kb-import — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited kb-import (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Import knowledge from existing documents into your knowledge base.
Read the KB config to understand available categories:
kb/.kb-config.yamlRead the index to see what already exists:
kb/index.mdRead the source file provided by the user. Supported formats:
Analyze the document and propose a plan to the user:
Present this as a table:
| # | Title | Category | Source Section |
|---|-------|----------|---------------|
| 1 | ... | ... | ... |Wait for user confirmation before proceeding.
For each planned entry, create a markdown file with YAML frontmatter:
---
title: "Entry Title"
description: "Brief one-liner for index lookup"
category: {category}
tags: [{tag1}, {tag2}]
sources: ["{source_filename}"]
last_updated: "{today's date}"
related:
- {category}/{related-file}.md
---
## Section Title
Content here. Write clear, quotable statements.
Each fact should be a self-contained sentence that can be cited as evidence.data-encryption.md, product-overview.mdAfter creating entries, regenerate the index and validate:
python3 scripts/kb-index.py --write # rewrite kb/index.md's "All Files by Category"
python3 scripts/kb-validate.py # check frontmatter, categories, related linksReview the stdout output to verify all new entries appear correctly. Resolve any validate errors before continuing.
Report to the user:
related: links between themUse this when the user wants to ingest many documents in one go (e.g., "import everything in ~/docs/policies/", or a list of 5+ files).
.md, .pdf, .txt, .docx). Skip obvious noise (.DS_Store, node_modules, hidden files).Read the frontmatter / first page of each file to get a title guess. Produce a single combined plan:
| # | Source file | Proposed KB entry | Category |
|---|-------------|-------------------|----------|
| 1 | policies/acceptable-use.pdf | security/acceptable-use.md | security |
| 2 | policies/retention.pdf | security/data-retention.md | security |
| ...Rules:
security/access) when the batch is large enough that a flat category would become unwieldy (> ~10 entries in one category).Wait for user confirmation on the full plan before proceeding.
After all files are processed:
python3 scripts/kb-index.py --write
python3 scripts/kb-validate.py
python3 scripts/kb-search.py "sanity-check-term" # spot-check a term that should appearReport: X created, Y updated, Z skipped (with reason per skip). Flag any validate warnings or errors.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.