Security audit

微信读书 AI 阅读助手

Security checks across malware telemetry and agentic risk

Overview

This skill is mostly honest about being a WeRead automation/export tool, but it stores login cookies and private reading data locally and has an avoidable unsafe shell call in the login flow.

Install only if you are comfortable with this skill storing your WeRead session and reading history in local files. Protect or delete profile/weread-cookies.json when done, avoid shared machines or synced folders, and consider patching the QR download to use Node or Playwright APIs instead of shelling out to curl.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The skill declares only allowed-tools but does not clearly present permission scope or user-facing consent boundaries for shell-driven automation that handles browser sessions, cookies, and local file writes. This increases the risk of overbroad execution because a user may invoke a skill that can run node scripts with persistence and data collection capabilities without an explicit, constrained permission model.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The documented purpose understates the full behavior: the finding indicates additional collection/export functions such as bookshelf enumeration, local decryption of protected chapter content, screenshots, and local chat logging. When a skill's real behavior exceeds its stated purpose, users cannot give informed consent, and hidden collection or DRM-bypassing behavior materially increases privacy, compliance, and abuse risk.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: The script spawns an external shell command to fetch a URL derived from page content, which unnecessarily expands the trust boundary from Playwright/Node into the system shell and an external binary. Although the URL is quoted and sourced from an expected WeChat login frame, using execSync with shell interpolation still creates avoidable command-execution and environment/path risks, and bypasses the browser context's network controls.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The README explicitly promotes persistent storage of cookies, reading progress, chapter content, notes, screenshots, and chat records, but does not provide a clear privacy/security warning about handling sensitive personal data. In this skill’s context, that data can expose account sessions and highly sensitive reading behavior; if the local machine or exported archives are accessed by others, privacy loss and account compromise become more likely.

Vague Triggers

Medium

Confidence: 78% confidence
Finding: The skill description does not define when it should activate, what user requests are in scope, or what preconditions must be satisfied before acting. In a skill that performs login, scraping, and local persistence, vague trigger conditions make unintended execution and overcollection more likely.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The documentation describes persistent storage of cookies, metadata, chapter text, screenshots, notes, and chat logs, but does not present a clear privacy warning or retention policy. These artifacts can expose account session material and highly sensitive reading behavior, annotations, and conversations if the local environment is shared or compromised.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The script loads and saves live WeRead authentication cookies to a local JSON file, enabling persistent session reuse outside the browser. If that file is read by another local user, malware, backups, or accidentally committed/shared, an attacker could hijack the user's account session without needing credentials.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The script is explicitly designed to extract and store rendered chapter text, screenshots, chat content, bookmarks, and notes under the local books directory, but provides no consent prompt, retention controls, or privacy warning. This creates a real privacy and data-exposure risk because sensitive reading activity and copyrighted or personal content may accumulate on disk and be accessible to other users, malware, sync services, or accidental sharing.

Ssd 3

Medium

Confidence: 90% confidence
Finding: The workflow automatically collects and stores user notes, highlights, and reading history in local files. Even if this is part of the intended feature set, these are sensitive personal data points, and automatic collection without granular consent or minimization creates unnecessary retention and disclosure risk.

Ssd 3

Medium

Confidence: 91% confidence
Finding: The skill instructs the assistant to use automatically pulled annotations and notes to drive discussion and to save conversation logs to disk. Combining reading annotations with chat transcripts increases profiling sensitivity and can reveal intimate interests or beliefs, especially because the storage appears to be local plain-text files.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/login.js:149