Local-first, agent-friendly Markdown knowledge base with a cross-platform CLI and web editor
AI Security Review
scanned 10d ago · by lpm-firewall-ai
The credential-exfiltration hint was not supported by an inspected transfer to an unrelated recipient. The explicit skill-repair command can modify agent skill directories, so this warrants a warning for agent configuration capability rather than a block.
This can add OpenKnowledge skill content to an agent's available context; the inspected code does not establish malicious behavior.
Mechanism
The command may copy bundled skill files into `.agents/skills` or supported editor skill directories when those host directories exist and the skill is missing.
AI rationale
The credential-exfiltration hint was not supported by an inspected transfer to an unrelated recipient. The explicit skill-repair command can modify agent skill directories, so this warrants a warning for agent configuration capability rather than a block.
Evidence
dist/cli.mjs
Decision evidence
public snapshot
AI called this Suspicious at 81.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
package.json exposes CLI commands; the inspected manifest has no npm install hook.
The explicit `ok repair-skills` command invokes skill repair, which can copy bundled skill files into agent skill directories.
The repair code skips absent host directories and existing skill copies; supported skill locations are declared in the bundle.
The flagged CLI location concerns removal of OpenKnowledge paths during deinitialization, not an install-time agent write.
The package bundle inventories pack commands, hooks, and MCP files as metadata.
Evidence against
The skill repair is invoked by an explicit CLI command and writes package-owned skill content; no unconsented install-hook trigger was found.
The inspected credential-related source did not establish a transfer to an unrelated recipient.
1import{ko as e}from"./dist-mO8anSf2.mjs";import{execFile as t}from"node:child_process";const n=new Set([`http:`,`https:`]),r=/[\u0000-\u0020\u007F-\u009F"'`\\&|<>^()$;{}[\]*?!~]/;f...
High
Child Process
Package source references child process execution.
87var t=null;try{t=new WebAssembly.Instance(new WebAssembly.Module(new Uint8Array([0,97,115,109,1,0,0,0,1,13,2,96,0,1,127,96,4,127,127,127,127,1,127,3,7,6,0,1,1,1,1,1,6,6,1,127,1,65,...
L88: changing to the minimum size of: 2`),this._maxSize=2)}record(e){this.updateByIncrement(e,1)}setStartTime(e){this.startTime=e}toPointValue(){return{hasMinMax:this._recordMinMax,min:...
L89: \t- OR - create a new view with the name ${e.name} and description '${e.description}' and InstrumentSelector ${r}
var t=null;try{t=new WebAssembly.Instance(new WebAssembly.Module(new Uint8Array([0,97,115,109,1,0,0,0,1,13,2,96,0,1,127,96,4,127,127,127,127,1,127,3,7,6,0,1,1,1,1,1,6,6,1,127,1,65,...
L88: changing to the minimum size of: 2`),this._maxSize=2)}record(e){this.updateByIncrement(e,1)}setStartTime(e){this.startTime=e}toPointValue(){return{hasMinMax:this._recordMinMax,min:...
L89: \t- OR - create a new view with the name ${e.name} and description '${e.description}' and InstrumentSelector ${r}
...
L97: causes have become circular...`;let o=r(e);return o?(t.add(e),a+`
L98: caused by: `+i(o,t)):a},a=e=>i(e,new Set),o=(e,t,i)=>{if(!n(e))return``;let a=i?``:e.message||``;if(t.has(e))return a+`: ...`;let s=r(e);if(s){t.add(e);let n=typeof e.cause==`funct...
L99: `:`
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
86*/
L87: var t=null;try{t=new WebAssembly.Instance(new WebAssembly.Module(new Uint8Array([0,97,115,109,1,0,0,0,1,13,2,96,0,1,127,96,4,127,127,127,127,1,127,3,7,6,0,1,1,1,1,1,6,6,1,127,1,65,...
L88: changing to the minimum size of: 2`),this._maxSize=2)}record(e){this.updateByIncrement(e,1)}setStartTime(e){this.startTime=e}toPointValue(){return{hasMinMax:this._recordMinMax,min:...
L89: \t- OR - create a new view with the name ${e.name} and description '${e.description}' and InstrumentSelector ${r}
...
L97: causes have become circular...`;let o=r(e);return o?(t.add(e),a+`
L98: caused by: `+i(o,t)):a},a=e=>i(e,new Set),o=(e,t,i)=>{if(!n(e))return``;let a=i?``:e.message||``;if(t.has(e))return a+`: ...`;let s=r(e);if(s){t.add(e);let n=typeof e.cause==`funct...
L99: `:`
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
1Cross-file remote execution chain: dist/dist-mO8anSf2.mjs spawns dist/chunk-5QMZ5MUS-BuB3i_B5.mjs; helper contains network access plus dynamic code execution.
