ...[truncated 1038 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill description does not warn users that invoked content may be written to local files under memory/ and synchronized to an external Odoo knowledge base. Without prominent disclosure and consent, users may reveal sensitive business, customer, or personal information under the mistaken assumption that the interaction is ephemeral.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases are broad and ambiguous, including common conversational expressions like '记一下' and generic terms like '知识库' or '更新知识库'. This can cause the skill to activate unintentionally and capture or persist content the user did not clearly consent to storing, especially since the skill writes to local memory and syncs to Odoo.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.