Security audit

WeRead Import

Security checks across malware telemetry and agentic risk

Overview

This WeRead exporter appears purpose-built, but its browser fallback can start a persistent debug Chrome session and legacy mode can copy sensitive Chrome login data.

Prefer the default Gateway API-key mode. Install only if you are comfortable granting access to your WeRead account data and writing into the chosen notes directory. Avoid WEREAD_PROFILE_SYNC_MODE=legacy unless you accept duplicating sensitive Chrome profile files, and close the managed Chrome/CDP session after browser-mode use.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill explicitly instructs the agent to execute shell commands such as `bash ./scripts/run.sh ...`, but it does not declare corresponding permissions. This creates a capability mismatch: users and policy systems may not realize the skill can run local commands, install dependencies, launch browsers, and write files, which increases the risk of unintended command execution and weakens security review boundaries.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The CLI explicitly documents that agents should not switch to the Cookie/web path unless the user chooses the legacy flow, yet `main()` automatically falls back to `runWebBackend()` when the Gateway is unavailable. In an agent setting, this changes the authentication mechanism and may launch or attach to a browser session to harvest cookies without an explicit user decision, violating the intended trust boundary and potentially exposing browser login state.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The script explicitly copies Chrome credential-related state files such as Cookies, Login Data, and Local State into a separate profile directory, which duplicates sensitive authentication material on disk. In this skill's context, that behavior is directly tied to reusing an existing browser login for WeRead export, so the risk is real: the copied profile may persist longer than expected, inherit weaker permissions, or be accessed by other local processes/users, increasing the attack surface for session theft or privacy compromise.

VirusTotal

60/60 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/cli.mjs:405

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/cli.mjs:26

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/cli.mjs:313