L1: import{a as e,i as t,n,o as r,r as i,t as a}from"./rolldown-runtime-tZXQYakl.mjs";import{$ as o,$a as s,$c as c,$d as l,$i as u,$l as d,$n as f,$o as p,$r as m,$s as h,$t as g,$u a...
L2: `,t),r=n===-1?e.length:n;if(r>t&&e[r-1]===`\r`&&--r,r-t>1024)return 0;let i=e.slice(t,r);return i.length===0||!joe.test(i)&&!Moe.test(i)?0:i.length}const pc=/&#(?:x[0-9A-Fa-f]+|X[0...
...
L66: </div>`}];function Boe(e){return["```html preview",e.html,"```"].join(`
L67: `)}const Voe=[{name:`--chart-1`,light:`oklch(0.62 0.19 259)`,dark:`oklch(0.72 0.14 259)`},{name:`--chart-2`,light:`oklch(0.58 0.14 145)`,dark:`oklch(0.73 0.13 145)`},{name:`--char
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
1import{t as e}from"./chunk-DXB73IDG-MLBj3lvC.mjs";function t(){let e=[{prop:`Function`,target:globalThis,violationType:`function_constructor`,strategy:`throw`,reason:`Function cons...
L2: `);n.register(`data:text/javascript,${encodeURIComponent(e)}`),i.importHooksRegistered=!0}}catch(e){console.debug(`[DefenseInDepthBox] Could not register import() hooks:`,e instanc...
dist/chunk-5QMZ5MUS-B37CnsNb.mjs#virtual:string-array:round1View on unpkg · L1
1import{t as e}from"./chunk-DXB73IDG-MLBj3lvC.mjs";function t(){let e=[{prop:`Function`,target:globalThis,violationType:`function_constructor`,strategy:`throw`,reason:`Function cons...
L2: `);n.register(`data:text/javascript,${encodeURIComponent(e)}`),i.importHooksRegistered=!0}}catch(e){console.debug(`[DefenseInDepthBox] Could not register import() hooks:`,e instanc...
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/cli.mjs:
import{o as e}from"./rolldown-runtime-tZXQYakl.mjs";import{$d as t,$l as n,Ac as r,Ao as i,Co as a,Dd as o,Df as s,Ed as c,Ef as l,Hc as u,Ic as d,Id as f,Io as p,Ja as m,Jl as h,J...
`)}const ga={out:e=>process.stdout.write(`${e}\n`),err:e=>process.stderr.write(`${e}\n`)},_a=T({title:C().optional(),error:C().optional(),message:C().optional()});function va(e){re...
`)){let e=n.trim();if(e===``)continue;let r=e.indexOf(`=`);r!==-1&&(t[e.slice(0,r)]=e.slice(r+1))}return t}function wa(e){return new Promise((t,n)=>{let r=[];e.on(`data`,e=>r.push(...
`;return`${I(`Error:`)} this project's git remote is ${r}, which is not a Git
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
87var t=null;try{t=new WebAssembly.Instance(new WebAssembly.Module(new Uint8Array([0,97,115,109,1,0,0,0,1,13,2,96,0,1,127,96,4,127,127,127,127,1,127,3,7,6,0,1,1,1,1,1,6,6,1,127,1,65,...
L88: changing to the minimum size of: 2`),this._maxSize=2)}record(e){this.updateByIncrement(e,1)}setStartTime(e){this.startTime=e}toPointValue(){return{hasMinMax:this._recordMinMax,min:...
L89: \t- OR - create a new view with the name ${e.name} and description '${e.description}' and InstrumentSelector ${r}
87var t=null;try{t=new WebAssembly.Instance(new WebAssembly.Module(new Uint8Array([0,97,115,109,1,0,0,0,1,13,2,96,0,1,127,96,4,127,127,127,127,1,127,3,7,6,0,1,1,1,1,1,6,6,1,127,1,65,...
L88: changing to the minimum size of: 2`),this._maxSize=2)}record(e){this.updateByIncrement(e,1)}setStartTime(e){this.startTime=e}toPointValue(){return{hasMinMax:this._recordMinMax,min:...
L89: \t- OR - create a new view with the name ${e.name} and description '${e.description}' and InstrumentSelector ${r}
...
L97: causes have become circular...`;let o=r(e);return o?(t.add(e),a+`
L98: caused by: `+i(o,t)):a},a=e=>i(e,new Set),o=(e,t,i)=>{if(!n(e))return``;let a=i?``:e.message||``;if(t.has(e))return a+`: ...`;let s=r(e);if(s){t.add(e);let n=typeof e.cause==`funct...
L99: `:`
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
86*/
L87: var t=null;try{t=new WebAssembly.Instance(new WebAssembly.Module(new Uint8Array([0,97,115,109,1,0,0,0,1,13,2,96,0,1,127,96,4,127,127,127,127,1,127,3,7,6,0,1,1,1,1,1,6,6,1,127,1,65,...
