Security audit

Knowledge

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Chinese-language local knowledge-base helper, with some documentation mismatch and privacy considerations but no artifact-backed malicious behavior.

Install only if you expect a Chinese-language helper that can query and list previews from your local knowledge base and interact with a localhost integration service. Review the external openclaw_integration implementation before relying on it, because that helper is not included in this artifact.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 描述与代码部分一致：代码明确实现了文档检索、系统状态查看、统计、文档列表以及双轨模式切换。但存在实质性偏差。第一，帮助文本声称“直接上传文件即可添加到知识库”，而代码本身没有任何文件处理、上传、导入或投喂接口，仅是文本命令路由。第二，代码不只是本地知识库，还会切换并调用 AnythingLLM 对话模式，这使实际行为比“本地知识库集成”更广。综合来看，描述遗漏了实际的外部对话系统集成，同时又宣称了未实现的投喂能力，因此应判定为描述与行为不完全匹配。

Natural-Language Policy Violations

Medium

Confidence: 84% confidence
Finding: All user-facing natural-language strings and examples are written in Chinese, and the trigger matching logic is primarily based on Chinese phrases, but the file does not offer users a language option or state that the skill is intentionally region-specific. This can violate language/locale policy when a skill effectively requires a specific language without opt-in.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The document listing path returns document IDs and content previews to any caller who triggers list functionality, with no visible authorization, redaction, or sensitivity checks in this skill. In a knowledge-base context, previews can leak confidential document names or snippets, making this an information disclosure issue even if only partial content is exposed.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The manifest and module description mention '投喂' and the help text explicitly says files can be uploaded to add them to the knowledge base. However, this file contains no upload or ingestion handling at all; it only routes mode switching, querying, status, statistics, and document listing requests through handle_request.

Static analysis

No suspicious patterns detected.