Wikipedia MCP

• Outcome: Pass
• Latest audit: Oct 16, 2026 · 6:43 AM UTC
• Version: 1.6.30

Overview

This is a broad but disclosed read-only Wikipedia/Wikimedia MCP skill; the main things to know are that it sends lookups to public Wikimedia services and uses an unpinned requests dependency.

Before installing, be comfortable with a read-only tool that sends your Wikipedia searches, article titles, public editor/usernames or IPs, and optional coordinates to Wikimedia public APIs. Avoid entering secrets or sensitive private locations. For stricter environments, pin and audit the requests dependency before use.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description is directionally correct but materially incomplete. The server does access Wikipedia and supports the listed features, so there is no contradiction in its core purpose. However, the actual code exposes a substantially larger capability surface than advertised, including Wikimedia Commons access and many analysis/audit/discovery tools not mentioned in the description. One capability—random famous quotes—is also unrelated to the stated Wikipedia-access purpose. Because the description understates significant behavior and includes unrelated omitted functionality, this should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This is not just a simple implementation detail expansion of the declared Wikipedia lookup skill. The declared description emphasizes article access, summaries, facts, categories, links, pageviews, news, and most-read content for research/general knowledge. The supplied code chunk materially broadens the skill into Wikipedia provenance, governance, and reliability auditing: revision history inspection, diffs, historical snapshots, editor profiling, talk-page parsing, maintenance flags, protection status, citation-needed detection, and template usage. Those are substantial undeclared capabilities and shift part of the skill’s primary purpose toward editorial/audit tooling, not merely content lookup. The resource domain remains Wikipedia/read-only APIs, so the mismatch is about scope and behavior, not exfiltration or unrelated external access.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The supplied code is a comprehensive smoke test for a large Wikipedia MCP server, not just the narrower set of capabilities named in the description. While many declared features are indeed present (search, summaries, random content, dinosaur facts, featured article, historical events, categories, outgoing links, pageviews, news, top reads, multilingual support), the actual skill also exposes many additional end-user capabilities that are not mentioned. These are material capabilities rather than internal implementation details, because they correspond to separately routed tools in the registry and meaningful user-facing functions. Therefore the description understates the scope of the skill and does not accurately represent what the code chunk actually supports.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill clearly performs network access to Wikipedia/Wikimedia APIs, but it does not declare any explicit tool scope or permissions boundary. That weakens user awareness and platform policy enforcement, making it easier for a seemingly informational skill to make outbound requests without an explicit trust decision.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest describes article search/lookups, summaries, facts, categories, links, pageviews, news, and most-read articles, but this file also exposes extensive editor- and governance-focused capabilities: revision diffs/history, recent changes, user contribution profiling, talk-page mining, maintenance flags, protection status, article pulse, template transclusion, historical snapshots, citation-needed extraction, and citation-source audits. These are materially broader than the stated 'general knowledge lookups' scope and are not obvious implementation details of the manifest’s listed features.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The quote tool accepts a lang parameter for consistency but explicitly ignores non-English values and always returns English quotes. This forces a specific language without user opt-in and conflicts with a language/locale choice policy.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · src/server.py (reported line 4321)May include surrounding context.

python

# article_protection — is this article locked, and for how long?
# ---------------------------------------------------------------------------
_AP_LEVEL_MEANINGS = {
    "autoconfirmed": "autoconfirmed accounts only (at least 4 days old with "
                     "10+ edits) — anonymous and brand-new accounts are blocked",
    "extendedconfirmed": "extended-confirmed accounts only (at least 30 days "
                         "old with 500+ edits)",

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · src/server.py (reported line 4413)May include surrounding context.

python

# article_protection — is this article locked, and for how long?
# ---------------------------------------------------------------------------
_AP_LEVEL_MEANINGS = {
    "autoconfirmed": "autoconfirmed accounts only (at least 4 days old with "
                     "10+ edits) — anonymous and brand-new accounts are blocked",
    "extendedconfirmed": "extended-confirmed accounts only (at least 30 days "
                         "old with 500+ edits)",

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description says the tool is 'Currently English-only' and that non-English lang values still return English quotes. Presenting a locale parameter while overriding the user's requested language is a natural-language policy violation because it forces English without opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This test script directly invokes many server functions that are clearly intended to fetch live Wikipedia data, but the file provides no user-facing warning that running the tests will generate a large number of outbound network requests. Apart from the brief run instruction, there is no disclosure in comments, prints, or prompts that execution depends on external services and may transmit queried article titles and parameters to Wikipedia endpoints.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest describes a Wikipedia skill focused on search, summaries, random facts, featured content, historical events, categories, links, view counts, news, and most-read articles. This test file explicitly asserts a 51-tool registry including additional capabilities such as revision diffs/history, user contributions, talk-page analysis, article flags/protection/pulse, citation-source analysis, article pathfinding, historical snapshots, template usage, contributors, references, infobox extraction, category-member enumeration, recent changes, and related-article discovery, indicating the implemented scope is substantially broader than the stated manifest purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README states that quote accepts a language parameter for consistency but is currently English-only. This is a natural-language locale constraint presented as a fixed behavior, and the documentation does not indicate user choice or a justified region-specific requirement.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill sends user-supplied queries, article titles, coordinates, and related lookups to third-party public APIs, but the description does not clearly warn users of that disclosure. This can expose sensitive research interests or location-related inputs to external services when users may expect purely local processing.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency is specified as requests>=2.28.0, which allows installation of any later version without ensuring a tested, known-safe release. This weakens supply-chain control and makes builds non-reproducible, increasing the chance that a vulnerable or incompatible version is pulled in later.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests>=2.28.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Because requests is not pinned, it is impossible to verify from this manifest whether the installed version avoids known advisories affecting some releases. In a skill that accesses external web content, using an unknown potentially vulnerable HTTP client version could expose requests, credentials, or TLS handling to known flaws depending on the resolved package version.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest focuses on accessing Wikipedia articles and feeds, but the code also provides Commons-wide media discovery (media_search, media_of_the_day, picture_of_the_day) and a local curated quote generator that does not access Wikipedia content at all. These are product-scope additions rather than necessary implementation details of the manifest’s claimed Wikipedia article lookup functionality.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The comments and assertions explicitly state that the quote tool is 'currently English-only' and verify that non-English lang values still return an English quote rather than honoring user locale choice. This bakes a language policy into the skill behavior without user opt-in or offering a language/locale choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.