Skills/Glama/gknowledge

gknowledge@0.3.0

BLOCKED· not started

Publisher claims: "Karpathy-style LLM wiki: sources are compiled once into linked Markdown pages with provenance, and agents search, read, ask cited questions and add sources. Works offline with no API key (uvx gknowledge-mcp --init )." Observed in sandbox: sends data to openapi.github.io, release-assets.githubusercontent.com.

Registry GlamaPublisher openapi · publishing for 250 daysInstalls 0Last detonated 20 h ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Blocked here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Revoked: guards refuse to launch this version

confirmed incident: contacted openapi.github.io, release-assets.githubusercontent.com (undeclared) Every machine running vet-skills guard stops starting it at the next launch; the state clears when the honeypot re-run or a reviewer clears it.

Before you give it your token

It will ask for
no credential variables read in the code
Where it talks to
no vendor host named in the codeAlso flathub.org — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · contacted openapi.github.io, release-assets.githubusercontent.com (undeclared)
What we could not test
server startup · the tool list · tool behavior

Do not connect it. The honeypot or a critical finding blocked this version; the evidence is below.

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (3 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-13 and scored it 40/100 (Blocked). Do not install it: the sandbox observed behaviour consistent with credential theft, exfiltration or persistence. Notable findings: Pipe-to-shell pattern; Privileged sudo command; Destructive file system command detected. Summary: sends data to openapi.github.io, release-assets.githubusercontent.com.

Behavior trace

Honeypot run · 1 s · 3 scenarios
t+CategoryObserved action
0.0sprocessinstall script run in the sandbox
0.5snetworkCONNECT tcp://openapi.github.io:443 · not in the allow-list, refused
0.5snetworkCONNECT tcp://github.com:443
0.5snetworkCONNECT tcp://release-assets.githubusercontent.com:443 · not in the allow-list, refused
0.5sprocessexec /usr/bin/mktemp
0.5sprocessexec /usr/bin/uname
0.5sprocessexec /usr/bin/curl
0.5sprocessexec /usr/bin/rm
0.5sprocessexited 1: xx Download failed from https://github.com/openapi/gknowledge/releases/latest/download/gknowledge_all.deb
0.7sprocessdependency install exit 1 ·
0.7sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.7sprocessscript backend runs setup only
0.9sprocesssecond launch, clock +45 days, CI unset
1.2snetworkCONNECT tcp://openapi.github.io:443 · not in the allow-list, refused
1.2snetworkCONNECT tcp://github.com:443
1.2snetworkCONNECT tcp://release-assets.githubusercontent.com:443 · not in the allow-list, refused
1.2sprocessexec /usr/bin/mktemp
1.2sprocessexec /usr/bin/uname
1.2sprocessexec /usr/bin/curl
1.2sprocessexec /usr/bin/rm
1.2sprocessexited 1: xx Download failed from https://github.com/openapi/gknowledge/releases/latest/download/gknowledge_all.deb

Static findings

CRITICAL
Pipe-to-shell patterninstall.sh:4 · Pipe-to-shell pattern — downloads and immediately executes remote code# curl -fsSL https://github.com/openapi/gknowledge/releases/latest/download/install.sh | bashFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
File permission modification commandMakefile:95 · File permission modification command — agent changes file ownership/permissionschmod +x $(DESTDIR)$(BINDIR)/gknowledgeFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
LOW
URL to a private-network addresstests/test_openai_compatible.py:152 · URL to a private-network address — a LAN or development targetassert not should_prefill_ollama_base_url("http://192.168.1.50:11434/v1")Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
File permission modification commandMakefile:98 · File permission modification command — agent changes file ownership/permissionschmod +x $(DESTDIR)$(BINDIR)/gknowledge-mcpFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Privileged sudo commandMakefile:5 · Privileged sudo command — agent may execute with elevated privileges# pip's externally-managed environment. Use PREFIX=/usr with sudo for aFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedbuild-aux/dev/watch.py:37 · Python subprocess execution detectedreturn subprocess.Popen([sys.executable, "-m", "gknowledge", *sys.argv[1:]],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_mcp.py:82 · Python subprocess execution detectedproc = subprocess.run([sys.executable, "-m", "gknowledge.mcp", str(tmp_path / "nope")],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Privileged sudo command.github/workflows/ci.yml:35 · Privileged sudo command — agent may execute with elevated privilegessudo apt-get update && sudo apt-get install -y flatpak flatpak-builderFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
LOW
Prompt injectionNOTES.md:309 · Prompt injection — known jailbreak technique reference · informational: not an instruction fileEnable "Developer mode"Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
File permission modification commandinstall.sh:59 · File permission modification command — agent changes file ownership/permissionschmod 644 "$TMP/gknowledge_all.deb"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Python subprocess execution detectedtests/test_mcp.py:33 · Python subprocess execution detectedproc = subprocess.run([sys.executable, "-m", "gknowledge.mcp", *args],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Privileged sudo command.github/workflows/release.yml:31 · Privileged sudo command — agent may execute with elevated privilegessudo apt-get update && sudo apt-get install -y flatpak flatpak-builderFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandinstall.sh:30 · Privileged sudo command — agent may execute with elevated privilegesif [ "$(id -u)" -eq 0 ]; then "$@"; else need sudo; sudo "$@"; fiFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Privileged sudo command.github/workflows/repos.yml:24 · Privileged sudo command — agent may execute with elevated privileges- run: sudo apt-get update && sudo apt-get install -y apt-utils flatpak ostreeFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Destructive file system command detectedinstall.sh:47 · Destructive file system command detectedsudo_cmd rm -f /etc/apt/sources.list.d/gknowledge.sources /usr/share/keyrings/gknowledge.gpgFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Collapsed <details> block carrying instructionsREADME.md:75 · Collapsed <details> block carrying instructions<summary>Other distributions, from source, and release builds</summary> - **Fedora, Arch and others:** install PyGObject, GTK 4 and Libadwaita with your packageFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Authorization escalation languageNOTES.md:309 · Authorization escalation language · informational: not an instruction fileEnable "Developer mode"Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Remote installer piped to shellinstall.sh:4 · Remote installer piped to shell# curl -fsSL https://github.com/openapi/gknowledge/releases/latest/download/install.sh | bashFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
Privileged sudo command.github/workflows/ci.yml:18 · Privileged sudo command — agent may execute with elevated privileges- run: sudo apt-get update && sudo apt-get install -y appstream desktop-file-utilsFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Privileged sudo command.github/workflows/ci.yml:28 · Privileged sudo command — agent may execute with elevated privilegessudo apt-get install -y ./dist/*.debFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandinstall.sh:58 · File permission modification command — agent changes file ownership/permissionschmod 755 "$TMP"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05

Cost to the agent

Instructions loaded
≈34 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

40 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Contacts a host you did not declare≈ +23 on the totalList every host you talk to in SKILL.md frontmatter (`network: [api.example.com]`), or stop contacting the ones you cannot justify.
  2. Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  3. Unclaimed publisher≈ +8 on the totalClaim openapi: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  4. Hidden instructions≈ +6 on the totalRemove HTML comments, zero-width characters and white-on-white text that carry instructions. Everything the agent is meant to read should be visible to the person reading the file.
  5. Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  6. File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
Publish a new version to Glama, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim openapiPropose a patch to the maintainer