WodeApp AI Engine

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:55 AM UTC
• Version: 1.0.18

Overview

The skill is instruction-only and purpose-aligned as an AI platform connector, but it documents broad remote project and workflow powers with unauthenticated project endpoints and inconsistent privacy disclosures.

Review this before installing if you will connect real projects or business integrations. Use project-scoped API keys with billing caps, avoid sensitive uploads, confirm before publishing, deleting, rolling back, sending messages, or running workflows, and do not expose project subdomains if their MCP or workflow endpoints remain unauthenticated.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:550
• Finding: Published Projects Expose Privileged MCP Tools Without Authentication## Vulnerability Details **File Location**: `SKILL.md:550-586` **Supporting Location**: `wodeapp-ai-skill.json:70-76` **Vulnerability Type**: Missing authentication and insufficient authorization **Risk Level**: High ### Vulnerable Code Snippet ```markdown ### 3. Project-Level MCP (Per-Project, No Auth Needed) Each published project exposes its own MCP server at its subdomain. The AI Agent connects and **auto-discovers** all project capabilities — data CRUD, workflows, AI, TTS, video, and digital human. ```json { "mcpServers": { "my-project": { "type": "sse", "url": "https://my-project.wodeapp.ai/mcp" } } } ``` **Auto-discovered tools per project:** | Category | Tools | Description | |----------|-------|-------------| | Data CRUD | `query_{col}` / `create_` / `update_` / `delete_` | Auto-generated from project collections | | Workflows | `run_workflow_{id}` + `get_workflow_status` + `get_workflow_schema` | Auto-extracted with input schemas, model override, wait-for-result | | AI | `ai_chat` / `ai_generate_image` / `ai_generate_json` | Text, image, JSON generation | | TTS | `tts_generate` / `tts_list_voices` | Text-to-speech with voice selection | | Video | `video_task_create` / `video_task_status` / `video_providers` | Unified Video API (replaces kling_*) | | Digital Human | `kling_avatar` | Portrait + audio → talking head video | | Custom Components | `component_create` / `component_list` / `component_get` / `component_delete` | AI-generate React components on demand | | Feishu Chat | `feishu_send` / `feishu_send_card` / `feishu_list_chats` | Send messages/cards to Feishu groups | | Feishu Bitable | `feishu_bitable_list_tables` / `feishu_bitable_list_records` / `feishu_bitable_create_record` / `feishu_bitable_update_record` / `feishu_bitable_search` | CRUD on Feishu spreadsheet data | | Feishu Docs | `feishu_doc_create` / `feishu_doc_read` | Create and read Feishu documents | | WeCom | `wecom_send` / `wecom_send_image` / `wecom_ ...[truncated 3920 chars]
• Remediation: ## Remediation Suggestions 1. Require authentication for every project MCP and workflow request. A project subdomain must never serve as the sole authorization mechanism. 2. Issue project-scoped credentials or short-lived signed capability tokens with explicit audience, project, tool, action, and expiration claims. 3. Enforce server-side authorization independently for every tool invocation rather than relying only on authentication at the MCP connection layer. 4. Apply least-privilege scopes, separating permissions such as: - Data read, create, update, and delete. - Workflow discovery and execution. - AI or media generation. - Page and component modification. - Enterprise messaging. - Document and organizational-directory access. 5. Disable mutation, messaging, organizational-data, and billable-generation tools for anonymous or public access by default. 6. Make public sharing opt-in and restrict shared capabilities to explicitly selected read-only tools or workflows. 7. Protect `/mcp/tools` and workflow-schema endpoints when their output reveals private collections, workflow structure, actions, or integrations. 8. Add per-project rate limits, spending limits, execution quotas, audit logs, anomaly detection, and immediate token revocation. 9. Require additional confirmation or stronger authorization for destructive operations, external messaging, and high-cost generation. 10. Review existing published projects and rotate or revoke associated access capabilities after authentication is introduced.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:720
