Security audit

乐享知识库

Security checks for vulnerabilities and agentic risk

Overview

This Lexiang skill matches its knowledge-base purpose, but it should be reviewed because it can upload local files and mutate or delete live knowledge-base data with broad triggers and incomplete safety guardrails.

Install only if you intend to let the agent operate on a Lexiang workspace. Use a least-privilege token, protect the local MCP config, verify the publisher/package integrity because the inspected SKILL.md hash differs from the attestation, and require the agent to show exact targets, file lists, destinations, and affected records before uploads, syncs, deletes, schema changes, or meeting imports.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (19)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill clearly instructs the agent to use MCP tools and perform write/edit/upload actions, but it does not declare corresponding permissions in a machine-readable way. This creates a transparency and policy-enforcement gap: a reviewer or runtime may underestimate the skill’s ability to access networked services and modify remote content.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The skill instructs the agent to use local shell commands (`wc`, `stat`, and especially `curl --data-binary @<path>`) to access and transmit local files outside MCP tool boundaries. This expands the agent from knowledge-base operations into arbitrary local file access and outbound network exfiltration, which is dangerous if a user or prompt induces selection of sensitive paths.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The activation description is broad enough to trigger on generic phrases like 'knowledge base' or 'my knowledge base,' which can cause the skill to activate outside clearly intended Lexiang-specific contexts. Overbroad activation increases the chance that the agent routes unrelated user requests into a skill that can read, write, and edit external content.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The invocation rule repeats ambiguous triggers and instructs the agent to read the skill whenever generic platform/content phrases appear, without strong disambiguation. In a skill with write/edit capabilities, ambiguous routing can lead to unintended access to enterprise knowledge content or accidental modification workflows.

Missing User Warnings

Medium

Confidence: 79% confidence
Finding: The documentation explicitly guides the agent to retrieve full comment details including the `content` field, which may contain sensitive user-generated information, but it provides no caution about privacy, access control, minimization, or safe display. In an MCP skill that reads enterprise knowledge-base comments, this omission can lead to unnecessary exposure of private discussion content to users or downstream systems.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The instructions enable importing external Tencent Meeting recordings into a knowledge base but provide no guidance to verify authorization, participant consent, confidentiality, or destination access controls before ingestion. In a knowledge-management skill, this omission can lead to accidental exfiltration or over-sharing of sensitive meeting content, especially because the workflow normalizes broad import and re-import actions.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The documentation tells the agent to PUT raw local file contents to a returned remote `upload_url` without any explicit warning, consent checkpoint, or validation of what file is being sent. In practice, this can cause silent exfiltration of sensitive local data if the file path is influenced by adversarial input or if the upload URL is untrusted or mis-bound.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The document instructs syncing a local folder to a remote knowledge base and storing detailed synchronization metadata locally, but it does not warn users that potentially sensitive local files will be transmitted off-device or that a state file containing file paths and remote identifiers will be written to disk. In a skill that may be invoked for personal or project knowledge bases, this omission can cause inadvertent disclosure of confidential content or metadata, especially if users point it at broad directories or commit the state file into source control.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The file provides multiple examples of document-writing and structure-modifying MCP calls without any nearby warning that these operations mutate user content. In an agent skill context, copyable examples can normalize unsafe invocation patterns and increase the chance an agent performs write actions without explicit user confirmation, potentially causing unintended edits or content creation in a knowledge base.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs users to place a bearer token directly into mcp.json, which stores credentials in plaintext on disk. Even though it warns not to echo the token in chat, it does not warn about local secret storage risks or recommend safer secret-handling mechanisms, so the token may be exposed through local compromise, backups, logs, or accidental file sharing.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger guidance encourages the skill to infer feedback intent from broad complaint-like phrases such as '为什么不能...' or '太麻烦了...', which can cause the agent to pivot into issue-drafting or repository-feedback workflows without a clear, task-specific user request. In a skill that may interact with external feedback channels or maintenance flows, this broad activation increases the risk of unnecessary data collection, unwanted workflow escalation, and confusing the user's intent.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger conditions are broad and include common phrases around knowledge bases and tables, which can cause the skill to activate in contexts the user did not intend. Because this skill exposes read, write, edit, and delete operations on structured data, accidental invocation increases the chance of unauthorized or unintended data modification.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The document advertises deletion and schema-modification capabilities but does not require explicit user confirmation, dry-run preview, or rollback guidance before destructive actions. In this context, the skill can delete records, fields, views, or alter table schemas, so a mistaken or adversarial prompt could cause irreversible data loss or service disruption.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The README documents synchronization and upload workflows that can modify remote knowledge-base content, but it does not prominently warn users that these actions may create, overwrite, or update content in a live workspace. In an AI-assisted MCP context, unclear documentation increases the risk of accidental destructive or unauthorized changes because users may treat generated plans as safe to execute without understanding their effect on remote data.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The script scans a local folder, computes sync actions, and prepares MCP upload calls that would transmit local file contents and metadata to a remote knowledge base. Although this appears to be intended functionality, there is no explicit consent prompt, destination verification, or strong safety guardrail at the point where data is staged for upload, which creates a real risk of accidental exfiltration of sensitive local files if the script is invoked on the wrong directory or with an incorrect target entry.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The folder scan recursively enumerates files and prepares them for upload, which can unintentionally include a large set of local documents with only minimal exclusions. In the context of a knowledge-base upload skill, this increases the risk of accidental bulk exfiltration of sensitive files if the user points the tool at a broad directory or misunderstands what will be included.

Ssd 3

Medium

Confidence: 92% confidence
Finding: The skill tells the assistant to read existing configuration from mcp.json and 'display existing configuration' back to the user with token masking. Reading secrets from local config and rendering them into conversational output expands the exposure surface, and masking guidance is brittle because implementations may partially leak tokens, URLs, tenant identifiers, or other sensitive metadata.

MCP Config Access

High

Category: Agent Snooping
Content: **返回值**：包含新文件的 `entry_id`，上传完成。按 `references/base.md` 中的**链接生成规则**拼接访问链接返回给用户。 > `{company_from}` 优先从 mcp.json `url` 提取，其次取 `whoami().company.code`。 ---
Confidence: 81% confidence
Finding: The skill directs the agent to read `mcp.json` configuration values to derive `{company_from}`, which encourages access to local configuration/secrets beyond normal tool-mediated data flow. Even though the cited field is only a URL, permitting config-file inspection establishes a pattern of local sensitive-file access that may expose credentials, endpoints, or tenant metadata.

MCP Config Access

High

Category: Agent Snooping
Content: | 问题 | 平台 | 解决方案 | |------|------|---------| | 连接器未连接 | 内置连接器平台 | 在客户端「集成」页面重新授权 | | 连接无响应 | 其他平台 | 确认 mcp.json 中 URL 包含 `company_from` 且格式正确 | | 401 未授权 | 其他平台 | token 过期或租户不匹配，参见上方「AccessToken 生命周期管理」 | | 参数报错 | 所有平台 | 执行 `get_tool_schema(tool_name="xxx")` 获取最新参数定义 | | 手动 MCP 与连接器冲突 | 内置连接器平台 | 从 mcp.json 删除 lexiang 手动条目，仅保留连接器 |
Confidence: 82% confidence
Finding: The skill repeatedly instructs the assistant to access and parse mcp.json to extract company_from and other connection details. Accessing local MCP configuration is sensitive because such files commonly contain tokens, headers, and endpoint data; in this skill's context, the config access is operationally related to setup, which makes the intent benign, but it still increases the risk of secret exposure or over-collection of local data.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/test_upload_files.py:28