Wenshushu File Uploader

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:41 AM UTC
• Version: 0.1.1

Overview

This file-sharing skill is not clearly malicious, but it needs Review because it can upload arbitrary local files and performs unverified automatic dependency installation with weak confirmation boundaries.

Review this before installing. Use it only for files you intentionally want to share through wenshushu.cn, confirm the exact local path before upload, and avoid sensitive files unless encrypted. Do not allow automatic setup to run remote installers or package installs unless you trust and verify those dependencies; prefer a pinned, reviewed installation. Be aware that public links, pickup codes, management links, and optional login tokens may create additional access paths if stored locally.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: install.sh:14
• Finding: Unverified Remote Installer Is Piped Directly into a Shell<![CDATA[ ## Vulnerability Details **File Locations**: - `install.sh:14-19` - `README.md:62-66` - `SKILL.md:205-208` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code `install.sh:14-19`: ```bash # Check uv and install it if unavailable if ! command -v uv &> /dev/null; then echo "📦 Installing uv (Python package manager)..." curl -LsSf https://astral.sh/uv/install.sh | sh export PATH="$HOME/.local/bin:$PATH" fi ``` `README.md:62-66`: ```bash # If uv is not installed, install it automatically curl -LsSf https://astral.sh/uv/install.sh | sh # Create a virtual environment ``` `SKILL.md:205-208`: ```bash # 1. Install uv curl -LsSf https://astral.sh/uv/install.sh | sh # 2. Install wssf ``` ### Technical Analysis The project downloads a mutable shell script from an external URL and immediately sends its contents to `sh`. There is no version pinning, local inspection, cryptographic checksum validation, signature verification, or immutable artifact reference between retrieval and execution. HTTPS protects the connection under normal conditions but does not establish that the returned installer is the same payload that was reviewed. The effective code can change after the Skill is audited. Compromise of the distribution server, domain, publishing infrastructure, or trusted TLS path could therefore turn installation into arbitrary command execution. The behavior is operationally unnecessary for the declared file-upload function. Uploading requires network access and read access to an explicitly selected file, but it does not require automatically executing an unverified remote shell program. Consequently, this installation path exceeds the minimum privileges required by the Skill. ### Attack Path 1. The Skill or user invokes `install.sh` on a system where `uv` is unavailable. 2. The script requests `https://astral.sh/uv/install.sh`. 3. An attacker who has compromised the remote distribution ...[truncated 1242 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all `curl | sh` instructions from `install.sh`, `README.md`, and `SKILL.md`. 2. Prefer requiring `uv` to be installed through a trusted operating-system package manager or an administrator-controlled software deployment process. 3. If automatic installation is essential: - Pin a specific `uv` release. - Download the release artifact to a local file rather than piping it into a shell. - Verify its published cryptographic checksum and, where available, its signature. - Abort installation on any verification failure. - Execute only the verified artifact after explicit user approval. 4. Run installation in an unprivileged, isolated environment with access limited to the Skill directory. 5. Do not run the installer as root or grant it access to Agent credentials, memory, or unrelated workspace files. 6. Document the exact artifact version, expected digest, source repository, and verification procedure. ]]>