L88: changing to the minimum size of: 2`),this._maxSize=2)}record(e){this.updateByIncrement(e,1)}setStartTime(e){this.startTime=e}toPointValue(){return{hasMinMax:this._recordMinMax,min:...
L89: \t- OR - create a new view with the name ${e.name} and description '${e.description}' and InstrumentSelector ${r}
...
L97: causes have become circular...`;let o=r(e);return o?(t.add(e),a+`
L98: caused by: `+i(o,t)):a},a=e=>i(e,new Set),o=(e,t,i)=>{if(!n(e))return``;let a=i?``:e.message||``;if(t.has(e))return a+`: ...`;let s=r(e);if(s){t.add(e);let n=typeof e.cause==`funct...
L99: `:`
1import{t as e}from"./chunk-DXB73IDG-MLBj3lvC.mjs";function t(){let e=[{prop:`Function`,target:globalThis,violationType:`function_constructor`,strategy:`throw`,reason:`Function cons...
L2: `);n.register(`data:text/javascript,${encodeURIComponent(e)}`),i.importHooksRegistered=!0}}catch(e){console.debug(`[DefenseInDepthBox] Could not register import() hooks:`,e instanc...
dist/chunk-5QMZ5MUS-B37CnsNb.mjs#virtual:string-array:round1View on unpkg · L1
1import{t as e}from"./chunk-DXB73IDG-MLBj3lvC.mjs";function t(){let e=[{prop:`Function`,target:globalThis,violationType:`function_constructor`,strategy:`throw`,reason:`Function cons...
L2: `);n.register(`data:text/javascript,${encodeURIComponent(e)}`),i.importHooksRegistered=!0}}catch(e){console.debug(`[DefenseInDepthBox] Could not register import() hooks:`,e instanc...
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/cli.mjs:
import{o as e}from"./rolldown-runtime-tZXQYakl.mjs";import{$d as t,$l as n,Ac as r,Ao as i,Co as a,Dd as o,Df as s,Ed as c,Ef as l,Hc as u,Ic as d,Id as f,Io as p,Ja as m,Jl as h,J...
`)}const ga={out:e=>process.stdout.write(`${e}\n`),err:e=>process.stderr.write(`${e}\n`)},_a=T({title:C().optional(),error:C().optional(),message:C().optional()});function va(e){re...
`)){let e=n.trim();if(e===``)continue;let r=e.indexOf(`=`);r!==-1&&(t[e.slice(0,r)]=e.slice(r+1))}return t}function wa(e){return new Promise((t,n)=>{let r=[];e.on(`data`,e=>r.push(...
`;return`${I(`Error:`)} this project's git remote is ${r}, which is not a Git
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
1Cross-file remote execution chain: dist/dist-mO8anSf2.mjs spawns dist/chunk-5QMZ5MUS-BuB3i_B5.mjs; helper contains network access plus dynamic code execution.
L1: import{a as e,i as t,n,o as r,r as i,t as a}from"./rolldown-runtime-tZXQYakl.mjs";import{$ as o,$a as s,$c as c,$d as l,$i as u,$l as d,$n as f,$o as p,$r as m,$s as h,$t as g,$u a...
L2: `,t),r=n===-1?e.length:n;if(r>t&&e[r-1]===`\r`&&--r,r-t>1024)return 0;let i=e.slice(t,r);return i.length===0||!joe.test(i)&&!Moe.test(i)?0:i.length}const pc=/&#(?:x[0-9A-Fa-f]+|X[0...
...
L66: </div>`}];function Boe(e){return["```html preview",e.html,"```"].join(`
L67: `)}const Voe=[{name:`--chart-1`,light:`oklch(0.62 0.19 259)`,dark:`oklch(0.72 0.14 259)`},{name:`--chart-2`,light:`oklch(0.58 0.14 145)`,dark:`oklch(0.73 0.13 145)`},{name:`--char
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
86\r `),Yr=e=>!e||Jr.has(e),Xr=class{constructor(){this.atEnd=!1,this.blockScalarIndent=-1,this.blockScalarKeep=!1,this.buffer=``,this.flowKey=!1,this.flowLevel=0,this.indentNext=0,this.indentValue=0,this.lineEndPos=null,this.next=null,this.pos=0}*lex(e,t=!1){if(e){if(typeof e!=`string`)throwTypeError(`source is not a string`);this.buffer=this.buffer?this.buffer+e:e,this.lineEndPos=null}this.atEnd=!t;let n=this.next??`stream`;for(;n&&(t||this.hasChars(1));)n=yield*this.parseNext(n)}atLineEnd(){let e=this.pos,t=this.buffer[e];for(;t===` `||t===` `;)t=this.buffer[++e];return!t||t===`#`||t===`