WiiM

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 3:20 PM UTC
• Version: 0.1.1

Overview

This skill is a straightforward WiiM audio-control helper, but users should treat its unpinned third-party CLI install command with normal supply-chain caution.

Before installing, verify that wiim-cli is the package you intend to trust, consider pinning a known version, and run it with only the local network and account access needed to control your WiiM devices.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12

Finding

Unpinned Third-Party Package Installation and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12-18
Vulnerability Type: Unverified and unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code:

bash

# Install globally
uv tool install wiim-cli

# Or run directly without installing
uvx --from wiim-cli wiim --help

Technical Analysis

The instructions install or execute wiim-cli from an external package registry without specifying a reviewed version, cryptographic hash, lockfile, trusted repository, or verified publisher. The uv tool install command installs executable third-party package code, while uvx retrieves and runs that code directly.

Package registry content is mutable and lies outside the audited project. Therefore, the code ultimately executed may differ from the code that was available when this skill was reviewed. A compromised maintainer account, malicious package release, dependency confusion event, or compromised transitive dependency could introduce arbitrary executable code.

The audited project contains no implementation code demonstrating an active malicious payload. This finding concerns the unsafe supply-chain execution pattern established by the documented commands.

Attack Path

1. An attacker compromises the wiim-cli package, its publisher account, the package registry entry, or a transitive dependency.
2. The attacker publishes a malicious release that includes harmful installation-time or runtime behavior.
3. A user or agent follows the instructions in SKILL.md.
4. uv tool install wiim-cli or uvx --from wiim-cli wiim --help resolves the latest acceptable mutable package release.
5. The malicious package or dependency executes with the privileges and environment access of the invoking user.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the invoking user's account. Depending on that account's permissions and environment, ...[truncated 495 chars]

Remediation

View remediation

Remediation Suggestions

• Pin wiim-cli to a specifically reviewed version rather than resolving an unspecified current release.
• Verify the package against cryptographic hashes and maintain a lockfile containing all resolved transitive dependencies.
• Document the canonical source repository and verified package publisher so users can validate provenance.
• Audit the selected release and its transitive dependencies before recommending execution.
• Avoid direct uvx execution of mutable package releases. Use a controlled, pre-reviewed artifact instead.
• Run the tool in an isolated, least-privileged environment with restricted filesystem, credential, and network access.
• Use automated dependency scanning and periodically review pinned versions before updating them.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The documentation instructs users to execute uvx --from wiim-cli wiim --help without pinning an exact package version. That causes the latest published package to be fetched at runtime, which creates a supply-chain risk: a malicious or compromised future release could be installed and executed unexpectedly. In a skill context, this is more dangerous because users may copy-paste the command directly and run unreviewed code.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.