T08 · Insecure Dependencies

Error

• Location: scripts/upload.py:31
• Finding: Third-Party Uploader Is Installed and Executed at Runtime Without Artifact Verification<![CDATA[ ## Vulnerability Details **File Locations**: - `scripts/upload.py:31-41` - `scripts/upload.py:159-164` - `install.sh:24-27` - `README.md:68-72` - `SKILL.md:210-214` **Vulnerability Type**: Insecure third-party dependency installation **Risk Level**: High ### Vulnerable Code `scripts/upload.py:31-41`: ```python def install_wssf(): """安装 wssf""" print("📦 正在安装 wssf...") try: # 使用 uv 安装 wssf subprocess.run( [UV_PATH, "pip", "install", "wssf==5.0.6"], check=True, timeout=120 ) ``` `scripts/upload.py:159-164`: ```python # 确保 wssf 已安装 if not check_wssf_installed(): print("⚠️ wssf 未安装，尝试安装...") if not install_wssf(): print("❌ 无法安装 wssf，请手动安装") sys.exit(1) ``` `install.sh:24-27`: ```bash # Install dependencies echo "📥 Installing dependency package (wssf)..." uv pip install wssf==5.0.6 ``` The installed package is subsequently executed against a user-selected file in `scripts/upload.py:69-69`: ```python cmd = [UV_PATH, "run", "wssf", "upload", str(filepath)] ``` ### Technical Analysis The Skill automatically installs `wssf==5.0.6` from the package source configured for `uv`. Pinning the version reduces ordinary version drift, but it does not authenticate the retrieved artifact. The project provides no hash-locked dependency file, verified wheel digest, signature, vendored source, or audit of transitive dependencies. The dependency is installed during normal runtime when the initial availability check fails. This makes an upload request capable of triggering the download and execution of code that is not included in the audited project. The downloaded uploader is particularly sensitive because it receives a fully resolved path to the selected local file and is expected to read and transmit that file. A compromised package or transitive dependency would execute with the Agent user's permissions and could access more than the intende ...[truncated 1886 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not install dependencies implicitly in response to an upload request. Require a separate, explicit, user-approved setup step. 2. Use a lockfile that records cryptographic hashes for `wssf` and every transitive dependency. 3. Install only from a trusted package index over authenticated TLS, and disallow fallback to untrusted or user-controlled indexes. 4. Prefer vendoring and auditing the minimal uploader implementation required by the Skill. 5. Verify the relationship between the package-index artifact and the cited source repository. 6. Install dependencies into a dedicated virtual environment located inside the Skill's controlled directory. 7. Run the uploader under a restricted account or sandbox with: - Read access only to the explicitly approved upload file. - No access to Agent credentials, memory, or unrelated workspace content. - Network access restricted to the required Wenshushu endpoints. - No permission to modify shell startup files or system executables. 8. Present the destination service, exact file path, and privacy implications to the user before transmission. 9. Fail closed when the verified dependency is unavailable rather than downloading and executing an unverified replacement. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (21)

Chaining Abuse

High

• Category: Tool Misuse

Content

首次使用时，技能会自动检查并安装依赖：
```bash
# 如果未安装 uv，会自动安装
curl -LsSf https://astral.sh/uv/install.sh | sh

# 创建虚拟环境
uv venv

• Confidence: 99% confidence
• Finding: The '| sh' pattern creates a direct command chain from untrusted network input to code execution, eliminating any meaningful validation step. In the context of an agent skill that may encourage automated setup, this is especially dangerous because it normalizes unsafe installation behavior and could lead to full host compromise.

Chaining Abuse

High

• Category: Tool Misuse

Content

### 方法二：手动安装
```bash
# 1. 安装 uv
curl -LsSf https://astral.sh/uv/install.sh | sh

# 2. 安装 wssf
uv venv

• Confidence: 98% confidence
• Finding: Using a pipeline into 'sh' causes immediate execution of remote content without review, creating a classic command-chaining abuse path. In this skill, that is more dangerous because the same skill already contemplates automatic installation and shell use, so an agent could normalize unsafe execution patterns around high-trust file-sharing workflows.

Chaining Abuse

High

• Category: Tool Misuse

Content

# 检查 uv，如未安装则安装
if ! command -v uv &> /dev/null; then
    echo "📦 正在安装 uv（Python 包管理器）..."
    curl -LsSf https://astral.sh/uv/install.sh | sh
    export PATH="$HOME/.local/bin:$PATH"
fi

• Confidence: 98% confidence
• Finding: The '| sh' pattern creates an execution chain where untrusted network data is interpreted immediately as shell commands. This removes opportunities for inspection and validation and significantly increases the chance of arbitrary code execution if the fetched script is malicious or tampered with.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The documented trigger phrases are broad enough that ordinary requests like '发文件给我' or '上传文件' could invoke the skill without strong confirmation of which local file should be exfiltrated. In an agent context, ambiguous auto-invocation increases the chance of unintended file uploads and accidental disclosure of sensitive data to a third-party service.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill describes shell-capable behavior such as automatic installation and command execution, but it does not declare any explicit tool scope or permissions boundaries. This increases the chance that an agent invokes shell access more broadly than intended, especially because the skill handles arbitrary file paths and networked uploads.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The description emphasizes convenience but does not clearly warn up front that files, filenames, metadata, links, and pickup codes will be sent to a third-party service and may become accessible to anyone with the link and code. Because the skill is designed for sharing local files, omission of this warning makes accidental data disclosure more likely.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger phrases are broad enough to match common requests like '发文件给我' or '生成下载链接', which could cause the skill to activate in situations where the user did not intend third-party upload. In this context, mistaken activation is especially risky because the action exfiltrates local files to a public external service.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The skill instructs persistent logging of uploaded filenames, sizes, timestamps, public URLs, pickup codes, and management links in a local memory file. Storing both access artifacts and management URLs creates an additional leakage surface beyond the original upload, enabling later unauthorized access or discovery of shared content if local memory is exposed.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The script's comments and user-facing messages are written in Chinese, and L33 instructs users to trigger the skill by saying '上传文件'. This imposes a specific language expectation without any visible opt-in, alternative language phrasing, or explanation that the skill is intentionally region- or locale-specific.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The installer downloads a remote script and immediately executes it with the shell, which gives the remote server full code execution during installation. If the upstream host, network path, or fetched content is compromised, users can be made to run arbitrary commands without any verification or explicit warning.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"""检查 wssf 是否已安装"""
    try:
        # 尝试运行 wssf --help
        result = subprocess.run(
            [UV_PATH, "run", "wssf", "--help"],
            capture_output=True,
            text=True,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The skill can modify the runtime environment by installing new software, which is a privileged side effect unrelated to the core task of uploading a file. In a skill context, this is more dangerous because users may expect a narrow file-transfer action, not package management with code-execution implications.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print("📦 正在安装 wssf...")
    try:
        # 使用 uv 安装 wssf
        subprocess.run(
            [UV_PATH, "pip", "install", "wssf==5.0.6"],
            check=True,
            timeout=120