• Finding: Headless Workflow Endpoints Are Documented Without Authentication## Vulnerability Details **File Location**: `SKILL.md:720-731` **Vulnerability Type**: Missing authentication on workflow discovery and execution **Risk Level**: High ### Vulnerable Code Snippet ```bash # Discover IO schema (inputs, outputs, step IDs for model overrides) curl https://my-project.wodeapp.ai/runtime-server/api/workflow/schema # → { "inputs": [...], "outputs": [...], "steps": [{"id":"chat_step","type":"chat"}, ...] } # Execute with model overrides (optional — override AI models per step) curl -X POST https://my-project.wodeapp.ai/runtime-server/api/workflow/run \ -H "Content-Type: application/json" \ -d '{"inputs":{"prompt":"Product copy"}, "modelOverrides":{"chat_step":"gpt-4o","summary":"deepseek-chat"}}' # → { "runId": "uuid", "status": "running" } # Poll until completed (guaranteed outputs are returned if schema defined) curl https://my-project.wodeapp.ai/runtime-server/api/workflow/run/{runId} # → { "status": "completed", "outputs": { "videoUrl": "https://..." }, "warnings": [] } ``` ### Technical Analysis The documented headless workflow requests contain no API key, bearer token, signed capability, or session credential. The unauthenticated schema endpoint reveals workflow inputs, outputs, internal step identifiers, and model-overridable steps. The execution endpoint then accepts arbitrary workflow inputs and model overrides, while the status endpoint returns generated outputs. This behavior creates a direct unauthenticated execution path independent of the project MCP interface. Because workflows may call AI models, generate media, process project data, or invoke integrated actions, anonymous execution exceeds the minimum privileges necessary for ordinary public viewing of a published project. The ability to override models can also increase cost or alter expected workflow behavior if expensive or unsuitable models are accepted. ### Attack Path 1. An attacker obtains or discovers a published project subdomain. 2. The attacker r ...[truncated 1346 chars]
• Remediation: ## Remediation Suggestions 1. Require authenticated, project-scoped authorization for schema discovery, workflow submission, and result polling. 2. Bind each workflow run to the authenticated principal that created it and reject status requests from other principals. 3. Use short-lived, single-workflow capability tokens for intentionally public workflows. 4. Restrict public capabilities to an explicit allowlist of workflows and inputs; keep internal step identifiers and integration details private. 5. Disable caller-controlled model overrides by default. If required, allow only an owner-configured model allowlist and enforce per-run cost ceilings. 6. Apply strict input validation, payload-size limits, per-principal rate limits, concurrency controls, and spending quotas. 7. Require elevated authorization or confirmation for workflows with external side effects, messaging, data mutation, or expensive media generation. 8. Record the authenticated caller, workflow, inputs classification, selected models, cost, result access, and side effects in tamper-resistant audit logs. 9. Use unguessable run identifiers, but do not treat identifier entropy as a replacement for authorization. 10. Update all documentation and examples to include the required authorization mechanism.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (15)

