T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:40- Finding
Execution of Code from an Unpinned Remote Repository
- Content
View full analysis
- Remediation
View remediation
Security audit
LLM-WikiMind MCP Setup
Security checks for vulnerabilities and agentic risk
Overview
The skill's goal is coherent, but it asks users to run mutable remote code and set up a quiet startup watcher, so it should be reviewed before installation.
Install only if you are comfortable reviewing the WikiMind repository and package sources first. Prefer pinned versions or a reviewed commit, run setup from a restricted environment, choose a narrow knowledge-base directory, and avoid adding the ~/.zshrc auto-start line unless you understand how to remove it and monitor what it runs.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T06 · System Persistence
Error
- Location
SKILL.md:102- Finding
Persistent Execution Through Shell Startup Configuration
- Content
View full analysis
/dev/null 2>&1' >> ~/.zshrc ``` ### Technical Analysis The Skill recommends appending a command to `~/.zshrc`, causing repository-provided code to run whenever the affected shell initialization file is processed. This establishes execution across sessions rather than limiting the watcher to the current Skill invocation. The command executes code directly from the cloned repository. If that checkout is later replaced, modified, or compromised, the altered script will be launched in future shell sessions. Redirecting both standard output and standard error to `/dev/null` suppresses operational and security-relevant errors, making unexpected behavior harder to identify. Repeated installation can also append duplicate startup entries because the command does not check whether the entry already exists. ### Attack Path 1. A user follows the auto-start instructions and appends the command to `~/.zshrc`. 2. The upstream checkout or local `wikimind` script is subsequently modified by an attacker or malicious update. 3. The user starts a new shell session that reads `~/.zshrc`. 4. The modified script starts automatically without requiring another explicit Skill invocation. 5. Output suppression conceals warnings or errors that could otherwise expose the unauthorized behavior. ### Impact Assessment The startup hook allows continued code execution under the affected user's privileges across shell sessions. A malicious replacement could access user-readable files, monitor or alter the knowledge base, modify user configuration, launch additional processes, and maintain user-level persistence. The finding does not establish root or administrator privilege escalation, but its scope i ...[truncated 74 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:35- Finding
Unpinned Python Dependency Installation
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Error
- Location
SKILL.md:159- Finding
Execution of a Mutable Package Through npx Latest
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger phrases are broad enough to match generic requests about setting up a knowledge base or personal wiki, which can cause the skill to activate in contexts the user did not specifically intend. In an agent setting, over-broad activation increases the chance of unsolicited repository cloning, package installation, or configuration changes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill recommends appending a command to
~/.zshrcfor auto-start without a clear warning that this creates persistent execution on every shell startup. Persistence changes like modifying shell startup files can surprise users, make troubleshooting harder, and create a lasting foothold if the referenced script is later changed or compromised.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 96% confidence
- Finding
The skill instructs users to run
npx clawhub@latest install wikimind-ingest, which fetches and executes the latest package version without pinning. This creates a supply-chain risk: a compromised upstream package or malicious update could execute arbitrary code on the user's machine during installation.- Content
Scope Creep
Low
- Category
- Excessive Agency
- Confidence
- 70% confidence
- Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
- Content
Step 3: Initialize the wiki
Run the interactive setup — it will ask where to store the knowledge base and handle everything else:
bash ./wikimind init