zhigui-second-brain-mcp-skill

Warn

Audited by Gen Agent Trust Hub on Sep 12, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The installation guide instructs users to clone a repository from an unverified GitHub source (https://github.com/CarlWangChina/zhigui-openclaw-ui-second-brain-skill.git).
  • [REMOTE_CODE_EXECUTION]: The setup process involves executing external code on the host machine via npm install and Node.js script execution (e.g., server.js, install.js, and seeding scripts).
  • [COMMAND_EXECUTION]: The skill requires the AI agent to run a shell command (node /absolute/path/.../server.js) to bridge tools via the Model Context Protocol (MCP).
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests potentially untrusted data that is later used to generate AI reflections and briefings, creating a risk of the agent following malicious instructions embedded in notes.
  • Ingestion points: Data is ingested through tools like zhigui_create_note and zhigui_create_goal, and read into context via zhigui_get_assistant_bootstrap (found in SKILL.md).
  • Boundary markers: The instructions do not define delimiters or specific 'ignore instructions' warnings for content retrieved from the second-brain storage.
  • Capability inventory: The skill has capabilities to write to the file system (zhigui_create_* tools) and manage schedules and decisions (found in SKILL.md).
  • Sanitization: There is no evidence of content sanitization or validation for data being interpolated into briefings or reflections.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 12, 2026, 06:50 PM
Security Audit — agent-trust-hub — zhigui-second-brain-mcp-skill