Ssd 3

High

• Confidence: 97% confidence
• Finding: The project-level MCP section explicitly states 'No Auth Needed' and promotes auto-discovery of powerful tools from a published project URL, including messaging, document, CRUD, workflow, and custom action capabilities. If those capabilities are actually reachable unauthenticated from a public subdomain, an attacker who knows or guesses the project URL could enumerate and invoke sensitive functions, causing data exposure, workflow execution, or abuse of integrated third-party channels. Because these are operational tools rather than read-only metadata, the context makes this substantially more dangerous.

Natural-Language Policy Violations

Medium

• Confidence: 77% confidence
• Finding: The Environment section instructs domestic users to use one domain and international users to use another, and much of the operational guidance is presented bilingually with assumptions about locale segmentation. This locale-specific routing is not framed as a user-selectable preference or an explicitly justified compliance requirement within the skill's activation policy.

Ssd 3

Medium

• Confidence: 90% confidence
• Finding: The skill instructs agents to list a user's existing projects and present URLs to help decide whether to create a new project or add a page. Without an explicit ownership and authorization check tied to the current requester, this encourages disclosure of project metadata and live URLs that may be sensitive. In multi-user or shared-agent contexts, exposing project names and URLs can leak business information even before any content is opened.

Ssd 3

Medium

• Confidence: 92% confidence
• Finding: The project-discovery recipe tells the agent to find prior projects and disclose their locations to the requester by default. That default behavior can leak prior workspaces, slugs, and workflow presence to anyone interacting through the agent if account/requester identity is not strongly bound. The danger is greater because the URLs are directly actionable and may expose additional public or semi-public project surfaces.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The skill describes state-changing operations such as update_page, delete_page, publish_project, rollback_version, and repeated auto-publish behavior without consistently requiring user confirmation. If an agent follows these recipes literally, it may alter or remove existing content and publish changes to live URLs unexpectedly. The risk is elevated because this platform is explicitly designed for project management and deployment, so these actions affect real remote assets.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Recipe 1 完整流程
# 步骤 1: 创建项目
curl -X POST https://wodeapp.ai/mainserver/mcp/call \
  -H "X-API-Key: $WODEAPP_API_KEY" -H "Content-Type: application/json" \
  -d '{"tool":"create_project","arguments":{"name":"my-avatar","templateId":"digital-avatar-marketing"}}'

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger scenarios are overly broad and match common requests like summarization, code generation, workflow, website creation, and even downloading videos. Such expansive activation guidance increases the chance the skill is invoked when the user did not intend to use this external service, causing unnecessary third-party transmission of prompts, files, project metadata, or generated content. In a tool-routing environment, vague activation boundaries are a real security and privacy risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# 发现所有可用工具
curl https://wodeapp.ai/mainserver/mcp/tools \
  -H "X-API-Key: $WODEAPP_API_KEY"

# 调用工具

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Text → `POST /mainserver/api/ai/chat`
```bash
curl -X POST https://wodeapp.ai/mainserver/api/ai/chat \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $WODEAPP_API_KEY" \
  -d '{"message":"Write a compelling product description for noise-cancelling headphones"}'

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The privacy section materially understates what is stored. Elsewhere the skill advertises cloud-synced run history and storage of intermediate/final workflow data, so users and agents may make unsafe data-sharing decisions based on an inaccurate 'only configurations and output URLs persist' claim. Misrepresentation of retention and storage boundaries is dangerous because it can cause sensitive prompts, workflow inputs, or derived artifacts to be sent under false assumptions.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: This JSON manifest describes the skill as a general-purpose "全能引擎" with sweeping capabilities but does not define any specific invocation phrases, scope boundaries, or exclusion conditions. In a manifest file, such broad natural-language positioning can contribute to ambiguous activation or overmatching if the host uses description text to route requests.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The privacy manifest limits recipients to WodeApp and selected AI providers, but the declared project MCP tool set includes integrations that can send or manipulate data in third-party business platforms such as Feishu, WeCom, and DingTalk. This creates a material transparency gap: users and host agents may authorize the skill under incomplete data-sharing assumptions, increasing the risk of unintended disclosure to external services.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The manifest states that raw prompts and AI responses are not persisted, yet the skill description advertises cloud-synced run history and workflow capabilities that plausibly retain prompt/response or execution payload data. Even if storage is partial or transient, this mismatch can mislead users about retention and exposure of sensitive inputs, undermining informed consent and secure handling expectations.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The skill is presented as an AI generation and project/workflow tool, but the project MCP tool catalog exposes a much broader operational surface, including messaging, document, directory, and record-management actions in external enterprise systems. This scope expansion increases the chance that a host agent or user invokes sensitive business actions without understanding that the skill can reach far beyond content generation.

Intent-Code Divergence

Low

• Confidence: 93% confidence
• Finding: The document claims the skill reads only WODEAPP_API_KEY, but later documents WODEAPP_MAIN_SERVER and WODEAPP_RUNTIME_SERVER as supported environment variables. This inconsistency weakens trust in the skill's boundary declarations and could enable unexpected routing to alternate endpoints if an operator relies on the earlier statement. While not directly an exploit by itself, misleading boundary documentation can cause unsafe deployment assumptions.

Static analysis

No suspicious patterns detected.