zhigui-second-brain-mcp-skill
Warn
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The installation guide instructs users to clone a repository from an unverified GitHub source (https://github.com/CarlWangChina/zhigui-openclaw-ui-second-brain-skill.git).
- [REMOTE_CODE_EXECUTION]: The setup process involves executing external code on the host machine via
npm installand Node.js script execution (e.g.,server.js,install.js, and seeding scripts). - [COMMAND_EXECUTION]: The skill requires the AI agent to run a shell command (
node /absolute/path/.../server.js) to bridge tools via the Model Context Protocol (MCP). - [INDIRECT_PROMPT_INJECTION]: The skill ingests potentially untrusted data that is later used to generate AI reflections and briefings, creating a risk of the agent following malicious instructions embedded in notes.
- Ingestion points: Data is ingested through tools like
zhigui_create_noteandzhigui_create_goal, and read into context viazhigui_get_assistant_bootstrap(found in SKILL.md). - Boundary markers: The instructions do not define delimiters or specific 'ignore instructions' warnings for content retrieved from the second-brain storage.
- Capability inventory: The skill has capabilities to write to the file system (
zhigui_create_*tools) and manage schedules and decisions (found in SKILL.md). - Sanitization: There is no evidence of content sanitization or validation for data being interpolated into briefings or reflections.
Audit Metadata