Wikipedia MCP

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:49 PM UTC
• Version: 1.6.4

Overview

This is a read-only Wikipedia/Wikimedia lookup skill that is broadly disclosed, with minor privacy and dependency caveats but no evidence of hidden or destructive behavior.

This skill appears suitable for normal Wikipedia/Wikimedia research use. Before installing, be aware that searches, article titles, dates, and coordinates may be sent to public Wikimedia services, so avoid secrets or confidential internal names. For managed environments, pin the requests dependency and consider enforcing outbound access only to Wikipedia/Wikimedia domains.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This is a description-behavior mismatch because the implementation materially exceeds the declared capability set. The declared description presents a Wikipedia access skill focused on search, summaries, random facts, dinosaur facts, featured article, historical events, categories, outgoing links, pageviews, news, and most-read articles. The code indeed supports those, so the primary purpose is aligned. However, it also exposes many additional user-facing tools not mentioned in the description, including backlinks, external links, nearby geographic article search, translations, revisions, recent changes, category member listing, infobox extraction, full article extracts, section listings, image/media retrieval, Wikimedia Commons media search, deaths-on-this-day, and picture-of-the-day. Most notably, it includes a `quote` tool backed by a hard-coded curated quote list rather than Wikipedia/Wikimedia data, which is unrelated to the declared Wikipedia-access purpose. Because these are externally visible capabilities rather than mere implementation details, the description does not accurately represent the actual behavior.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill explicitly requires network access to Wikipedia/Wikimedia APIs, but the manifest does not declare any tool scope such as permissions or allowed-tools. That creates an avoidable trust gap: consumers cannot tell from policy metadata that the skill will make outbound requests, which weakens least-privilege controls and makes security review and sandboxing harder.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The manifest describes access to Wikipedia features such as article search, summaries, categories, links, view counts, news, and most-read content. However, the code also adds a manually curated famous-quote dataset and related `quote` tool, plus Wikimedia Commons media search and retrieval features, which are distinct capabilities not described in the manifest’s stated scope.

Missing User Warnings

Low

• Confidence: 94% confidence
• Finding: The README describes a skill that sends article titles, search queries, locations, and other user-provided inputs to external Wikimedia/Wikipedia endpoints, but it does not clearly disclose that this is a networked data-sharing operation. This can lead users or integrators to unknowingly send sensitive research terms, internal names, or private interests to third-party services, creating a privacy and compliance risk even though the destination is a legitimate public API.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.28.0

• Confidence: 93% confidence
• Finding: The dependency is not pinned to an exact version, which makes builds non-reproducible and can result in different environments installing different releases of requests. In a network-facing research skill that fetches external content, this increases supply-chain and maintenance risk because a vulnerable or breaking release could be installed without review.

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 89% confidence
• Finding: Because requests is unpinned, it is not possible to verify whether the deployed version includes fixes for known advisories affecting some releases. Given this skill accesses external resources over HTTP(S), running an affected version could expose it to issues such as credential leakage or other request-handling flaws depending on how the library is used.

Description-Behavior Mismatch

Low

• Confidence: 88% confidence
• Finding: The manifest frames the skill as multi-language Wikipedia access across 10 wikis, which suggests per-language Wikipedia endpoints only. The implementation also calls centralized Wikimedia infrastructure (`wikimedia.org`) for pageviews/top-reads and Wikimedia Commons for media features, extending beyond the narrower wording of '10 wikis'.

Natural-Language Policy Violations

Low

• Confidence: 92% confidence
• Finding: The natural-language docstring explicitly states that the `lang` parameter is accepted but non-English values still return English quotes. This creates a locale-policy issue because the skill ignores the user's requested language instead of offering an opt-in choice or clearly constraining the tool to English-only at the interface level.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The tool description says the quote feature is 'Currently English-only' and that non-English `lang` values still return English quotes. Accepting a locale parameter while always forcing English can violate language-choice expectations and organizational locale policy.

Static analysis

No suspicious patterns detected.