ClawHub
Back to skill

Security audit

weread-socrates

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed local reading companion that uses WeRead and user-chosen AI APIs for its stated purpose, with bounded local service behavior.

Install only if you are comfortable giving this local app access to your WeRead API key and sending selected highlights, personal thoughts, and chat answers to the AI provider you configure. Clear saved AI keys from the settings panel and stop the local server when finished; the bundled Mermaid library is large/minified, so trust in the publisher and packaged dependency matters.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (13)

Ae1

High
Category
analysis-evasion
Content
bash scripts/start.sh
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
bash scripts/start.sh
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
- **无外部依赖**：Mermaid 渲染库已打包在 `assets/mermaid.min.js` 本地加载，页面不加载任何第三方 CDN 脚本。
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
| 端口 3456 被占用 | 之前的服务未正常关闭 | 运行 `bash scripts/stop.sh` 释放端口后重新启动；若是其他程序占用，脚本会提示，请自行确认处理 |
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
| 端口 3456 被占用 | 之前的服务未正常关闭 | 运行 `bash scripts/stop.sh` 释放端口后重新启动；若是其他程序占用，脚本会提示，请自行确认处理 |
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
- 微信读书 API 接口详情、参数和返回字段：见 [references/weread-api.md](references/weread-api.md)
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
- 前端源码：`assets/ai-reading-companion.html`
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
- 服务端源码：`assets/server.js`（端口 3456，代理微信读书 API + 静态文件服务）
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Hidden Instructions

High
Category
Prompt Injection
Content
<div class="app-container">

  <!-- Header -->
  <div class="app-header">
    <h1>AI 伴读</h1>
    <p class="subtitle">你的苏格拉底式阅读教练</p>
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
</div>
</div>

<!-- Toast -->
<div class="toast" id="toast"></div>

<script>
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

External Transmission

Medium
Category
Data Exfiltration
Content
},
  deepseek: {
    name: 'DeepSeek',
    endpoint: 'https://api.deepseek.com/v1/chat/completions',
    model: 'deepseek-chat',
    keyUrl: 'https://platform.deepseek.com/api_keys',
  },
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
assets/server.js:163