文曲·文库

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:37 AM UTC
• Version: 0.1.19

Overview

The skill’s research-library workflow is mostly disclosed and purpose-aligned, but its default path installs and runs an external CLI/browser stack that is not fully verifiable from the reviewed artifact.

Install only if you are comfortable authorizing an agent to install and run the Wenqu CLI, download a browser runtime if needed, access the web for searches and page fetches, and write a persistent materials library under your home directory. Prefer running it in a constrained environment and verify the CLI release digest before first use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/wenqu-cli.md:7

Finding

Unverifiable External CLI and Transitive Dependency Execution

Content

View full analysis

Vulnerability Details

File Location: references/wenqu-cli.md:7-19
Additional Location: references/wenqu-cli.md:24-29
Vulnerability Type: External package installation and execution without an included lockfile or concrete fail-closed artifact verification
Risk Level: Medium

Vulnerable Code

bash

pipx install 'wenqu-cli==0.1.0'
wenqu doctor --json

bash

python3 -m pip install --user 'wenqu-cli==0.1.0'
export PATH="$(python3 -m site --user-base)/bin:$PATH"
wenqu doctor --json

The installed executable is subsequently used to download and configure its browser environment:

bash

wenqu setup library --dry-run --json
wenqu setup library

Technical Analysis

The Skill directs the Agent to download wenqu-cli and its transitive dependencies from an external Python package registry and execute the resulting commands. The CLI implementation, dependency lockfile, and expected package hashes are not included in the audited project.

Although the package version is pinned to 0.1.0, version pinning alone does not verify artifact integrity or constrain unpinned transitive dependencies. The documentation instructs the Agent to compare the version and SHA-256 value with GitHub Releases, but it does not provide the expected digest or a concrete fail-closed verification command. As a result, the reviewed Skill cannot independently guarantee that the installed artifact is the intended audited package.

User authorization, pipx isolation, and the dry-run step are useful safeguards, but they do not eliminate supply-chain exposure. A dry run is also implemented by the externally installed executable and therefore cannot be treated as a security boundary if that executable has already been compromised.

Attack Path

1. A user invokes the Skill's research or webpage-collection workflow.
2. The Agent obtains the documented installation authorization.
3. The Agent runs `p ...[truncated 1373 chars]

Remediation

View remediation

Remediation Suggestions

1. Include the reviewed CLI source in the same audited repository, or reference an immutable source commit and reproducibly built artifact.
2. Publish the exact expected SHA-256 digest in the Skill and provide a concrete verification command that runs before any package code is imported or executed.
3. Fail closed when the artifact digest, package origin, signer identity, or expected version cannot be verified.
4. Use a hash-locked dependency file covering all transitive dependencies, such as a generated requirements file with --hash entries, rather than pinning only the top-level package.
5. Verify package signatures or provenance attestations where supported and bind verification to the expected publisher and repository.
6. Prefer pipx or a sandbox over the pip install --user fallback. Restrict the CLI's filesystem access to the designated materials directory and restrict network access to documented search and content endpoints.
7. Perform browser setup and crawling in an isolated container or similarly constrained runtime with no unnecessary access to home-directory credentials.
8. Document the precise endpoints, files, environment variables, and credentials the CLI may access so operators can enforce least-privilege controls.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are broad and include common requests such as collecting materials, organizing资料, saving webpages, and web scraping. This can cause the skill to activate in contexts where the user did not intend repository-wide downloading, indexing, or long-term storage, increasing the chance of unintended network access, content collection, and file writes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger table uses ambiguous activation signals like '沉淀知识', '积累案例', and '抓取这个网页' without sufficiently constraining when the full collection workflow should run. In this skill, activation leads to searching, fetching, filesystem writes, and maintaining a persistent library, so ambiguous routing materially increases the risk of unintended side effects and over-collection.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The entire playbook is written as prescriptive operational guidance in Chinese and repeatedly specifies Chinese-formatted artifacts such as 收集清单, with no indication that the user may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.