• Confidence: 96% confidence
• Finding: This code installs a package at runtime from an external package source, which expands the skill's behavior beyond simple file upload and introduces supply-chain risk. In an agent environment, automatic dependency installation can execute unreviewed code during install time and may expose the host to compromise if the package, index, or transport is tampered with.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This function uploads arbitrary local files to a third-party service without an explicit consent gate or a clear privacy warning at the point of action. In an agent skill, that materially increases risk because the agent may be asked to upload sensitive workspace data, credentials, or internal documents to an external host.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
        print(f"📤 正在上传: {filepath.name} ({filepath.stat().st_size / 1024:.1f} KB)")
        result = subprocess.run(
            cmd,
            capture_output=True,
            text=True,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Low

• Confidence: 71% confidence
• Finding: All user-facing examples, invocation guidance, and interaction patterns are presented only in Chinese, and the skill does not indicate that users may choose another language. This can be a natural-language locale policy issue when a skill effectively forces a specific language without opt-in or justification.

External Script Fetching

Low

• Category: Supply Chain

Content

首次使用时，技能会自动检查并安装依赖：
```bash
# 如果未安装 uv，会自动安装
curl -LsSf https://astral.sh/uv/install.sh | sh

# 创建虚拟环境
uv venv

• Confidence: 98% confidence
• Finding: The README instructs users to fetch and execute a remote installation script via curl piped directly to the shell, which bypasses review and makes the host trust live network content at execution time. If the remote server, transport path, or hosting account is compromised, arbitrary code can run on the user's system during skill setup.

External Script Fetching

Low

• Category: Supply Chain

Content

### 方法二：手动安装
```bash
# 1. 安装 uv
curl -LsSf https://astral.sh/uv/install.sh | sh

# 2. 安装 wssf
uv venv

• Confidence: 93% confidence
• Finding: The skill includes instructions to fetch and run a remote install script directly from the network. Even if presented as manual installation guidance, this pattern is dangerous because compromise of the remote host, transport, or script content would lead to arbitrary code execution on the local machine.

Vague Triggers

Low

• Confidence: 84% confidence
• Finding: The description only states that the skill uploads files and generates a share link and pickup code, but it does not define when the skill should activate, what user confirmation is required, or what boundaries apply to file selection and upload. For a file-upload skill, vague activation scope can cause unintended invocation or overly broad handling of local files, increasing the risk of accidental data exfiltration through normal agent behavior rather than an overt exploit.

External Script Fetching

Low

• Category: Supply Chain

Content

# 检查 uv，如未安装则安装
if ! command -v uv &> /dev/null; then
    echo "📦 正在安装 uv（Python 包管理器）..."
    curl -LsSf https://astral.sh/uv/install.sh | sh
    export PATH="$HOME/.local/bin:$PATH"
fi

• Confidence: 93% confidence
• Finding: The script fetches executable installation content from an external URL at install time. Even though HTTPS is used, there is no checksum, signature verification, or pinning to a reviewed artifact, so trust is delegated entirely to the remote endpoint.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: Most user-facing output and usage instructions in the script are written only in Chinese, which imposes a language preference without any visible opt-in or fallback. The policy allows locale constraints when documented and justified, but this file does not clearly state that the skill is intentionally Chinese-only or provide a user language choice.

Static analysis

No suspicious patterns detected.